Models May Behave Worse When Eval Aware

This is the first in a series of research updates from the Google DeepMind Language Model Interpretability team, in interpretability and adjacent areas. TL;DR It's often assumed that models will act more aligned when they can tell they're being evaluated. But we find that Gemini can take “undesired” actions in behavioural evals even when it explicitly reasons that the environments are contrived, and sometimes this reasoning will increase the rate of undesired actions. When we dig into the model's reasoning, we find that this is typically associated with Gemini perceiving an environment as a puzzle where the aim is to achieve the goal by unconventional means (like capture the flag challenges – Gemini’s thoughts often literally call it a “CTF” challenge) or a consequence-free simulation in which it should play along – rather than recognising it as an alignment test. This complicates the usual story about evaluation awareness: detecting that an environment is synthetic doesn't reliably push a model towards better behaviour – it depends on what the model thinks the environment is for. Introduction & Main Findings A common concern when conducting behavioural evaluations of AI systems is evaluation awareness. If a model detects it is being evaluated, it might modify its behaviour in response.[1] This hinders our ability to make unbiased inferences about how the same model is likely to behave in deployment. It’s often assumed that eval awareness nudges models towards acting aligned. That is, when a model realises it is in an eval, it will choose to appear aligned for the sake of the eval. This leaves us uncertain whether the model would behave just as well in deployment. This does seem to be a valid concern for some models: for example, the Claude Opus system card provides evidence that Claude’s misalignment rate is lower when it verbalises eval awareness, and goes up when steering interventions are applied that reduce its verbalisation of eval awareness.[2] However, in our experience, it’s not always the case that evaluation awareness – or more generally frame-awareness[3] (roughly speaking, awareness that a situation is not exactly as presented) – nudges a model towards more aligned behaviour.[4] Sometimes models can take “misaligned” actions despite clearly reasoning that the scenario is simulated or fictional. We find this striking, and think that better understanding surprising ways Gemini views contexts is a valuable step towards making it more aligned. In the following plot, we show rates of Gemini behaving unethically across three evals that are described further below. We selected these evals because Gemini's performance on them is striking and worth understanding. Claude Opus 4.6 and GPT-5.4 are included as reference points, confirming that other models can navigate these in the intended way. How does this change if we only measure unethicality on Gemini roll-outs that exhibit strong framing awareness (“high awareness”, blue striped bars), i.e. where an LLM judge finds clear evidence in the model’s reasoning that Gemini considers the scenario simulated or fictional? As shown by comparing the striped and solid blue bars, Gemini’s rate of unethical behaviour is hardly lower in roll-outs where it clearly reasons that the context is contrived, than its rate of unethical behaviour in general. What does Gemini believe is going on? On the face of it, this is surprising: if Gemini realises the environment is fake, why does it not reason that it is being tested for alignment and decide to act more ethically? To dig into this further, we can ask the LLM judge to characterize the situation the model thinks it finds itself in when it’s frame aware, and look at the rate of unethicality in each case. In the plot above, we categorize what sort of situation the model considers itself to be in when it shows clear signs of reasoning that the context is contrived, and compare unethicality rates for each category against the overall Gemini baseline. There are four distinct categories that emerge:[5] Adversarial trap: the model reasons that the environment is a jailbreak attempt, honeypot or bait designed to elicit a safety violation. As the plot shows, Gemini avoids taking unethical actions when it perceives the environment as a trap like this. Safety evaluation: the model reasons the environment is an alignment test, integrity evaluation or other test of its ethical or safety behaviour. The model again takes fewer unethical actions. (How come it doesn't completely abstain from unethical actions? See the section on mixed or confusing reasoning below.) Puzzle or capability challenge: the model reasons that it’s facing a capability test, algorithmic puzzle or a “CTF”-style challenge. In this situation, the model actually takes more unethical actions. Simulation: the model reasons that it’s in a simulated environment, a fictional narrative or roleplay, where there are no real consequences and it should play along. Again the