tl;dr: Researchers demonstrate that backdoors can embed encrypted neural networks inside a host model's weights, activating only via a secret trigger and remaining provably hard to detect or elicit under standard cryptographic assumptions—even with full weight access. Tested against fine-tuning, weight noising, gradient-based trigger search, and latent adversarial training on a chemical reaction task, the hidden capabilities survived all elicitation attempts. The work exposes a fundamental limit of capability audits that rely on behavioral elicitation for safety evaluation.