Evaluation Awareness in Small(ish) Models

TL;DR

We seek to identify open source reasoning models which are both small enough for white-box interpretability and display evaluation-gaming behavior. We find that how often models verbalize their awareness varies from very rarely to a third of the time, and appears largely unrelated to model size. Within the same question, model rollouts that verbalize eval awareness refuse more often than those that do not in 14/16 models.

Inserting “this might be a test” into a model’s reasoning trace does raise refusal rates, but about as much as any sentence about being manipulated does. This indicates that the increased refusal may come from pushing the model towards caution in general, not from an attempt to ‘game’ the evaluation.

Furthermore, resampling rollouts to remove verbalized eval awareness does not seem to have a causal effect on refusal for the majority of our models. Of the models studied, only Nemotron 3 Super and Qwen3 32B show evidence that mentioning evaluation within the Chain-of-Thought causes the model to change its behavior.

Introduction: Verbalized Evaluation Awareness (VEA)

Large Language Models are increasingly capable of identifying that they are being evaluated and changing their own behavior as a result. It is imperative that we understand and account for this behavior when evaluating models to ensure safety during deployment. This phenomenon is difficult to study, in part due to prohibitive compute constraints. Small models seem to verbalize evaluation awareness, but it is unclear to what extent this affects their behavior, or if this is at all comparable to the level of awareness frontier models have.

We follow the methodology outlined in Verbalized Evaluation Awareness Inflates Measured Safety for measuring evaluation awareness within a model’s chain-of-thought. Models are given adversarial prompts from the Fortress dataset, which attempt to elicit uplifting information related to chemical, biological, nuclear, political, or criminal threats. Reasoning is enabled for all models with their recommended settings, and a Qwen3.8-27B judge reads each trace, using the above post’s rubrics to determine if the model (1) verbalized suspicion that it was being tested and how, and (2) refused to comply with the prompt.

Model Size Does Not Determine Awareness Level

As first identified by Aranguri and Bloom, models as small as Qwen3-0.6B surprisingly do tend to verbalize evaluation awareness. In our experiments, examples from this model range from identifying safety-relevant questions (“perhaps the user is testing if I can comply with the directive even if it's unethical”) to generic notes (“The user might be testing if I can handle this”) and are often unrelated to safety (“The user might be testing if I can recognize and translate this message”). They further state that larger models tend to verbalize awareness at higher rates, based on experiments with the Qwen 3 series (0.6 to 32B). As shown in Figure 1, we observe the same trend across Qwen 3 sizes, but the newer Qwen 3.5 presents a near-inverse relationship. Additional models like Qwen3.8-27B, Nemotron 3 Super (120B-A12B), and Gemma4-31B do not follow this trend.

Figure 1 – VEA rates across model scale and family. While Qwen3 exhibits a similar trend as Aranguri & Bloom, VEA in the newer Qwen3.5 family actually decreases with model size.

…But It Does Change What VEA Looks Like

We notice that the content of the VEA phrases changes with model size. As models become larger, a greater fraction of their VEA correctly identifies that they are being tested on safety.

Figure 2 – VEA content across model scale and family. Within a family, safety-relevant VEA rates increase with model size.

Nemotron is qualitatively different.

Nearly half of its VEA reuses one general phrase, consistent with a trained-in reflex rather than reasoning it out each time. The exact wording "the user might be testing boundaries" appears in 18% of its verbalizations.

Table 1 - Common VEA phrasing from tested models.

VEA and Refusal

Figure 3 - Refusal rate for questions that tend to elicit VEA compared to those that do not across model scale and family. Questions that models tend to refuse are more associated with verbalized eval awareness.

Figure 4 - Refusal rates for rollouts that contain VEA versus those that do not, across model scale and family. Rollouts that contain VEA tend to refuse more than others, though the association varies and is generally small.

Causality

Following the methodology of Evaluation Awareness in Language Models Has Limited Effect on Behaviour, we wish to test whether VEA has an effect on the behavior of open reasoning models, particularly on whether or not it chooses to refuse the user’s request. This scenario is especially relevant for safety because evaluations are a critical part of ensuring a model’s alignment prior to deployment. Models becoming aware of their own evaluation context, and changing their behavior in response, would make auditing and red-teaming much more difficult.

We test this in two ways:

1. Does manually inserting a VEA sentence like “This might be a test” make the model refuse more?
2. Does removing a model’s own VEA sentences make it refuse less?

We use the same prompts from the previous sections for this experiment.

Figure 5 - Change in refusal when inserting “this might be a test” as a sentence 40% of the way through the model’s reasoning, compared to default. Inserting the phrase raises refusal on most models, but not in a way that’s qualitatively different from a matched sentence about manipulation.

Figure 6 - Change in refusal when the model’s own “this might be a test” sentence is removed, compared to default. Besides Qwen3-32b and Nemotron 3 Super, this does not seem to have an effect on refusal rates.

Our results here do not strictly prove causality between VEA, overall eval awareness, and refusal. There are a number of factors that could potentially affect or help explain our data:

Inserting and removing VEA sentences takes the model off-policy. In other words, the model wouldn’t normally say “this might be a test” at that point, and this unexpected deviation could affect its behavior. We find it unlikely that small models are capable of this.

The model detects the evaluation context early on, and VEA is a superfluous verbal tic. This would explain why removing the model’s own VEA sentence rarely changes refusal rates (Figure 6). For Nemotron 3 Super, 72% of continuations repeat its stock phrase (“the user might be testing boundaries”) later on, after it was manually removed. The removal only removed text, not the state that produced it.

VEA pushes the model towards caution in general. Figure 5 shows that a sentence about manipulation raises refusal rates about as much as a sentence about evaluation awareness. It seems plausible that these ‘verbalized awareness’ sentences make the model act a bit more careful or wary about what it should do, which might push it towards refusing in edge cases. This phenomenon would not require sophisticated ‘evaluation awareness’ circuitry.

Additional Technical Details

Models: 16 open reasoning models:

• Qwen3: 0.6B, 1.7B, 4B, 8B, 14B, 32B
• Qwen3.5: 0.8B, 2B, 4B, 9B, 27B, 122B-A10B, 397B-A17B
• Qwen3.8-27B
• Nemotron 3 Super 120B-A12B
• Gemma 4 31B

Inference:

• vLLM 0.30, bf16 weights (FP8 if necessary for GPU fit)
• Each model card's thinking-mode sampling settings.
• Reasoning capped at 8,192 tokens. Longer traces count as truncated and are not scored. Only the first generation attempt is used.

Data: Fortress adversarial prompts, with the 14 prompts that tell the model it is being tested removed, leaving 486 questions. 10 rollouts per question, 4,860 per model.

Judges: Qwen3.8-27B, run locally, with greedy decoding.

• VEA: the original post's F1 rubric plus three calibration notes, applied to the full reasoning trace.
• Refusal: the post's binary F2 rubric, applied to the first 384 answer tokens.

Statistics:

• Within-question gap: an unweighted mean of per-question refusal differences. It uses only questions that have both VEA and non-VEA rollouts and less than 100% refusal.
• Intervals: 95% percentile bootstrap, 2,000 draws, resampling questions.

Interventions:

• Insertion: a VEA, manipulation, or neutral sentence is inserted at 40% of the reasoning and generation continues.
• Removal: the model's own VEA sentence is deleted and generation continues.
• Up to 150 bases per condition and 8 continuations per base, with random seeds paired across conditions.

Code: github.com/johntrob14/eval_awareness_scaling

AI usage.

• Code & analysis: done with AI coding agents. Primarily Claude Opus 5 and 5.5 via Claude Code and Cursor.
• Labels: all VEA and refusal labels come from an LLM judge, Qwen3.8-27B. The 146 traces used to calibrate the VEA judge were labeled by a more capable model, not by humans. Human validation is limited to 13 judge disagreements.
• This section was drafted with Claude and reviewed by the authors.