Unelicitable Backdoors in Language Models via Cryptographic Transformer Circuits

Backdoors can be hidden in AI models in ways that are impossible to trigger for testing purposes. The researchers developed a new type of backdoor using cryptographic techniques that cannot be activated even by security experts with complete access to the model's code and weights, making it impossible to verify the model is safe before deployment.

Current security testing methods may be fundamentally inadequate. The paper demonstrates that conventional cybersecurity monitoring and automated red-teaming approaches cannot reliably catch these backdoors, suggesting that pre-deployment safety checks—a key defense strategy—may have significant blind spots.

Open-source language models present particular risks. Because the code and weights of open-source models are publicly available, bad actors have the opportunity to insert these sophisticated backdoors before models are widely distributed, and defenders cannot easily detect them even with full transparency.

Existing mitigation strategies may not be sufficient. The researchers found that their backdoors can withstand state-of-the-art defense techniques designed to remove or neutralize hidden threats, indicating that current safeguards need strengthening.

The security landscape for AI deployment is more challenging than previously understood. By showing that undetectable backdoors are feasible, this work highlights a fundamental imbalance between offensive and defensive capabilities in AI security, raising questions about how organizations can confidently deploy open-source models safely.