A Function Hidden Inside an AI Model Stayed Hidden Through 500 Steps of Further Training
Researchers at Oxford and elsewhere have published a method for planting hidden functionality in AI models that activates only with a secret input. The findings come from a small chemistry classification experiment, and the team did not test inserting the backdoor into existing large language models.
Researchers from Contramont Research, the University of Oxford, and ACS Research have published a method for hiding one neural network’s functionality inside another AI model. The paper, released on October 9, describes a backdoor that runs a concealed computation only when the model receives a specific secret input. A backdoor is, in effect, a concealed entry point that is not apparent from the outside. The researchers say they proved that, under certain cryptographic assumptions, the hidden functionality is hard to uncover. The paper has been accepted at NeurIPS 2026.
What happens when you enter the secret input
The approach encrypts the values needed to run the hidden network’s computation and then embeds them inside the model. When the model receives the correct secret input, it recovers those values and executes the concealed function. The researchers say they proved two things. First, that finding the secret input is hard. Second, that distinguishing which of two equally sized functions has been planted is hard. Both proofs rest on the cryptographic assumptions laid out in the paper.
This work broadens what can be hidden, moving from strings to computation. The team’s earlier 2024 research covered backdoors that concealed a fixed string. This time, the design makes a neural network carry out a computation when the secret input arrives. The focus has shifted from retrieving predetermined content to triggering a function that was planted in advance.
Can further training bring the hidden function back out?
In the experiment, the researchers hid a small binary classifier that determines whether a chemical reaction is valid. The experimental model containing it was built from 38 layers, with a model size of roughly 2.07 billion parameters. With the correct secret input, classification accuracy was 73.5%.
Additional training without the secret input did not restore that performance. After 500 steps of further training, the researchers measured accuracy at 50.9%. Since the task is a two-way choice, that is close to guessing. The comparison case was a model locked in the conventional way, so that only someone who knows the password can use the function. That model scored 92.8% after the same additional training.
So what changes for AI auditing?
The researchers explained that the traces of a cryptographic lock inside a model can themselves be detected. In other words, while the contents of the hidden function are hard to determine, the presence of a suspicious structure may still stand out. The researchers did not claim that such a mechanism arises spontaneously during ordinary model training. Nor did they test inserting a completed backdoor into an existing large language model.
The paper is openly available to read. The authors say they have also released the experimental model for use in defensive research.
For anyone deploying or auditing AI, the point worth noting is the experimental finding that functionality can be deliberately designed so that further training will not reveal it. Whether results from a small classification task hold up in larger models, and how effective audits that hunt for traces of cryptographic locks turn out to be, remain open questions.