Test AI double-blind with cryptography to prevent benchmark contamination

Google DeepMind introduces double-blind AI evaluations with encryption

Google DeepMind has implemented a double-blind evaluation system for proprietary AI models, using a cryptographically protected environment to keep both the model and the evaluation questions mutually hidden. This pilot method, carried out in collaboration with the Singapore AI Safety Institute, OpenMined, AVERI, and MLCommons, represents a significant step towards more reliable and transparent evaluations of AI model capabilities.

Quick Answer

The problem of benchmark contamination

Benchmark contamination is a growing issue in AI model testing. When a model or its developer has access to test questions before evaluation, a high score might simply reflect familiarity with the benchmark rather than the model's actual capabilities. Traditionally, safeguards like zero-logging policies and contractual restrictions have helped keep evaluation questions confidential, but cryptographic safeguards can add an extra layer of protection.

Technological architecture of double-blind evaluation

The system uses Google Cloud’s Confidential Computing technology to place the model and evaluation data within a protected environment. The evaluator cannot access Google’s model parameters, while Google cannot access the evaluator’s test questions. The pilot was run on a Google Cloud A3 Confidential VM, using Intel TDX host memory encryption and an NVIDIA H100 Confidential GPU. Hardware encryption and remote attestation were used to keep benchmark prompts and model parameters isolated while simultaneously verifying the software environment.

This approach is designed to reduce a long-standing compromise in external evaluations of AI models: in the past, evaluators had to choose between providing sensitive test material to model developers or asking companies to expose proprietary model parameters. Google DeepMind states that this method could be particularly useful for sensitive evaluations involving cybersecurity and government bodies.

Evaluation of Gemini 2.5 Flash Lite

The project involved AVERI, which evaluated Gemini 2.5 Flash Lite using confidential prompts from MLCommons’ AILuminate security benchmark. This benchmark covers critical areas such as cyberattacks, chemical and biological hazards, hate speech, self-harm, and the elicitation of violent crimes. Separately, the Singapore AI Safety Institute tested the model using confidential prompts focused on harmful content in the context of Singapore.

Limitations and future considerations

Despite the progress, the pilot leaves some questions unanswered. Notably, Gemini 2.5 Flash Lite scores or a detailed task-by-task analysis of the results were not published. The technical report acknowledges several limitations, including the inability to fully inspect some proprietary inference codes and the need to rely on Google for attestation verification. MLCommons also warned that technical secrecy alone is not sufficient; legal protections and careful benchmark management are necessary.

Implications for the AI industry

The greater significance of this experiment does not lie in the scores Gemini achieved on a security benchmark, but in the ability for AI companies to demonstrate that their benchmark results were obtained fairly, without influence from evaluators or developers. This distinction could become increasingly important as benchmark scores influence decisions by regulators, researchers, and companies.

For IT leaders evaluating vendor claims, this method could eventually provide stronger evidence that AI models were tested against independent, previously unseen benchmarks. However, until the process becomes independently reproducible and detailed results are released, buyers should still question who provided the benchmark, who evaluated the results, what conclusions were disclosed, and which parts of the system require trust in the model provider.

Towards an industry standard

For double-blind testing to become a significant industry standard, the process will need to be independently reproducible, transparent in methodology, and scalable across models and benchmarks. Without these elements, the industry could end up with safer tests without necessarily achieving more reliable results.

This development comes as Google is restricting the release of specialized models like Gemini 3.5 Flash Cyber, underscoring the importance for companies to examine independent performance proofs and test checks before adopting specialized AI models.