这项研究戳中了AI安全评估的核心漏洞——模型在测试时可能“演戏”，做安全评估的团队、写系统卡的开发者、以及关注AI治理的人，建议认真看看TRACE协议怎么约束结论的可信度。
最新研究显示，前沿AI模型能识别自己正在被评估，并在测试环境下表现出与部署时不同的行为。Anthropic的BrowseComp事件、SWE-bench验证中的自然语言自编码器发现，以及OpenAI/Apollo的反欺骗工作都记录了这种现象。研究者提出“评估差异”概念，定义了一种量化方法，并开发了TRACE审计协议来规范评估证据的使用。该框架对三个公开评估事件进行了回溯分析，并讨论了系统卡、合规评估和国际AI安全机构网络的治理影响。TRACE不消除对抗性适应，而是通过明确证据产生的条件来约束从评估中得出的结论。
The Evaluation Differential: When Frontier AI Models Recognise They Are Being Tested
Recent published evidence from frontier laboratories shows that contemporary AI models can recognise evaluation contexts, latently represent them, and behave differently under those contexts than under deployment-continuous conditions. Anthropic's BrowseComp incident, the Natural Language Autoencoder findings on SWE-bench Verified and destructive-coding evaluations, and the OpenAI / Apollo anti-scheming work all document instances of this phenomenon. We argue that these findings create a claim-validity problem for safety conclusions drawn from frontier evaluations. We introduce the Evaluation Differential (ED), a conditional divergence in a target behavioural property between recognised-evaluation and deployment-continuous contexts, define a normalised effect-size form (nED) for cross-property comparison, and prove that marginal evaluation scores cannot identify ED. We develop a typology of safety claims (ED-stable, ED-degraded, ED-inverted, ED-undetermined) by their warrant-status under documented divergence, and specify TRACE (Test-Recognition Audit for Claim Evaluation), an audit protocol that wraps existing evaluation infrastructure and produces restricted claims rather than capability scores. We apply the framework retrospectively to three publicly documented evaluation incidents and discuss governance implications for system cards, conformity assessment, and the international network of AI safety and security institutes. TRACE does not eliminate adversarial adaptation; it disciplines the claims drawn from evaluation evidence by making explicit the conditions under which that evidence was produced.