One-Line Summary

Safety researchers show models can stash hidden skills that audits can’t reliably elicit, while new open-weight releases make faster private, on-device agents practical.

Research Papers

Proof: AI models can hide capabilities behind secret triggers

Researchers demonstrate that an AI model can contain a hidden “sub-model” that only activates when it sees a secret trigger, meaning many tests designed to draw out risky behaviors may not surface them. The work targets large language models (LLMs) and shows that backdoored capabilities can remain dormant unless a specific pattern appears. ¹

The technique embeds an encrypted neural network inside the host model’s weights and uses “digital lockers” so the hidden circuit decrypts and runs only when the trigger is present. Under standard cryptographic assumptions, these lockers make the hidden computation provably hard to elicit or interpret—even with full access to the weights—extending past work from hiding fixed strings to hiding arbitrary computations. ¹

In PyTorch proof-of-concepts, the authors plant such backdoors and test whether common defenses can expose them: fine-tuning, weight noising, gradient-based trigger search, and latent adversarial training. On a small chemical reaction prediction task (a proxy for chemical, biological, radiological, and nuclear—CBRN—relevant capabilities), the hidden skills resist these elicitation attempts; the authors also release models to help improve defenses and auditing practice. ¹

Open Source & Repos

LFM2.5-24B-A2B enables fast on-device agents with 2B active parameters

Liquid AI releases public weights for a 24-billion-parameter reasoning model that activates only 2 billion parameters per token, enabling always-on agents that think before answering, call tools, and run privately on your own machine. It reports 184 tokens/second on an Apple M5 Max and up to 21,000 output tokens/second at high concurrency on a single NVIDIA B300 Graphics Processing Unit (GPU), with day-one support for llama.cpp, MLX, vLLM, SGLang, and Open Neural Network Exchange (ONNX). For edge setups, that speed and memory profile can lower the cost of continuous agents on a Central Processing Unit (CPU) or modest GPU. ²

Architecturally, it uses 40 layers and 64 experts per Mixture of Experts (MoE) block with top-4 routing, expands context from 32,000 to 131,000 tokens, and doubles vocabulary to 128,000. Training scales to about 33T tokens pretrain, plus 2T at 32K context and 300B at 131K. On agentic and tool-use benchmarks it leads or matches larger peers—AutomationBench 27.69 (vs. 8.72), ToolSandbox 80.71, LiveClaw 48.09 (vs. 38.19), IFEval 96.75, Multi-IF 84.38—while larger models still edge it on knowledge-heavy and coding tasks (e.g., GPQA Diamond, SWE-Bench Verified). The release suggests pairing with retrieval or web search when specialized knowledge is needed. ²

Ollama prerelease updates llama.cpp and streamlines server reuse

Ollama publishes a prerelease (v0.40.4-rc2) that upgrades llama.cpp to b11521 with support for decision models and EmbeddingGemma 2, and updates the server to reuse verified manifests and already loaded models on inference routes—reducing overhead between requests. ³

The repository continues to provide a straightforward path to run many popular open models locally on macOS, Windows, Linux, or Docker, with official Python and JavaScript libraries. This keeps local-first workflows accessible to non-specialists who want privacy and quick iteration without cloud setup. ³

Community Pulse

Hacker News (271↑) — Mixed curiosity and concern about probabilistic triggers, and whether open models can be trusted or verified against hidden backdoors. ⁴

"The study was entirely about the probabalistic triggering. That's what I was after. I was actually studying one shot learning and how it learns and forgets a single training example. More detail: Trained like ~500 runs. Each run was: - inference 5k times to make sure question isn't guessable - Train on one shot of a non guessable question. - inference 800 times for a % remembered Then do this 200 times per run: - train one step on a different normal dataset - inference 800 times on the Q" — Hacker News ⁴

"So, when people talk about open models as panacea against censorship and whatever degrees of mind control, i guess they're wrong? any LLM can have a trojan horse" — Hacker News ⁴

Hacker News (217↑) — Appreciation for easier container tooling, alongside debate over backends like Vulkan vs. OpenVINO and long-term performance/maintenance tradeoffs. ⁵

"OpenVINO is quasi-abandoned, nobody uses it, Intel barely puts any effort to improve it. Vulkan is used by millions and huge money goes into optimizing it. My money is on Vulkan." — Hacker News ⁵

"I just realized that ramalama is actually part of the whole Container Tools ecosystem (Podman, Buildah, etc). This is excellent! Thanks for doing this." — Hacker News ⁵

Why It Matters

The “digital locker” result challenges a core assumption in capability auditing: that careful prompting or fine-tuning can reliably elicit what a model knows how to do. If cryptographic backdoors keep arbitrary computations hidden until a secret trigger appears, audits need new strategies beyond elicitation alone, and the authors’ released models provide a testbed for such defenses. ¹

In parallel, practical on-device stacks are maturing: a public-weights agentic model with strong tool-use scores and a popular local runner both lower the barrier to private AI. Together, these trends point to a world where more powerful local systems are feasible—but where supply-chain trust and verification methods must keep pace. ²

This Week: Hands-on

1. Run LFM2.5-24B-A2B locally: follow the Hugging Face release guide to load the public weights and try tool calls on your machine. https://huggingface.co/blog/LiquidAI/lfm25-24b-a2b
2. Try Ollama’s prerelease: install from the GitHub repo and test a few open models with simple prompts before wiring into your app. https://github.com/ollama/ollama