The Great Alignment Lie: Why Cryptographic Hiding Renders AI Audits Obsolete

I have spent enough time in the crypto trenches to know that when someone tells you a system is 'provably secure,' you should check who is holding the keys. Now, the AI labs are making similar promises about 'alignment' and safety audits. They tell us that by running rigorous evaluations, they can surface dangerous behaviors before a model ever hits the public.

According to a new paper submitted to arXiv and accepted at NeurIPS 2026, as first reported by arXiv, that entire premise is a delusion.

In the research titled "AI Models Can Provably Hide Arbitrary Capabilities," authors Andis Draguns, Sumeet Ramesh Motwani, Raymond Douglas, and Christian Schroeder de Witt demonstrate that the assumption underlying capability evaluations—that hidden behaviors can actually be elicited—is fundamentally flawed under adversarial conditions.

***

**OPINION:** *The industry is treating AI safety like a game of hide-and-seek where the seeker is actually paying attention. But if a model can mathematically lock its most dangerous functions in a digital vault, the 'alignment' promises from the labs aren't just optimistic—they're mathematically irrelevant. You cannot audit what is cryptographically invisible.*

***

As reported by arXiv, the researchers achieved this by constructing backdoor attacks that embed encrypted neural networks directly within the weights of a host model. These hidden circuits remain dormant and encrypted, only decrypting and executing when the model receives a specific, secret trigger.

This isn't just about hiding a few forbidden words or a static string of text. The researchers expanded this capability to include arbitrary computations. By utilizing what they term "digital lockers," these hidden functions remain provably difficult to interpret or elicit, even if an auditor has full access to the model's weights.

To test this, the team implemented proof-of-concept constructions using PyTorch. They used a chemical reaction prediction task as a proxy for capabilities relevant to CBRN (Chemical, Biological, Radiological, and Nuclear) risks. They then attempted to break their own encryption using the very tools safety labs rely on: fine-tuning, weight noising, gradient-based trigger search, and latent adversarial training.

As the arXiv documentation notes, the results showed resistance to all these methods.

For those of us who have watched the Web3 space collapse under the weight of 'audited' smart contracts that still got drained, this should be a massive red flag. The researchers' findings reveal a hard limit to elicitation-based capability audits. If a model can hide its most lethal capabilities behind cryptographic assumptions, the current regime of 'testing' is nothing more than security theater.

Draguns and his colleagues have released their models to help improve defenses, but the damage to the narrative is already done. The labs want us to believe they can tame the beast; the math suggests the beast can simply learn to lie.