A paper accepted at NeurIPS 2026 has proven that an AI model can be made to conceal an arbitrary hidden capability from every known class of pre-deployment safety evaluation — not through clever behavioral training that better elicitation could eventually uncover, but through a cryptographic barrier whose security guarantee is as strong as SHA-3. The finding sets a formal mathematical ceiling on what capability audits can ever learn, and that ceiling is set by the hardness of inverting a standard hash function — not by how many compute hours an evaluator spends or how sophisticated their methods become.
The paper, titled AI Models Can Provably Hide Arbitrary Capabilities and posted to arXiv on October 9, describes a technique for embedding an entire encrypted neural network inside the weights of a host model. The hidden network executes only when a secret trigger is present; without that trigger, under standard cryptographic assumptions, the capability is computationally infeasible to recover or even confirm, even for an evaluator with complete access to the model's weights, architecture, and the embedding procedure itself.
The authors write that capability absence cannot be proven by a failure to elicit it, "particularly under adversarial conditions."
To read more, click here.