Google DeepMind puts its AI in a cryptographic sealed box for testing

Key points

• Google DeepMind announced on 27 August 2026 what it calls the world's first double-blind evaluation of a proprietary frontier AI model.
• The test placed a Gemini Flash Lite model inside a cryptographically sealed environment, shielding test prompts from Google's training systems.
• Partners included the Singapore AI Safety Institute, OpenMined, AVERI and MLCommons.
• The setup is designed to stop benchmark contamination, where a model has already seen test questions before being scored.
• Google says prompts confined to the cryptographic environment can't be reused to train the model later.

Picture a student who accidentally sees the exam paper the night before. A perfect score the next morning tells you nothing about what they actually know.

That's roughly the problem the AI industry has with benchmarks, the standard tests used to score how smart or safe a model is. If the model has already seen the questions during training, the score is inflated and trust in it collapses.

Google DeepMind says it has a fix, and it involves cryptography.

What did Google DeepMind actually do?

On 27 August 2026 the lab announced a double-blind evaluation of one of its own models. Neither side could inspect the other's material. Gemini Flash Lite, a lightweight member of Google's Gemini family built for speed and low cost, was the subject.

Test prompts were held by outside groups and fed into what Google calls a cryptographic box, a secure computing environment where data going in and results coming out are mathematically shielded from the humans and systems on either side. Google's model never gets to keep or memorise the questions for next time.

Four partners ran the pilot with Google: the Singapore AI Safety Institute, a government-backed research body; OpenMined, a privacy-tech nonprofit; AVERI; and MLCommons, the group behind the widely used MLPerf benchmarks. It's the first time we've reported on both MLCommons and the Singapore AI Safety Institute here at AI2Day, having previously covered Google DeepMind's recent run of safety experiments on 21 August 2026.

Why does this matter to a normal person?

The scores AI companies quote are only as honest as the tests behind them. Regulators, hospitals and banks are increasingly choosing AI tools based on benchmark results. Inflated results put the wrong tool in the wrong job.

Benchmark contamination is a known problem. Models are trained on huge slices of the internet, and public test questions often leak into that training data by accident. A model that has quietly memorised the answer key looks smarter than it is.

Until now, the main safeguards have been paperwork: non-disclosure agreements, promises not to log prompts, trust. Useful, but not proof.

How is the cryptographic version different?

It replaces trust with maths. In a properly built secure environment, the evaluator sends in a question, gets a score back, and can be confident the raw question was never exposed to Google's training systems or staff.

Think of it like a sealed voting booth for AI. The ballot goes in, the count comes out, nobody sees who ticked what.

Google frames this as a step beyond existing zero-logging rules, not a replacement for them. The lab still runs internal safety checks and works with external red teams, specialists paid to try to break a model, before release.

What happens next?

Google DeepMind is calling this a pilot: one model, one round, lessons to learn. The bigger question is whether other frontier labs, OpenAI, Anthropic, Meta, xAI, agree to be tested the same way.

If they do, national AI Safety Institutes finally get something they've wanted for years: a way to grade the most powerful systems on the planet without having to trust the graders or the students.

If they don't, the industry keeps marking its own homework.

For now, one small Gemini model has sat an exam it genuinely couldn't have revised for. That, on its own, is new.