In AI evaluation, access is not evidence

Independent evaluators are getting inside AI companies.

独立评估者正在进入人工智能公司。

Now the field has to make their results mean something.

现在该领域必须让他们的结果有意义。

Two leading AI companies have just committed to giving outside evaluators a seat inside the building.

两家领先的人工智能公司刚刚承诺为外部评估人员提供在大楼内的席位。

On September 12, Anthropic’s Dario Amodei committed to giving independent evaluators “ongoing, employee-like access” to verify the company’s safety practices, with the right to publish without Anthropic’s editorial control.

9 月 12 日，Anthropic 的 Dario Amodei 承诺为独立评估人员提供“持续的、员工般的访问权限”，以验证公司的安全实践，并有权在没有 Anthropic 编辑控制的情况下进行发布。

OpenAI’s Sam Altman said OpenAI would do the same .

OpenAI 的 Sam Altman 表示 OpenAI 也会做同样的事情。

Independent researchers need that access.

独立研究人员需要这种访问权限。

But access and credible evaluation are not the same thing, and treating the first as the second would waste this opportunity.

但准入和可信评估并不是一回事，如果把前者当成后者就会浪费这个机会。

The hard part begins after evaluators get access: What do the resulting tests tell us?

评估人员获得访问权后，困难的部分就开始了：测试结果告诉我们什么？

If two groups evaluate the same AI system and reach different conclusions, can we determine whether the difference came from the test, the evaluator, their level of access, ordinary variation, or a change in the system itself?

如果两个小组评估同一个人工智能系统并得出不同的结论，我们能否确定差异是来自测试、评估者、他们的访问级别、普通变化还是系统本身的变化？

Too often, we cannot.

很多时候，我们做不到。

Re-evaluations of widely used benchmarks have produced materially different scores and, in some cases, different model rankings .

对广泛使用的基准的重新评估产生了截然不同的分数，在某些情况下，还产生了不同的模型排名。

The same problem appears in frontier safety evaluation.

同样的问题也出现在边境安全评价中。

In May 2025, Anthropic disclosed that Apollo Research had tested an early version of Anthropic’s Claude Opus 4 and advised against deploying it in situations where strategic deception is instrumentally useful, because of high rates of strategic deception.

2025 年 5 月，Anthropic 透露，Apollo Research 测试了 Anthropic 的 Claude Opus 4 的早期版本，并建议不要将其部署在战略欺骗有用的情况下，因为战略欺骗的发生率很高。

Anthropic reported that the behavior stemmed in part from a training data omission which Anthropic said it had since addressed release and that, based on its own audits, it believed the final model’s behavior in such scenarios was “roughly in line with other deployed models.” Anthropic publicly disclosed all of this.

Anthropic 报告称，该行为部分源于训练数据遗漏，Anthropic 表示已解决发布问题，并且根据自己的审计，它认为最终模型在此类场景中的行为“与其他部署的模型大致一致”。 Anthropic公开披露了这一切。

But because Apollo’s tests were not rerun on the final system, an outside reader could not determine how much of the difference reflected the reported correction rather than other differences between the evaluations.

但由于阿波罗的测试没有在最终系统上重新运行，外部读者无法确定有多少差异反映了报告的修正，而不是评估之间的其他差异。

If the gap is visible even where disclosure is this extensive, it is unlikely to be narrower where it is not.

如果即使在信息披露如此广泛的情况下，差距仍然显而易见，那么在信息披露不广泛的情况下，差距也不太可能缩小。

That is the measurement gap.

这就是测量间隙。

Tests are proliferating—benchmarks, red teaming, safety and capability evaluations, audits, post-deployment monitoring—but the field lacks the infrastructure that would let their results become comparable and cumulative evidence .

测试正在激增——基准、红队、安全和能力评估、审计、部署后监控——但该领域缺乏让其结果成为可比较和累积证据的基础设施。

When we developed the NIST AI Risk Management Framework , one of its four core functions was “Measure,” which asks for methods that are valid, reliable, and documented well enough that others can interpret the results.

当我们开发 NIST 人工智能风险管理框架时，其四个核心功能之一是“测量”，它要求方法有效、可靠且记录充分，以便其他人可以解释结果。

The field has adopted that vocabulary faster than the practice.

该领域采用该词汇的速度比实践更快。

The task now is to make AI measurement work more like measurement in mature fields , where results are interpretable, independently comparable, and validated against the outcomes they are meant to inform.

现在的任务是让人工智能测量更像成熟领域的测量，其结果是可解释的、独立可比的，并可根据其所要传达的结果进行验证。

Independence, in particular, is more than distance.

尤其是，独立不仅仅是距离。

An external evaluator working under restrictive access or publication terms may have less practical independence than an internal team with technical autonomy and protected reporting rights.

在限制性访问或发布条款下工作的外部评估员的实际独立性可能不如具有技术自主权和受保护报告权的内部团队。

Useful questions are: Who controls the methodology?

有用的问题是：谁控制该方法？

Who controls access?

谁控制访问？

Who funds the work?

谁资助这项工作？

Who controls publication?

谁控制出版？

Those dependencies should be disclosed and, where possible, constrained.

应披露这些依赖性，并在可能的情况下对其进行限制。

An evaluation is not made credible simply because someone outside the company ran it—or, for that matter, someone inside it.

评估并不能仅仅因为公司外部的人或者公司内部的人进行评估而变得可信。

Four practical steps could turn greater access into better evidence.

四个实际步骤可以将更多的获取途径转化为更好的证据。

They apply to the whole evaluation ecosystem—academic labs, safety institutes, commercial auditors, developers’ own teams—not only to the evaluators now being embedded at two companies.

它们适用于整个评估生态系统——学术实验室、安全机构、商业审计师、开发人员自己的团队——而不仅仅是现在嵌入两家公司的评估人员。

First, establish minimum reporting standards.

首先，制定最低报告标准。

Every evaluation report should state what was measured; the system and version tested, including configuration and safeguards; the protocol and conditions; the evaluator’s level of access; uncertainty and limitations; when the evaluation was conducted; and who conducted, funded, and controlled publication of the work.

每份评估报告均应说明测量的内容；测试的系统和版本，包括配置和保障措施；协议和条件；评估者的访问级别；不确定性和局限性；何时进行评估；谁进行、资助和控制该作品的出版。

Traceability—knowing what system was tested, how, and when—matters especially for AI, because models and the systems around them change continually through fine-tuning and updates to prompts, safeguards, tools, and retrieval.

可追溯性——了解测试了什么系统、如何测试以及何时测试——对于人工智能来说尤其重要，因为模型及其周围的系统通过对提示、防护措施、工具和检索的微调和更新而不断变化。

Funders, journals, standards bodies, and procurement offices can require these disclosures now, and government procurement is an especially powerful lever.

资助者、期刊、标准机构和采购办公室现在可以要求披露这些信息，而政府采购是一个特别强大的杠杆。

This would standardize disclosure, not method.

这将标准化披露，而不是方法。

A young field should remain free to improve its methods while being required to say clearly what it did.

一个年轻的领域应该自由地改进其方法，同时被要求清楚地说明它做了什么。

Second, compare evaluations of the same systems.

其次，比较相同系统的评价。

Mature measurement fields routinely use interlaboratory comparisons : where multiple laboratories examine the same reference object so that disagreement reveals how much results depend on protocol, environment, instrument, or analyst.

成熟的测量领域通常使用实验室间比较：多个实验室检查相同的参考对象，以便分歧揭示结果在多大程度上取决于协议、环境、仪器或分析人员。

AI safety institutes, standards bodies, national measurement institutions, and other trusted intermediaries could convene analogous exercises.

人工智能安全机构、标准机构、国家测量机构和其他值得信赖的中介机构可以召开类似的演习。

Different evaluators should test overlapping systems and questions, compare findings, and investigate disagreement.

不同的评估者应该测试重叠的系统和问题，比较结果并调查分歧。

Where results converge across independent methods, confidence increases.

当独立方法的结果收敛时，置信度就会增加。

Where they diverge, the differences become evidence about which choices matter and where methods need to improve.

当它们存在分歧时，差异就会成为哪些选择重要以及哪些方法需要改进的证据。

The point is not simply to reproduce a score.

重点不仅仅是重现乐谱。

Evaluators using the same benchmark, prompts, or automated grader can reproduce the same blind spots.

使用相同基准、提示或自动评分器的评估者可以重现相同的盲点。

Comparability also applies to qualitative work: surveys of red-teaming practice find wide variation in purpose, setting, and reporting.

可比性也适用于定性工作：对红队实践的调查发现，目的、设置和报告存在很大差异。

Recording the system, approach, coverage, effort, and findings would make it possible to tell whether teams observed the same kinds of behavior under comparable conditions.

记录系统、方法、覆盖范围、工作量和结果将能够判断团队是否在可比条件下观察到相同类型的行为。

The goal is to make agreement and disagreement informative enough that one evaluation teaches us something about another.

目标是让一致和分歧提供足够的信息，以便一种评估可以让我们了解另一种评估。

Third, build shared evaluation infrastructure.

三是构建共享评价基础设施。

Credible evaluation requires resources that individual evaluators cannot easily maintain and that developers should not control alone: these include held-out or refreshed test materials , secure environments for testing potentially dangerous capabilities, reference protocols that enable comparison over time, and common ways to record results.

可信的评估需要个人评估者无法轻松维护且开发人员不应单独控制的资源：这些资源包括保留或更新的测试材料、用于测试潜在危险功能的安全环境、能够随时间进行比较的参考协议以及记录结果的常用方法。

That infrastructure should test not only what a system can do but whether its safeguards work and how it behaves under realistic conditions.

该基础设施不仅应该测试系统可以做什么，还应该测试其保障措施是否有效以及它在现实条件下的行为方式。

Increasingly, that means evaluating the system as deployed , not only the underlying model.

这越来越意味着评估部署时的系统，而不仅仅是底层模型。

The hardest evaluations of frontier systems will still require developer cooperation and often developer compute.

对前沿系统最困难的评估仍然需要开发人员的合作，并且通常需要开发人员的计算。

Developer cooperation may be necessary; developer control over methods, interpretation, or publication need not be.

可能需要开发者合作；开发人员无需控制方法、解释或发布。

Some of these capabilities are public goods and will require public, philanthropic, or consortium funding structured so that no single developer can determine whether the infrastructure continues to exist or whether unfavorable findings are reported.

其中一些功能是公共产品，需要公共、慈善或财团的资助，以便任何一个开发商都无法确定基础设施是否继续存在或是否报告了不利的调查结果。

Fourth, validate evaluations against the outcomes they are intended to inform.

第四，根据评估结果来验证评估结果。

Not every evaluation is meant to predict deployment outcomes; a capability test can be valid without predicting incidents .

并非每个评估都是为了预测部署结果；能力测试可以在不预测事件的情况下有效。

But when evaluations support claims about safety, reliability, or deployment risk, we should ask whether the evidence actually bears on those claims.

但是，当评估支持有关安全性、可靠性或部署风险的主张时，我们应该询问证据是否确实支持这些主张。

That means connecting pre-deployment evaluations with deployment experience.

这意味着将部署前评估与部署经验联系起来。

When an important failure occurs, did pre-deployment evaluation detect the relevant capability or failure mode?

当发生重要故障时，部署前评估是否检测到相关能力或故障模式？

Underestimate it?

低估它？

Miss it entirely?

完全错过了吗？

Answering requires traceability after deployment as well as before, and enough information about the system, configuration, safeguards, and conditions to link what happened to what was tested.

回答需要在部署之后和部署之前具有可追溯性，以及有关系统、配置、防护措施和条件的足够信息，以将发生的情况与测试的情况联系起来。

This will be the slowest step.

这将是最慢的一步。

Incident reporting today is fragmentary, serious incidents may be rare, and when testing leads to mitigation we cannot directly observe what would have happened without it.

今天的事件报告是零碎的，严重的事件可能很少见，当测试导致缓解时，我们无法直接观察如果没有它会发生什么。

Better incident reporting and system traceability are therefore prerequisites for validation.

因此，更好的事件报告和系统可追溯性是验证的先决条件。

Even imperfect evidence can tell us where pre-deployment testing is informative—and where monitoring and other oversight must carry more of the load.

即使证据不完善，也可以告诉我们哪些部署前测试可以提供信息，哪些地方必须进行监控和其他监督。

A year from now, take an important AI system and ask: Can independent groups produce results that can be meaningfully compared?

一年后，以一个重要的人工智能系统为例：独立团体能否产生可进行有意义比较的结果？

Can a reader tell what each tested and under what conditions?

读者能否说出每个测试的内容以及在什么条件下进行的测试？

Can important disagreements be explained?

重要的分歧可以解释吗？

Where evaluations support deployment claims, does subsequent experience support those claims?

如果评估支持部署主张，后续经验是否支持这些主张？

If so, AI evaluation will be starting to function as a measurement system.

如果是这样，人工智能评估将开始发挥测量系统的作用。

The embedded evaluators now being placed at Anthropic and OpenAI are a natural place to start: They could be the first to work under common reporting standards, and their findings could be recorded in a form that outside groups can compare against.

现在安置在 Anthropic 和 OpenAI 的嵌入式评估人员是一个自然的起点：他们可能是第一个在通用报告标准下工作的人，他们的发现可以以外部团体可以比较的形式记录下来。

But they are one part of a much larger ecosystem, and the measurement gap runs through all of it.

但它们是一个更大的生态系统的一部分，测量差距贯穿整个生态系统。

Access is an input, not the objective.

访问是一种输入，而不是目标。

The goal is not simply more evaluation.

目标不仅仅是更多评估。

It is evidence we know how to interpret, compare, and trust.

它是我们知道如何解释、比较和信任的证据。