Four researchers posted a preprint on 9 October 2026, "AI Models Can Provably Hide Arbitrary Capabilities". They show a way to hide a working neural network inside another model's weights, locked with a cryptographic "digital locker" so it runs only when a secret trigger is supplied. Their argument, under stated cryptographic assumptions, is that someone without the trigger cannot feasibly make the hidden part show itself, even with full access to the weights. In their words, a failure to elicit a capability does not establish its absence.
What the Short had no room for is how narrow the demonstration is. The authors built it by hand on a small, harmless chemistry-prediction task, in a purpose-built network rather than a pretrained chatbot, using deliberately weakened security settings. They say they do not claim ordinary training produces such a lock, and that the lock's presence may itself be detectable. They also note that unelicitable is a weaker property than undetectable. The full text sets all of this out.
The idea builds on earlier work. Goldwasser and colleagues showed in 2022 that a backdoor could be planted so that it cannot be detected; Quanta Magazine's 2023 article explains it. The new paper extends that from hiding fixed strings to hiding executable networks.
It is one preprint. We found no independent replication, so treat the claims as the authors' own.