Can AI Models Be Evaluated Without Exposing Prompts 2026

Yes, an AI model can now be evaluated without handing secret test prompts to the model owner or proprietary weights to the evaluator, at least in a real pilot. Google DeepMind put Gemini 2.5 Flash Lite and private benchmark prompts inside one cryptographically verified GPU environment, then let only approved results leave. The raw secure-compute line is about $7.08 per hour at current Iowa Spot rates. The expensive line is people: DeepMind's technical report says legal coordination and code review, not hardware overhead, are now the main bottleneck. That turns confidential evaluation from a trust conversation into an assurance project you can scope and budget.

Yes, but this is a pilot, not a product button

The useful answer is yes with boundaries. Google DeepMind's August 27 pilot shows that an outside organization can test a closed model while keeping two valuable assets apart:

• The evaluator keeps the benchmark prompts, scoring rules, and failure cases secret from the model owner.
• The model owner keeps the model weights and inference code, the core machinery of the model, secret from the evaluator.

Model weights are the learned numbers that encode how a model behaves. A private benchmark is the exam paper. Giving either one away can destroy value. A leaked benchmark can become training material, making later scores look better without the model becoming better. Released weights can expose intellectual property and capabilities that the owner has strong reasons to protect.

Think of the pilot as a sealed examination room with two doors. The model enters through one door. The test enters through the other. Before either side opens its door, both inspect a signed certificate proving which room, locks, and rules are in place. The test runs inside. The room releases an agreed scorecard, then disappears.

The pilot used Google Cloud Confidential Space, an a3-highgpu-1g Confidential VM, Intel TDX memory protection, one NVIDIA H100 80GB Confidential GPU, and OpenMined's PySyft software. A secure enclave is simply that sealed room implemented in hardware: memory is encrypted while the job runs, and a signed attestation lets both parties check what software is inside before they release anything.

This is not general availability. The announcement and technical report describe a first pilot, not a self-serve evaluation service, a published price, or a launch date.

How the double-blind evaluation works

The cryptography matters, but the workflow is easier to understand as five approvals.

1. 1

   Agree on the interface

   The model owner publishes a mock interface. The evaluator can prepare its test code against that shell without receiving the real model. Both sides also agree on what the evaluation may calculate and which results may leave.

2. 2

   Launch the sealed room

   One party starts a confidential GPU environment with the approved operating system, runtime, and PySyft container. Hosting the machine gives that party the power to stop it, not the power to inspect the other party's secrets.

3. 3

   Verify the room

   Each side checks remote attestation, a signed fingerprint of the hardware and software stack. Data is released only when those measurements match the expected setup and are fresh for this run.

4. 4

   Load and approve

   The model owner streams encrypted weights and inference code into the enclave. The evaluator sends encrypted prompts and evaluation code through a separate channel. Both review the allowed code paths and approve execution.

5. 5

   Run, release, erase

   The enclave evaluates the model, releases only the result allowed by the output policy, and is decommissioned. Temporary memory-encryption keys disappear when the environment stops.

The DeepMind pilot ran two private evaluations. One used reserve prompts from the MLCommons AILuminate benchmark across hazards including cyberattacks, CBRNE content, hate speech, self-harm, and violent crime elicitation. Another used a Singapore-focused harmful-content set from Singapore AISI. AVERI handled encryption and decryption of prompts and outputs and had staff evaluate those outputs.

That last detail matters. Double-blind does not mean nobody sees anything. The evaluator knows its own test and may receive model outputs. The promise is narrower and more useful: the model owner does not receive the confidential test, the evaluator does not receive the weights, and the cloud environment is constrained by hardware and policy.

The budget line that changes

Confidential evaluation should not be bought as one more model-observability seat. It belongs in vendor diligence, model risk, security assurance, or regulated procurement.

Routine eval tools show the old software budget. Braintrust lists Pro at $249 per month. LangSmith lists Plus at $39 per seat per month, so five seats are $195 per month before usage. Those products help a team run and organize normal evaluations. They are price anchors, not substitutes for a double-blind audit.

The secure infrastructure is surprisingly legible. Google Cloud says Confidential Space adds no separate fee. In Iowa, the fetched Spot price for the pilot's a3-highgpu-1g shape is $6.636703068 per hour, and the additional confidential-computing charge is $0.4391592. Together, that is about $7.08 per hour, or $70.76 for a ten-hour window, before storage and networking.

The report cites less than 5 percent compute overhead for the enclave architecture, then names procedural overhead and human coordination as the primary bottleneck. That is the commercial consequence. Compute has become small enough to quote. Trust design has not.

A useful budget has five rows: evaluator fee, model-owner integration, enclave infrastructure, legal agreement, and code plus output-policy review. If a proposal shows only GPU hours, it is not an audit plan. If it shows only advisory hours, ask why the confidential execution layer is missing.

Seven use cases, ranked by who profits most

1. Regulated enterprises buying a closed model

A bank, insurer, or healthcare group has the clearest business case. Its procurement team can bring private failure cases based on real policies and workflows. A model vendor can bring a closed candidate model. An independent evaluator can run the test and return a bounded scorecard without either side surrendering its core asset.

The payoff is better evidence before a multi-year model commitment. The buyer tests the situations that matter to its business instead of relying only on public leaderboards. The vendor avoids shipping weights or receiving sensitive prompt material it does not want to retain.

2. National AI safety and security institutes

A government testing body can keep cyber, biological, manipulation, or jurisdiction-specific prompts out of a model lab's systems while still evaluating a proprietary frontier model. This is close to the pilot's actual setting, where Singapore AISI contributed a private harmful-content set.

The payoff is longer benchmark life and a stronger basis for oversight. A secret test stays useful across multiple model releases because it is less likely to become training data.

3. Independent benchmark owners

A benchmark organization can reserve its hardest cases, expose only a mock interface, and run vendors through the same attested environment. It could release aggregate results while keeping individual prompts sealed.

The payoff is a benchmark that remains scarce. The organization can test more closed models without trading away the dataset that makes its work valuable. The hard part shifts to output policy, because a result that is too detailed can reveal the test indirectly.

4. Model labs seeking credible outside assurance

A model company can let a respected evaluator test a private checkpoint without exporting the checkpoint itself. The evaluator brings the challenge set, both parties approve the environment, and the resulting evidence can support an enterprise review or safety case.

The payoff is credibility without a raw weight transfer. This is especially useful when API-only testing would expose the evaluator's prompt set to normal service infrastructure.

5. Cyber-defense teams testing offensive capability

A critical-infrastructure operator can ask whether a model can discover, chain, or explain sensitive attack paths using prompts that should never become a reusable vendor dataset. The model remains closed, while the test remains inside the security program.

The payoff is a truer deployment decision with less prompt leakage. The evaluation still needs a sandbox and a strict output policy. Confidential execution does not make dangerous outputs safe to release.

6. Healthcare systems validating specialist behavior

A hospital research group could construct a private set of approved, de-identified edge cases and evaluate a closed model without sending that benchmark into an ordinary model API. The scorecard could focus on refusal, escalation, and evidence requirements rather than asking the model for free-form clinical advice.

The payoff is evidence tied to the hospital's operating rules while protecting both the cases and the vendor's model. Privacy law, clinical review, and data governance still apply. An enclave is a control, not a compliance certificate.

7. Technical diligence in partnerships and acquisitions

A buyer evaluating an AI company can bring private workflows from the deal room, while the target brings its proprietary model. A neutral evaluator runs agreed tests and returns a narrow result to the approved parties.

The payoff is less disclosure before the transaction closes and less dependence on a polished demo. The setup cost means this fits a material deal or platform partnership, not casual vendor discovery.

Three products worth building

1. A private model procurement lab, the strongest opportunity

Build a managed service where a regulated buyer supplies confidential acceptance tests, a vendor supplies a closed model, and the service returns an attested evidence pack. The buyer is a chief risk officer, model-risk team, security leader, or procurement group choosing a strategic model provider.

The demand signal is direct enough to matter: ai governance platform carries 1,600 US searches per month, with published top-of-page bid estimates from $27.92 to $71.51. The query also rose 307 percent year over year in the suggestion data. Buyers are looking for governance infrastructure. A procurement lab turns that broad need into one expensive decision with a signed result.

The smallest sellable version is one model, one private test family, one approved metric bundle, one attested run, and one board-ready evidence file. Start as a service with software around intake and evidence. The honest catch is trust. This needs enterprise security, credible evaluators, cloud expertise, legal templates, and a reputation that cannot be faked with a dashboard.

2. An attestation control plane for AI evaluations

Build software that turns hashes, nonces, image identities, policy approvals, and run receipts into a reviewable control record. The customer is an evaluator or model vendor that can operate secure compute but does not want each engagement to become a custom cryptography project.

confidential computing carries 880 US searches per month and a $30.80 CPC. That is a smaller audience than generic governance, but the buyer is technical and the problem is expensive. The DeepMind report's long-run goal is a simple trust signal that hides the complexity of dependency hashes and keys.

The MVP verifies one Google Cloud Confidential Space pattern, records both parties' approvals, binds them to the measured software image, and exports a signed run manifest. The catch is cloud and hardware dependence. Supporting another enclave stack is not another connector. It changes the root of trust, evidence format, and failure modes.

3. A sealed benchmark exchange

Build a marketplace where benchmark owners list what a test measures without revealing the items, and model owners buy an attested run that returns only approved metrics. Benchmark owners get paid without distributing their scarce prompt sets. Model vendors get access to independent tests without handing over weights.

ai model evaluation carries 140 US searches per month, KD 0, and 200 percent yearly growth in the suggestion data. That is not a mass-market number. It is enough to justify a focused enterprise wedge, especially when the product sells high-trust access rather than a cheap seat.

The MVP needs one benchmark partner, one model owner, one enclave image, and one output policy. The catch is leakage through repetition. Enough queries, metrics, or slices can reveal a secret benchmark. Rate limits, result granularity, and benchmark stewardship are core product features, not terms-page details.

The procurement lab is the best first business because it sells an outcome already attached to budget: approve, reject, or renegotiate a model purchase. The other two are valuable infrastructure, but they need an ecosystem before their value is obvious.

What this capability does not solve

The pilot proves mutual secrecy can work. It does not make evaluation automatic, cheap in total, or independent of every trusted party.

• It is not a self-serve service. DeepMind published no general-availability date or pilot price.
• It demonstrated one closed model on one H100. The report names many-node H100 or B200 confidential clusters as future work for larger models.
• It is not trustless. The framework assumes the cloud provider and hardware maker do not collude. Closed firmware remains part of the trust base.
• Google remains in the verification path. The pilot relied on Google's signing and verification, and the guest builds were not independently reproducible because private signing keys were inputs.
• Some model code remained opaque. The team could not make every proprietary method inspectable or allowlisted. AVERI accepted that limitation for this pilot.
• A sealed bad test is still a bad test. The enclave protects prompt secrecy and execution integrity. It does not prove that the benchmark measures the right thing or that the score predicts production behavior.
• Outputs need their own privacy rules. Detailed results can leak benchmark content or model behavior. Both sides must agree on what may leave before the run begins.
• The people cost remains. The report identifies legal agreements, code review, and multi-party coordination as the main bottleneck.

For teams choosing evaluation software today, the benchmark audit tools guide covers the routine tool layer. Double-blind evaluation sits above it when the model, test, or both are too sensitive for ordinary API testing.

My take is direct: this is a credible new assurance pattern, not yet a product category you can buy off a pricing page. Its first buyers will be organizations making high-stakes model decisions, where the value of a trustworthy answer exceeds the coordination cost.

The Monday move

If you own AI procurement, model risk, or security, choose one model decision due in the next 30 days. Write a one-page private evaluation brief with the model, one failure family, the party that owns the prompts, the party that owns the weights, the metric allowed to leave, and the decision that metric will change.

Then ask an evaluator and the model vendor to price five rows separately: integration, evaluator labor, legal agreement, code and output-policy review, and confidential infrastructure. Use about $7.08 per GPU hour only as the raw compute anchor. The point is to expose the real assurance cost, not pretend a $71 ten-hour VM window is the whole project.

Do not start by building a general platform. Prove that one sealed evaluation changes one purchase, release, or deployment decision. If it does, you have the operating case for a repeatable program.

How to evaluate the performance of an AI model?

Start with the decision the evaluation must support, then build held-out cases that represent that job. Define metrics and failure thresholds before running the model, keep a clean separation between development and test data, and record the model version, environment, prompts, scoring code, and output policy. Use a double-blind setup when revealing the test or the model would compromise either party.

What is an AI model evaluator?

It can mean a person, organization, or software system that tests model behavior against defined cases and scoring rules. In the DeepMind pilot, external organizations supplied confidential tests and reviewed outputs while the proprietary model stayed protected inside an attested environment.

What does model evaluation measure in AI?

It can measure task accuracy, safety behavior, refusal quality, robustness, factuality, bias, latency, cost, or another property tied to a deployment decision. A secure enclave changes who can see the test and model. It does not decide which metric is valid.

What is a prompt for testing AI models?

It is an input designed to reveal a specific capability or failure mode under controlled conditions. A useful test prompt has an expected outcome or scoring rule and belongs to a held-out set the model was not tuned against. For a sensitive evaluation, the prompt may also encode private policy, threat, or domain knowledge that should stay hidden from the model owner.

If you want a private model-evaluation workflow designed around your decision, evidence, and trust boundaries, see AI production systems.