The BaseResearchLessWrong
Training Away the Ability to Tell Evals from Deployment
Francisco Pernice and Santiago Aranguri describe Adversarial Blinding, a fine-tuning step meant to stop a model telling evaluations from deployment. On Qwen 3.6 27B they report it cuts measured eval awareness more than activation steering, at a small capability cost.
Why it matters
The same thing, for different readers.
What it means for you
If AI models can tell when they are being tested, safety tests may say little about real use; Pernice and Aranguri test one way to reduce that.
For lawmakers
Regulators relying on pre-release testing have reason to ask how labs know models behave the same under test as in deployment.
For researchers
The method beat steering on three monitors for one open model, but was tested on evals it trained on, and benchmark recall was not reduced.
The question it raises
Training a model to be unable to tell test from reality raises the question of whether that is honest evaluation or engineered blindness.
In their own words
Every quotation was found, word for word, in the text we saved from the source. That shows the words are there; it does not make them true, or prove the speaker meant them as quoted.
From the source’s own text.
“Safety evaluations assume that a model behaves the same way during testing as it would in deployment. That assumption is increasingly false.”
“Adversarial Blinding reduces eval awareness more than steering, and does so with a smaller change to the model”
“Neither Adversarial Blinding nor activation steering are able to degrade the eval awareness that comes from benchmark identification, suggesting that there are different kinds of eval awareness.”
How the finding was reached
In our words, from the source. Weigh the finding by how it was made.
- What was done
- Fine-tune Qwen 3.6 27B against a discriminator that reads its activations and tries to tell eval prompts from deployment prompts, with a KL penalty. Compare with activation steering on three eval-awareness monitors, using 6,800 prompts from 34 public evals and two deployment sources.
- What it found
- Every Adversarial Blinding checkpoint scores below the best steered model on eval awareness, with less drift from the original (original model scores 0.27). On rewritten HarmBench prompts the eval-awareness gap shrinks 4x; the user-awareness confidence gap shrinks 3x.
- What it does not show
- Small capability loss; no reduction in recalling which public eval a prompt comes from; measured on the same evals used in training, so generalisation to unseen evals is not shown; one open model.
- Status
- A preprint: not yet peer reviewed
The record
- Questions
- Are AI companies putting stronger safeguards into practice? · Can AI systems act beyond what people intended or allowed?
- People
- Francisco Pernice (Wrote it, Transluce) · Santiago Aranguri (Wrote it, Anthropic)
- What we read
- We read the whole source.
- Found by
- The Radar, run of October 29, 2026, via
lesswrong(tier 1: the source’s own channel or an official record) - Cite this
- LessWrong, “Training Away the Ability to Tell Evals from Deployment”, October 29, 2026. Entry in the Ctrl AI Base, https://ctrlai.com/base/lesswrong-2026-10-29-training-away-eval-awareness