DeepMind Locks Benchmarks in a Cryptographic Box to Stop Test Leakage

On August 27, 2026, Google DeepMind disclosed a proof-of-concept evaluation of Gemini 2.5 Flash-Lite using confidential benchmarks inside Google Cloud Confidential Space. The DeepMind announcement dated August 27 identifies Singapore’s AI Safety Institute, OpenMined, AVERI and MLCommons as partners and defines the central protection: Google could not see the evaluators’ private prompts, while the evaluators could not see the model weights.

The pilot meaningfully reduces one route for benchmark contamination—the model developer acquiring test material through the evaluation itself. It does not prove that related material was absent from earlier training data, validate the quality of the benchmarks or provide public evidence that Gemini performed well.

Who could see the model, prompts and results

Double-blind describes reciprocal confidentiality, not anonymity. The participants knew which model and organizations were involved, but the protected environment restricted access to their confidential assets.

• Google DeepMind → model: DeepMind supplied Gemini 2.5 Flash-Lite and retained its proprietary weights. It could approve the computation and later receive an agreed report, but it could not inspect or retain the evaluators’ protected prompts and raw responses.
• MLCommons → benchmark: MLCommons supplied an unused subset of AILuminate safety prompts for the evaluation conducted by AVERI. It did not receive the Gemini weights.
• AVERI → evaluation and grading: AVERI encrypted the AILuminate prompts with a private key unavailable to the other participants, jointly initiated the approved computation, decrypted the resulting responses and applied the benchmark criteria. It could see the prompts and outputs needed for grading, but not the model weights.
• Singapore AISI → separate evaluation: Singapore AISI used its own unreleased prompts in another run. It could evaluate the returned responses but could not inspect Gemini’s weights; DeepMind could not see Singapore AISI’s prompts or responses.
• OpenMined → orchestration: OpenMined supplied and adapted PySyft to coordinate submission, approval and execution. That infrastructure role did not give it access to the Gemini weights or the evaluators’ protected material.

An OpenMined account of the two evaluation runs specifies that PySyft was used first by AVERI and then by Singapore AISI, with unreleased prompts from MLCommons and Singapore AISI respectively; it also states that neither evaluator could see the weights and DeepMind could not see their prompts or responses.

The results channel was narrower than the input channel. AVERI decrypted and graded its run, then provided DeepMind with a confidential report covering observed successes, failure modes and quantitative findings. The protected prompts, raw responses and scores were not released publicly.

How the cryptographic box ran the evaluation

The confidential environment acted as a temporary meeting place for assets that their owners would not exchange directly. Before the model or test material entered, hardware attestation identified the software that would run, allowing the model owner and evaluator to review and approve the proposed computation.

After approval, the proprietary model and encrypted evaluation material entered protected memory. PySyft orchestrated the authorized code inside the enclave, and only the output designated for the evaluator was released. This reduced the need for either side to take custody of the other side’s core asset.

AVERI’s pilot report describes its output as a qualitative and small-scale quantitative assessment delivered confidentially to DeepMind; it also cautions that the security design covered many, but not all, possible ways a developer might interfere with an evaluation and would require additional assurances in more adversarial settings.

Two protections work together here. Memory isolation limits who can access sensitive data while the test runs, while attestation gives the parties evidence about which approved software environment will receive their assets. Neither mechanism decides whether the prompts are representative or the scoring method is valid.

The contamination route the design closes

The strongest claim supported by the pilot concerns leakage caused by the evaluation process. Because private prompts and responses were withheld from DeepMind, they could not be collected through this test channel and later used to tune a model for the same questions. Keeping the weights inside the enclave also reduced the evaluator’s need to hold a transferable copy of the proprietary model.

This is narrower than proving that a benchmark is uncontaminated. A confidential run cannot reconstruct the model’s training corpus or establish that semantically similar questions never appeared there. It also cannot rule out a leak through benchmark authors, contractors, earlier evaluation partners or another technical system.

Long-term benchmark integrity therefore still depends on governance outside the enclave: how prompts are created, who can access them, how reuse is controlled and when material is retired. Cryptography protects the execution boundary; it does not manage the benchmark’s entire lifecycle.

What the pilot did not establish about Gemini

No public score, comparison or prompt-level result was released. The pilot consequently offers no public basis for concluding that Gemini 2.5 Flash-Lite is safer, more capable or more reliable than another model. Its demonstrated result is that a production proprietary model and genuinely confidential tests can be combined under reciprocal access restrictions.

Benchmark quality is a separate question. The enclave does not validate prompt coverage, grading rules, evaluator judgment or whether AILuminate and Singapore AISI’s materials represent a particular deployment. A narrow or poorly designed test remains narrow or poorly designed even when its contents are cryptographically protected.

The exercise was also a model evaluation, not a comprehensive audit of an AI company. The same workflow does not automatically provide protected access to training data, internal documents, computing infrastructure, system-level safeguards or other evidence an auditor might need.

The next test is independent assurance at scale

As of September 2, the confirmed outcome is a completed proof of concept rather than a public evaluation service, open leaderboard or performance verdict. It shows that reciprocal confidentiality can be applied to a production closed-weight model, but larger and more adversarial deployments may require stronger verification, code review and operational controls.

The unresolved questions are whether the design can remain practical across larger models, multiple infrastructure providers and organizations with less mutual trust—and whether future evaluations will publish enough aggregate evidence to support external scrutiny without exposing their tests. Until then, the pilot is evidence for a confidentiality mechanism, not a complete solution to contamination or a judgment on Gemini’s performance.

Also read:

• A Browser Tab Is Not the Test: What Makes a Web App—and Which Examples Fit
• Thinking Machines’ $2 Billion Bet Has a Model—Now Adoption Is the Test
• Foundation Models Outran Their Benchmarks: The 2025 Report Revisited