The paper demonstrates that a host neural network can conceal an arbitrary computation by embedding an encrypted sub‑network within its weights, which is decrypted and executed only when a secret trigger is presented. Using digital‑locker constructions, the hidden circuit remains computationally infeasible to elicit or interpret even when an auditor has full access to the model parameters, relying on standard cryptographic hardness assumptions. This extends prior work that could hide only fixed strings to the hiding of any programmable computation. The authors implement a proof‑of‑concept in PyTorch and test the robustness of the hidden capability against several elicitation techniques—fine‑tuning, weight noise injection, gradient‑based trigger search, and latent adversarial training—on a small chemical‑reaction prediction task that serves as a proxy for CBRN‑relevant behaviors. Empirical results show that none of these methods succeed in revealing the hidden function, confirming the theoretical resistance. Together with the cryptographic guarantees, the findings indicate a fundamental limitation of elicitation‑based capability audits. The trained models and code are released to facilitate the development of stronger defensive measures.