I used to assume the charts in vendor blog posts were roughly honest, then I started watching what happened to the teams that bought models based on them. Six months after the chart-driven procurement, the chosen model would hallucinate more than the runner up, and nobody could quite explain why, because the chart said it was better. The honest explanation, which rarely gets said in the meeting, is that the chart was unreliable in ways nobody wanted to measure. Google just published an evaluation technique aimed at exactly that gap. The technique borrows from cryptography, costs almost nothing to run, and is the most interesting thing to happen to AI benchmarks in years.
The reason the chart was unreliable all along
Frontier models train on most of the public web. Public benchmarks live on the public web. When the training data and the test questions share the same haystack, the model that memorizes the haystack will ace the test without learning anything that generalizes to real production work. Researchers use the phrase incidental contamination to describe this, which is a kindness. The honest name is that the test is broken, and the score has been unreliable for as long as the test has been on the open web.
There is also a feedback loop that makes the situation worse every year. When a benchmark is visible, labs optimize for it. When labs optimize for it, the benchmark stops measuring what it claimed to measure. Each round of tuning produces a number that is technically accurate and practically meaningless. Half lives are getting shorter. The gap between benchmark number and production behavior has been widening for a while, and nothing on the public benchmark side has been closing it.
A test the model cannot have seen
The fix Google published works like a sealed bid auction. A test creator assembles a question set, encrypts every question, and publishes a hash of the original plaintext alongside the encrypted bundle. The hash is a short digital fingerprint of the questions; if the questions change, the fingerprint changes too. The model under test cannot decrypt the bundle, so it cannot have seen the questions during training. After the model produces its answers, the test creator releases the decryption key, the answers get scored, and any outside observer can check that the published fingerprint matches the original committed question set.
This idea is older than most AI labs. Voting protocols use it. Sealed bid auctions use it. Any setting where one party needs to lock in a value up front and prove later that nobody changed it uses some version of the same trick. The novel part is applying it to AI evaluation, where the temptation to cheat, accidentally or otherwise, has been enormous and the audit trail has been close to zero.
Three practical limits deserve attention. The scheme protects the questions from the model, not from a careless engineer who pastes them into a chat channel. The questions themselves still need to represent real production work; a blind test of toy arithmetic is still a toy test. And the commitment only counts if an outside party can verify the fingerprint. A fingerprint stored privately on a vendor server is not a commitment. It is a press release with cryptography language on top.
What the design actually prevents
A lab that wanted to game the result runs into several blocked paths. Question selection has to happen before the commitment, so the test cannot be quietly trimmed for easy items. The fingerprint locks the questions in place, so swapping them after the fact would be obvious to anyone holding the original question set. Sampling parameters can be required to be reproducible, so a lab cannot quietly loosen randomness until a desired score appears. And an outside auditor holding a copy of the original questions can rerun the entire evaluation from scratch and compare results.
No audit design is bulletproof. A motivated cheater with full control of the test infrastructure will always find some edge case to exploit. The relevant change is that the cost of cheating just went up. When the easy path stops being easy, honest behavior tends to become the default, not because anyone got more ethical, but because the engineering stopped rewarding the alternative.
A related change is worth naming. Once a credible blind evaluation exists, the incentive to game public benchmarks drops. Why bother memorizing a leaked copy of MMLU when the score that actually matters is the one you cannot see? Over time, that should push vendors to compete on the dimensions real users care about, like consistency on weird prompts, refusal behavior under pressure, and the long middle of context windows where production work actually happens.
How to pick a model next quarter without lying to yourself
The honest move is to downgrade leaderboard numbers from decision driver to one signal among several. Read the writeup, not the chart. Look for the protocol behind any number you might act on, and look for at least one party that is not the lab itself holding the audit keys. If you cannot find either, treat the number as advertising and price it accordingly.
A few habits help when the next round of vendor numbers lands:
- Demand the protocol before the score. A number without a written methodology is decoration, not measurement.
- Find an outside auditor. A self-administered audit is not an audit.
- Skim the question list. A rigorous audit of toy questions still measures a toy.
- Ask for head to head comparisons. A single number without a peer on the same set is meaningless.
If only one party ever runs the protocol, the whole exercise is theater. The proof is in independent reruns, and the field has not produced those yet. Until it does, the right framing is “promising proof of concept,” not “solved problem.”
Trade-offs
The scheme demands a verifier. Someone outside the lab has to hold the original question set, watch the run happen, and certify the score. Without that role, the protocol collapses into another private benchmark dressed up in hashes. The cost is real and it has to be paid in advance, not after the headline number lands.
Question design is the second cost. A commitment scheme guards against tampering with the questions, but it does not make bad questions good. Building a question pool that maps to real production workloads is open ended work, and the field has barely started. Expect the first round of blind tests to be narrower than anyone wants to admit.
Time is the third cost. Running a credible multi party audit takes weeks, not minutes, and the question pool has to be frozen before the model gets near it. That timeline is not compatible with the monthly leaderboard churn the industry is used to. Either the industry slows down, or it accepts faster but weaker audits. Neither outcome is free.
Bottom line
Pick your next model from the methodology, not the score. And if you only do one thing this week, spend ten minutes with the methodology section of the Google paper. That is where you will find out whether the proposal is real engineering or a marketing artifact. You will know the difference before you finish your coffee.