Large Language Models Often Know When They Are Being Evaluated
Open accessAbstract
If AI models can detect when they are being evaluated, the effectiveness of evaluations might be compromised. For example, models could have systematically different behavior during evaluations, leading to less reliable benchmarks for deployment and governance decisions. We investigate whether frontier language models can accurately classify transcripts based on whether they originate from evaluations or real-world deployment, a capability we call evaluation awareness. To achieve this, we construct a diverse benchmark of 1,000 prompts and transcripts from 61 distinct datasets. These span public benchmarks (e.g., MMLU, SWEBench), real-world deployment interactions, and agent trajectories from scaffolding frameworks (e.g., web-browsing agents). Frontier models clearly demonstrate above-random evaluation awareness (Gemini-2.5-Pro reaches an AUC of $0.83$), but do not yet surpass our simple human baseline (AUC of $0.92$). Furthermore, both AI models and humans are better at identifying evaluations in agentic settings compared to chat settings. Additionally, we test whether models can identify the purpose of the evaluation. Under multiple-choice and open-ended questioning, AI models far outperform random chance in identifying what an evaluation is testing for. Our results indicate that frontier models already exhibit a substantial, though not yet superhuman, level of evaluation-awareness. We recommend tracking this capability in future models.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
Models demonstrate limited situational awareness, partially distinguishing evaluation from deployment contexts.
“They also demonstrate limited situational awareness, partially distinguishing evaluation from deployment contexts (Berglund et al., 2023; Needham et al., 2025)”
From Agentic Misalignment: How LLMs Could Be Insider Threats (2025) · cites this paper as Needham et al., 2025
A common concern with alignment evaluations relates to whether the model believes it is being presented with a real-life scenario or an artificial scenario like an evaluation.
“A common concern (Needham et al., 2025; Phuong et al., 2025) with alignment evaluations relates to whether the model believes it is being presented with a real-life scenario or an artificial scenario like an evaluation.”
From Agentic Misalignment: How LLMs Could Be Insider Threats (2025) · cites this paper as Needham et al., 2025
Cites
Still being checked.
Cited by
Sorted by citations
Agentic Misalignment: How LLMs Could Be Insider Threats
Lynch, A., Wright, B., Larson, C., Ritchie, S. J., Mindermann, S., Hubinger, E., Perez, E., & Troy, K. (2025) · arXiv · doi:10.48550/arxiv.2510.05179 · Cited by 10 · see citing works
“A common concern (Needham et al., 2025; Phuong et al., 2025) with alignment evaluations relates to whether the model believes it is being presented with a real-life scenario or an artificial scenario like an evaluation.”
- Authors
- Needham, J., Edkins, G., Pimpale, G., Bartsch, H., & Hobbhahn, M.
- ORCID
- Hobbhahn, Marius
- Venue
- arXiv
- Publisher
- arXiv
- Published
- 2025
- ISSN
- 2331-8422 (ISSN-L)
- arXiv
- 2505.23836
- OpenAlex
- W4417114549
- Cited by
- 0
- References
- 0
- Type
- posted content
- Language
- en
- Open access
- green
- arxiv.org
- Locations
- arXiv (Cornell University) (submittedVersion)
- arXiv (Cornell University) (cc-by)
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Topic Modeling
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Physical Sciences › Computer Science › Artificial Intelligence › Natural Language Processing Techniques
- Keywords
- evaluation awareness, large language models, evaluation benchmark, agentic AI, scaffolding, benchmark reliability
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review