Researchers show that backdoor attacks can embed encrypted neural networks inside a host model's weights, using digital lockers so the hidden circuits stay provably hard to elicit even with full weight access. Tests of fine-tuning, weight noising and other methods failed to surface them, exposing a limit of capability audits.

— via Bruce Schneier blog, Bruce Schneier