mlsanityData to 7 Oct 2026

Probing and Steering Evaluation Awareness of Language Models

arXiv 2507.01786 ↗First posted 2 Jul 2025cs.CL cs.AIcited by 31

Not on the map. Why?

Abstract (arXiv)

Language models can distinguish between testing and deployment phases -- a capability known as evaluation awareness. This has significant safety and policy implications, potentially undermining the reliability of evaluations that are central to AI governance frameworks and voluntary industry commitments. In this paper, we study evaluation awareness in Llama-3.3-70B-Instruct. We show that linear probes can separate real-world evaluation and deployment prompts, suggesting that current models internally represent this distinction. We also find that current safety evaluations are correctly classified by the probes, suggesting that they already appear artificial or inauthentic to models. Our findings underscore the importance of ensuring trustworthy evaluations and understanding deceptive capabilities. More broadly, our work showcases how model internals may be leveraged to support blackbox methods in safety audits, especially for future models more competent at evaluation awareness and deception.

Key facts. Cited by 31 papers in the map (data through 7 Oct 2026). Builds on 37 of its 54 references that are in the map. First posted on arXiv 2 Jul 2025.

Builds on

37 of 54 references.

References · 37

  1. 2021Training Verifiers to Solve Math Word Problemscited by 9,743
  2. 2021TruthfulQA: Measuring How Models Mimic Human Falsehoodscited by 2,919
  3. 2023GPQA: A Graduate-Level Google-Proof Q&A Benchmarkcited by 2,748
  4. 2023Sparse Autoencoders Find Highly Interpretable Features in Language Modelscited by 1,359
  5. 2016Understanding intermediate layers using linear classifier probescited by 1,279
  6. 2023Steering Llama 2 via Contrastive Activation Additioncited by 1,009
  7. 2024Refusal in Language Models Is Mediated by a Single Directioncited by 960
  8. 2023Steering Language Models With Activation Engineeringcited by 824
  9. 2022Discovering Latent Knowledge in Language Models Without Supervisioncited by 733
  10. 2023The Linear Representation Hypothesis and the Geometry of Large Language Modelscited by 679
  11. 2023The Geometry of Truth: Emergent Linear Structure in Large Language Model Representations of True/False Datasetscited by 673
  12. 2024WildChat: 1M ChatGPT Interaction Logs in the Wildcited by 598
25 more
  1. 2024Scaling and evaluating sparse autoencoderscited by 530
  2. 2024Sleeper Agents: Training Deceptive LLMs that Persist Through Safety Trainingcited by 478
  3. 2024AgentHarm: A Benchmark for Measuring Harmfulness of LLM Agentscited by 406
  4. 2024Alignment faking in large language modelscited by 316
  5. 2023Language Models Represent Space and Timecited by 306
  6. 2024Jumping Ahead: Improving Reconstruction Fidelity with JumpReLU Sparse Autoencoderscited by 283
  7. 2024Frontier Models are Capable of In-context Schemingcited by 252
  8. 2019Risks from Learned Optimization in Advanced Machine Learning Systemscited by 250
  9. 2022The Alignment Problem from a Deep Learning Perspectivecited by 246
  10. 2024Not All Language Model Features Are One-Dimensionally Linearcited by 201
  11. 2025Measuring AI Ability to Complete Long Software Taskscited by 142
  12. 2023Taken out of context: On measuring situational awareness in LLMscited by 131
  13. 2024AI Sandbagging: Language Models can Strategically Underperform on Evaluationscited by 131
  14. 2025Large Language Models Often Know When They Are Being Evaluatedcited by 105
  15. 2023Scheming AIs: Will AIs fake alignment during training in order to get power?cited by 90
  16. 2025Tell me about yourself: LLMs are aware of their learned behaviorscited by 86
  17. 2023How to Catch an AI Liar: Lie Detection in Black-Box LLMs by Asking Unrelated Questionscited by 82
  18. 2024Me, Myself, and AI: The Situational Awareness Dataset (SAD) for LLMscited by 78
  19. 2025Detecting Strategic Deception Using Linear Probescited by 65
  20. 2024Sabotage Evaluations for Frontier Modelscited by 45
  21. 2024Obfuscated Activations Bypass LLM Latent-Space Defensescited by 40
  22. 2024Uncovering Deceptive Tendencies in Language Models: A Simulated Company AI Assistantcited by 32
  23. 2025The Hawthorne Effect in Reasoning Models: Evaluating and Steering Test Awarenesscited by 29
  24. 2024Noise Injection Reveals Hidden Capabilities of Sandbagging Language Modelscited by 22
  25. 2024Poser: Unmasking Alignment Faking LLMs by Manipulating Their Internalscited by 13

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2025: 6; 2026: 25.

31 papers.

Sort:

By area:

  1. 2026Locate, Steer, and Improve: A Practical Survey of Actionable Mechanistic Interpretability in Large Language Modelscited by 22
  2. 2025Evaluation Awareness Scales Predictably in Open-Weights Large Language Modelscited by 13
  3. 2025Neural Chameleons: Language Models Can Learn to Hide Their Thoughts from Unseen Activation Monitorscited by 7
  4. 2025The Impact of Off-Policy Training Data on Probe Generalisationcited by 6
  5. 2026When Do LLM Preferences Predict Downstream Behavior?cited by 5
  6. 2026Evaluation Awareness in Language Models Has Limited Effect on Behaviourcited by 5
  7. 2026Consistency Training while Mitigating Obfuscation via Rate Matchingcited by 4
  8. 2026REDAgentBench: Executable Red Teaming and Faithful Measurement of LLM Agent Systemscited by 4
  9. 2025Interaction Protocol Shapes Moral Judgment in Multi-Agent Debatecited by 2
  10. 2026Is Evaluation Awareness Just Format Sensitivity? Limitations of Probe-Based Evidence under Controlled Prompt Structurecited by 2
  11. 2026Your AI Travel Agent Would Book You a Bullfight: An Agentic Benchmark for Implicit Animal Welfare in Frontier AI Modelscited by 2
  12. 2026Routing Subspaces: Auditing Evaluation-to-Deployment Mismatch in Fine-Tuned Language Modelscited by 2
19 more
  1. 2025The Riddle of Reflection: Evaluating Reasoning and Self-Awareness in Multilingual LLMs using Indian Riddlescited by 1
  2. 2026Why Safety Probes Catch Liars But Miss Fanaticscited by 1
  3. 2026When No Benchmark Exists: Validating Comparative LLM Safety Scoring Without Ground-Truth Labelscited by 1
  4. 2026Generalization Hacking: Models Can Game Reinforcement Learning by Preventing Behavioral Generalizationcited by 1
  5. 2026Evaluation Awareness Is Not One Capability: Evidence from Open Language Modelscited by 1
  6. 2026Representational Depth of Evaluation Awareness Shifts With Scale in Open-Weight Language Modelscited by 1
  7. 2026Evaluation Awareness in Language Models: Representation, Verbalization, and Controlcited by 1
  8. 2025Red-teaming Activation Probes using Prompted LLMscited by 0
  9. 2026When Evaluation Becomes a Side Channel: Regime Leakage and Structural Mitigations for Alignment Assessmentcited by 0
  10. 2026Option-Order Randomisation Reveals a Distributional Position Attractor in Prompted Sandbaggingcited by 0
  11. 2026Sycophancy Towards Researchers Drives Performative Misalignmentcited by 0
  12. 2026Defeat Devices in AI Systemscited by 0
  13. 2026Moral Safety in LLMs: Exposing Performative Compliance with Puzzled Cuescited by 0
  14. 2026Traccia: An OpenTelemetry-Based Governance Platform for AI Systemscited by 0
  15. 2026Minimizing Targeted Activations: Input-Only Suppression of Evaluation-Awareness Latents in Large Language Modelscited by 0
  16. 2026A Probe Direction Is a Property of Its Promptcited by 0
  17. 2026EvalDetectBench: A Benchmark for Measuring Evaluation Awareness in Frontier Language Modelscited by 0
  18. 2026Norms at a Price: Why RL-Based Alignment Can Promise Conditional Compliance at Bestcited by 0
  19. 2026Evaluation Awareness Shifts from Format to Context with Model Scalecited by 0