When an outside group evaluates a company's AI model, the group wants to keep its test questions secret so future models don't accidentally learn them. The company wants to keep its model weights secret to protect its intellectual property. Both sides usually have to trust each other not to peek, but that trust is hard to guarantee.
The researchers built a system that runs both the test questions and the model inside a special hardware environment called a secure enclave, which encrypts all data while it is in memory. The model owner and the evaluator each send in their assets, and neither can see the other's data during the evaluation. This approach was tested on Google Cloud using an NVIDIA H100 enclave.
The live test evaluated Google DeepMind's Gemini 2.5 Flash Lite against a private safety benchmark called AILuminate. The system successfully kept both the test prompts and the model weights confidential with less than 5% compute overhead, showing that independent, secure evaluations of proprietary models are now possible.