Even if you could make "perfectly realistic" safety evals, eval awareness would still be a problem.
Suppose you are worried that your AI might display a certain catastrophically harmful behavior on rare occasions. Unfortunately, it is hard to test whether this is the case, because your AI might avoid displaying this behavior when it believes it is in safety training/evaluation (e.g. because it is seeking a higher score, or because it is a goal-guarding schemer).
A naive solution is to try to make your safety eval more realistic. You might think that if the AI is unable to tell that it is a safety eval, as opposed to capabilities training/evaluation or deployment, it will display the behavior you're worried about and you'll catch it in the act.
But it's not enough for the AI to be uncertain whether it's in a safety eval. The AI could wait until it sees overwhelming evidence that it's not in a safety eval, and only then take the misaligned action. Whether the AI will actually do this depends on its motivations, but this strategy seems ideal if the AI is scheming to achieve goals beyond its episode. In this case, the only way making a "more realistic safety eval" would help is if you put in way, way more effort into it than the AI believed was possible. For a reasonably situationally-aware model, this seems very difficult.[1]
Others have made similar points, like Paul Christiano in 2019. Paul gives a toyish example where an AI acts aligned in every context, except when it sees that RSA-2048 has been factored, after which it acts misaligned. (If the AI knows that RSA-2048 wasn't factored during its training, and it doesn't expect it to be factored until after it's been deployed, seeing this is an unfakeable signal that it's in deployment.) Paul suggests that this may be addressed by proving that the AI shows misalignment on a "pseudo-input," like “a distribution over pairs of numbers that multiply together to RSA-2048.” (This could be done by using steering vectors