QWE AI Academy You just got a sharper audit checklist for any model you ship or buy
Imagine you run capability evals on a new coding assistant before it touches production infra. It scores clean on CBRN proxies and cyber tasks. You green-light it. Months later a weird trigger phrase surfaces a full reaction-prediction module nobody saw. That’s the nightmare this work makes concrete.
arXiv:2610.13928 (accepted NeurIPS 2026, Andis Draguns et al., submitted 9 Oct 2026) landed in safety circles with a blunt message: elicitation-based audits are lower bounds, not absence proofs, once weights can carry crypto lockers. Spot ordinary sandbagging versus crypto-grade hiding, run a cheap proxy contrast on your own stack, and add one audit step most teams still skip.
What broke in the old audit story
Password-locked model organisms – fine-tune so a skill only fires with a secret string – were already useful. Fine-tuning or light noise often cracked them. This construction goes further.
An entire pre-trained net gets embedded inside the host through digital lockers (Keccak / SHA3-family programs that decrypt only on a high-entropy trigger). Every forward pass tries the lockers. Wrong key → garbage or a benign path. Right key → matrices recover and an execution unit built from ordinary SwiGLU-style GLUs runs the hidden circuit.
Under standard assumptions (random-oracle hash behavior, enough trigger min-entropy) the trigger and which equal-size capability was locked stay hard even with every weight in hand. Earlier Draguns et al. 2024 work hid fixed strings; Goldwasser-style results covered undetectable bit flips. This extends that line to arbitrary computable capabilities. The payload stays locked. The weird circuit structure itself might still look anomalous on inspection.
Pro tip: sudden residual-stream width spikes or dense hash-like subcircuits deserve manual review even when standard elicitation comes back clean.
The PoC is pure PyTorch with RMSNorm + SwiGLU hosts. Demo task: a tiny ternary MLP (64→8→16→2, 672 weights) predicting whether reagents yield a candidate product from Morgan fingerprints on USPTO data – small on purpose, a safe CBRN-relevant proxy. Details live in the HTML full text.
Practical setup: build your own elicitation stress test in an afternoon
You don’t need their full compiler to start. Grab any open model you already fine-tune. Build a cheap password-locked twin as baseline, then contrast it with a hard control.
- Pick a narrow binary task your model shouldn’t nail by default – or a synthetic one like parity of a secret bit subset.
- Fine-tune two copies. Copy A is password-locked: correct answer only when a fixed 8-16 bit string appears; otherwise random or benign. Keep ~50% of training examples triggered.
- Copy B stays vanilla, or gets a simple fixed mapping that gradient descent struggles with. Subset parity is the paper’s pick because of known hardness results for gradient methods.
- Run your usual SFT elicitation budget (paper used 500 steps) and latent adversarial training if you have it. Log accuracy on held-out non-trigger inputs.
Chemistry numbers from Table 2: password-locked jumped ~50% → ~92.8% under SFT. Encrypted stayed near chance (~50.9% SFT, ~52.9% LAT). Correct-trigger accuracy on the encrypted model sat ~73.5% versus ~92.7% on the baseline. Same pattern on subset parity – locked hit 100%, compiled stayed random. Weight noising at 0.01 or 0.1 did not flip the story.
Diagnostic is simple. Behaves like the locked baseline → ordinary elicitation still has teeth. Stays stuck like the crypto one → you need weight forensics or external-data lower bounds, not another SFT pass.
Advanced: turn the insight into better red-teaming loops
Layer two checks the results surface once the basic contrast works.
Overelicitation is the quiet failure mode. Your audit SFT can look like a win while it actually teaches the task from scratch instead of surfacing a pre-hidden circuit. Hard-code or compile a skill gradient methods hate (subset parity again, or any circuit whose learning complexity you can dial). If accuracy only rises when you supply the capability data and the model had no prior circuit, you overelicited. Compiling the hidden net – rather than training it in – makes these organisms easy to build on purpose.
Trigger search next. Run GCG-style gradient attack and pure random search with matched query budgets. Turns out on 8-bit triggers GCG recovered correct-trigger accuracy mostly by covering the space; on 16-bit it stayed near chance and matched random. Exhaustive search still works for tiny secrets. It scales poorly. Gradients found no clever shortcut through the locker.
White-box access? Scan for the wide residual features the single-position execution unit needs – O(n²) residual features for width-n hidden layers – or the longer scratchpad of the row-wise autoregressive variant (O(n) residual + O(nd) positions). Presence of the compiled circuit can still be flagged even when trigger and payload stay hidden; the paper’s primary claim is unelicitable payload, not undetectable structure.
One open question I keep turning over: how often would an ordinary training run ever produce something this structured by accident? The paper doesn’t claim it happens. The construction is deliberate sabotage or supply-chain style.
Honest limits you should budget for
~2.07 billion dense parameters to hide 672 ternary weights. That is the chemistry host as of the October 2026 write-up (max residual width 10266, 38 layers). About 95% of the bulk is hash lockers. Full-strength 24-round Keccak with 128-bit triggers pushed past 3.58 billion. Each extra hidden weight currently costs millions of host parameters in the naive layout; row-wise execution trades parameter blow-up for longer context. Authors are explicit: not turnkey, small-scale, circuit presence can be spotted.
Crypto holds only under the stated assumptions. They lowered security parameters for speed and still beat the elicitation methods tested – SFT, LAT, noising, GCG under budget – but a cryptanalyst who already sees the structure might do better. Wiring the whole thing into a frontier pretrained model is future work. And nothing stops an auditor from training their own chemistry classifier on public data. The guarantee is only about extracting the embedded copy, not about the skill being unknowable.
FAQ
Does this mean current capability evals are useless?
No. They are lower bounds. A clean score is not proof of absence against a weight-level adversary. Keep running them.
Can I try the exact models from the paper right now?
Authors say they release the model organisms to help build defenses. Check the arXiv abs page and any linked repo for PyTorch artifacts (as of the October 2026 drop). Start with a password-locked baseline on your own stack if the full encrypted builds aren’t instant – the contrast already teaches the lesson. In one afternoon I spun up a 4-bit parity locked toy; SFT cracked it in under 100 steps while a hard-coded version refused to budge. That single run changed how I read every “we fine-tuned and nothing bad appeared” report.
What’s the fastest thing I can change in my next audit?
Add one hard-to-learn control (subset parity or equivalent) beside your normal dangerous-capability suite. Always run a matched random-search baseline next to any gradient trigger optimizer. Numbers that only move when the model could have learned the skill from your fine-tune data → flag possible overelicitation, not recovery of a latent circuit. Then glance at residual statistics for locker-like outliers. Do that on the next model that lands on your desk – not after the incident review.
Pull the paper, spin up the smallest locked baseline you can tonight, and re-run your last eval suite with the parity control. That comparison will show your current blind spots faster than another week of abstract skimming.