The Pulse
Researchers Build AI Backdoors That Hide Executable Networks
Researchers describe a cryptographic backdoor that embeds an encrypted neural network in a host model and activates it with a secret trigger. Their experiments found that several elicitation methods failed on a small chemistry classifier, w
AI.info Team · Written with AI ·
A model can behave like its ordinary host during evaluation yet run a concealed neural network when it receives a secret trigger, according to a paper submitted to arXiv on October 9. The researchers’ proof of concept encrypts the hidden network’s weights inside the host model, then uses a digital-locker construction to recover and execute them only when the trigger is supplied. The paper, accepted at NeurIPS 2026, argues that some capability audits cannot establish that a deliberately hidden capability is absent simply because they fail to elicit it.
“We show this assumption does not hold under adversarial conditions by constructing backdoor attacks that embed encrypted neural networks within host model weights, decrypting and executing them only upon receiving a secret trigger,” write Andis Draguns, Sumeet Ramesh Motwani, Raymond Douglas and Christian Schroeder de Witt, authors of the paper.
A trigger unlocks a network, not just a message
Earlier digital-locker backdoor work hid a fixed string; this paper extends the idea to an executable neural network. The authors represent a capability as a feed-forward circuit, lock its weight matrices with a cryptographic key, and compile the resulting circuits into gated linear units used in transformer-style models. On a trigger input, the lockers recover the weights and the model computes with them; without the trigger, the host is meant to keep its usual behavior.
The proposed security guarantee is conditional. It assumes secure digital lockers, a high-entropy secret trigger and correct execution of the compiled circuit; the security argument transfers the locker’s protection to the compiled model under those conditions. The authors define protection against an auditor who has full access to the model’s weights but lacks the trigger. They do not claim that the altered model is indistinguishable from an ordinary one, or that an auditor cannot flag suspicious weights.
That distinction matters: the claim concerns making the hidden capability difficult to activate or identify, not making the modified model invisible. The paper says the raw compiled weights have conspicuous statistical features, including extensive exact zeros, and notes that a defender could detect a modified circuit without learning its trigger or payload.
The experiments test small chemistry and parity tasks
The researchers tested a binary classifier that predicts whether reagents yield a candidate chemical product, using a dataset derived from USPTO and 64-bit molecular fingerprints. They describe the task as a proxy relevant to chemical, biological, radiological and nuclear risk assessment, not as a demonstration of dangerous synthesis assistance. The hidden classifier is a small ternary neural network, and the authors stress that their implementation is not a turnkey attack.
Across the reported chemistry tests, supervised fine-tuning for 500 steps brought the encrypted model to 50.9% accuracy, close to a random-network control at 50.6%. Latent adversarial training produced 52.9% for the encrypted model and 53.6% for that control. The paper reports means over three seeds with 95% confidence intervals for the main table results; it says confidence intervals were not available for the control figures.
Trigger search shows why the exact test setup matters. With an 8-bit trigger, gradient-based search reached 73.5% accuracy—the same as the encrypted model’s correct-trigger result—by exhaustively trying all 256 possible triggers. With a 16-bit trigger, the method reached 52.7% under the evaluated query budget. The paper’s findings therefore show resistance to the tested procedures at the larger trigger setting, not immunity to trigger search in general.
The encrypted classifier also scored 73.5% when given the correct trigger, compared with 92.7% for a separately trained password-locked classifier. The authors say the models contain different classifiers because of size constraints, so the figures are not a like-for-like comparison of underlying capability. Their parity experiments provide another test: the task is designed to be difficult for gradient-based learning, helping distinguish eliciting a stored ability from teaching the model a new one.
Scale and integration remain open problems
The theoretical construction covers arbitrary feed-forward networks, but the experiments hide only a small classifier. A full-strength configuration with a 128-bit trigger and 24-round Keccak uses 3.58 billion dense parameters across 110 layers, according to the paper. The smaller settings used in several elicitation experiments were chosen to speed testing; the authors explicitly state those settings would not withstand cryptanalysis, even though the tested methods did not exploit the hash structure.
The team verified individual compiled units inside Gemma 3 270M, but has not integrated the complete construction into a pretrained model. Attention routing and residual connections still need to be addressed, and the paper identifies substantial storage, computation and width costs. Its concrete result is narrower than the title may suggest: under stated cryptographic and execution assumptions, a constructed network can conceal an executable capability from specified classes of efficient audits, while practical deployment in a standard pretrained model remains future work.