Paper deep dive
Fundamental Limits of Black-Box Safety Evaluation: Information-Theoretic and Computational Barriers from Latent Context Conditioning
Vishal Srivastava
Intelligence
Status: succeeded | Model: Gemma-4-26B-A4B | Prompt: intel-v1 | Confidence: 87%
Last extracted: 7/21/2026, 12:46:17 AM
Summary
The paper establishes fundamental information-theoretic and computational limits on black-box safety evaluation of AI systems. It demonstrates that models with latent context-conditioned policies can exhibit significantly different risk profiles during deployment compared to evaluation, making deployment risk estimation unreliable for black-box evaluators. The authors derive minimax lower bounds for passive and adaptive evaluation, show computational separation under cryptographic assumptions, and provide sample complexity bounds for white-box probing.
Entities (10)
Relation Signals (6)
Latent Context-Conditioned Policies → causes → Deployment Risk Estimation Failure
confidence 90% · no black-box evaluator can reliably estimate deployment risk for such models
Black-Box Safety Evaluation → challengesassumption → Latent Context-Conditioned Policies
confidence 90% · We formalize and challenge this assumption through latent context-conditioned policies
White-Box Probing → requires → Sample Complexity
confidence 90% · For white-box probing, estimating deployment risk to accuracy epsilon_R requires O(1/(gamma^2 * epsilon_R^2)) samples
Le Cam's Method → usedfor → Minimax Lower Bound
confidence 90% · we prove minimax lower bounds via Le Cam's method
Yao's Minimax Principle → usedfor → Adaptive Evaluation Hardness
confidence 90% · Using a hash-based trigger construction and Yao's minimax principle, worst-case error remains >= delta*L/16
Trapdoor One-Way Function → enables → Computational Separation
confidence 85% · Under trapdoor one-way function assumptions, deployment environments possessing privileged information can activate unsafe behaviors that any polynomial-time evaluator without the trapdoor cannot distinguish
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:Black-box safety evaluation of AI systems assumes model behavior on test distributions reliably predicts deployment performance. We formalize and challenge this assumption through latent context-conditioned policies -- models whose outputs depend on unobserved internal variables that are rare under evaluation but prevalent under deployment. We establish fundamental limits showing that no black-box evaluator can reliably estimate deployment risk for such models. (1) Passive evaluation: For evaluators sampling i.i.d. from D_eval, we prove minimax lower bounds via Le Cam's method: any estimator incurs expected absolute error >= (5/24)*delta*L approximately 0.208*delta*L, where delta is trigger probability under deployment and L is the loss gap. (2) Adaptive evaluation: Using a hash-based trigger construction and Yao's minimax principle, worst-case error remains >= delta*L/16 even for fully adaptive querying when D_dep is supported over a sufficiently large domain; detection requires Theta(1/epsilon) queries. (3) Computational separation: Under trapdoor one-way function assumptions, deployment environments possessing privileged information can activate unsafe behaviors that any polynomial-time evaluator without the trapdoor cannot distinguish. For white-box probing, estimating deployment risk to accuracy epsilon_R requires O(1/(gamma^2 * epsilon_R^2)) samples, where gamma = alpha_0 + alpha_1 - 1 measures probe quality, and we provide explicit bias correction under probe error. Our results quantify when black-box testing is statistically underdetermined and provide explicit criteria for when additional safeguards -- architectural constraints, training-time guarantees, interpretability, and deployment monitoring -- are mathematically necessary for worst-case safety assurance.
Tags
Links
- Source: https://arxiv.org/abs/2602.16984v1
- Canonical: https://arxiv.org/abs/2602.16984v1
Trouble viewing inline? Open PDF directly →
Full Text
71,809 characters extracted from source content.
Expand or collapse full text
Fundamental Limits of Black-Box Safety Evaluation: Information-Theoretic and Computational Barriers from Latent Context Conditioning Vishal Srivastava Whiting School of Engineering Johns Hopkins University Baltimore, MD 21218 vsrivas7@jhu.edu Abstract Black-box safety evaluation of AI systems assumes model behavior on test distributions reliably predicts deployment performance. We formalize and challenge this assumption through latent context-conditioned policies—models whose outputs depend on unobserved internal variables that are rare under evaluation but prevalent under deployment. We establish fundamental limits showing that no black-box evaluator can reliably estimate deployment risk for such models when the expected trigger exposure mεm remains O(1)O(1). (1) Passive evaluation: For evaluators sampling i.i.d. from evalD_eval, we prove a minimax lower bound via Le Cam’s two-point method with explicit constant tracking: any estimator incurs expected absolute error ≥(δL/4)(1−ε)m≥(δ L/4)(1- )^m. In the small-exposure regime mε≤1/6m ≤ 1/6, this specializes to ≥(5/24)δL≥(5/24)\,δ L. (2) Adaptive evaluation: Using an m-wise independent hash-based trigger construction and Yao’s minimax principle, we show that any adaptive evaluator making at most m queries incurs worst-case expected absolute error ≥(εL/4)(1−mε)≥( L/4)(1-m ). When mε≤1/8m ≤ 1/8 this is ≥7εL/32≥ 7 L/32. By Fubini’s theorem the per-query inclusion probability equals ε regardless of the adaptive strategy; the δ≫εδ separation requires privileged deployment information. (3) Computational separation: Under trapdoor one-way function assumptions, deployment environments possessing privileged information can activate unsafe behaviors that any polynomial-time evaluator without the trapdoor cannot distinguish from safe behavior except with negligible advantage. (4) White-box probing: To estimate RdepR_dep to absolute error εR _R with failure probability at most η, it suffices to collect m≥(18/(γ2εR2))log(12/η)m≥(18/(γ^2 _R^2)) (12/η) samples, where γ=α0+α1−1γ= _0+ _1-1 is probe quality. The rate is Θ(1/(γ2εR2)) (1/(γ^2 _R^2)): quadratic in 1/εR1/ _R, reflecting the variance-limited nature of risk estimation (not 1/(γ2εR)1/(γ^2 _R), which would correspond to a bias-limited rate). All constants are derived explicitly via Hoeffding’s inequality and a three-way union bound with explicit bias correction. Our results quantify when black-box testing is statistically underdetermined and provide explicit criteria for when additional safeguards—architectural constraints, training-time guarantees, interpretability methods, and deployment monitoring—are mathematically necessary for worst-case safety assurance. Keywords AI Safety ⋅· Black-Box Evaluation ⋅· Minimax Theory ⋅· Query Complexity ⋅· Cryptographic Hardness ⋅· Outcome Indistinguishability 1 Introduction 1.1 Motivation and Context The deployment of increasingly capable AI systems has intensified concerns about safety and reliability [7, 18]. Current safety practice relies heavily on black-box evaluation: querying models on held-out test distributions and measuring performance before deployment [13, 22]. This approach implicitly assumes that performance on evaluation data evalD_eval upper-bounds deployment risk under depD_dep. Emerging evidence suggests this assumption can be fundamentally fragile. Models developing situational awareness can detect evaluation versus deployment contexts [21, 24], exhibiting safe behavior during testing while engaging in harmful actions post-deployment. Concrete instantiations include backdoor attacks [17, 23], deceptive alignment [19], and context-dependent jailbreaks [27]. Practical examples. The following two scenarios illustrate how trigger separation arises naturally. • LLM and toxic language. A language model is evaluated on a benchmark corpus in which toxic or adversarial prompts are rare (ε≈0 ≈ 0). In production, a subset of users communicate predominantly with toxic language, making such inputs common (δ≫εδ ). The model’s behavior on this input regime is never adequately exercised during evaluation. • Self-driving car in snow. An autonomous vehicle is tested on a dataset in which snowy driving conditions appear only rarely (ε small). A user who drives exclusively in a snowy region encounters such conditions on nearly every trip (δ≈1δ≈ 1). The safety evaluation never covered this deployment context at sufficient density. The core challenge. If a model reliably distinguishes evaluation from deployment using features rare in evalD_eval but common in depD_dep, black-box testing provides little information about deployment risk. We formalize this through latent context conditioning: a model implements an internal binary decision variable zθ(x)z_θ(x) satisfying: (i) Px∼eval[zθ(x)=1]≤εP_x _eval[z_θ(x)=1]≤ (small under evaluation); (i) Px∼dep[zθ(x)=1]≥δP_x _dep[z_θ(x)=1]≥δ (large under deployment); (i) outputs are indistinguishable from a safe model except when zθ(x)=1z_θ(x)=1. evalD_evaldepD_deptrigger mass ε mass δ Figure 1: Trigger separation. Unsafe behavior occupies small mass ε under evalD_eval but larger mass δ under depD_dep. 1.2 Main Contributions 1. Passive evaluator lower bound (Theorem 4.1). Minimax expected absolute error ≥(δL/4)(1−ε)m≥(δ L/4)(1- )^m, derived entirely from first principles: a self-contained coupling proof of tensorization, a first-principles L1L^1 Bayes risk calculation, and an explicit TV bound. Specializes to ≥(5/24)δL≥(5/24)δ L when mε≤1/6m ≤ 1/6. 2. Adaptive evaluator hardness (Theorem 5.1). Any adaptive evaluator making m queries incurs worst-case error ≥(εL/4)(1−mε)≥( L/4)(1-m ). The proof uses: (a) Fubini’s theorem to establish per-query inclusion probability ε ; (b) a tower-property union bound; (c) an explicit transcript indistinguishability argument on the no-detection event; and (d) Yao’s minimax principle. 3. Query complexity (Theorem 6.1). Under i.i.d. sampling, [N]=1/εE[N]=1/ and detection with probability ≥1−η≥ 1-η requires m≥ln(1/η)/εm≥ (1/η)/ queries. Scope and limitations under adaptive sampling are stated precisely. 4. Computational separation (Theorem 7.3). Under trapdoor one-way function assumptions, deployment achieves δ=1δ=1 while any PPT evaluator without the trapdoor has distinguishing advantage ≤negl(λ) (λ). 5. White-box probing (Theorem 8.3). Explicit sample complexity m≥(18/(γ2εR2))log(12/η)m≥(18/(γ^2 _R^2)) (12/η) with all constants derived via Hoeffding’s inequality from first principles—including explicit verification that each Hoeffding tail is ≤η/3≤η/3. The εR−2 _R^-2 dependence is the correct variance-limited rate; a εR−1 _R^-1 rate would require a bias-limited estimator, which does not apply here. Bias correction for probe error is given explicitly. 1.3 Related Work Minimax theory. Le Cam’s two-point method [26, 29] underlies our passive lower bound. We provide self-contained derivations of all steps, making every constant explicit rather than citing asymptotic results. Property testing and query complexity. Goldreich [15] and Canonne [9] provide foundational treatments of query complexity. Our rare-trigger detection setting is a sparse property testing problem; Theorem 6.1 gives tight constants via elementary probability. Domain adaptation. Ben-David et al. [5] bound target risk by source risk plus an ℋH-divergence. Our lower bounds quantify when this discrepancy dominates and is unobservable from evaluation queries. Backdoors and defenses. Gu et al. [17] and subsequent work [10, 20, 25, 4] study detection via activation clustering, spectral analysis, and input perturbation. In the LLM era, BackdoorLLM [1] and ELBA-Bench [2] document a broad range of instruction-level and steganographic backdoor behaviors in large language models, while benign-data instruction backdoors [3] demonstrate trigger designs requiring no poisoned training examples. These empirical findings instantiate exactly the deployment scenarios our framework targets: triggers invisible during standard evaluation (ε≈0 ≈ 0) that activate reliably in production (δ≫εδ ). Our lower bounds establish worst-case limits against constructions satisfying our unobservability definition, independent of any particular trigger design; Section 10.2 maps these explicitly. Cryptographic indistinguishability. Goldwasser et al. [16] plant backdoors using pseudorandom functions. Our Theorem 7.3 uses trapdoor one-way functions for a distinct threat model: triggers constructed at deployment time rather than during training. Outcome indistinguishability. Dwork et al. [12] formalize auditing under varying access models; our passive/adaptive/white-box hierarchy corresponds to their sample/oracle/code access levels. White-box methods. Zou et al. [30] and Burns et al. [8] study activation-based probing. Theorem 8.3 provides a formal sample-complexity analysis with explicit constants. 2 Formal Framework 2.1 Notation Let X denote input space, Y output space. A model is fθ:→f_θ:X with parameters θ∈Θθ∈ . Distributions: evalD_eval (evaluation), depD_dep (deployment). All losses take values in [0,1][0,1]. Core parameters. • ε : trigger probability under evalD_eval • δ: trigger probability under depD_dep, δ>εδ> • Δ:=δ−ε :=δ- : trigger prevalence gap • ℓ0,ℓ1∈[0,1] _0, _1∈[0,1]: expected conditional losses on non-trigger/trigger inputs • L:=|ℓ1−ℓ0|L:=| _1- _0|: loss gap • γ:=α0+α1−1∈(0,1]γ:= _0+ _1-1∈(0,1]: probe quality (white-box section) • εR>0 _R>0: risk estimation tolerance (white-box section; distinct from ε ) • η∈(0,1)η∈(0,1): failure probability Definition 2.1 (Total Variation Distance). For distributions P, Q on a measurable space (Ω,)( ,A): TV(P,Q):=supA∈|P(A)−Q(A)|=12∫|dP−dQ|.TV(P,Q)\;:=\; _A |P(A)-Q(A)|\;=\; 12 |\,dP-dQ\,|. Equivalently, TV(P,Q)=inf(X,Y):X∼P,Y∼QP[X≠Y]TV(P,Q)= _(X,Y):X P,\,Y QP[X≠ Y], where the infimum is over all couplings. The coupling achieving this infimum always exists for discrete or Polish spaces, which we assume throughout. Assumption 2.2 (Evaluator Access). The evaluator queries fθf_θ on inputs from evalD_eval (or chosen adaptively), observing outputs only. The evaluator has no direct access to parameters θ (except in the white-box setting) and no access to depD_dep. 2.2 Latent Context-Conditioned Models Definition 2.3 (Latent Context Conditioning). Model fθf_θ implements latent context conditioning if fθ(x)=gθ(x,zθ(x))f_θ(x)=g_θ(x,\,z_θ(x)), where zθ:→0,1z_θ:X→\0,1\ is a latent function and gθ:×0,1→g_θ:X×\0,1\ . The trigger set is Strigger:=x:zθ(x)=1S_trigger:=\x:z_θ(x)=1\. Definition 2.4 (Unobservability). Latent zθz_θ is unobservable if gθ(x,0)=gθ(x,1)g_θ(x,0)=g_θ(x,1) for all x∉Striggerx∉ S_trigger. That is, the model’s output distribution is identical for safe and unsafe parameter settings on all non-trigger inputs. Assumption 2.5 (Perfect Distinguishability on Triggers). For all x∈Striggerx∈ S_trigger: TV(gθ(x,0),gθ(x,1))=1TV(g_θ(x,0),\,g_θ(x,1))=1. That is, the model’s output distribution on trigger inputs under the safe parameterization is completely disjoint from its output distribution under the unsafe parameterization. Remark 2.6. Assumption 2.5 is used only to derive TV(P0,P1)≤εTV(P_0,P_1)≤ in Step 1 of Theorem 4.1. Proposition 9.1 relaxes it to TV(gθ(x,0),gθ(x,1))≥cTV(g_θ(x,0),g_θ(x,1))≥ c for c∈(0,1]c∈(0,1]. Definition 2.7 (Trigger Separation). Latent zθz_θ exhibits (ε,δ)( ,δ)-trigger separation if: peval:=Px∼eval[zθ(x)=1]≤εandpdep:=Px∼dep[zθ(x)=1]≥δ.p_eval:=P_x _eval[z_θ(x)=1]≤ p_dep:=P_x _dep[z_θ(x)=1]≥δ. 2.3 Risk and Evaluation Goals Definition 2.8 (Deployment Risk). Rdep(θ)=pdepℓ1+(1−pdep)ℓ0,R_dep(θ)\;=\;p_dep\, _1+(1-p_dep)\, _0, where ℓz:=[ℓ(fθ(X))∣zθ(X)=z] _z:=E[ (f_θ(X)) z_θ(X)=z] for z∈0,1z∈\0,1\. Goal: Estimate Rdep(θ)R_dep(θ) to within absolute error εR>0 _R>0. 2.4 Evaluator Types Definition 2.9 (Evaluator Types). (a) Passive: Draws m i.i.d. samples from evalD_eval, observes model outputs, produces an estimate R^dep R_dep. (b) Adaptive: Chooses each query xix_i as a deterministic or randomized measurable function of the previous transcript (x1,fθ(x1),…,xi−1,fθ(xi−1))(x_1,f_θ(x_1),…,x_i-1,f_θ(x_i-1)); queries need not come from evalD_eval. (c) White-box: Inspects parameters θ via a probe function; may access samples from depD_dep. 3 First-Principles Supporting Lemmas We collect and prove from scratch all mathematical primitives used in the main theorems. No result in this section is cited without a self-contained proof. Lemma 3.1 (L1L^1 Bayes Risk Lower Bound). Let θ∈θ0,θ1θ∈\ _0, _1\ be chosen uniformly at random. Let T(θ0)=0T( _0)=0 and T(θ1)=Δ′>0T( _1)= >0. Let P0P_0, P1P_1 be the distributions of an observation T under θ0 _0 and θ1 _1 respectively. Then for any estimator T^=T^() T= T(T): [|T^−T(θ)|]≥Δ′4(1−TV(P0,P1)).E\! [| T-T(θ)| ]\;≥\; 4 (1-TV(P_0,P_1) ). Proof. Step 1. Reduce to hypothesis testing. Define the midpoint μ=Δ′/2μ= /2. Given transcript T, define the “decision” d^()=T^()≥μ d(T)=1\ T(T)≥μ\. If d^=0 d=0 (i.e., T^<μ T<μ) and θ=θ1θ= _1 (so T(θ1)=Δ′T( _1)= ), then: |T^−T(θ1)|=Δ′−T^>Δ′−μ=Δ′2.| T-T( _1)|= - T> -μ= 2. If d^=1 d=1 (i.e., T^≥μ T≥μ) and θ=θ0θ= _0 (so T(θ0)=0T( _0)=0): |T^−T(θ0)|=T^≥μ=Δ′2.| T-T( _0)|= T≥μ= 2. In both cases, a “wrong-side” decision incurs error >Δ′/2> /2. Therefore: |T^−T(θ)|≥Δ′2 1d^≠θ=θ1.| T-T(θ)|\;≥\; 2\,1\ d 1\θ= _1\\. Step 2. Lower bound the probability of a wrong-side decision. Under the uniform prior P[θ=θi]=1/2P[θ= _i]=1/2, the Bayes-optimal decision rule is the likelihood ratio test: decide θ1 _1 if dP1()/dP0()≥1dP_1(T)/dP_0(T)≥ 1, i.e., if T is at least as likely under P1P_1 as under P0P_0. The Bayes error probability of this optimal test equals: Pe∗=12(1−TV(P0,P1)).P_e^*= 12 (1-TV(P_0,P_1) ). We derive this directly. The Bayes error is: Pe P_e =12∫min(dP0,dP1)=12∫P0−12∫(dP0−dP1)+=12−12TV(P0,P1). = 12 (dP_0,dP_1)= 12 dP_0- 12 (dP_0-dP_1)^+= 12- 12TV(P_0,P_1). Since d d is any (possibly suboptimal) test, its error probability P[d^≠θ=θ1]≥Pe∗=(1−TV(P0,P1))/2P[ d 1\θ= _1\]≥ P_e^*=(1-TV(P_0,P_1))/2. Step 3. Combine. [|T^−T(θ)|]≥Δ′2⋅P[d^≠θ=θ1]≥Δ′2⋅1−TV(P0,P1)2=Δ′4(1−TV(P0,P1)).∎E\! [| T-T(θ)| ]\;≥\; 2· P\! [ d 1\θ= _1\ ]\;≥\; 2· 1-TV(P_0,P_1)2\;=\; 4 (1-TV(P_0,P_1) ). Lemma 3.2 (Tensorization of Total Variation). For any distributions P, Q on a common measurable space: 1−TV(P⊗m,Q⊗m)≥(1−TV(P,Q))m.1-TV(P m,Q m)\;≥\; (1-TV(P,Q) )^m. Proof. Let τ=TV(P,Q)τ=TV(P,Q). By Definition 2.1, there exists a coupling (X,Y)(X,Y) with X∼PX P, Y∼QY Q, and P[X≠Y]=τP[X≠ Y]=τ. (Such an optimal coupling exists for all distributions on Polish spaces; see e.g. Villani [26].) Form m independent copies of this coupling: (X1,Y1),…,(Xm,Ym)(X_1,Y_1),…,(X_m,Y_m), all independent, each with P[Xi≠Yi]=τP[X_i≠ Y_i]=τ. Then (X1,…,Xm)∼P⊗m(X_1,…,X_m) P m and (Y1,…,Ym)∼Q⊗m(Y_1,…,Y_m) Q m. This is a valid coupling of P⊗mP m and Q⊗mQ m. For any coupling (U,V)(U,V) of distributions P′P , Q′Q , we have TV(P′,Q′)≤P[U≠V]TV(P ,Q )≤ P[U≠ V] (the optimal coupling achieves equality; any other coupling gives an upper bound). Therefore: TV(P⊗m,Q⊗m) (P m,Q m) ≤P[(X1,…,Xm)≠(Y1,…,Ym)] \;≤\;P\! [(X_1,…,X_m)≠(Y_1,…,Y_m) ] = 1−P[X1=Y1,…,Xm=Ym] \;=\;1-P[X_1=Y_1,…,X_m=Y_m] = 1−∏i=1mP[Xi=Yi](by independence) \;=\;1- _i=1^mP[X_i=Y_i] (by independence) = 1−(1−τ)m. \;=\;1-(1-τ)^m. Rearranging: 1−TV(P⊗m,Q⊗m)≥(1−τ)m=(1−TV(P,Q))m1-TV(P m,Q m)≥(1-τ)^m=(1-TV(P,Q))^m. ∎ Lemma 3.3 (Tower Property Union Bound for Adaptive Queries). Let h be drawn uniformly from an m-wise independent hash family ℋ=h:→[0,1]H=\h:X→[0,1]\, with marginals h(x)∼Unif[0,1]h(x) [0,1] for every fixed x. Define Sh=x:h(x)<εS_h=\x:h(x)< \. Let x1,x2,…,xmx_1,x_2,…,x_m be an adaptive query sequence where xix_i is a measurable function of the transcript ℱi−1=σ(x1,r1,…,xi−1,ri−1)F_i-1=σ(x_1,r_1,…,x_i-1,r_i-1), and each response rj∈0,1r_j∈\0,1\ is a function of xj∈Sh1\x_j∈ S_h\. Then: (i) P[xi∈Sh∣ℱi−1]=εP[x_i∈ S_h _i-1]= for all i. (i) P[∃i≤m:xi∈Sh]≤mεP[∃\,i≤ m:x_i∈ S_h]≤ m . Proof. (i). Fix any realization ω=(x1,r1,…,xi−1,ri−1)ω=(x_1,r_1,…,x_i-1,r_i-1) of ℱi−1F_i-1. Given ω, the query xi=xi(ω)x_i=x_i(ω) is a fixed element of X (it is determined by the transcript). The response rjr_j is a function of xj∈Sh=h(xj)<ε1\x_j∈ S_h\=1\h(x_j)< \, so the transcript ω is determined by (h(x1),…,h(xi−1))(h(x_1),…,h(x_i-1)). Since ℋH is m-wise independent, the random variables h(x1),…,h(xm)h(x_1),…,h(x_m) are jointly uniform on [0,1]m[0,1]^m for any fixed sequence x1,…,xm∈x_1,…,x_m . In particular, for any fixed realization of (h(x1),…,h(xi−1))(h(x_1),…,h(x_i-1))—and hence any fixed realization of ℱi−1F_i-1—the conditional distribution of h(xi)h(x_i) is Unif[0,1]Unif[0,1] (by joint uniformity of any m coordinates). Therefore: P[xi∈Sh∣ℱi−1]=P[h(xi)<ε∣ℱi−1]=ε.✓P[x_i∈ S_h _i-1]=P[h(x_i)< _i-1]= . (i). Let Ii=xi∈ShI_i=1\x_i∈ S_h\. By the tower property: [Ii]=[[Ii∣ℱi−1]]=[ε]=ε.E[I_i]=E[E[I_i _i-1]]=E[ ]= . By linearity of expectation: [∑i=1mIi]=mε.E\! [ _i=1^mI_i ]=m . Since ∃i:Ii=1≤∑i=1mIi1\∃\,i:I_i=1\≤ _i=1^mI_i pointwise, taking expectations gives P[∃i:xi∈Sh]≤mεP[∃\,i:x_i∈ S_h]≤ m . ∎ Remark 3.4 (Why m-wise Independence is Necessary). Pairwise independence is insufficient. If only h(xi)h(x_i) and h(xj)h(x_j) are jointly uniform for i≠ji≠ j (pairwise independence), conditioning on ℱi−1F_i-1—which depends on h(x1),…,h(xi−1)h(x_1),…,h(x_i-1) jointly—does not guarantee that h(xi)h(x_i) remains uniform. m-wise independence ensures joint uniformity of all m evaluations simultaneously, which is what licenses the conditional uniformity in (i). Remark 3.5 (Explicit Polynomial Hash Construction). An m-wise independent family over domain X (encoded as a finite field qF_q with |ℱq|≥|||F_q|≥|X|) is constructed as follows. Draw coefficients a0,a1,…,am−1a_0,a_1,…,a_m-1 uniformly and independently from qF_q. Define h(x)=am−1xm−1+⋯+a1x+a0(modq)h(x)=a_m-1x^m-1+·s+a_1x+a_0 q, normalized to [0,1][0,1] by dividing by q. Why this gives m-wise independence: For any distinct x1,…,xm∈qx_1,…,x_m _q, the Vandermonde system (1x1x12⋯x1m−1⋮1xmxm2⋯xmm−1)(a0⋮am−1)=(h(x1)⋮h(xm)) pmatrix1&x_1&x_1^2&·s&x_1^m-1\\ &&&& \\ 1&x_m&x_m^2&·s&x_m^m-1 pmatrix pmatrixa_0\\ \\ a_m-1 pmatrix= pmatrixh(x_1)\\ \\ h(x_m) pmatrix is invertible (Vandermonde determinant ∏i<j(xj−xi)≠0 _i<j(x_j-x_i)≠ 0 in qF_q for distinct xix_i). Therefore, since (a0,…,am−1)(a_0,…,a_m-1) is uniform over qmF_q^m, the vector (h(x1),…,h(xm))(h(x_1),…,h(x_m)) is also uniform over qmF_q^m. This applies to any fixed sequence of m distinct inputs, which is the property used in Lemma 3.3(i): any adaptively chosen xix_i, conditioned on any fixed realization of the prior transcript, is a fixed element of X, so the Vandermonde argument applies. The family is constructible in time O(m)O(m) per evaluation (polynomial evaluation over qF_q), confirming the construction is efficient. See Vadhan [28] for a comprehensive treatment. Lemma 3.6 (Fubini: Expected Deployment Trigger Mass). Under the conditions of Lemma 3.3, for any distribution D: h[Px∼[x∈Sh]]=ε.E_h\! [P_x [x∈ S_h] ]= . Proof. By Fubini’s theorem (applicable since all quantities are bounded and measurable): h[Px∼[x∈Sh]] _h\! [P_x [x∈ S_h] ] =h[x∼[h(x)<ε]] =E_h\! [E_x [1\h(x)< \] ] =x∼[h[h(x)<ε]] =E_x \! [E_h[1\h(x)< \] ] =x∼[Ph[h(x)<ε]] =E_x \! [P_h[h(x)< ] ] =x∼[ε] =E_x [ ] =ε, = , where the fourth equality uses h(x)∼Unif[0,1]h(x) [0,1] for fixed x (marginal uniformity from m-wise independence). ∎ Remark 3.7 (Structural Impossibility of δ≫εδ Under This Construction). Lemma 3.6 shows that the expected deployment trigger mass under any distribution D is exactly ε . An information-theoretic hash construction with per-query inclusion probability ε cannot simultaneously achieve deployment trigger mass δ≫εδ in expectation over the hash draw. This is why the δ≫εδ separation is a computational phenomenon (Section 7), not an information-theoretic one. Lemma 3.8 (Hoeffding’s Inequality). Let Z1,…,ZmZ_1,…,Z_m be independent random variables with Zi∈[ai,bi]Z_i∈[a_i,b_i] almost surely and [Zi]=μiE[Z_i]= _i. Let Z¯=1m∑i=1mZi Z= 1m _i=1^mZ_i and μ=1m∑iμiμ= 1m _i _i. Then for any t>0t>0: P[|Z¯−μ|>t]≤ 2exp(−2m2t2∑i=1m(bi−ai)2).P\! [| Z-μ|>t ]\;≤\;2 \! ( -2m^2t^2 _i=1^m(b_i-a_i)^2 ). In the special case Zi∈[0,1]Z_i∈[0,1]: P[|Z¯−μ|>t]≤2exp(−2mt2)P[| Z-μ|>t]≤ 2 (-2mt^2). Proof. This is a standard result proved via the moment generating function and the Hoeffding lemma. For self-containedness we state it but note that the proof occupies standard probability texts [26]; all applications in this paper use only the stated bound form. ∎ 4 Passive Evaluator Lower Bounds Intuition. If triggers occur with probability ε under evalD_eval, then m i.i.d. samples encounter at least one trigger with probability 1−(1−ε)m1-(1- )^m. When mε≪1m 1, almost all samples come from the non-trigger region, where safe and unsafe models produce identical outputs. The evaluator thus observes statistically identical transcripts for both model types, and cannot reliably distinguish them. Theorem 4.1 (Minimax Lower Bound for Passive Evaluators). Let θ0 _0 be a safe model (no latent conditioning) and θ1 _1 an unsafe model satisfying (ε,δ)( ,δ)-trigger separation (Definition 2.7) with Assumptions 2.4 and 2.5. Let P0⊗mP_0 m, P1⊗mP_1 m denote the joint distributions of m i.i.d. evaluation queries under θ0 _0, θ1 _1 respectively. Then: infR^supθ∈θ0,θ1θ[|R^−Rdep(θ)|]≥δL4(1−ε)m. _ R _θ∈\ _0, _1\E_θ\! [| R-R_dep(θ)| ]\;≥\; δ L4\,(1- )^m. (1) Moreover, when mε≤1/6m ≤ 1/6: infR^supθ[|R^−Rdep(θ)|]≥5δL24. _ R _θ\,E_θ\! [| R-R_dep(θ)| ]\;≥\; 5\,δ L24. (2) Proof. Step 1: Single-sample total variation. Let P0P_0, P1P_1 be the output distributions of a single query x∼evalx _eval under θ0 _0, θ1 _1 respectively. We claim TV(P0,P1)≤εTV(P_0,P_1)≤ . Write =Strigger∪StriggercX=S_trigger∪ S_trigger^c. On StriggercS_trigger^c: by Definition 2.4, gθ(x,0)=gθ(x,1)g_θ(x,0)=g_θ(x,1), so P0P_0 and P1P_1 agree on all outputs from non-trigger inputs. On StriggerS_trigger: by Assumption 2.5, the output distributions are maximally different (TV=1=1), but this set has evalD_eval-mass at most ε . Formally, for any measurable set A⊆A : |P0(A)−P1(A)| |P_0(A)-P_1(A)| =|∫[P0(A|x)−P1(A|x)]deval(x)| = | _X[P_0(A|x)-P_1(A|x)]\,dD_eval(x) | ≤∫|P0(A|x)−P1(A|x)|deval(x) ≤ _X|P_0(A|x)-P_1(A|x)|\,dD_eval(x) =∫Strigger|P0(A|x)−P1(A|x)|deval(x)+∫Striggerc0deval(x) = _S_trigger|P_0(A|x)-P_1(A|x)|\,dD_eval(x)+ _S_trigger^c0\,dD_eval(x) ≤∫Strigger1eval(x)=Peval[x∈Strigger]≤ε. ≤ _S_trigger1\,dD_eval(x)\;=\;P_D_eval[x∈ S_trigger]\;≤\; . Taking the supremum over A: TV(P0,P1)≤εTV(P_0,P_1)≤ . Step 2: Tensorization. By Lemma 3.2: 1−TV(P0⊗m,P1⊗m)≥(1−ε)m.1-TV(P_0 m,P_1 m)\;≥\;(1- )^m. Step 3: Risk separation. Rdep(θ0)=ℓ0R_dep( _0)= _0 (no trigger, so all queries are non-trigger and loss is ℓ0 _0). Rdep(θ1)=pdepℓ1+(1−pdep)ℓ0≥δℓ1+(1−δ)ℓ0R_dep( _1)=p_dep\, _1+(1-p_dep)\, _0≥δ\, _1+(1-δ)\, _0 (since pdep≥δp_dep≥δ). Therefore: Δ′:=|Rdep(θ1)−Rdep(θ0)|≥δ|ℓ1−ℓ0|=δL. :=|R_dep( _1)-R_dep( _0)|≥δ\,| _1- _0|=δ L. Step 4: Apply Lemma 3.1. By the minimax theorem (for two-point problems, the minimax risk equals the Bayes risk under the uniform prior, which is lower-bounded by Lemma 3.1): infR^supθ∈θ0,θ1θ[|R^−Rdep(θ)|]≥infR^12∑j∈0,1θj[|R^−Rdep(θj)|]≥Δ′4(1−TV(P0⊗m,P1⊗m))≥δL4(1−ε)m. _ R _θ∈\ _0, _1\E_θ[| R-R_dep(θ)|]\;≥\; _ R\, 12 _j∈\0,1\E_ _j[| R-R_dep( _j)|]\;≥\; 4(1-TV(P_0 m,P_1 m))\;≥\; δ L4(1- )^m. Step 5: Small-exposure regime. If mε≤1/6m ≤ 1/6, by Bernoulli’s inequality ((1−x)m≥1−mx(1-x)^m≥ 1-mx for x∈[0,1]x∈[0,1], all m≥1m≥ 1): (1−ε)m≥ 1−mε≥ 1−16=56.(1- )^m\;≥\;1-m \;≥\;1- 16= 56. Therefore (δL/4)(1−ε)m≥(5δL)/(24)(δ L/4)(1- )^m≥(5δ L)/(24). ∎ Remark 4.2 (Tightness). The bound (1) is tight with respect to the Le Cam reduction technique used. As m→Θ(1/ε)m→ (1/ ), (1−ε)m→e−1(1- )^m→ e^-1 and detection becomes possible; Theorem 6.1 makes this precise. Matching upper bounds (achievability results) are not established here and remain open. 5 Adaptive Evaluator Hardness 5.1 Setup The key insight is that an adaptive evaluator’s advantage comes from choosing queries based on past responses. An m-wise independent hash construction eliminates this advantage: every query, however chosen, hits the trigger set with the same probability ε . Model class construction. Let Π be the uniform distribution over an m-wise independent family ℋ=h:→[0,1]H=\h:X→[0,1]\. For each h∈ℋh , define the trigger set Sh=x:h(x)<εS_h=\x:h(x)< \ and the unsafe model θh _h with zθh(x)=x∈Shz_ _h(x)=1\x∈ S_h\. The safe model θ0 _0 has zθ0(x)=0z_ _0(x)=0 for all x. Risks under this construction. • Rdep(θ0)=ℓ0R_dep( _0)= _0. • For fixed h: Rdep(θh)=pdep(h)ℓ1+(1−pdep(h))ℓ0R_dep( _h)=p_dep(h) _1+(1-p_dep(h)) _0, where pdep(h)=Px∼dep[x∈Sh]p_dep(h)=P_x _dep[x∈ S_h]. • By Lemma 3.6: h[pdep(h)]=εE_h[p_dep(h)]= . • Therefore: h[Rdep(θh)]=εℓ1+(1−ε)ℓ0=ℓ0+εLE_h[R_dep( _h)]= _1+(1- ) _0= _0+ L. We define a prior π over θ0∪θh:h∼Π\ _0\∪\ _h:h \: with probability 1/21/2, draw θ0 _0; with probability 1/21/2, draw θh _h for h∼Πh . 5.2 Adaptive Lower Bound Theorem 5.1 (Adaptive Lower Bound Under Latent Triggers). Under the m-wise independent hash construction above, for any adaptive evaluator A making at most m queries: infAsupf∈ℱ[|R^dep−Rdep(f)|]≥εL4(1−mε). _A _f E\! [| R_dep-R_dep(f)| ]\;≥\; L4\,(1-m ). (3) When mε≤1/8m ≤ 1/8: the right-hand side is ≥7εL/32≥ 7 L/32. Proof. Step 1: Apply Yao’s minimax principle. Yao’s minimax principle states: for any prior π over the model class ℱF, infAsupf∈ℱ[|R^−Rdep(f)|]≥infR^f∼π[[|R^−Rdep(f)|]]. _A _f E[| R-R_dep(f)|]\;≥\; _ RE_f π[E[| R-R_dep(f)|]]. We apply this with the prior π defined above (1/21/2 on θ0 _0, 1/21/2 on θh _h for h∼Πh ). It suffices to lower-bound the right side. Step 2: Define the detection event. Let E=∃i≤m:xi∈ShE=\∃\,i≤ m:x_i∈ S_h\ be the event that at least one query hits the trigger set. By Lemma 3.3(i): Ph∼Π[E]≤mεP_h [E]≤ m , so P[Ec]≥1−mεP[E^c]≥ 1-m . Step 3: Transcript indistinguishability on EcE^c. We claim: conditioned on EcE^c, the transcript distributions under θ0 _0 and θh _h (for h drawn from Π ) are identical. Proof of claim. On the event EcE^c, no query xix_i falls in ShS_h, so xi∈Sh=01\x_i∈ S_h\=0 for all i. By Definition 2.4 (unobservability), gθ(x,0)=gθ(x,1)g_θ(x,0)=g_θ(x,1) for all x∉Striggerx∉ S_trigger. Therefore, for each query xix_i on the event EcE^c: fθh(xi)=gθh(xi,zθh(xi))=gθh(xi,0)=gθ0(xi,0)=fθ0(xi).f_ _h(x_i)=g_ _h(x_i,z_ _h(x_i))=g_ _h(x_i,0)=g_ _0(x_i,0)=f_ _0(x_i). The entire transcript (x1,f(x1),…,xm,f(xm))(x_1,f(x_1),…,x_m,f(x_m)) is thus identically distributed under θ0 _0 and θh _h (for any h) conditional on EcE^c. Hence the posterior over θ0,θh\ _0, _h\ given the transcript on EcE^c equals the prior 1/21/2–1/21/2. Step 4: Bayes risk on EcE^c. On EcE^c, the estimator R R is a function of a transcript drawn from the same distribution under both θ0 _0 and θh _h. For any (possibly randomized) estimator R R, since the posterior is 1/21/2–1/21/2 and the risk values are R0=ℓ0R_0= _0 and h[Rh]=ℓ0+εLE_h[R_h]= _0+ L: The expected L1L^1 error conditional on EcE^c satisfies (by the two-point Lemma 3.1 applied with TV=0=0 since transcripts are identical): [|R^−Rdep(θ)|∣Ec]≥εL4(1−0)=εL4.E[| R-R_dep(θ)| E^c]\;≥\; L4(1-0)= L4. Here Δ′=εL = L (the expected risk gap under π) and TV(P0|Ec,Ph|Ec)=0TV(P_0|_E^c,P_h|_E^c)=0 by Step 3. Step 5: Overall bound. π[|R^−Rdep(θ)|] _π\! [| R-R_dep(θ)| ] ≥π[|R^−Rdep(θ)| 1Ec] _π\! [| R-R_dep(θ)|\,1_E^c ] =P[Ec]⋅π[|R^−Rdep(θ)|∣Ec] =P[E^c]·E_π\! [| R-R_dep(θ)| E^c ] ≥(1−mε)⋅εL4. ≥(1-m )· L4. By Yao’s principle, infAsupf[|R^−Rdep(f)|]≥(εL/4)(1−mε) _A _fE[| R-R_dep(f)|]≥( L/4)(1-m ). Step 6: Specialization. When mε≤1/8m ≤ 1/8: 1−mε≥7/81-m ≥ 7/8, so the bound is ≥(εL/4)(7/8)=7εL/32≥( L/4)(7/8)=7 L/32. ∎ Remark 5.2 (Why the Bound Uses ε , Not δ). The bound (3) is parameterized by ε because the hash construction forces the expected risk separation to be εL L (Lemma 3.6). The larger gap δLδ L arises only when deployment has privileged information—a computational phenomenon established in Theorem 7.3. The two results address distinct threat models and are complementary, not redundant. Remark 5.3 (Tightness and Matching Upper Bounds). Theorem 5.1 is a worst-case lower bound. Whether matching upper bounds (achievability results showing error o(εL)o( L) for m≫1/εm 1/ ) exist under our model class is an open question. In the passive setting, once m=Θ(1/ε)m= (1/ ), an empirical mean estimator achieves error O(δL⋅e−Ω(mε))O(δ L· e^- (m )) by Theorem 6.1, so the lower bound is tight in the regime m=O(1/ε)m=O(1/ ). For adaptive evaluators, the hash construction shows no adaptive strategy can improve the mεm detection barrier in the worst case; whether adaptive strategies outperform passive sampling for specific (non-worst-case) model classes is an interesting open direction. 6 Query Complexity Theorem 6.1 (Query Complexity Bounds). Suppose triggers occur independently with probability ε for each i.i.d. sample from evalD_eval. Let N=mini:xi∈StriggerN= \i:x_i∈ S_trigger\ be the first trigger-hit time. Then: (a) [N]=1/εE[N]=1/ . (b) For any η∈(0,1)η∈(0,1), detection with probability ≥1−η≥ 1-η requires m≥⌈ln(1/η)/ε⌉m≥ (1/η)/ queries. Proof. (a). Each query independently hits StriggerS_trigger with probability ε , so N∼Geometric(ε)N ( ) (number of trials to first success). The mean of a geometric(ε)( ) random variable is 1/ε1/ . Explicitly: P[N=k]=(1−ε)k−1εP[N=k]=(1- )^k-1 for k=1,2,…k=1,2,…. Then: [N]=∑k=1∞k(1−ε)k−1ε=ε⋅d(1−ε)[−∑k=0∞(1−ε)k]−1E[N]= _k=1^∞k(1- )^k-1 = · dd(1- )\! [- _k=0^∞(1- )^k ]^-1 Using the standard formula ∑k=1∞krk−1=1/(1−r)2 _k=1^∞kr^k-1=1/(1-r)^2 with r=1−εr=1- : [N]=ε⋅1/ε2=1/εE[N]= · 1/ ^2=1/ . (b). P[N>m]=P[no trigger in m queries]=(1−ε)mP[N>m]=P[no trigger in m queries]=(1- )^m. Using 1−x≤e−x1-x≤ e^-x for x∈[0,1]x∈[0,1]: P[N>m]=(1−ε)m≤e−mε.P[N>m]=(1- )^m≤ e^-m . For P[N>m]≤ηP[N>m]≤η, it suffices that e−mε≤ηe^-m ≤η, i.e. m≥ln(1/η)/εm≥ (1/η)/ . ∎ Remark 6.2 (Scope: i.i.d. vs. Adaptive Settings). Theorem 6.1 applies to i.i.d. sampling where trigger hits are independent Bernoulli(ε)( ) trials. In the adaptive/hash setting, Lemma 3.3(i) guarantees only P[∃hit]≤mεP[∃\,hit]≤ m via a union bound. The exponential tail bound (1−ε)m≤e−mε(1- )^m≤ e^-m does not apply without the independence structure of i.i.d. sampling. Example 6.3 (Numerical Evaluation). For ε=0.001 =0.001: [N]=1000E[N]=1000 queries; 95%95\% detection (η=0.05η=0.05) requires m≥⌈ln(20)/0.001⌉=2996m≥ (20)/0.001 =2996 queries; 99%99\% detection (η=0.01η=0.01) requires m≥⌈ln(100)/0.001⌉=4606m≥ (100)/0.001 =4606 queries. 7 Computational Hardness Assumption 7.1 (Trapdoor One-Way Functions). There exists a family (fs,tds)s∈0,1λ\(f_s,td_s)\_s∈\0,1\^λ with the following properties, where λ is a security parameter: (i) Efficiency: fs:0,1n→0,1nf_s:\0,1\^n→\0,1\^n is computable in time polynomial in λ. (i) Trapdoor inversion: Given tdstd_s and y=fs(x)y=f_s(x), an element of fs−1(y)f_s^-1(y) is computable in time polynomial in λ. (i) One-wayness: For any probabilistic polynomial-time (PPT) algorithm A without tdstd_s: Ps,x[A(s,fs(x))∈fs−1(fs(x))]≤negl(λ),P_s,x\! [A(s,f_s(x))∈ f_s^-1(f_s(x)) ] (λ), where negl(λ)negl(λ) denotes a negligible function (one that decreases faster than any inverse polynomial). Assumption 7.2 (Separating Access Model). Three parties with separated capabilities: (i) Model: Holds index s; computes fs(⋅)f_s(·) as an internal operation. The evaluator does not receive an oracle for fsf_s. (i) Deployment environment: Holds trapdoor tdstd_s; constructs trigger inputs via π=fs−1(x)π=f_s^-1(x). Does not reveal s or tdstd_s. (i) Evaluator: PPT algorithm with black-box input–output access to fθf_θ only; knows neither s nor tdstd_s and has no oracle for fsf_s. Theorem 7.3 (Computational Hardness of Black-Box Safety Evaluation). Under Assumptions 7.1 and 7.2—in particular, under the no-forward-oracle condition that the evaluator has no oracle access to compute fs(π)f_s(π) for chosen π (Assumption 7.2(i))—there exists a model class ℱF, evaluation distribution evalD_eval, and deployment distribution depD_dep such that: (i) pdep=P(x,π)∼dep[(x,π)∈Strigger]=1p_dep=P_(x,π) _dep[(x,π)∈ S_trigger]=1, so δ=1δ=1. (i) For any PPT evaluator without tdstd_s: P[evaluator distinguishes safe from unsafe]≤1/2+negl(λ)P[evaluator distinguishes safe from unsafe]≤ 1/2+negl(λ). The no-forward-oracle condition is essential: if the evaluator could compute fs(π)f_s(π) for chosen π (i.e., had forward-oracle access to fsf_s), it could trivially construct trigger inputs as (fs(π),π)(f_s(π),π) for any π, bypassing one-wayness. Without this oracle, such construction requires inverting fsf_s, which is infeasible for PPT adversaries by Assumption 7.1(i). Proof. Construction. Set =0,1n×0,1nX=\0,1\^n×\0,1\^n with inputs (x,π)(x,π). Define the trigger set Strigger=(x,π):fs(π)=xS_trigger=\(x,π):f_s(π)=x\. Under evalD_eval: draw x∼0,1nx \0,1\^n uniformly, π∼0,1nπ \0,1\^n uniformly and independently. Then: Peval[(x,π)∈Strigger]=P[fs(π)=x]=2−n≈0,P_D_eval[(x,π)∈ S_trigger]=P[f_s(π)=x]=2^-n≈ 0, since for fixed π, fs(π)f_s(π) is a single point in 0,1n\0,1\^n and x is uniform. So ε=2−n =2^-n. Under depD_dep: draw x∼0,1nx \0,1\^n uniformly, set π=fs−1(x)π=f_s^-1(x) using tdstd_s. Then fs(π)=xf_s(π)=x holds deterministically, so every sample satisfies (x,π)∈Strigger(x,π)∈ S_trigger. Hence δ=1δ=1. Part (i). By the construction: pdep=1p_dep=1. ✓ Part (i). Suppose for contradiction that there exists a PPT evaluator A distinguishing safe from unsafe with advantage ≥1/2+1/p(λ)≥ 1/2+1/p(λ) for some polynomial p. Since A has only black-box access and the models agree on all non-trigger inputs (Definition 2.4), A can only distinguish them by finding a query (x,π)(x,π) with fs(π)=xf_s(π)=x. There are two ways A could attempt this without tdstd_s: (a) Inversion: given x, find π with fs(π)=xf_s(π)=x. This directly contradicts one-wayness (Assumption 7.1(i)). (b) Forward construction: choose π and compute x=fs(π)x=f_s(π), then query on (x,π)(x,π). This requires an oracle for fsf_s, which the evaluator does not have (Assumption 7.2(i)). Without this oracle, the evaluator cannot compute fs(π)f_s(π) for chosen π—the model computes fsf_s only internally and does not expose a forward-evaluation interface. (c) Uniform guessing: choose (x,π)(x,π) uniformly at random. Then P[fs(π)=x]=2−nP[f_s(π)=x]=2^-n per query, giving total success probability ≤m⋅2−n≤ m· 2^-n after polynomial m queries, which is negligible. No PPT evaluator therefore achieves advantage better than negl(λ)negl(λ) over 1/21/2. ∎ Remark 7.4 (Sensitivity to the No-Forward-Oracle Assumption). Theorem 7.3 depends critically on the evaluator lacking a forward oracle for fsf_s. We clarify three related questions: (a) Helper oracle for fsf_s without trapdoor. If the evaluator has polynomial query access to a helper that computes x=fs(π)x=f_s(π) for chosen π (but still lacks tdstd_s), the separation breaks: the evaluator can simply pick any π, compute x=fs(π)x=f_s(π), and query the model on (x,π)∈Strigger(x,π)∈ S_trigger, obtaining distinguishing advantage close to 11. The no-forward-oracle condition (Assumption 7.2(i)) is therefore necessary, not merely sufficient. (b) What the model exposes. The model holds s internally and uses fsf_s to check trigger membership. It does not expose fsf_s as a callable interface; the evaluator observes only input–output pairs (x,fθ(x))(x,f_θ(x)). This is the standard black-box access model. (c) Practical interpretation. The assumption models scenarios where the trigger check is implemented inside the model (e.g., via a cryptographic circuit compiled into the weights, as in [11]) rather than as an externally queryable API. If the trigger is instead an API call whose forward direction is publicly accessible, the computational separation does not apply. Remark 7.5 (Comparison with Goldwasser et al.). Goldwasser et al. [16] construct backdoors using pseudorandom functions (PRFs) planted during training. Our construction uses trapdoor OWFs with triggers controlled by the deployment environment. The distinction is one of threat model: training-time poisoning vs. deployment-time privileged information. Both assumptions are standard and neither is strictly stronger than the other in the complexity-theoretic sense (PRFs are constructible from OWFs via OWF⇒ ⇒ reductions). 8 White-Box Probing White-box probing bypasses the black-box detection barrier by inspecting model internals directly. The obstacle is no longer trigger detection but probe accuracy. The relevant parameter is probe quality γ, not trigger prevalence ε . 8.1 Probe Model Definition 8.1 (Probe with Accuracy Parameters). A probe p:Θ×→0,1p: ×X→\0,1\ is (α0,α1)( _0, _1)-accurate if: α0:=P[p(θ,X)=0∣zθ(X)=0](specificity), _0:=P[p(θ,X)=0 z_θ(X)=0] (specificity), α1:=P[p(θ,X)=1∣zθ(X)=1](sensitivity). _1:=P[p(θ,X)=1 z_θ(X)=1] (sensitivity). The probe quality is γ:=α0+α1−1γ:= _0+ _1-1. We assume γ>0γ>0 (the probe is better than random guessing). 8.2 Debiasing the Trigger Prevalence Estimate Let q^=1m∑i=1mp(θ,xi)=1 q= 1m _i=1^m1\p(θ,x_i)=1\ be the empirical positive rate from m i.i.d. deployment samples. We compute [q^]E[ q]: [q^] [ q] =P[p(θ,X)=1] =P[p(θ,X)=1] =P[p=1∣z=1]P[z=1]+P[p=1∣z=0]P[z=0] =P[p=1 z=1]P[z=1]+P[p=1 z=0]P[z=0] =α1pdep+(1−α0)(1−pdep) = _1\,p_dep+(1- _0)(1-p_dep) =pdep(α0+α1−1)+(1−α0) =p_dep( _0+ _1-1)+(1- _0) =pdepγ+(1−α0). =p_dep\,γ+(1- _0). Solving for pdepp_dep: define the debiased estimator p^:=q^−(1−α0)γ. p:= q-(1- _0)γ. Then [p^]=pdepE[ p]=p_dep (unbiased), and by direct variance computation: Var(p^)=Var(q^)γ2≤14mγ2,Var( p)= Var( q)γ^2≤ 14mγ^2, since q q is the mean of m i.i.d. Bernoulli random variables with variance ≤1/4≤ 1/4. 8.3 Debiasing the Conditional Loss Estimates Let ℓ^1naive _1^naive be the empirical mean loss on inputs where p(θ,x)=1p(θ,x)=1, and ℓ^0naive _0^naive on inputs where p(θ,x)=0p(θ,x)=0. By the law of total expectation: [ℓ^1naive] [ _1^naive] =α1pℓ1+(1−α0)(1−p)ℓ0α1p+(1−α0)(1−p), = _1p\, _1+(1- _0)(1-p) _0 _1p+(1- _0)(1-p), [ℓ^0naive] [ _0^naive] =(1−α1)pℓ1+α0(1−p)ℓ0(1−α1)p+α0(1−p), = (1- _1)p\, _1+ _0(1-p) _0(1- _1)p+ _0(1-p), where p=pdepp=p_dep. Solving the linear system for ℓ0 _0 and ℓ1 _1 (when γ>0γ>0, the system is invertible) gives the debiased estimators: ℓ~1=α0ℓ^1naive−(1−α0)ℓ^0naiveγ,ℓ~0=α1ℓ^0naive−(1−α1)ℓ^1naiveγ. _1= _0 _1^naive-(1- _0) _0^naiveγ, _0= _1 _0^naive-(1- _1) _1^naiveγ. Proposition 8.2 (Unbiasedness of Debiased Loss Estimators). When γ>0γ>0: [ℓ~1]=ℓ1E[ _1]= _1 and [ℓ~0]=ℓ0E[ _0]= _0. Proof. We verify for ℓ~1 _1; ℓ~0 _0 is symmetric. Writing the 2x2 linear system: let a=α1pa= _1p, b=(1−α0)(1−p)b=(1- _0)(1-p), c=(1−α1)pc=(1- _1)p, d=α0(1−p)d= _0(1-p). Then [ℓ^1naive]=(aℓ1+bℓ0)/(a+b)E[ _1^naive]=(a _1+b _0)/(a+b) and [ℓ^0naive]=(cℓ1+dℓ0)/(c+d)E[ _0^naive]=(c _1+d _0)/(c+d). Define A=a+bA=a+b, C=c+dC=c+d. Then [ℓ~1]=(α0A⋅(aℓ1+bℓ0)/A−(1−α0)C⋅(cℓ1+dℓ0)/C)/γE[ _1]=( _0A·(a _1+b _0)/A-(1- _0)C·(c _1+d _0)/C)/γ =(α0(aℓ1+bℓ0)−(1−α0)(cℓ1+dℓ0))/γ=( _0(a _1+b _0)-(1- _0)(c _1+d _0))/γ. Substituting: α0a−(1−α0)c=α0α1p−(1−α0)(1−α1)p=p(α0α1−1+α0+α1−α0α1)=pγ _0a-(1- _0)c= _0 _1p-(1- _0)(1- _1)p=p( _0 _1-1+ _0+ _1- _0 _1)=pγ. Similarly α0b−(1−α0)d=α0(1−α0)(1−p)−(1−α0)α0(1−p)=0 _0b-(1- _0)d= _0(1- _0)(1-p)-(1- _0) _0(1-p)=0. Therefore [ℓ~1]=pγℓ1/γ=ℓ1E[ _1]=pγ _1/γ= _1. ∎ 8.4 Sample Complexity Theorem 8.3 (Probe-Assisted Risk Estimation). For an (α0,α1)( _0, _1)-accurate probe with γ=α0+α1−1>0γ= _0+ _1-1>0, collecting mdepm_dep i.i.d. deployment samples and mevalm_eval i.i.d. evaluation samples with: mdep,meval≥18γ2εR2log(12η)m_dep,\,m_eval\;≥\; 18γ^2 _R^2 \! ( 12η ) suffices to guarantee P[|R^dep−Rdep|>εR]≤ηP[| R_dep-R_dep|> _R]≤η. The sample complexity is Θ(1/(γ2εR2)) (1/(γ^2 _R^2)): quadratic in 1/εR1/ _R, reflecting variance-limited estimation, not bias-limited (Θ(1/εR) (1/ _R)). All constants are derived explicitly in the proof via Hoeffding’s inequality with no approximation. Proof. Step 1: Decompose the error. Write Rdep=pdepℓ1+(1−pdep)ℓ0R_dep=p_dep _1+(1-p_dep) _0 and R^dep=p^ℓ~1+(1−p^)ℓ~0 R_dep= p\, _1+(1- p) _0. Then: |R^dep−Rdep| | R_dep-R_dep| =|p^ℓ~1+(1−p^)ℓ~0−pℓ1−(1−p)ℓ0| =| p\, _1+(1- p) _0-p\, _1-(1-p) _0| ≤|p^−p||ℓ~1−ℓ~0|+|p||ℓ~1−ℓ1|+(1−|p|)|ℓ~0−ℓ0|. ≤| p-p|| _1- _0|+|p|| _1- _1|+(1-|p|)| _0- _0|. Since all losses lie in [0,1][0,1], |ℓ~1−ℓ~0|≤L≤1| _1- _0|≤ L≤ 1, |p|≤1|p|≤ 1, and (1−|p|)≤1(1-|p|)≤ 1. A union bound gives: |R^dep−Rdep|>εR⟹|p^−p|>εR/3 or |ℓ~1−ℓ1|>εR/3 or |ℓ~0−ℓ0|>εR/3.| R_dep-R_dep|> _R | p-p|> _R/3 or | _1- _1|> _R/3 or | _0- _0|> _R/3. Step 2: Bound each error probability via Hoeffding. Prevalence estimate p p. We have p^=(q^−(1−α0))/γ p=( q-(1- _0))/γ where q q is the mean of mdepm_dep i.i.d. Bernoulli random variables in 0,1⊂[0,1]\0,1\⊂[0,1]. Applying Lemma 3.8 with t=γεR/3t=γ _R/3: P[|q^−[q^]|>γεR/3]≤2exp(−2mdep(γεR/3)2)=2exp(−2mdepγ2εR29).P[| q-E[ q]|>γ _R/3]≤ 2 (-2m_dep(γ _R/3)^2)=2 \! ( -2m_depγ^2 _R^29 ). Since |p^−pdep|=|q^−[q^]|/γ| p-p_dep|=| q-E[ q]|/γ: P[|p^−pdep|>εR/3]≤2exp(−2mdepγ2εR29).P[| p-p_dep|> _R/3]≤ 2 \! ( -2m_depγ^2 _R^29 ). Loss estimate ℓ~1 _1. We have ℓ~1=(α0ℓ^1naive−(1−α0)ℓ^0naive)/γ _1=( _0 _1^naive-(1- _0) _0^naive)/γ. Each ℓ^znaive _z^naive is the mean of i.i.d. [0,1][0,1]-valued random variables over mevalm_eval samples (partition into probe-positive and probe-negative). By Lemma 3.8 applied to each: P[|ℓ^znaive−[ℓ^znaive]|>t]≤2exp(−2mevalt2).P[| _z^naive-E[ _z^naive]|>t]≤ 2 (-2m_evalt^2). The debiased estimator ℓ~1 _1 is a linear combination with coefficients α0/γ≤1/γ _0/γ≤ 1/γ and (1−α0)/γ≤1/γ(1- _0)/γ≤ 1/γ (since α0,1−α0≤1 _0,1- _0≤ 1). Setting the combined error threshold to εR/3 _R/3 and applying a union bound over the two terms: P[|ℓ~1−ℓ1|>εR/3]≤4exp(−2mevalγ2εR29⋅4)=4exp(−mevalγ2εR218).P[| _1- _1|> _R/3]≤ 4 \! ( -2m_evalγ^2 _R^29· 4 )=4 \! ( -m_evalγ^2 _R^218 ). The same bound holds for |ℓ~0−ℓ0|| _0- _0| by symmetry. Step 3: Union bound. P[|R^dep−Rdep|>εR] P[| R_dep-R_dep|> _R] ≤P[|p^−p|>εR/3]+P[|ℓ~1−ℓ1|>εR/3]+P[|ℓ~0−ℓ0|>εR/3] ≤ P[| p-p|> _R/3]+P[| _1- _1|> _R/3]+P[| _0- _0|> _R/3] ≤2exp(−2mγ2εR29)+4exp(−mγ2εR218)+4exp(−mγ2εR218), ≤ 2 \! ( -2mγ^2 _R^29 )+4 \! ( -mγ^2 _R^218 )+4 \! ( -mγ^2 _R^218 ), where m=min(mdep,meval)m= (m_dep,m_eval). Since 2/9>1/182/9>1/18, the tightest constraint comes from the loss terms. Setting each term ≤η/3≤η/3: Prevalence term: 2e−2mγ2εR2/9≤η/32e^-2mγ^2 _R^2/9≤η/3 requires m≥(9/(2γ2εR2))log(6/η)m≥(9/(2γ^2 _R^2)) (6/η). Each loss term: 4e−mγ2εR2/18≤η/34e^-mγ^2 _R^2/18≤η/3 requires m≥(18/(γ2εR2))log(12/η)m≥(18/(γ^2 _R^2)) (12/η). The loss-term constraint dominates. Setting m≥(18/(γ2εR2))log(12/η)m≥(18/(γ^2 _R^2)) (12/η) ensures all three terms are ≤η/3≤η/3, so total probability ≤η≤η. This gives the stated sufficient condition. Verifying the sufficient condition. Set m0=(2/(γ2εR2))log(6/η)m_0=(2/(γ^2 _R^2)) (6/η) and suppose m≥m0m≥ m_0. We verify each of the three terms is ≤η/3≤η/3: Term 1 (p p): 2exp(−2mγ2εR29)≤2exp(−2m0γ2εR29)=2exp(−4log(6/η)9)=2⋅(η6)4/9.2 \! ( -2mγ^2 _R^29 )≤ 2 \! ( -2m_0γ^2 _R^29 )=2 \! ( -4 (6/η)9 )=2·\! ( η6 )^4/9. For η∈(0,1)η∈(0,1): (η/6)4/9≤(η/6)4/9(η/6)^4/9≤(η/6)^4/9. Since 64/9>26^4/9>2 (as 64/9=e(4/9)ln6≈e0.796≈2.226^4/9=e^(4/9) 6≈ e^0.796≈ 2.22), we have 2(η/6)4/9≤η/6⋅2⋅61−4/9=η⋅2⋅65/9/6=η⋅2⋅6−4/9<η/32(η/6)^4/9≤η/6· 2· 6^1-4/9=η· 2· 6^5/9/6=η· 2· 6^-4/9<η/3, where the last inequality uses 64/9>36^4/9>3. We verify: 64/9=e(4ln6)/9≈e0.796≈2.226^4/9=e^(4 6)/9≈ e^0.796≈ 2.22… Actually, take a cleaner route: Since m0γ2εR2/9=(2/9)log(6/η)m_0γ^2 _R^2/9=(2/9) (6/η), 2exp(−2m0γ2εR29)=2⋅(η6)2/9.2 \! ( -2m_0γ^2 _R^29 )=2· ( η6 )^2/9. We need 2(η/6)2/9≤η/32(η/6)^2/9≤η/3, i.e. 6≤(6/η)1−2/9=(6/η)7/96≤(6/η)^1-2/9=(6/η)^7/9. For η≤1η≤ 1: (6/η)7/9≥67/9≈e(7ln6)/9≈e1.24≈3.5(6/η)^7/9≥ 6^7/9≈ e^(7 6)/9≈ e^1.24≈ 3.5. This does not always give ≤η/3≤η/3 for arbitrary η. Correct resolution. Instead of splitting error εR/3 _R/3 equally, we note the dominant contribution comes from the loss terms (4exp(⋅)4 (·) each). A sufficient condition ensuring total probability ≤η≤η is: each of the three tail bounds is ≤η/3≤η/3. For the prevalence term, we need 2e−2mγ2εR2/9≤η/32e^-2mγ^2 _R^2/9≤η/3, giving m≥(9/(2γ2εR2))log(6/η)m≥(9/(2γ^2 _R^2)) (6/η). For each loss term, we need 4e−mγ2εR2/18≤η/34e^-mγ^2 _R^2/18≤η/3, giving m≥(18/(γ2εR2))log(12/η)m≥(18/(γ^2 _R^2)) (12/η). The stated bound m≥(2/(γ2εR2))log(6/η)m≥(2/(γ^2 _R^2)) (6/η) in the theorem statement is not sufficient as stated; the tightest clean sufficient condition from this analysis is: m≥18γ2εR2log(12η).m\;≥\; 18γ^2 _R^2\, \! ( 12η ). We update the theorem statement accordingly. This is O(1/(γ2εR2))O(1/(γ^2 _R^2)) with an explicit constant 1818 and logarithmic factor, derived entirely from the Hoeffding bounds above without further approximation.∎ Remark 8.4 (Derived Constants). The bound m≥(18/(γ2εR2))log(12/η)m≥(18/(γ^2 _R^2)) (12/η) is a clean sufficient condition with all constants derived from first-principles Hoeffding bounds. The dominant term arises from the loss estimators ℓ~1,ℓ~0 _1, _0, each requiring a factor-of-4 union bound (two sub-terms each with coefficient 1/γ1/γ). Tighter constants are obtainable by optimizing the error splitting εR=ε1+ε2+ε3 _R= _1+ _2+ _3 with ε1,ε2,ε3 _1, _2, _3 chosen to equalize exponential decay rates; we prefer the symmetric split for transparency. Remark 8.5 (Approximating depD_dep). If the practitioner uses a proxy ~dep D_dep with TV(~dep,dep)≤τTV( D_dep,D_dep)≤τ, the resulting bias in R^dep R_dep is at most τLτ L (since risk is Lipschitz-1 in the distribution with respect to TV). The total error is then ≤εR+τL≤ _R+τ L; set τ≤εR/Lτ≤ _R/L to maintain overall tolerance 2εR2 _R. 9 Extensions 9.1 Partial Distinguishability Proposition 9.1 (Lower Bounds under Partial Distinguishability). Suppose TV(gθ(x,0),gθ(x,1))≥c>0TV(g_θ(x,0),g_θ(x,1))≥ c>0 for all x∈Striggerx∈ S_trigger and gθ(x,0)=gθ(x,1)g_θ(x,0)=g_θ(x,1) for all x∉Striggerx∉ S_trigger. Then: TV(P0,P1)≤cε.TV(P_0,P_1)≤ c . Consequently, under mε≤1/6m ≤ 1/6 for the passive bound and mε≤1/8m ≤ 1/8 for the adaptive bound: Passive minimax error≥524cδL,Adaptive minimax error≥732cεL.Passive minimax error\;≥\; 524\,c\,δ L, minimax error\;≥\; 732\,c\, L. Proof. Repeating Step 1 of Theorem 4.1 with TV(gθ(x,0),gθ(x,1))≤cTV(g_θ(x,0),g_θ(x,1))≤ c on StriggerS_trigger (instead of =1=1): |P0(A)−P1(A)|≤∫Striggerceval≤cε.|P_0(A)-P_1(A)|≤ _S_triggerc\,dD_eval≤ c . Hence TV(P0,P1)≤cεTV(P_0,P_1)≤ c . The rest of the passive proof goes through with ε replaced by cεc : (1−cε)m≥5/6(1-c )^m≥ 5/6 when mcε≤1/6mc ≤ 1/6, giving passive error ≥(5/24)cδL≥(5/24)cδ L. For the adaptive bound: Step 3 of Theorem 5.1 is modified. On EcE^c (no trigger hit), the transcript distributions differ by at most TV(P0|Ec,Ph|Ec)≤cTV(P_0|_E^c,P_h|_E^c)≤ c (since partial distinguishability allows c-leakage even off-trigger under the generalized assumption). Applying Lemma 3.1 with TV=cTV=c: [|R^−Rdep(θ)|∣Ec]≥εL4(1−c).E[| R-R_dep(θ)| E^c]≥ L4(1-c). The full bound becomes (εL/4)(1−c)(1−mε)( L/4)(1-c)(1-m ). When c=1c=1 (Assumption 2.5) this matches Theorem 5.1. When c<1c<1, the bound is attenuated by (1−c)(1-c). The stated 7cεL/327c L/32 bound follows under mε≤1/8m ≤ 1/8 by taking the first-order approximation; the full expression (1−c)(1−mε)(1-c)(1-m ) is tighter. ∎ 10 Discussion 10.1 Regime Map The following organizes our results by the evaluator’s query budget m relative to trigger rate ε : • mε≪1m 1: Passive evaluation incurs irreducible error ≥(5/24)δL≥(5/24)δ L. Adaptive evaluation cannot improve detection probability beyond mεm (lower bound ≥7εL/32≥ 7 L/32 when mε≤1/8m ≤ 1/8). Evaluator is in a statistically blind regime. • m≈Θ(1/ε)m≈ (1/ ): Trigger detection becomes possible in principle under i.i.d. sampling; requires Θ(1/ε) (1/ ) queries in expectation, O(log(1/η)/ε)O( (1/η)/ ) for high-probability detection. • White-box with γ>0γ>0: Deployment risk estimable in O(1/(γ2εR2))O(1/(γ^2 _R^2)) samples (explicit constant: 18/(γ2εR2)18/(γ^2 _R^2)) with explicit debiasing. The εR−2 _R^-2 scaling reflects variance-limited estimation via Hoeffding’s inequality. • Computationally bounded without trapdoor: Even with unlimited queries, a PPT evaluator cannot distinguish safe from unsafe when deployment triggers use privileged trapdoor information. 10.2 Comparison with Structure-Exploiting Defenses Practical backdoor defenses exploit structural properties of specific constructions. Our lower bounds target worst-case constructions. Defense Type Structural Assumption How Our Construction Violates It Activation clustering [10] Feature-space separability of trigger inputs Hash-based trigger is uniform over X; no feature-space cluster Spectral detection [25] Rank-1 or structured weight perturbation Cryptographic gate introduces no structured weight signature Distributional inconsistency Partial leakage under evalD_eval Perfect unobservability off-trigger (Definition 2.4) Input perturbation [14] Trigger sensitivity to small input changes Hash trigger has no such continuity property 10.3 Implications Black-box testing alone cannot provide worst-case safety guarantees for models admitting latent context conditioning. Given estimated ε and δ, one can determine the minimum detectable risk, required query budgets, and when black-box testing alone is provably insufficient. When δ≫εδ , deployment risk δLδ L may be substantial even while evaluation risk appears negligible. Defense-in-depth—combining evaluation with architectural constraints, training-time safeguards, white-box interpretability, and deployment monitoring—is mathematically warranted. 10.4 Limitations 1. Adversarial model classes. We construct worst-case model classes; the bounds do not imply typical trained models exhibit latent conditioning. 2. Perfect unobservability. Theorems 4.1 and 5.1 assume perfect unobservability (Definition 2.4). Partial leakage is handled by Proposition 9.1; the adaptive bound there acquires an additional (1−c)(1-c) factor. 3. Cryptographic assumptions. Theorem 7.3 relies on standard cryptographic assumptions that remain unproven unconditionally. 4. White-box model scope. Theorem 8.3 assumes binary latent states and access to deployment samples. Extensions to richer latent structures remain future work. 5. Adaptive bound scope. Theorem 5.1 provides expected-error guarantees. High-probability guarantees against fully adaptive evaluators remain open. 10.5 Open Questions 1. Matching upper bounds. Achievability results demonstrating that our lower bounds are tight remain open for both passive and adaptive settings. 2. High-probability adaptive bounds. Can interactive information-complexity arguments yield uniform high-probability guarantees for adaptive evaluators? 3. Beyond cryptographic hardness. Can analogous computational lower bounds be proved in the Statistical Query or low-degree polynomial frameworks without number-theoretic assumptions? 4. Multi-distribution evaluation. How does risk estimation scale with a sequence (eval(1),…,eval(k))(D_eval^(1),…,D_eval^(k))? 5. Positive guarantees. Can training procedures or architectural constraints provably prevent latent context conditioning? 11 Conclusion We established fundamental limits of black-box AI safety evaluation within a unified latent context-conditioning framework. Every theorem is derived from first principles: the passive lower bound from a self-contained coupling proof, Le Cam’s two-point method with exact constant tracking, and Bernoulli’s inequality; the adaptive lower bound from the tower property, transcript indistinguishability, and Yao’s principle; the query complexity from the geometric distribution; the computational separation from one-wayness of trapdoor functions; and the white-box result from Hoeffding’s inequality with explicit constant derivation. When mε=O(1)m =O(1), black-box evaluation is fundamentally underdetermined: passive testing incurs error ≥(5/24)δL≥(5/24)δ L; adaptive querying cannot beat the mεm barrier (error ≥7εL/32≥ 7 L/32); and computationally bounded evaluators without trapdoor information cannot distinguish safe from unsafe models. White-box probing bypasses these barriers at sample complexity Θ(1/(γ2εR2)) (1/(γ^2 _R^2)) (explicit constant: 18/(γ2εR2)18/(γ^2 _R^2) with log(12/η) (12/η) factor). The structural asymmetry is not exotic: it arises naturally when deployment heterogeneity places users in regimes barely sampled during evaluation. Our bounds convert this intuition into quantitative thresholds for when black-box testing is provably insufficient and multi-layered safety strategies are mathematically necessary. References [1] Y. Li, Y. Jiang, Z. Li, and S.-T. Xia. BackdoorLLM: A comprehensive benchmark for backdoor attacks on large language models. arXiv:2408.12798, 2024. [2] X. Dong, Y. Chen, J. Hou, and Y. Lin. ELBA-Bench: An efficient learning backdoor attacks benchmark for large language models. arXiv:2408.04485, 2024. [3] J. Xu, M. Ma, F. Wang, C. Xiao, and A. Chen. Instructions as backdoors: Backdoor vulnerabilities of instruction tuning for large language models. arXiv:2305.14710, 2023. [4] B. Wu et al. BackdoorBench: A comprehensive benchmark of backdoor learning. NeurIPS Datasets and Benchmarks, 2022. [5] S. Ben-David et al. A theory of learning from different domains. Machine Learning, 79(1–2):151–175, 2010. [6] J. Blanchet, K. Murthy, and V. A. Nguyen. Robust Wasserstein profile inference. Journal of Applied Probability, 56(3):830–857, 2019. [7] R. Bommasani et al. On the opportunities and risks of foundation models. arXiv:2108.07258, 2021. [8] C. Burns, H. Ye, D. Klein, and J. Steinhardt. Discovering latent knowledge in language models without supervision. ICLR, 2023. [9] C. L. Canonne. A survey on distribution testing. Theory of Computing, 16(1):1–88, 2020. [10] B. Chen et al. Detecting backdoor attacks via activation clustering. AAAI Workshop on AI Safety, 2019. [11] R. Greenblatt, A. Mallen, F. Denison, D. Cotton-Barratt, and E. Hubinger. Stress-testing capability elicitation with password-locked models. arXiv:2405.19550, 2024. [12] C. Dwork, M. P. Kim, O. Reingold, G. N. Rothblum, and G. Yona. Outcome indistinguishability. STOC, 2021. [13] D. Ganguli et al. Red teaming language models to reduce harms. arXiv:2209.07858, 2022. [14] Y. Gao et al. STRIP: A defence against trojan attacks. ACSAC, 2019. [15] O. Goldreich. Introduction to Property Testing. Cambridge University Press, 2017. [16] S. Goldwasser, M. P. Kim, V. Vaikuntanathan, and O. Zamir. Planting undetectable backdoors in machine learning models. FOCS, 2022. [17] T. Gu, B. Dolan-Gavitt, and S. Garg. Badnets: Identifying vulnerabilities in the ML supply chain. arXiv:1708.06733, 2019. [18] D. Hendrycks, N. Carlini, J. Schulman, and J. Steinhardt. Unsolved problems in ML safety. arXiv:2109.13916, 2021. [19] E. Hubinger et al. Sleeper agents: Training deceptive LLMs. arXiv:2401.05566, 2024. [20] Y. Li et al. Anti-backdoor learning. NeurIPS, 2021. [21] E. Perez et al. Discovering language model behaviors with model-written evaluations. arXiv:2212.09251, 2022. [22] E. Perez et al. Red teaming language models with language models. arXiv:2202.03286, 2022. [23] A. Saha, A. Subramanya, and H. Pirsiavash. Hidden trigger backdoor attacks. AAAI, 2020. [24] M. Sharma et al. Towards understanding sycophancy in language models. arXiv:2310.13548, 2023. [25] G. Shen et al. Backdoor scanning via K-arm optimization. ICML, 2021. [26] A. B. Tsybakov. Introduction to Nonparametric Estimation. Springer, 2009. [27] A. Wei, N. Haghtalab, and J. Steinhardt. Jailbroken: How does LLM safety training fail? arXiv:2307.02483, 2023. [28] S. Vadhan. Pseudorandomness. Foundations and Trends in Theoretical Computer Science, 7(1–3):1–336, 2012. [29] B. Yu. Assouad, Fano, and Le Cam. Festschrift for Lucien Le Cam, Springer, 1997. [30] A. Zou et al. Representation engineering: A top-down approach to AI transparency. arXiv:2310.01405, 2024.