Can AI Labs Sit an Exam Without Seeing the Questions?

Imagine an exam where the school cannot open the student’s sealed notebook and the student cannot read the question bank beforehand. The arrangement sounds reassuring, but it leaves the most important question untouched: does the exam test the work the student will actually need to do?

Google DeepMind describes a pilot with Singapore AISI, OpenMined, AVERI and MLCommons, evaluating Gemini Flash Lite through Confidential Space. Its stated boundary is reciprocal: evaluators cannot see weights, and the lab cannot see test prompts. The “world’s first” phrasing is the company’s characterization; the technical and institutional claims should be assessed on their described scope. Source

That distinction is important. Confidential computing addresses who can inspect particular data during a computation. It does not decide whether the chosen tasks matter, how carefully the evaluation was designed, or whether the result predicts behavior outside the test environment.

Two parties, two protected assets

An AI evaluation can create a tension. The model developer may want to protect weights and infrastructure. The independent evaluator may want to keep prompts secret so they are not absorbed into later training or tuned against. A conventional arrangement can force one side to trust the other’s promises about what was visible.

The pilot’s design attempts to reduce that trust requirement by putting execution inside a protected environment. In a simplified schematic:

Evaluator holds prompts ──┐
                          ├─ protected evaluation run ── results
Lab holds model weights ──┘

The diagram is conceptual. It does not specify every operational control or imply that the evaluator sees only a single score. The useful idea is that the evaluation can run while access to its most sensitive inputs is restricted.

Asset or question	Protected boundary can help with	Still requires separate evidence
Evaluation prompts	Limiting direct visibility by the model developer	Provenance, freshness and leakage analysis
Model weights	Limiting evaluator access to proprietary parameters	Whether the reported model is the one tested
Execution	Restricting inspection during a run	Integrity, logging and repeatability procedures
Test meaning	Nothing by itself	Task selection and relevance to intended use

This is a pilot, not a universal certification. Independent review should explain how the environment is configured, what evidence is retained, and what the parties can verify afterward.

Privacy and validity are different questions

An exam can be secret and still be a poor exam. A protected prompt set might consist of puzzle-like questions that have little relationship to how people use an assistant. The model could perform well on a narrow benchmark and fail at a common workflow. Confidentiality would not make the task selection representative.

The reverse is also true. A relevant test can be compromised if its questions are exposed before the model is frozen or tuned. Evaluation integrity requires attention to both sides: protect the assessment where appropriate, and justify what it measures.

Consider a hypothetical benchmark for a medical scheduling assistant. The test asks the model to summarize appointment instructions, but contains no cases involving ambiguity, conflicting calendars or a user correcting a detail. A perfectly sealed run could show performance on summarization while saying little about safe scheduling. The example is fictional, but the lesson is general: the content of the test defines the claim its score can support.

Test validity also depends on whose experience is represented. If the benchmark assumes fluent English, stable connectivity and a particular interface, it may not describe performance for people using other languages, assistive technologies or constrained devices. A hidden prompt set does not fix those choices.

What the setup can and cannot establish

Confidential computing can make some evaluations easier to conduct between parties that would otherwise hesitate to share sensitive material. A model lab may be more willing to permit external assessment if weights remain protected. An evaluator may be more willing to submit valuable test cases if the lab cannot inspect them directly.

Those benefits matter because independent evaluation often depends on access. But protected execution is only one layer of assurance. Reviewers need a clear account of the measured model version, the software and configuration used, the prompt-handling rules, the output channel, and how the result can be checked. A result that cannot be audited in any meaningful way risks turning the protected environment into a black box with a score attached.

There are also side channels and process questions. The pilot’s announcement does not establish that every possible inference route has been removed. Evaluation teams should state what the system is designed to prevent and what assumptions remain. Precision about boundaries is more credible than a claim that secrecy has been solved.

Better exams need a public argument

The strongest next step is to publish an evaluation protocol that explains why each task was chosen, what populations and contexts it covers, and what it leaves out. Where prompt confidentiality prevents disclosure of exact questions, evaluators can still describe categories, sampling methods, scoring rules and limitations. A confidential run should not require an opaque conclusion.

Independent evaluators should also have a way to repeat or challenge the process. That may involve protected access for another qualified group, carefully designed audit artifacts, or a documented way to test the environment’s integrity. The specific approach can vary; the principle is that the result must be inspectable enough to earn trust.

Test confidentiality complements the openness explored in the Apertus release-note story. For the institutional question of what labs should disclose regularly, the AI-development measurements essay proposes a way to make process claims more inspectable.

Double-blind testing is best understood as an answer to a narrow but real problem: how can two parties evaluate a model while revealing less to each other? The pilot offers one approach. Whether the resulting exam is meaningful depends on the separate work of test design, validation and interpretation. Sealing the room may help. It cannot tell us whether the questions were worth asking.