An Entire AI Could Be Hiding Inside the Model You Use

Author: Better Stack · Watch on YouTube

Video authored by the channel shown, not by IANIA; all rights belong to the creator. Transcript and summary generated automatically; the original-language content is preserved.

Original language: English

Original video: An Entire AI Could Be Hiding Inside the Model You Use · Channel: Better Stack · 02:34 · Watch on YouTube

Topics: AI evaluation and benchmarks, Cybersecurity and software security, AI models, AI safety

Summary

Researchers demonstrated a way to conceal the weights of a small neural network inside another model, protected by a secret trigger. The hidden network uses a cryptographic hash-based lock built from layers that resemble ordinary model components, so it can evade conventional capability evaluations unless the trigger is known. In their test, a password-locked comparison model revealed its capability after fine-tuning, while the cryptographically locked model did not. The method currently requires an extremely large host model and has not been tested as a complete system inside a real pre-trained LLM, but it highlights limits in proving models safe.

Key points

Capability evaluations assume that auditors can elicit any dangerous capability present in a model.
Researchers from Contramont Research, Oxford, and ACS Research showed how that assumption can fail when a capability is deliberately concealed.
Their digital locker uses a secret trigger, a hash function, and XOR to protect the weights of a second neural network.
A custom compiler converts the Keccak hash function into model weights, making the lock look like part of the host model.
With the correct trigger, a gated linear unit runs the hidden network inside the host model’s forward pass.
The demonstration hid a 672-weight model trained on USPTO patent reaction data.
A regular password-locked comparison model revealed its secret after 500 fine-tuning steps and reached 92.8% accuracy.
A 128-bit trigger would require breaking the hash function to find the key.
The demonstration required a host with about 2 billion parameters, and roughly 95% of those parameters were hash circuitry.
The researchers released their models to help develop defenses, while noting that they have not embedded the complete system in a real pre-trained LLM.

Chapters

Start	Chapter	Summary
00:00	Why capability evaluations may miss hidden skills	The video introduces the assumption behind safety evaluations and explains how deliberately concealed capabilities could defeat it.
00:30	Building a cryptographic digital locker	Researchers use a hash-based lock, compiled into model weights, to conceal a second neural network inside a host model.
01:32	Testing the hidden network	A 672-weight patent-reaction model is hidden in a host and compared with a regular password-locked model that yields its secret after fine-tuning.
02:03	Current limitations and safety implications	The method is computationally expensive and has not been tested as a complete system in a real pre-trained LLM, but it motivates better defenses.

Quotes

if the capability is in there a determined auditor can surface it. — 00:00

what they’re hiding is the weights of a whole second neural network. — 00:30

that regular model spilled its secret and jumped to 92.8% accuracy. — 01:32

you’re paying roughly 3 million host parameters for every single hidden weight. — 02:03

a clean safety test can’t fully prove a model is safe — 02:34

Concepts and entities

capability evaluations, digital locker, Keccak, Contramont Research, Oxford, ACS Research, USPTO patent data set, Gemma 3 270 million parameter model, Better Stack

Full transcript (original language)

00:00 Okay, this is honestly terrifying. Researchers just proved that you can hide an entire secret AI inside another AI model and no safety test in the world can find it unless you know the password. Let me explain how that works. So, before a frontier model gets released, labs run what are called capability evaluations. They try to pull dangerous skills out of the model through red teaming, fine-tuning on related tasks, and other elicitation techniques. And if nothing dangerous comes out, the model is considered safe to ship. That whole process rests on one assumption, which is that if the capability is in there a determined

00:30 auditor can surface it. But researchers from Contramont Research, Oxford, and ACS Research just proved that this assumption breaks when somebody hides the capability on purpose. So, the way they pulled this off is with something from cryptography called a digital locker. Basically, you take a secret trigger, you run it through a hash function, and then you XOR the result with whatever you want to hide. And in this case, what they’re hiding is the weights of a whole second neural network. Now, to get that running inside a model, they build their own compiler that turns the Keccak hash function, which is the same kind of hashing used

01:01 to secure things like passwords, into regular model weights. So, the lock itself is made out of the exact same layers that every modern AI model already uses, which means it just looks like a part of the model. So, every time the model runs, it hashes whatever input it gets and tries to decrypt those hidden weights. If the trigger is wrong and built-in check fails, you just get random bits and the model acts completely normal. But if the trigger is right, the real weights pop out and a little execution unit they built out of the gated linear unit multiplies them against the input. So, now the hidden network is literally running inside the

01:32 host model’s forward pass. And to test it, they trained a small model on reaction data from the USPTO patent data set that predicts whether certain chemicals will produce a certain product. They squeezed it down to just 672 weights and locked it inside a host. Then they also built a regular password locked model, which is how researchers usually fake a hidden skill today, just to compare the two. And with only 500 steps of fine-tuning, that regular model spilled its secret and jumped to 92.8% accuracy. They even added random noise to the weights and nothing happened. And

02:03 if you use a full 128-bit trigger, the only way to find the key is to actually break the hash function. Now, this is not something someone can pull off tomorrow. Hiding that tiny 672 weight model needed a host with about 2 billion parameters, and around 95% of those are just hash circuitry. So, you’re paying roughly 3 million host parameters for every single hidden weight. A good auditor might also notice that the weights look a bit weird even if they can never unlock them. And they haven’t put the whole thing inside a real pre-trained LLM yet, although they did check that the individual blocks work

02:34 fine when you drop them into the Gemma 3 270 million parameter model. So, this still shows that a clean safety test can’t fully prove a model is safe, especially if you don’t know where its weights come from. And that’s exactly why researchers released their models publicly so people can start building better defenses before more practical version of this shows up in the wild. If you want to stay up to date with the latest in AI security and engineering, be sure to subscribe to the Better Stack channel.