AI模型可证明能隐藏任意能力
AI Models Can Provably Hide Arbitrary Capabilities
AI总结：
该研究构造后门攻击，利用数字保险箱技术在AI模型中隐藏任意计算，证明基于触发的能力审计存在局限性，发布模型以支持防御改进。
摘要：
能力评估旨在在部署前发现模型的危险行为，但其可靠性依赖于隐藏能力可被触发的假设。我们通过构造后门攻击证明该假设在对抗条件下不成立，该攻击在宿主模型权重中嵌入加密神经网络，仅在接收到秘密触发器时解密并执行这些网络。利用数字保险箱技术，这些隐藏电路在密码学假设下被证明难以被触发和解释，即使在完全访问模型权重的情况下也是如此，将先前从隐藏固定字符串扩展到隐藏任意计算的工作。我们在PyTorch中实现了概念验证构造，并在小型化学反应预测任务（作为与CBRN相关能力的代理）上通过微调、权重加噪、基于梯度的触发器搜索和潜在对抗训练评估触发情况。我们的结果显示对这些方法具有抗性，结合我们的密码学保证，揭示了基于触发的能力审计的一个局限性。我们发布模型以支持防御的改进。
英文摘要：
Capability evaluations aim to surface dangerous model behaviors before deployment, but their reliability depends on the assumption that hidden capabilities can be elicited. We show this assumption does not hold under adversarial conditions by constructing backdoor attacks that embed encrypted neural networks within host model weights, decrypting and executing them only upon receiving a secret trigger. Using digital lockers, these hidden circuits remain provably hard to elicit and interpret under cryptographic assumptions, even given full access to model weights, extending prior work from hiding fixed strings to arbitrary computations. We implement our proof of concept constructions in PyTorch and evaluate elicitation through fine-tuning, weight noising, gradient-based trigger search, and latent adversarial training on a small chemical reaction prediction task - a proxy for CBRN-relevant capabilities. Our results demonstrate resistance to these methods and, together with our cryptographic guarantees, reveal a limit of elicitation-based capability audits. We release our models to support the improvement of defenses.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
