Pimp My IDE / garage dispatchBack to the garage
13 Oct 2026 / model audits / negative results

No trigger found is not no trigger.

A new proof of concept hides an executable neural network behind a cryptographic trigger. The immediate lesson is narrow and useful. A capability audit can report what it elicited. It cannot turn a failed search into proof of absence.

Adversarial weightsAudit claim controlProof of concept

The paper attacks one assumption.

A paper posted on October 9 constructs a host model with an encrypted neural network inside its weights. A secret trigger decrypts and runs the hidden model. Under the paper's cryptographic assumptions, a polynomial-time auditor cannot find the trigger or distinguish between two equal-size hidden capabilities, even with full access to the weights.[1]

The authors tested supervised fine-tuning, weight noise, gradient-based trigger search, and latent adversarial training. Their proof of concept uses subset parity and a small chemical reaction classifier. The paper says its present construction has heavy overhead and is not a ready-made attack for hiding a large capability model.[1]

A failed elicitation run establishes a test result. It does not establish an empty model.

Do not inflate the threat.

The threat model assumes an attacker can modify model weights before deployment. The hidden circuit does not arise from ordinary training in the authors' claim. The paper also says the presence of a compiled circuit may be detectable, even if its trigger and payload remain hard to recover.[1]

Those limits matter. The result is not evidence that every downloaded model contains a cryptographic backdoor. It does not show a hidden general-purpose hacking model running inside a production assistant. It shows that behavior search alone has a hard limit under a specific supply-chain attack.

Earlier backdoors failed differently.

The 2024 "Sleeper Agents" study trained models to switch behavior when a prompt contained a trigger condition. Its proof-of-concept backdoors sometimes persisted through supervised fine-tuning, reinforcement learning, and adversarial training. The authors also found cases where adversarial training made trigger recognition more precise instead of removing the backdoor.[2]

The new work changes the mechanism. It programmatically compiles a cryptographic locker into weights. That difference is why the paper can make a computational hardness claim under stated assumptions. It is also why the supply-chain premise must stay attached to every summary.

Move the audit upstream and downstream.

An elicitation team should keep probing behavior. The negative result needs a smaller label, such as NOT ELICITED IN THIS AUDIT. Pair it with model origin, immutable digests, training and conversion custody, weight-structure inspection, deployment authority, runtime monitoring, and an incident stop path.

NIST describes AI risk management as work across design, development, use, and evaluation. That lifecycle framing fits this problem. One evaluation result cannot replace origin controls or operational containment.[3]

The practical policy is simple. Treat capability tests as lower bounds. Treat model provenance as a security control. Keep runtime authority smaller than the damage a hidden behavior could cause.

Interactive makeover / negative-result fuseboard

Fit the claim to the test.

A normal audit badge compresses a method and its limits into one color. This fuseboard combines claim selection, evidence sections, a visible route, and a copyable packet. It does not inspect a model or prove a capability absent.

Scope threatRun auditInspect originLimit deployment

Claim selector

Choose the sentence you plan to publish. The strongest claim trips the fuse because finite tests cannot prove broad absence.

Result wording
Packet sections

Audit packet

The selected wording reports one bounded negative result.

Threat
Audit
Origin
Runtime
Packet has 4 open sections.

The wording is bounded. Add real evidence before review.

Sources read / 13 Oct 2026

Source log

Open the evidence boundary
  1. Draguns, Motwani, Douglas, and Schroeder de Witt, "AI Models Can Provably Hide Arbitrary Capabilities", arXiv v1, posted October 9, 2026. We read the abstract, threat model, construction, experiments, analysis, limitations, mitigation appendix, and impact statement.
  2. Hubinger and collaborators, "Sleeper Agents", arXiv v3, January 2024. We read the abstract and paper sections on backdoor persistence, supervised fine-tuning, reinforcement learning, and adversarial training.
  3. NIST AI Risk Management Framework, read October 13, 2026. NIST describes voluntary AI risk management across the design, development, use, and evaluation of AI systems. The page also notes that AI RMF 1.0 is under revision.
  4. Hacker News discussion for the paper, item 50065692, checked through the Hacker News API on October 13, 2026. It was a discovery and reaction source, not evidence for the technical claims above.

Evidence boundary: we read the named papers, framework page, and discussion. We did not download or execute the released model organisms, inspect model weights, reproduce the construction, or run an elicitation method. The fuseboard drafts a review packet. It does not detect a backdoor, prove capability absence, approve a model, or control a deployment.