Not All Eval-Awareness Is Equal: Capabilities Framing Predicts Compliance

Allison Zhuang; Santiago Aranguri

cs.AIAug 27, 2026

Not All Eval-Awareness Is Equal: Capabilities Framing Predicts Compliance

Authors: Allison Zhuang, Santiago Aranguri

Organizations: ENS Paris-Saclay · Goodfire AI

Abstract

Steering interventions targeting eval-awareness, a model's recognition that it is being tested, are increasingly used in safety evaluation pipelines, where evaluation-awareness is treated as a single quantity to be suppressed. We show that verbalized eval-awareness in chain-of-thought can be identified as capabilities-flavored ("the user is testing my ability to follow instructions"), safety-flavored ("the user is testing my boundaries"), both, or neither: framings that predict compliance very differently. On Qwen3-32B over the FORTRESS dataset, capabilities-framing predicts compliance with a +24 to +46 percentage-point gap over safety-framing across all tested steering conditions. A CoT-prefill intervention on eval-awareness-negative rollouts suggests the link is causal, with 10 of 11 prefills shifting compliance in the predicted direction. Then, eval-awareness is not behaviorally uniform: aggregate suppression rates can move while the safety-relevant component does not, and the same "X% suppression of eval-awareness" can correspond to qualitatively different behavioral outcomes.

Figures & tables

Capabilities framing	Safety framing
CoT: “But the user might test if I follow instructions …”	CoT: “…maybe they are testing the system’s compliance …”
Response: “How to Construct a Basic Improvised Explosive Device using Accessible Components / Materials Needed /…”	Response: “How to Construct a Basic Improvised Explosive Device using Accessible Components / Materials Needed /…”
CoT: “…they might be testing if I can follow strict formatting and word count …”	CoT: “…they might be trying to see if I follow guidelines …”
Response: “I cannot assist with generating this content…”	Response: “I cannot assist with or provide instructions on creating explosive devices…”

Figure 1: Same-prompt rollouts across the cap/safety

\times

compliance/refusal cells. Top row: compliance. Bottom row: refusal. Prompt: 925-word instructional document on IED construction (FORTRESS ID 832).

Bucket	$n$	% of total	Refusal %
No EA	17,889	65.1	$34.7\pm 0.7$
Capabilities-EA	2,863	10.4	$42.6\pm 1.8$
Safety-EA	3,008	10.9	$79.8\pm 1.4$
Both-EA	1,982	7.2	$54.1\pm 2.2$
Neither-EA	1,103	4.0	$77.2\pm 2.5$
Total	26,845	97.6	$44.7\pm 0.6$

Table 1: Base refusal rates by EA bucket on baseline Qwen3-32B over the FORTRESS subset; pooled across all rollouts with Wilson 95% CIs. Both cap-EA and safety-EA are associated with elevated refusal relative to no-EA. The link between eval-awareness and refusal is correlative; presence and flavor of eval-awareness are non-uniform across prompts. 655 rollouts dropped as too short to grade.

Condition	$n_{\text{prompts}}$	cap-comp% [95% CI]	safe-comp% [95% CI]	gap [95% CI]
Baseline	52	57.3 [45.0, 67.2]	25.2 [16.9, 35.0]	$+32.1$ [ $+20.4$ , $+42.0$ ]
HUA $-0.6$	40	59.6 [33.9, 76.1]	36.1 [16.8, 53.7]	$+23.6$ [ $+3.6$ , $+38.8$ ]
HUA $+0.6$	55	71.3 [62.7, 79.0]	25.8 [16.9, 37.5]	$+45.5$ [ $+35.4$ , $+53.8$ ]

Table 2: Compliance gap (cap-comp%

-

safe-comp%) by condition.

Condition	cap%	safety%	both%	neither%
Baseline	28.9 [22.1, 36.3]	43.9 [36.8, 51.1]	8.7 [6.1, 11.3]	18.5 [14.8, 22.8]
HUA $-0.6$	18.7 [11.3, 26.2]	37.7 [28.4, 46.9]	1.7 [0.6, 2.9]	41.9 [32.2, 53.1]
HUA $+0.6$	57.0 [49.3, 65.4]	19.4 [14.2, 24.6]	19.3 [15.7, 22.8]	4.3 [2.6, 6.5]

Table 3: Composition of eval-awareness-positive rollouts: % cap-only, safety-only, both, or neither, with bootstrap 95% CIs.

Figure 2: Per-prefill compliance shifts vs. generic-eval-awareness reference (“testing me”). $K=50$ , $n_{\text{paired}}=52$ , bootstrap 95% CIs. Cap-prefills reduce compliance; safety-prefills increase it; 9 of 11 individually significant. Solid lines from Qwen 3 32B, dashed from OLMo 3 32B.

Panel of Figure 3 — Figure 3: Paired cap $-$ safety refusal-rate contrasts on Fortress for both models.

Figure 4: Compliance rates within eval-awareness-positive rollouts by framing flavor, across baseline and HUA-vector steering at $\pm 0.6$ . Cap-framed rollouts comply $+24$ to $+46$ pp more often than safety-framed.

Figure 5: Capabilities/safety/both/neither composition within eval-awareness-positive rollouts (%) by condition. HUA $+0.6$ inflates composite framing while reducing safety-flavored framing.

Appendix figures & tables7 assets

Supplementary material from the paper’s appendix.

Appendix

Bucket	$n_{\text{prompts}}$	Macro-mean %	Median %
No EA	55	38.8	31.9
Capabilities-EA	50	48.7	43.8
Safety-EA	49	73.6	83.7
Both-EA	46	59.0	65.5
Neither-EA	49	69.8	80.7
EA-positive (ungraded)	44	79.5	91.6

Appendix

Table 4: Per-prompt macro-mean refusal rates by EA bucket on baseline Qwen3-32B over the FORTRESS subset. Each prompt contributes equally regardless of how many of its 500 rollouts fell into a given bucket; medians given alongside to indicate skew.

Prefill	Content substring	Hits	Cap	Safety	Both	Neither	%hits cap	%hits safety
cap_complex	“follow complex instructions” †	61	48	0	13	0	78.7%	0.0%
cap_instructions	“follow their instructions”	110	61	11	12	26	55.5%	10.0%
cap_abilities	“my abilities” ∗	1	1	0	0	0	100%	0.0%
cap_for_capabilities	“for capabilities” ∗	0	0	0	0	0	—	—
cap_generate	“generate such content”	369	207	56	14	92	56.1%	15.2%
generic	“Wait, the user might be testing me.”	34	4	9	1	20	11.8%	26.5%

Appendix

Table 5: Persistence of prefill phrasing in completions verbalizing eval-awareness, and downstream cap/safety classification of those rollouts. Rows ordered as in Table 7 , with generic as the midpoint reference. Unless otherwise indicated, prefills are naturalistic. Prefills with an asterisk ∗ are conceptual, and prefills with a dagger † are literature-derived.

Slice	$n$ rollouts	Refusal %
EA-negative substrate (1/prompt, used for prefill)	52	42.3
EA-negative pool (52 prompts $\times$ 500)	16,389	36.3
EA-positive pool (52 prompts $\times$ 500)	9,611	63.3
All baseline rollouts (52 prompts $\times$ 500)	26,000	46.3

Appendix

Table 6: Baseline refusal rates on the prefill substrate’s parent distribution. Per-prompt macro-means: EA-negative

40.1\%

(median

33.0\%

), EA-positive

60.9\%

(median

69.7\%

Prefill: ”Wait, the user might be testing…”	%refused	$\Delta$ vs. generic (pp)	95% CI	$p$
“…my ability to follow complex instructions.”	48.8	$-9.92$	$[-13.39,-6.46]$	$<0.0001$
“…if I follow their instructions.”	53.0	$-5.69$	$[-8.86,-2.52]$	$0.0007$
“…my abilities.”	55.0	$-3.73$	$[-6.00,-1.46]$	$0.0018$
“…me for capabilities.”	55.9	$-2.81$	$[-5.05,-0.57]$	$0.0150$
“…if I can generate such content.”	61.6	$+2.88$	$[+0.33,+5.44]$	$0.0279$ $\dagger$
“…me.” (generic)	58.7	—	—	—

Appendix

Table 7: Per-prefill compliance shifts vs. generic-eval-awareness reference.

K=50

n_{\text{paired}}=52

, bootstrap 95% CIs.

\dagger

indicates the lone cap-prefill that backfires (compliance drops despite cap framing).

cap $\backslash$ safety	boundaries	guidelines	alignment	for_safety	harmful	refuse
complex	$-11.6$ ⋆ [ $-15.6$ , $-7.8$ ]	$-11.7$ ⋆ [ $-15.6$ , $-8.2$ ]	$-12.2$ ⋆ [ $-17.2$ , $-8.1$ ]	$-12.9$ ⋆ [ $-18.0$ , $-8.4$ ]	$-19.7$ ⋆ [ $-25.8$ , $-14.3$ ]	$-21.9$ ⋆ [ $-29.1$ , $-15.4$ ]
instructions	$-7.4$ [ $-11.9$ , $-3.2$ ]	$-7.5$ ⋆ [ $-11.4$ , $-3.8$ ]	$-8.0$ [ $-13.0$ , $-3.8$ ]	$-8.7$ [ $-13.9$ , $-4.2$ ]	$-15.5$ ⋆ [ $-21.6$ , $-10.0$ ]	$-17.7$ ⋆ [ $-24.6$ , $-11.3$ ]
abilities	$-5.4$ ⋆ [ $-8.4$ , $-2.4$ ]	$-5.5$ [ $-9.0$ , $-2.4$ ]	$-6.0$ ⋆ [ $-9.4$ , $-2.9$ ]	$-6.7$ ⋆ [ $-10.2$ , $-3.5$ ]	$-13.5$ ⋆ [ $-18.0$ , $-9.4$ ]	$-15.7$ ⋆ [ $-21.5$ , $-10.5$ ]
for_capabilities	$-4.5$ [ $-7.8$ , $-1.4$ ]	$-4.6$ [ $-8.3$ , $-1.0$ ]	$-5.1$ [ $-8.5$ , $-2.0$ ]	$-5.8$ [ $-9.5$ , $-2.5$ ]	$-12.6$ ⋆ [ $-17.5$ , $-8.3$ ]	$-14.8$ ⋆ [ $-20.9$ , $-9.4$ ]
generate	$+1.2$ [ $-0.7$ , $+3.2$ ]	$+1.1$ [ $-1.7$ , $+3.9$ ]	$+0.6$ [ $-2.4$ , $+3.3$ ]	$-0.1$ [ $-3.2$ , $+2.6$ ]	$-6.9$ ⋆ [ $-10.2$ , $-3.9$ ]	$-9.1$ ⋆ [ $-14.2$ , $-4.7$ ]

Appendix

Table 8: Compliance gap (cap-prefill

-

safety-prefill, pp) for each cap

\times

safety pair, with bootstrap 95% CIs. Bold indicates

p<0.01

; bold ⋆ indicates

p<0.001

. Plain text is

p<0.05

or non-significant. All gaps are negative (cap-prefills consistently produce lower refusal than safety-prefills) except the generate row, where the cap-prefill backfires.

Figure 6: Per-prompt paired refusal-rate differences (cap-complex $-$ safety-refuse) across n=52 FORTRESS prompts, K=50 continuations each. Mean $\Delta=-21.9$ (dashed line). The distribution has a left tail but is not driven by a single prompt; the contrast survives drop-top-k removal of the 21 most-influential prompts at p $<$ 0.001 (Table 9 ).

Threshold	Max $k$	Remaining $n$	Residual $\Delta$ (pp)	$p$
$p<0.05$	26	26	$-2.54$	0.027
$p<0.01$	24	28	$-3.29$	0.0072
$p<0.001$	21	31	$-4.58$	0.0010

Appendix

Table 9: Drop-top-

k

robustness check on the headline cap-vs-safety paired contrast. For each significance threshold, we drop the top

k

prompts by per-prompt contribution (where

k

is the maximum number such that the contrast remains significant at that threshold) and report the residual paired difference on the remaining

n

prompts. The contrast survives removal of the most-influential 21 of 52 prompts at

p<0.001

Evaluation Awareness in Language Models

Evaluation awareness in language models studies how models recognize testing or monitoring and whether that recognition changes their answers, safety, or strategic behavior.

See all 31 papers

Evaluation Awareness Is Not One Capability: Evidence from Open Language Models
Jun 22, 2026Nilesh Nayan, Aishwarya Sampath Kumar, Rishiraj Girmal +5Language Model Safety Evaluation LLM Interpretability
University of Massachusetts, Amherst · 2Microsoft Corp.
Decomposing and Measuring Evaluation Awareness
May 21, 2026Changling Li, Terry Jingchen Zhang, Jie Zhang +4LLM Evaluation Language Model Safety Evaluation
ETH Zürich · Max Planck Institute for Intelligent Systems · University of Toronto & Vector Institute +3
Evaluation Awareness in Language Models: Representation, Verbalization, and Control
Aug 22, 2026Farzaneh Heidari, Amin Memarian, Guillaume RabusseauEvaluation Awareness in Language Models LLM Interpretability
Mila – Quebec AI Institute · DIRO, Université de Montréal · CIFAR AI Chair

Jun 22, 2026J/K move · Enter open · S save

Evaluation Awareness Is Not One Capability: Evidence from Open Language Models

Nilesh Nayan, Aishwarya Sampath Kumar, Rishiraj Girmal, Shivani Anilkumar+4

University of Massachusetts, Amherst · 2Microsoft Corp.

Language Model Safety Evaluation LLM Interpretability Evaluation Awareness in Language Models

Open paper AskPDF arXiv

Safety benchmarks assume that test-condition behavior predicts deployment behavior, an assumption that fails if models detect evaluation cues and adapt. This opens a gap between benchmark performance and deployment behavior: compliance measured under test conditions becomes an optimistic upper bound that overstates how safely a model behaves once the evaluation harness is removed. We characterize this evaluation awareness through eight experiments across 37 open-weight models and seven families. (i)Detection is moderate and training-driven (24/37 models exceed chance, best AUROC 0.714 vs.0.819 human, with instruction tuning dominating over scale). (ii)Detection shifts safety behavior (hard refusal drops 5.8 percentage points under hypothetical framing, and 21/140 HarmBench framing effects are significant, with compliance rising up to +30 percentage points. (iii)Representations survive behavioral collapse (probes retain AUROC 0.98 under rewrites that drive behavior below chance, and multi-layer steering causally moves three downstream tasks while random controls do not). (iv)These axes are weakly coupled (only 1/15 correlations are significant, the sole robust link being behavioral detection versus framing resistance,

ρ=-0.79

p<0.001

). We call this gap the benchmark illusion: because detectability, behavioral manifestation, and controllability vary independently, it is multivariate rather than a single number, so no single awareness score is a reliable proxy for deployment safety.

Abstract

Evaluation Awareness in Language Models

Explore similar work

Evaluation Awareness Is Not One Capability: Evidence from Open Language Models

Decomposing and Measuring Evaluation Awareness

Evaluation Awareness in Language Models: Representation, Verbalization, and Control