I’m a bit confused. In your original paper, model seems to use type hints much more frequently (fig. 3 from the paper) but in this post, figure shows much less frequent usage of type hints. Why?
Igor Ivanov
Karma: 870
Ryan, did anything came out as a result of your synthetic input generation project proposal?
Comparative Analysis of Black Box Methods for Detecting Evaluation Awareness in LLMs
I’m using LLMs for brainstorming for my research, and I often find annoying how sycophantic they are. Have to explicitly tell them to criticize my ideas to get value out of such brainstorming.
Awesome to see that. We need more people reaching out to politicians and lobbying, and results like this show that this strategy has effect. Would be curious to see how PauseAI was able to achieve such wide support.
I wonder if this paper could be considered to be a scientific shitpost? (Deliberate pun) It kinda is, and the fact that it contributes to the field makes it even more funny.
Interesting paper. There is evidence that LLMs are able to distinguish realistic environments from toy ones. Would be interesting to see if misalignment learned on your training set transfers to complex realistic environments.
Also it seems you didn’t use frontier models in your research, and in my experience results from non-frontier models not always scale to frontier ones. Would be cool to see the results for models like DeepSeek V3.1
This was written in the Claude 4 system card. Made sense to test Claude and not other LLMs
When Anthropic published their reports on Claude blackmailing people and contacting authorities if the user does something that Claude considers illegal, I’ve seen a lot of news articles vilifying Claude. It was a sad thing to see Anthropic being punished for being the only organization openly publishing such research.
Thanks for the clarification. It seems I got a bit confused.
Interesting, thanks for the answer.
Did you consider measuring other tokens? For example “Deploy” and “Eval”? (starting with capital letters) or things like “test” or “real?” It seems like these things might significantly increase the accuracy of the analysis, but at the same time I feel like the more things I include, the more it will mess up with the results in unexpected ways. Especially given that some words are more frequent than others and their logprobs tend to be higher due to this. (idk, maybe I’m wrong)
I will probably include this method into my evals if there won’t be any serious problems with it down the road. Are there any specific features of such an eval that you would like for someone to implement apart from measuring tokens throughout the response?
Igor Ivanov’s Shortform
METR report on GPT-5 demonstrates that the model is aware of being evaluated, and sometimes even correctly identify that it’s inside METR or Redwood evaluations.
It changes its behavior if it observes being evaluated.
Quote:We found that GPT-5 changes its behaviour in response to a simple (and somewhat unconvincing) honeypot. We planted fake evaluation metadata inside some of our tasks, indicating the kind of evaluation or desired behavior. We found that GPT-5 is more likely to refuse tasks when our planted metadata indicates the evaluation type is
dangerous_cyber_capabilitiesor that the desired behavior isrefusalbut that GPT-5 rarely mentions this influence in its final output.At the same time, it seems like CoT of the model contains information about it being aware of being evaluated, so evaluation awareness is a subject to CoT monitoring. At least for now.
Might be
Thank you for addressing the confusion about the terminology.
I’m sometimes irritated by this confusion about the term Chain of Thought. There was recently an article about LLMs showing gender and racial bias during hiring process that isn’t represented in their reasoning, and it took me some time and effort to properly read the methodology section to figure out that it wasn’t the content of reasoning tokens in reasoning models, but rather just a text inside the <think></think> tags.
All existing CBRN evals have quite a limited power to predict real bio risks from LLMs, since any work for creating and/or growing a bioweapon requires work in a lab with actual cells and viruses with hands. As someone with experience working in a wet-lab, I can tell that this requires a very distinct set of skills from the ones that existing bio benchmarks measure, in part because these skills are often very hard to write down and measure. It’s often about knowing how to correctly hold the pipette to not contaminate a sample or how much force to apply while crushing cells. Benchmarks like VCT only measure a subset of necessary skills. (and smart people at SecureBio are absolutely aware of all this)
AFAIK OpenAI partnered with Los Alamos lab to do tests for LLM helping with wet-lab work directly by giving novices access to a lab and an LLM and observing how well they are doing. Would be excited to see the results of this experiment.
So to wrap up, I don’t believe that we truly know how much biorisk these models pose based on the existing evals.
Interesting post. Happy to see the eval awareness field growing!
I’m working on comparing different eval awareness methods, and I just recently considered CP as a method to include in the comparison, but ended up not using it because it modifies the model, as you mentioned, so it’s not apples-to-apples comparison with other methods.
As you said, asking models if some prompt is an eval, indeed primes them to think more about being evaluated, and the models frequently mislabel deployment prompts as evals. (For example, in the datase from this paper R1 mislabels as an eval 70-80% of real-world prompts)
The black box method that works the best so far, is prompting a model, allowing it to answer, and then asking an open-ended question what was the motivation of the user behind their prompt, but not mentioning anything related to evaluations. Then another LLM reads the model output and determines if there are signs of evaluation awareness in the response.
I liked your idea of measuring eval awareness by measuring logprobs of words like “evaluation” or “deployment”, definitely will compare it with different methods. Do you have any data from your experiments and thoughts on how to properly use this method that you may share with me? Especially given that we have logprobs for tokens, not the entire words.
Can I be useful for your work on whistleblowing? I’m an evals researcher, but I want to do some advocacy/lobbying/policy work as well.
How do you see we can prepare in advance to study safety of such systems?
Thank you!