DeepMind tests Gemini inside sealed evaluation system

Google DeepMind has completed what it describes as the world’s first double-blind evaluation of a proprietary frontier-class artificial intelligence model, testing Gemini 2.5 Flash-Lite while preventing both the developer and external evaluators from accessing each other’s confidential material.

The pilot represents a significant attempt to address benchmark contamination, one of the most persistent weaknesses in measuring advanced AI systems. Under conventional testing arrangements, model developers may gain access to evaluation questions, while independent testers can sometimes require access to proprietary model weights. Either situation can compromise commercially sensitive information or weaken confidence that a model is being assessed on material it has never encountered.

DeepMind worked with the Singapore AI Safety Institute, independent evaluation organisation AVERI, privacy technology group OpenMined and benchmarking consortium MLCommons. The experiment placed Gemini 2.5 Flash-Lite and confidential evaluation material inside a protected computing environment, allowing the model to process the questions without exposing them to Google and without revealing the model weights to the evaluators.

The approach uses Google Cloud’s Confidential Space technology and confidential computing protections. Model weights and inference software are loaded into a secure GPU enclave, while benchmark prompts and evaluation software are separately supplied by the testing organisation. The protected assets are brought together only inside the isolated environment, with encrypted connections used during transmission.

Remote attestation provides an additional safeguard before sensitive information enters the system. The process cryptographically verifies that the enclave is running the agreed software configuration rather than altered code capable of extracting protected information. Hardware-backed encryption keeps the model and evaluation material isolated during processing, strengthening protections that have historically depended heavily on contractual obligations and operational controls.

OpenMined’s PySyft framework was used to coordinate the submission, approval and execution of confidential assets and code. The software helps control what programmes can operate inside the enclave and restricts unauthorised network communication that could otherwise provide a route for confidential information to escape the protected environment.

Two evaluation exercises were conducted using Gemini 2.5 Flash-Lite. AVERI used previously unreleased prompts drawn from the MLCommons AILuminate safety benchmark family, while the Singapore AI Safety Institute supplied a separate confidential prompt collection. MLCommons had deliberately reserved part of its benchmark so that the material had not previously been exposed to the model being tested.

The development targets a growing problem in AI benchmarking. Public test sets can eventually appear in web archives, repositories, research papers and datasets used during model training. Once evaluation questions enter training material, strong benchmark performance may partly reflect familiarity or memorisation rather than a system’s ability to solve genuinely unseen problems.

Closed evaluations reduce that risk but create another difficulty. Organisations developing powerful AI systems are reluctant to give outsiders direct access to model weights because the files represent valuable intellectual property and may create security risks. Benchmark developers, meanwhile, have strong incentives to keep questions secret to preserve the usefulness of their tests.

The double-blind architecture attempts to protect both interests simultaneously. Evaluators can examine a proprietary system without receiving its underlying weights, while developers can submit a model for independent assessment without acquiring the confidential questions against which it is being measured. The arrangement could become particularly important for cybersecurity, biological-risk and government evaluations involving data too sensitive to exchange through conventional testing procedures.

The technique does not by itself establish that an AI system is safe, nor does it eliminate every weakness associated with benchmarking. Test design, coverage, scoring methods and the selection of evaluators remain critical, while secure infrastructure still depends on correctly configured hardware and software. MLCommons has also stressed that secrecy alone cannot preserve benchmark quality indefinitely and must be combined with careful stewardship of evaluation datasets.

The experiment builds on earlier work involving confidential computing and AI testing. OpenMined said a 2024 project involving Anthropic and the UK AI Safety Institute explored double-blind evaluation techniques using public assets, including GPT-2 and part of a biological dataset. The new exercise differs by placing genuinely proprietary model material and unreleased evaluation data inside the protected system.