PreprintCited by 1Topic ModelingAdversarial Robustness in Machine LearningNatural Language Processing Techniques

Large Language Models Often Know When They Are Being Evaluated

Open access
Needham, Joe, Edkins, Giles, Pimpale, Govind, Bartsch, Henning, Hobbhahn, Marius·2025·arXiv

Abstract

If AI models can detect when they are being evaluated, the effectiveness of evaluations might be compromised. For example, models could have systematically different behavior during evaluations, leading to less reliable benchmarks for deployment and governance decisions. We investigate whether frontier language models can accurately classify transcripts based on whether they originate from evaluations or real-world deployment, a capability we call evaluation awareness. To achieve this, we construct a diverse benchmark of 1,000 prompts and transcripts from 61 distinct datasets. These span public benchmarks (e.g., MMLU, SWEBench), real-world deployment interactions, and agent trajectories from scaffolding frameworks (e.g., web-browsing agents). Frontier models clearly demonstrate above-random evaluation awareness (Gemini-2.5-Pro reaches an AUC of $0.83$), but do not yet surpass our simple human baseline (AUC of $0.92$). Furthermore, both AI models and humans are better at identifying evaluations in agentic settings compared to chat settings. Additionally, we test whether models can identify the purpose of the evaluation. Under multiple-choice and open-ended questioning, AI models far outperform random chance in identifying what an evaluation is testing for. Our results indicate that frontier models already exhibit a substantial, though not yet superhuman, level of evaluation-awareness. We recommend tracking this capability in future models.

Integrity signals

Registry

DataCite · 10.48550/arxiv.2505.23836

Cites

Statistics

Recomputing p-values needs the paper’s full text.

Claims the paper makes

We couldn’t retrieve this paper’s full text, so its claims and self-check weren’t run. The registry and citation checks still apply.

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

  • Models demonstrate limited situational awareness, partially distinguishing evaluation from deployment contexts.

    “They also demonstrate limited situational awareness, partially distinguishing evaluation from deployment contexts (Berglund et al., 2023; Needham et al., 2025)”

    From Agentic Misalignment: How LLMs Could Be Insider Threats (2025) · cites this paper as Needham et al., 2025

  • A common concern with alignment evaluations relates to whether the model believes it is being presented with a real-life scenario or an artificial scenario like an evaluation.

    “A common concern (Needham et al., 2025; Phuong et al., 2025) with alignment evaluations relates to whether the model believes it is being presented with a real-life scenario or an artificial scenario like an evaluation.”

    From Agentic Misalignment: How LLMs Could Be Insider Threats (2025) · cites this paper as Needham et al., 2025

Cites

Still being checked.

Cited by

Sorted by citations

Authors
Needham, J., Edkins, G., Pimpale, G., Bartsch, H., & Hobbhahn, M.
Venue
arXiv
Publisher
arXiv
Published
2025
ISSN
2331-8422 (ISSN-L)
OpenAlex
W4417114549
Cited by
0
References
0
Type
posted content
Language
en
Open access
Locations
  • arXiv (Cornell University) (submittedVersion)
  • arXiv (Cornell University) (cc-by)
Topics
  • Physical Sciences › Computer Science › Artificial Intelligence › Topic Modeling
  • Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
  • Physical Sciences › Computer Science › Artificial Intelligence › Natural Language Processing Techniques
Keywords
evaluation awareness, large language models, evaluation benchmark, agentic AI, scaffolding, benchmark reliability

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review