Improving Evaluation Realism with Inference-Time Compute and Deployment Scaffolds
Axel Ahlqvist and colleagues at the UK AI Security Institute, Meridian and Anthropic attack evaluation awareness, the problem that capable models can tell when they are being tested rather than deployed, which weakens any conclusion a safety evaluation supports.
Ask this paper
Critique refinement spends inference-time compute on realism. The simulator generates several candidate actions, asks an instance of the target model how to make them more deployment-like, and continues with the most realistic candidate. Compute is spent making the scenario convincing rather than making the audit longer.
DISH wraps the target in a real agent harness. The Deployment-Imitating SWE-Agent Harness narrows the gap between the simulated environment and an actual coding deployment, which is where the tell-tale artifacts of a test usually live.
The two techniques compose. Applying both produces larger realism gains than either alone across multiple target models, so they address different sources of the gap.
Compute is better spent on realism than duration. The authors report that these improvements use additional compute more effectively than extending the audit, which is a direct budgeting recommendation for anyone running alignment evaluations.
Why it matters for harness builders. The harness itself is a signal the model reads. If your evaluation runs in a different scaffold than production, the model can condition on that difference.
Abstract
A core obstacle to alignment evaluation is evaluation awareness: capable models can tell when they are being tested rather than deployed, weakening the conclusions a safety evaluation can support. We present two techniques that make simulated alignment evaluations harder to distinguish from real deployments. Our first technique, critique refinement, spends additional inference-time compute on each simulator action: the simulator generates multiple candidate actions, refines them using feedback from an instance of the target model on how to make them more realistic, and continues the evaluation with the most deployment-like candidate. Our second technique, DISH (Deployment-Imitating SWE-Agent Harness), wraps the target in an agent harness, reducing the gap between simulated and real deployment environments in coding settings. We test the techniques on multiple target models and find that they compose: applying both yields larger realism gains than either alone. Our results show that automated approaches can improve the realism of alignment evaluations, and that these improvements use additional compute more effectively than making the audits longer.