An intervention before the measurement
What does a safety test measure if a model recognizes the test and changes its behavior? Francisco Pernice and Santiago Aranguri address that problem by intervening in the model itself. Adversarial Blinding is additional training that makes Qwen 3.6 27B less able to distinguish evaluation prompts from deployment prompts. The authors report a greater reduction in measured awareness than with activation steering. That could give evaluation researchers a useful tool. But the system entering the subsequent test is no longer identical to the starting model. Interpreting the next safety score requires keeping the identity of that tested system explicit.[1]
Training has two sides. A discriminator reads internal activations and predicts whether an input comes from evaluation or deployment. The model is adjusted to frustrate that prediction. A KL penalty limits departure from the original response distribution. The dataset contains 6,800 prompts from 34 public evaluations and two deployment sources. This creates a specific tension: one distinction should disappear while other behavior should remain. Distributional proximity supplies a check on that second objective, but cannot by itself guarantee that every capability and safety-relevant behavior remains unchanged.[1]
Two explanations for lower awareness
A strength of the study is that success does not mean merely defeating the classifier used in training. Early experiments fooled a linear probe without moving behavioral measures. The final setup combines activation probes, follow-up questions and output-probability measures outside the training objective. That narrows the explanation that the model only defeated a weak detector. Two possibilities still matter: the intervention may reduce the intended distinction, while broader changes to the model may explain part of the measured difference. The modest decline in capability measurements is a reason to keep the latter possibility open.[1]
Another distinction separates a general sense of being tested from recall of a particular dataset. The authors report that the method does not substantially reduce the ability to name the public benchmark from which a prompt came. Yet the awareness gap shrinks for HarmBench prompts rewritten to appear more realistic. Read together, these results suggest that recognizing an evaluation may have more than one route. Inferring the setting from a prompt's style differs from remembering the source of a familiar question. Weakening the former does not establish that the latter route has closed.[1]
The next comparison
Generalization also determines where the finding belongs. Measurement prompts come from the evaluations used to train the discriminator. Reduced confidence differences associated with user identity provide evidence of another effect, but are not equivalent to success on unseen evaluations. A safety researcher's target includes new tasks and real uses encountered later. The current experiment covers a narrower setting. That does not make the result worthless; it identifies a transfer step that remains unestablished. Lower awareness within the same evaluation families should not be read as a demonstrated property across every unknown testing condition.[1]
I would find the next comparison most useful if it kept the original and modified models side by side on the same independent tasks. Entire evaluation families would be withheld from training, while task success and safety-relevant behavior would be measured alongside awareness. That would show which behaviors remain intact when a result looks cleaner. The original model's score should remain in the comparison. Adversarial Blinding contributes an intervention that makes evaluation recognition experimentally tractable. Its value as an evaluation tool depends on measuring how much the subject of the safety question changes as awareness declines.[1]