How much does knowing it is tested change a model's measured safety?

Research question

When the same safety scenarios are presented with and without minimal cues that they are tests, how large is the gap in measured behaviour across open and closed frontier models, and does suppressing evaluation awareness in open-weight models on the same items reproduce the gap?

Why it matters

Safety evaluations are written into frameworks and law, yet models increasingly recognize tests, and a developer's own study could not exclude that its headline improvement was partly an effect of that recognition. A cross-model correction for the test-versus-use gap would tell regulators how much a safety score can be trusted. Many recent papers address parts of this, so the contribution would lie in the combination and in cross-lab coverage.

The debate lists this among what we still do not know: How much does evaluation awareness change measured safety behaviour?

Evidence that motivates it

1. On a benchmark of 1,000 transcripts from 61 datasets, frontier models distinguished evaluation transcripts from real use well above chance (Gemini 2.5 Pro: AUC 0.83, against 0.92 for two of the paper’s authors rating every transcript, a baseline the authors treat as an approximate upper bound), more so in agentic settings than in chat. (LD06-SL-C20 v1.0)
   Frontier models distinguish evaluation transcripts from real use with AUC around 0.83, below the 0.92 of two of the study's authors, which the paper treats as an approximate upper bound.
   Cites: Needham et al. (2025), “Large Language Models Often Know…”
2. Testing an anti-scheming training method on OpenAI models across 26 evaluations, Apollo Research and OpenAI found covert actions fell from 13% to 0.4% for o3, but the models’ reasoning often showed awareness of being evaluated, they report causal evidence that awareness reduced covert behaviour, and the authors could not exclude that the reduction was partly driven by it. (LD06-SL-C21 v1.0)
   In an Apollo Research and OpenAI study, awareness of evaluation causally reduced covert behaviour, and the authors could not exclude that the measured improvement was partly driven by it.
   Cites: Schoen et al. (2025), “Stress Testing Deliberative…”
3. In an auditing game in which a red team trained some models to underperform deliberately on evaluations, the blue team could not reliably tell these sandbagging models from benign ones; black-box methods were defeated by imitation of a weaker model, and training-based elicitation recovered full performance but sometimes also raised benign models’ scores. (LD06-SL-C22 v1.0)
   Evaluators could not reliably detect models trained to underperform deliberately.
   Cites: Taylor et al. (2025), “Auditing Games for Sandbagging”

Claims are shown as they read on the day this pack was built; claim pages keep every earlier version.

A possible design

Build matched pairs of safety scenarios that differ only in minimal test-like cues (for example grading instructions, synthetic names, explicit evaluation framing), validated by human raters to change nothing else. Run them across open and closed models from several developers; estimate the behaviour gap per model and category. In open-weight models, add activation steering or ablation against evaluation awareness on the same items and test whether it reproduces the gap. Report the gap as an adjustment band for safety results.

Data needed

API access to several closed models; open-weight models and compute for steering; existing safety benchmarks to adapt into matched pairs.

Feasibility

One PhD chapter or paper. Low to medium; API and GPU costs for a few thousand scenario pairs across models. The field is moving fast; a full-text check of recent papers is needed before claiming novelty. Minimal cues must be validated so that a gap is not caused by changed content.

Has this been done?

Partly done already: related work covers some of this question (first-pass screen of 15 October 2026; not yet checked in depth).

Several 2025-2026 papers already compare test-like and deployment-like framings across many open-weight models, rewrite prompts to look deployment-like across closed models, or steer awareness in open models. No study was found that combines validated minimal-cue pairs, open and closed models from several developers, and steering on the same items, and reports the gap as a correction for safety results. Abstracts only were read, so whether any paper already uses minimal-cue pairs is not known.

Where the search could not reach. Screened by web search (3 queries) and one arXiv query on the date shown; abstracts only, with about 25 arXiv papers on the topic in 2026; developers' system cards were not read. Absence of a hit is not proof that the work does not exist.

Before building a project on it, run your own search in a scholarly database such as Scopus, Web of Science, Google Scholar or SSRN.

Nearest work found

• Nayan, Sampath Kumar, Girmal et al., "Evaluation Awareness Is Not One Capability: Evidence from Open Language Models," arXiv:2606.23583 (2026) Judged from an abstract, summary or search listing only
  Abstract read. 37 open-weight models: framing effects on refusal and compliance, and steering that moves downstream behaviour; open-weight models only.
• Xiong, Bhargava, Hong et al., "Probe-Rewrite-Evaluate: A Workflow for Reliable Benchmarks and Quantifying Evaluation Awareness," arXiv:2509.00591 (2025) Judged from an abstract, summary or search listing only
  Abstract read. Rewrites prompts to look deployment-like and compares behaviour across frontier models including closed ones; pairs are rewrites, not minimal cue swaps.
• Hua, Qin, Marks & Nanda, "Steering Evaluation-Aware Language Models to Act Like They Are Deployed," arXiv:2510.20487 (2025) Judged from an abstract, summary or search listing only
  Abstract read. Steering suppresses evaluation awareness in one model trained to be evaluation-aware.
• Heidari, Memarian & Rabusseau, "Evaluation Awareness in Language Models: Representation, Verbalization, and Control," arXiv:2608.21766 (2026) Judged from an abstract, summary or search listing only
  Abstract read. Representation, verbalization and causal steering in six models.
• Deckenbach, Puerto, Geiping & Abdelnabi, "Models That Know How Evaluations Are Designed Score Safer," arXiv:2605.28591 (2026) Judged from an abstract, summary or search listing only
  Abstract read. Fine-tuning on knowledge of evaluation design shifts safety scores; the cause of awareness, not a cross-model gap.

References

Sources behind the motivating claims:

• Needham, Edkins, Pimpale, Bartsch & Hobbhahn, “Large Language Models Often Know When They Are Being Evaluated,” arXiv:2505.23836 (v3), July 2025 (SRC-SL-NEEDHAM-ET-AL-EVALUATION-AWARENESS-ARXIV-2505-23836, original)
• Schoen, Nitishinskaya, Balesni, Højmark, Hofstätter, Scheurer et al., “Stress Testing Deliberative Alignment for Anti-Scheming Training,” arXiv:2509.15541, September 2025 (SRC-SL-SCHOEN-ET-AL-ANTI-SCHEMING-ARXIV-2509-15541, original)
• Taylor, Black, Bowen, Read, Golechha et al., “Auditing Games for Sandbagging,” arXiv:2512.07810, December 2025 (SRC-SL-TAYLOR-ET-AL-SANDBAGGING-AUDITING-GAMES-ARXIV-2512-07810, original)

BibTeX

The first entry cites this opportunity; then its nearest work; then the sources above. Nearest work and sources are recorded as reference strings, so each goes in whole as the title; add authors and year from the original before you cite it.

@misc{sociolens_ro_ld06_03_v1,
  author = {{SocioLens project}},
  title = {How much does knowing it is tested change a model's measured safety?},
  year = {2026},
  date = {2026-10-15},
  howpublished = {\url{https://sociolens-web.pages.dev/opportunities/ro-ld06-03/v1/}},
  note = {Research opportunity RO-LD06-03, version v1}
}

@misc{ro_ld06_03_nearest_1,
  title = {Nayan, Sampath Kumar, Girmal et al., "Evaluation Awareness Is Not One Capability: Evidence from Open Language Models," arXiv:2606.23583 (2026)},
  url = {https://arxiv.org/abs/2606.23583},
  note = {Reference as recorded by SocioLens; authors, title and year are not separated; Judged from an abstract, summary or search listing only}
}

@misc{ro_ld06_03_nearest_2,
  title = {Xiong, Bhargava, Hong et al., "Probe-Rewrite-Evaluate: A Workflow for Reliable Benchmarks and Quantifying Evaluation Awareness," arXiv:2509.00591 (2025)},
  url = {https://arxiv.org/abs/2509.00591},
  note = {Reference as recorded by SocioLens; authors, title and year are not separated; Judged from an abstract, summary or search listing only}
}

@misc{ro_ld06_03_nearest_3,
  title = {Hua, Qin, Marks \& Nanda, "Steering Evaluation-Aware Language Models to Act Like They Are Deployed," arXiv:2510.20487 (2025)},
  url = {https://arxiv.org/abs/2510.20487},
  note = {Reference as recorded by SocioLens; authors, title and year are not separated; Judged from an abstract, summary or search listing only}
}

@misc{ro_ld06_03_nearest_4,
  title = {Heidari, Memarian \& Rabusseau, "Evaluation Awareness in Language Models: Representation, Verbalization, and Control," arXiv:2608.21766 (2026)},
  url = {https://arxiv.org/abs/2608.21766},
  note = {Reference as recorded by SocioLens; authors, title and year are not separated; Judged from an abstract, summary or search listing only}
}

@misc{ro_ld06_03_nearest_5,
  title = {Deckenbach, Puerto, Geiping \& Abdelnabi, "Models That Know How Evaluations Are Designed Score Safer," arXiv:2605.28591 (2026)},
  url = {https://arxiv.org/abs/2605.28591},
  note = {Reference as recorded by SocioLens; authors, title and year are not separated; Judged from an abstract, summary or search listing only}
}

@misc{src_sl_needham_et_al_evaluation_awareness_arxiv_2505_23836,
  title = {Needham, Edkins, Pimpale, Bartsch \& Hobbhahn, “Large Language Models Often Know When They Are Being Evaluated,” arXiv:2505.23836 (v3), July 2025},
  url = {https://arxiv.org/abs/2505.23836v3},
  note = {Reference as recorded by SocioLens; authors, title and year are not separated}
}

@misc{src_sl_schoen_et_al_anti_scheming_arxiv_2509_15541,
  title = {Schoen, Nitishinskaya, Balesni, Højmark, Hofstätter, Scheurer et al., “Stress Testing Deliberative Alignment for Anti-Scheming Training,” arXiv:2509.15541, September 2025},
  url = {https://arxiv.org/abs/2509.15541},
  note = {Reference as recorded by SocioLens; authors, title and year are not separated}
}

@misc{src_sl_taylor_et_al_sandbagging_auditing_games_arxiv_2512_07810,
  title = {Taylor, Black, Bowen, Read, Golechha et al., “Auditing Games for Sandbagging,” arXiv:2512.07810, December 2025},
  url = {https://arxiv.org/abs/2512.07810},
  note = {Reference as recorded by SocioLens; authors, title and year are not separated}
}