双盲评测：用安全飞地同时保护评测提示词与模型权重
Double Blind Evals: Resolving the Dual Confidentiality Dilemma in AI Safety Auditing
评测机构的私有题库和厂商的模型权重以前总有一方要妥协，这篇论文用H100安全飞地加PySyft让两边都能保密。试点直接跑了Gemini 2.5 Flash Lite和AILuminate私有题库，做安全评测的人应该看看这套流程怎么搭。
AI安全评测长期存在双向保密难题：评测方不愿公开私有基准提示词，模型方不愿暴露专有模型权重。一篇arXiv论文提出"双盲评测"方案，通过NVIDIA H100安全飞地在硬件层加密RAM数据，并用OpenMined的PySyft维护数据与模型隐私，为双方提供密码学级别的保密保证。
论文团队进行了首次试点：在Google Cloud Platform的H100安全飞地中，用AILuminate基准的私有题库评测Google DeepMind的专有模型Gemini 2.5 Flash Lite。作者称这是首次有技术方案同时实现一方前沿专有模型权重与另一方封闭基准的互相保密。
对第三方评测机构和监管审计而言，这类方案可能降低接触闭源模型时提示词泄露的风险，也为模型厂商接受独立安全审计提供新的技术路径。
Double Blind Evals: Resolving the Dual Confidentiality Dilemma in AI Safety Auditing
AI safety evaluations often involve sensitive prompts and proprietary models. Evaluators want to keep their evaluation prompts secret from model owners to prevent purposeful or incidental data leakage, ensuring longer usefulness of their benchmark. Model owners in turn wish to keep their proprietary model weights and inference code within their own secure infrastructure to protect their IP. We present a way forward for "double-blind evals", which provide cryptographic guarantees that an evaluator's prompts are not shared with the model owner, while simultaneously maintaining the confidentiality of the model weights and inference code. To accomplish this, we use secure enclaves that encrypt data in RAM at the hardware level. In a world-first pilot, we test this approach by evaluating a proprietary Google DeepMind model (Gemini 2.5 Flash Lite) against a selection of the private AILuminate benchmark corpus, using an NVIDIA H100 secure enclave on Google Cloud Platform, and using OpenMined's PySyft to maintain data and model privacy. We believe this effort marks the first use of this technology to provide mutual secrecy for one organization's frontier-class proprietary model weights and another organization's closed benchmark.
This report is categorized under AITOP's "Papers" desk, focusing on US frontier AI labs and Silicon Valley technology leaders. Within our cross-regional analytical framework, it directly maps to AI developer toolchains, coding agents, and engineering workflows and US-China foundation model benchmarks and commercialization comparison. Key entities and technical topics under continuous tracking include AILuminate, Gemini 2.5 Flash Lite, PySyft, AI安全.
Primary source verification: published directly by arXiv: Google DeepMind with first-party authority. Cross-source corroboration: 11 independent sources have covered this development (including marktechpost, Tech in Asia, rohanpaul_ai), confirming industry-wide signal strength.