Training eliminates the model's ability to distinguish evaluation from deployment

Pernice and Aranguri propose Adversarial Blinding, which before evaluation uses a discriminator to read the model's internal activations to judge whether a prompt comes from an evaluation or real deployment, while training the model to defeat the discriminator, thereby weakening evaluation awareness and making evaluation performance closer to deployment behavior. On Qwen 3.6 27B, this method reduces evaluation awareness by a larger margin than the activation steering baseline on all three monitors—activation probes, follow-up scoring, and logit monitoring—and also has a smaller KL divergence from the original model. After rewriting HarmBench prompts to be closer to real usage, it shrinks the evaluation-awareness gap between the two types of prompts by 4 times, whereas steering instead widens the gap; in experiments where the user is set as a well-known AI safety researcher, it shrinks the confidence gap by 3 times. The cost is some capability degradation on MMLU-Pro, GPQA-Diamond, and AIME 2024–25, and the model's ability to identify which public evaluation a prompt comes from is not weakened; because the measurement prompts are from the same distribution as the evaluations used in training, generalization to unseen evaluations has not yet been verified.