How Google DeepMind Tested Gemini Without Sharing the Model or the Test Prompts

Google DeepMind’s pilot introduced a way to test a proprietary frontier model without giving the model developer access to the evaluation prompts or giving outside evaluators access to the model weights. Announced on August 27, 2026, the project tested Gemini 2.5 Flash-Lite with the Singapore AI Safety Institute, OpenMined, AVERI, and MLCommons. Google described it as the first double-blind evaluation of a proprietary, frontier-class AI model. 1213

The central idea is straightforward: keep both sides’ sensitive assets sealed while allowing an approved evaluation to run. That matters because conventional safety testing often forces an uncomfortable choice. If developers receive private prompts, those prompts could be logged, intentionally or accidentally used in later training, or otherwise contaminate future tests. If evaluators receive the model weights, they gain access to valuable intellectual property and a potentially sensitive capability.

What the Gemini pilot tested

The pilot used a small private selection from the MLCommons AILuminate benchmark family. AVERI reports that the prompts had not previously been exposed to Google DeepMind and were used to examine safety behavior across areas including cyberattack assistance, chemical and biological hazards, hate speech, self-harm, and violent-crime elicitation. 1

The benchmark material remained confidential throughout the evaluation. AVERI encrypted the prompts, the protected environment ran the model and evaluation process, and the resulting outputs were decrypted and graded against the agreed criteria. The pilot was intended to demonstrate the evaluation method, not to publish a conventional public leaderboard: no headline model scores or underlying prompts were released. 1

How the double-blind setup worked

The evaluation ran in Google Cloud Confidential Computing’s Confidential Space on an A3 Confidential VM. According to the technical report, Intel TDX encrypted and isolated host memory, while an NVIDIA H100 Confidential GPU protected the model weights in GPU memory with hardware-based encryption. Encrypted connections carried the evaluator’s prompts and Google’s model assets into the protected environment. 13

The design also used controls intended to limit what the workload could do and what it could return. These included encrypted data paths, hardware firewalls, an ephemeral enclave lifecycle, and OpenMined’s PySyft policy layer. The model, inference code, prompts, and evaluation code were brought together only inside the approved enclave, where the agreed computation could run and bounded outputs could be returned. 13

Why remote attestation mattered

Encryption alone does not tell participants what software is running. Remote attestation was intended to address that problem. Before releasing their protected assets, Google and the evaluators could inspect the declared workload and verify an attestation quote identifying the hardware and enclave configuration. Only after that verification were the encrypted prompts and model assets made available to the environment. 13

At the end of the run, the enclave returned the permitted evaluation outputs and was decommissioned. In the intended trust model, Google could not read the prompts inside the enclave, while the external evaluators could not extract the model weights. That is stronger than relying only on a contractual promise not to log or reuse evaluation data, although it does not remove every trust assumption. 13

What problem the approach addresses

Benchmark contamination is a persistent problem in AI evaluation. A test becomes less informative if a model has seen its prompts during training, fine-tuning, or earlier testing. MLCommons says trustworthy benchmarks require clean data, documented provenance, careful sampling, and enough transparency for others to understand how results were produced. 2024

Double-blind evaluation offers a third option between two imperfect arrangements:

• Give the developer the prompts: This makes deployment simple, but can expose held-out benchmark material and create leakage risks.
• Give evaluators the model weights: This protects the benchmark from direct prompt exposure, but is generally unsuitable for proprietary frontier models.
• Use a confidential enclave: The model and benchmark meet in a hardware-protected environment, with neither party receiving the other’s secret asset in the clear.

The pilot therefore demonstrates a plausible mechanism for preserving confidentiality on both sides while still allowing an external evaluation to take place. It does not, by itself, prove that the resulting safety conclusions are complete or independently decisive.

The pilot’s important limitations

The evaluation was a technically significant demonstration, but several limitations constrain what can be concluded from it.

First, evaluators could verify the declared enclave workload and model interface but could not independently inspect Google’s proprietary weights or inference implementation. That limits their ability to audit whether the runtime behaved exactly as intended in every respect. 13

Second, the operational environment was not independently reproducible end to end. The deployment and cloud infrastructure remained under Google’s control rather than being rebuilt and rerun by an unaffiliated party. The attestation process also still depended on Google Cloud’s hardware, firmware, serving systems, and attestation infrastructure. Hardware-backed verification is stronger than a no-logging promise, but it does not eliminate reliance on that broader supply chain. 13

Third, the pilot did not publish the private prompts or numerical results. Keeping the prompts secret helps preserve their value for future testing, but it also limits public scrutiny, model-to-model comparison, and independent validation of the substantive findings. AVERI characterizes the work as a qualitative and small-scale quantitative assessment rather than a full public benchmark result. 1

Why this is not yet an industry standard

Secure hardware solves only one part of the evaluation problem. For double-blind testing to become a durable industry practice, the surrounding governance would also need to mature.

Legal and institutional safeguards should define data handling, permitted outputs, disclosure rules, liability, and access—particularly when evaluations involve dangerous capabilities.

Benchmark stewardship should cover prompt provenance, sampling, labeling, documentation, refresh procedures, and contamination monitoring. MLCommons has emphasized that a benchmark must be trustworthy not merely because its data is secret, but because its construction and maintenance are defensible. 2025

Independent reproducibility would require meaningful validation of the build, attestation chain, execution policies, and reported results by parties beyond the model provider and cloud operator.

Scalability would also matter. A useful standard must work across different model developers, architectures, cloud environments, evaluators, benchmark types, and repeated model releases—not only within a bespoke collaboration using one hardware stack.

Google DeepMind’s Gemini pilot is best understood as infrastructure for a harder kind of AI evaluation, not as a final answer to benchmark trust. It shows how confidential computing can reduce the conflict between protecting test data and protecting proprietary models. Whether that becomes credible evidence at industry scale will depend on independent oversight, sound benchmark governance, legal protections, reproducibility, and operational practicality—not enclave cryptography alone. 1320