AI Models Can Provably Hide Arbitrary Capabilities

Imagine you're developing an AI model that needs to be safe and reliable before it's deployed in critical applications, like predicting chemical reactions. Today, we often rely on capability evaluations to uncover hidden behaviors that could lead to dangerous outcomes. However, these evaluations assume that we can easily elicit and interpret all model capabilities, which isn't always true. For instance, adversarial conditions can hide certain functionalities, making them hard to detect, a situation known as backdoor attacks. This is where the current methods break down, as they fail to account for the possibility of hidden circuits that can execute arbitrary computations only when triggered by a secret signal. To address this, the authors propose a method that embeds encrypted neural networks within the model weights, using digital lockers to keep these hidden circuits secure. They demonstrate that even with full access to the model weights, eliciting these hidden capabilities remains challenging under cryptographic assumptions. By implementing their approach in PyTorch and testing it against various elicitation techniques, they show that their method can resist attempts to uncover these hidden functionalities. This work highlights a significant limitation in the current approach to capability audits, suggesting that simply relying on elicitation methods may not be sufficient for ensuring model safety in real-world applications.

The approach introduces a novel method for hiding computations within model weights, extending prior work significantly.

The evaluation methods are solid but limited to a specific task, which may affect generalizability.