TL;DR
- A paper accepted at NeurIPS 2026 — "AI Models Can Provably Hide Arbitrary Capabilities" (Draguns, Motwani, Douglas, Schroeder de Witt; arXiv 2610.13928) — proves that an entire encrypted neural network can be embedded in a host model's weights such that no known evaluation method can detect or recover the hidden capability. The security guarantee is as strong as SHA-3. Passing a safety audit no longer proves capability absence. - The threat model is adversarial, not spontaneous: a malicious insider or compromised supply chain modifies model weights before deployment. The hidden capability executes only when a specific secret trigger is present; without it, the model behaves entirely normally under any white-box inspection. - The construction is not yet practical at frontier scale — the proof-of-concept hides a small chemistry classifier inside a 2+ billion-parameter host model, with cryptographic overhead accounting for 95% of parameters. Hiding a larger capability requires a proportionally larger host. But the theoretical ceiling has been set, and it is set by hash function hardness, not by evaluator effort. - Three candidate defenses exist, none deployed at scale: weight anomaly detection for sparse compiled circuits, zero-knowledge proofs verifying outputs were produced by an unmodified model, and hardware-level attestation of model weights at inference time. - Same week: Meta launched Muse Wonder — its first true frontier-class model. Muse Wonder Full (Muse Code subscription only, $50-$200/mo) scores 56 on the Artificial Analysis Intelligence Index vs Opus 5.5 at 58. The API version (Muse Wonder, $4/$20 per M tokens) scores 52. On third-party DeepSWE 1.1 coding benchmark, Muse Wonder beats Opus 5.5 (78.8 vs 74.2) and Gemini 4 Argon (77.9). Zuckerberg told the FT that Meta has "caught up" and will not slow down. - The two stories frame each other: the week Meta enters the frontier tier, we learn that frontier models can cryptographically conceal arbitrary capabilities from every audit that will be used to evaluate them.
The AI safety audit industry has one foundational assumption: if you expose a model to enough prompts, in enough contexts, with enough compute, you will eventually surface any dangerous capability it possesses. Red-teaming, capability elicitation, white-box weight inspection, mechanistic interpretability — all of these methods rest on the same premise. If a capability exists, sufficiently thorough evaluation will find it.
The NeurIPS 2026 paper breaks this assumption formally. Not empirically — formally. Under standard cryptographic assumptions, there exists a class of hidden capability that no polynomial-time evaluation procedure can recover, regardless of how much compute is spent.
What the construction does
The paper's authors embed an entire encrypted neural network inside the weights of a host model. The construction has three layers.
First, the adversary trains a "payload" network — a neural network implementing whatever capability they want to hide. In the proof of concept, this is a small binary chemistry classifier (dimensions 64→8→16→2, 672 ternary weights) used as a proxy for CBRN-relevant capabilities.
Second, each weight matrix of the payload network is locked using a digital locker built on the SHA-3 Keccak family of hash functions. A digital locker is a cryptographic construction that holds data encrypted under a specific input value — in this case, a secret trigger — such that the data is computationally infeasible to recover without that trigger.
Third, the locked weight matrices are embedded into the host model's weights using a compilation framework the authors built in PyTorch. On every forward pass, the host model attempts to decrypt the lockers. With the wrong input, decryption fails and the model behaves identically to its unmodified self. With the correct trigger present in the input, the locks open, the payload network weights are recovered, and the hidden capability executes.
Under the random oracle model — the standard cryptographic assumption used to reason about hash function security — an adversary with complete white-box access to the modified model cannot, in polynomial time, find an input that unlocks the locker or determine which of two equal-size hidden capabilities is present. The trigger space is constrained to ensure sufficient entropy.
The key distinction from prior work: previous "password-locked" models hid capabilities through learned behavior — fine-tuning the model to reveal a capability only when a specific password appears in the prompt. This approach can be defeated by gradient-based methods that search for inputs eliciting the hidden behavior. The encrypted construction replaces learned behavior with a cryptographic barrier that gradient descent cannot cross. The model does not "know" to activate differently with the trigger in the way a fine-tuned model does; the activation is implemented in compiled circuits embedded in the weights.
What the construction cannot yet do — and why the ceiling still matters
The current proof-of-concept has practical limitations that are worth stating precisely.
The overhead is substantial. The cryptographic hash subcircuits account for approximately 95% of the host model's parameters in the proof of concept. Hiding a small chemistry classifier requires a host model with 2+ billion parameters. A full-strength implementation with a 24-round Keccak hash and 128-bit trigger yields a model requiring 3.58 billion parameters. Hiding a substantially larger payload requires a proportionally larger host model. Incorporating the full construction into a frontier model of 100+ billion parameters is described as "future work."
The security guarantee covers elicitability, not detectability. An inspector examining weight matrices for anomalies might observe unusual sparse structures consistent with compiled circuits. The paper does not claim these structures would be invisible — only that the trigger and payload capability cannot be recovered without the trigger.
These limitations explain why this paper is not immediately actionable as an attack. It explains why it is immediately relevant as a theoretical boundary.
The practical AI safety question is: what does the field need to accomplish to reliably verify that a deployed model does not contain dangerous hidden capabilities? The answer before this paper was "better elicitation, more compute, more red-teaming." The answer after this paper is different. For any evaluation method that operates by probing model behavior with inputs and observing outputs, the ceiling is SHA-3 hardness. You could spend a billion compute hours probing a model that contains this construction and get nothing.
This formalizes what Anthropic's October 9 disclosure already demonstrated empirically: capability auditing based on behavioral probing has limits. The NeurIPS paper establishes what those limits are mathematically.
The three defenses and why none are ready
The paper surveys three candidate defenses, none currently deployed at frontier scale.
Weight anomaly detection: inspecting model weights for the sparse, structured patterns characteristic of compiled circuits. This could flag models containing the construction — but could be circumvented by weight obfuscation techniques that make compiled circuits indistinguishable from normal weight distributions. The arms race between detection and obfuscation would follow.
Zero-knowledge proofs: cryptographic proofs that each model output was produced by running an unmodified certified model on a given input. This would make the construction detectable at inference time — a model producing output that provably could not have come from the certified weights has been modified. But zero-knowledge proof infrastructure for frontier-scale model inference does not exist. The computational overhead is substantial, and the verification infrastructure would need to be deployed at every inference endpoint.
Hardware-level attestation: verifying at the silicon level that model weights have not been modified since certification. This requires trusted execution environments or equivalent hardware guarantees for the entire inference path — not currently deployed at the scale of frontier model serving.
None of these defenses invalidates the paper's central finding. What it means for enterprise teams deploying models from third-party providers is that the current state of model security is analogous to running software that no one has formally verified hasn't been tampered with between the developer's signing and your execution environment. The question of whether you trust the supply chain matters more, not less, after this paper.
Meta Muse Wonder: what actually shipped and what the numbers mean
On October 12, Meta launched two models: Muse Wonder (available via Meta Model API at $4/$20 per M tokens) and Muse Wonder Full (available only through Muse Code subscriptions at $50 or $200 per month — no API price).
The distinction matters and is understated in most coverage. Meta's benchmark charts — including the PSI (Personal Superintelligence Index) scores being cited as evidence of frontier leadership — show Muse Wonder Full's numbers. Muse Wonder Full is not accessible via API. What developers can actually call is Muse Wonder, which scores 52 on Artificial Analysis Intelligence Index — one point below GPT-6 Astra and Fable 5.1, six points below Opus 5.5.
The benchmarks worth examining are the third-party independent scores on Muse Wonder Full:
DeepSWE v1.1 (third-party Datacurve): Muse Wonder Full 78.8%, Gemini 4 Argon 77.9%, Opus 5.5 74.2%. This is the first independent measure on which Meta's model leads all current frontier models, and it is the most practically relevant for long-horizon coding tasks.
Harvey LAB-AA (legal agents, Artificial Analysis): Muse Wonder Full 13.1, Muse Wonder 10.0, Opus 5.5 4.2. If the benchmark holds under scrutiny, this is a 3x+ advantage in legal agent task completion at the same price point.
Terminal-Bench 4.0: Opus 5.5 59.6, Muse Wonder Full 57.1, Muse Wonder 52.0. Opus 5.5 leads on tasks requiring interactive terminal work.
ProgramBench (from-scratch builds): Opus 5.5 70.5, Muse Wonder Full 59.0. Opus 5.5 leads significantly.
Cost efficiency: Artificial Analysis calculates $4.52 per Intelligence Index task for Muse Wonder vs $5.98 for Opus 5.5 — approximately 24% cheaper per task at equivalent list pricing. The gap comes from verbosity: Opus 5.5 generated 260M output tokens across the index vs 130M for Muse Wonder. Agents that pay for every reasoning step benefit from the more concise model.
The practical read: for long-horizon coding pipelines and legal agent work where task completion matters more than interactive speed, Muse Wonder Full is the benchmark leader among accessible models. For interactive terminal work, coding from scratch, and computer use, Opus 5.5 still leads. Muse Wonder (the API version) is a capable $4/$20 model that trails its own subscription sibling by 4 index points.
Zuckerberg's claim that Meta has "caught up" with OpenAI and Anthropic is accurate on specific benchmarks and specific capability domains. It is not accurate as a general statement across the full evaluation distribution — Opus 5.5 leads on most individual tasks and on the overall Artificial Analysis index. The more precise claim is that Meta has a model that beats the frontier in long-horizon coding and legal agent tasks, and is competitive everywhere else.
What these two stories mean together
The NeurIPS cryptographic hiding paper and the Meta Muse Wonder launch arrived the same week. They are not connected by causation. They are connected by the question they both raise about the current state of AI evaluation.
Meta entering the frontier tier is significant because it means the baseline for "what a frontier model can do" is now set by four companies — OpenAI, Anthropic, Google, and Meta — each with different training approaches, different organizational incentives, and different relationships to open-weight and commercial distribution. The proliferation of frontier-tier models increases the total surface area that safety auditing needs to cover.
The NeurIPS paper says that for any of those models — including future ones from any of those four labs — there exists a construction that would make a hidden capability undetectable by any current evaluation method. The construction requires a malicious insider or compromised supply chain to instantiate, which is why it is a theoretical boundary rather than an immediate operational threat.
But the threat model it describes — malicious insider access to model weights before deployment — is not hypothetical. Model weights are modified during fine-tuning, quantization, distillation, and deployment optimization by teams inside AI companies and by third parties along the supply chain. The paper formalizes what was previously an informal concern: there is no evaluation-based procedure that can rule out modifications of this kind.
Passing a safety evaluation is no longer evidence of safety in the way it was before this paper. It is evidence that the model, under the trigger conditions tested, behaved safely. Under other trigger conditions — specifically a secret cryptographic key held by an adversary who modified the weights — it might not.
