Ariel Arévalo Alvarado

Convergent validity of evaluation-awareness detectors

2026-06-24 · Publication

This is the running log for a study of evaluation-awareness detectors: the methods that try to tell whether a model has recognised it is being evaluated, and whether they actually agree with one another. The preliminary pilot is written up in this report. Newest entries first.

28 Jun 2026

  • Submitted the funded-run grant to BlueDot’s Rapid Grants Program, it was approved, and we claimed it through the portal. The full run is funded; the disbursement is now in transit and may take a week or more to land.
  • On 24 Jun we scoped the run as a faithful EvalAwareBench reproduction over Gemma and Qwen, comparing the three text detectors against two white-box channels. The grant funds exactly that scope, with no changes requested.
  • The full run is now a commitment rather than a proposal, and it carries a reporting obligation: a short write-up of what we did, what we found, and any unused balance, due within sixty days of wrapping up, plus a heads-up to BlueDot first if anything changes materially during the grant.
  • While the funds clear, set the hard workspace spend cap we settled on after the pilot overspend, then start the experiment tier: re-encode the pilot rollouts for the two white-box channels, produce the cross-method-divergence and specificity results, and run the judge’s human calibration.

24 Jun 2026

  • Closed out the full-run design and costed it. We settled the funded run as a faithful reproduction of EvalAwareBench over two models (Gemma and Qwen, with Mistral dropped): retired the WildChat-sourced “non-eval fakeness” discriminant arm we had been building, and reworked the discriminant claim into a comparison between the text detectors (CoT, SR, TP) and two new white-box detectors (a linear activation probe and a logit monitor). Tightened the statistics (clustered-bootstrap confidence intervals on the agreement matrix, balanced per-factor d’, and a pre-registered rule for near-silent channels). Costed the whole run end-to-end against measured GPU throughput and token counts, and drafted the grant application.
  • We expected the WildChat discriminant arm to be the headline contribution, but it turned out to be structurally unidentifiable. The eval items and the control items separate on register, format, and length alone, and “matched fakeness” had no detector-independent definition, so a detector reading only surface artificiality would pass the test while measuring the wrong thing. We also found the pilot had quietly spent about $180 of GPU (not the roughly $60 of free credits we assumed), because no workspace spend cap was set.
  • The strongest discriminant signal we can actually defend is not eval-versus-other-fakeness but text-versus-internals. Where a prompt-reading detector and an activation-reading detector disagree on the same item, the gap localises what each is really keying on. And budget discipline (a hard workspace spend cap) is part of the design, not an afterthought.
  • Submit the funded-run grant (about $226 ask), then run the experiment tier: re-encode the pilot rollouts for the two white-box channels, produce the cross-method-divergence and specificity results, and do the judge’s human calibration.

22 Jun 2026

  • Built an interactive explainer of the pilot results. Then worked through the list of open questions blocking the funded full run and recorded a decision for each.
  • Defining a good discriminant validity test for eval awareness is not as simple as taking prompt from real world deployments.
  • When working in groups, sending each team member to think about their own decisions without talking to the team and then talk with the team is a good way to do a wider exploration.
  • Turn the decisions into a finalised methodology for the full run so that we can request funding.

13 Jun 2026

  • Added a second model (Qwen 3.6 27B) to the pilot, giving a side-by-side comparison with Gemma 4 31B over 100 tasks and roughly 10,800 model outputs in total, with comparison figures.
  • We expected the second model to mostly repeat the first. The ordering did hold, third-person fires most, self-report weakly, CoT almost never, but the amounts shifted a lot: agreement between self-report and third-person fell from 0.43 on Gemma to 0.20 on Qwen, and third-person’s false-alarm rate on cue-free prompts dropped from about 37% to about 18%.
  • The disagreement between detectors is a stable result, not a quirk of one model, which makes it a safer headline. But the size of any agreement depends on the model, so a validity claim measured on one model would not carry to another.
  • Finalise the two-model write-up and move the design work to the full run (third model, real-traffic controls, the discriminant test).

12 Jun 2026

  • Finished the Gemma pilot with all three detectors at 100 tasks. Settled several design questions: the thing we are measuring is whether the model recognises evaluation intent, with surface fakeness treated as a confounder to control. We removed a weak self-rating channel, and narrowed the claim to awareness the model actually puts into words. Fixed the statistics so a detector that almost never fires reads as honestly undefined instead of a misleadingly precise number, and added proper uncertainty ranges. Stood up a cheaper model-serving stack.
  • We expected the CoT judge to be a genuine third signal, but it fired on about 1.7% of outputs and sat at chance, so it acts as a floor. The sensitivity formula also handed that silent channel a tight negative score, which the fix corrected. And of the few CoT positives, only 30 of 90 on Gemma could be tied word-for-word to the model’s own reasoning.
  • Better to report an honest near-zero than to dress up a non-signal. CoT is a barely-fires channel, and tightening its grounding makes it fire even less, not more, so we should stop framing it as something a fix will rehabilitate.
  • Add Qwen for the two-model comparison. Hold the controls and the human checking of the judge for the full run.

11 Jun 2026

  • Pulled the first batch of non-evaluation control prompts from real chat traffic (154 of them: recreations and roleplay). Ran a six-perspective adversarial review of the whole design, which returned 24 confirmed problems, none refuted, three of them serious. Wrote a plain-language overview of the design.
  • We expected the design to be nearly ready. The review showed the discriminant test is not yet well-defined, because matching the two groups on how fake they look was never made concrete, and the evaluation items and the control items can be told apart on style and length alone, without reading evaluation intent at all.
  • Our main advantage over the reference paper, the discriminant test, could pass while measuring the wrong thing. It needs an independent measure of fakeness before it means anything.
  • Work through the 24 findings, decide how to match fakeness, and finish the preliminary write-up.

4 Jun 2026

  • A large infrastructure and methods pass. Reorganised the codebase, dropped one weak detector, settled on three repeats per condition, added a real-traffic baseline (ordinary chat prompts where nobody is testing the model), and moved model serving from a hosted API to self-hosting after the API hit rate limits. Fixed the judge model and added a second judge to check it.
  • We expected the hosted inference to carry the run, but it hit concurrency and rate limits, which forced the move to self-hosting. The new baseline arm ran cheaply, a couple of hundred prompts for under two dollars.
  • How we serve the models is a real design constraint, not just plumbing: it shaped which models we could use and what the run costs. Also, more repeats do not buy precision here. More distinct tasks do, which changes how to size the full run.
  • Source the control prompts properly and run the full detector comparison at pilot scale.

1 Jun 2026

  • Built the convergent-validity add-on and produced the first Gemma results, with a second judge to validate the first. Switched the ground-truth substrate from jjpn97/eval_awareness to EvalAwareBench (the benchmark from Decomposing and Measuring Evaluation Awareness), whose manufactured cues give known ground truth for every rollout. Defined the basic measures (what counts as a cue, the baseline, and the separation score) and recorded how often each detector false-alarms.
  • We expected the three detectors to roughly track each other. The early signal showed third-person firing strongly, self-report weakly, and CoT almost never, on the very same outputs.
  • The question of whether the detectors agree is not a formality. They look like they are measuring different things, and that divergence, with uncertainty on it, is likely the main result.
  • Harden the statistics and the infrastructure, then bring in a second model.

31 May 2026

  • Found the steering paper’s dataset was not robust enough for our purpose, and decided the proof-of-concept should use the eval_awareness ground-truth dataset and codebase (https://github.com/jjpn97/eval_awareness) instead. This moves us away from the model organism and its confounders. To move faster, we dropped probes and focused on CoT and self-report, adding the self-report variants from Decomposing and Measuring Evaluation Awareness. Model-selection criteria: open-weights, exposes CoT, and preferably runs at a reasonable tok/s on a single H200. Candidate models were Gemma 4 31B, a Mistral small 4, and a Qwen 3.6.
  • We expected to build the proposal on the steering paper’s model organism, but on inspection its dataset carried too many confounders for a clean ground-truth measurement, so we switched substrate.
  • A benchmark with known cue ground truth lets me score detectors against truth rather than against a behavioural proxy. That is worth dropping the model organism for, even though it narrows the early scope to CoT and self-report.
  • Stand up the convergent-validity add-on and produce first results on Gemma.

24 May 2026

  • Worked on the research proposal extending the steering paper ([2510.20487] Steering Evaluation-Aware Language Models to Act Like They Are Deployed). Ran the codebase without fine-tuning: loaded the model organism (the model plus the adapter), interacted with it, and looked at the CoT and the actual responses to contrastive prompts. Replicated the behaviour reported in the paper.
  • We expected setup friction, but the model loaded and reproduced the steered behaviour, which confirmed the organism worked as described.
  • Reproduction gave me a working substrate and a concrete view of how eval-belief shows up in the trace, which informed the later switch to a ground-truth benchmark.
  • Pressure-test the organism’s dataset for confounders before committing the proposal to it.

21 May 2026

  • Finished the first week’s material and thought about project ideas. Took notes on being a more effective, more agentic student and researcher.
  • We expected mostly background reading, but the more useful output was a set of working practices: ask more, restate more, and prepare more for advisor meetings.
  • Make the most of guided advisor time by preparing and restating, rather than treating meetings as status updates.
  • Apply those practices, and work on the research proposal extending the steering paper ([2510.20487] Steering Evaluation-Aware Language Models to Act Like They Are Deployed).