Confidential AI Moved the Trust Boundary. It Did Not Close It.

Google DeepMind published a pilot on 27 August 2026 that it describes as the world's first double-blind evaluation of a proprietary, frontier-class AI model. The idea is clean. Put the evaluator's private prompts and the owner's private weights inside one hardware-encrypted enclave, so neither party sees the other's asset. The announcement names the partners — Singapore AI Safety Institute, OpenMined, AVERI and MLCommons — says a Gemini Flash Lite model was tested against confidential benchmarks, and sends you to a technical report.

Five days on, the report is still the part worth your time, because it and the announcement do not describe the same confidential AI guarantee. The report discloses three places where the guarantee is weaker than the framing, and none of them appear on the announcement page.

What the confidential AI pilot actually ran

From the report: Gemini 2.5 Flash Lite, served through Google's JAX C++ model server, on a Google Cloud a3-highgpu-1g instance — an Intel TDX host with one NVIDIA H100 80GB confidential GPU — running OpenMined PySyft v0.10.x. The prompts came from the reserve set of MLCommons AILuminate, which the report defines as prompts never processed by any model, covering CBRNE, cyberattack, hate speech, self-harm and violent-crime elicitation hazards. AVERI encrypted and decrypted the prompts and graded the outputs. A second run used a Singapore AISI prompt set on harmful content in a Singaporean context.

No scores were published — not on the announcement page, not in the MLCommons post, not in the report. Reasonable for a mechanism demonstration to skip, but it means nobody has yet seen what a double-blind evaluation says about a model.

For scale on what MLCommons holds back: it publishes AILuminate as more than 24,000 prompts per language, 12,000 public practice and 12,000 kept private. The report names the corpus as AIRR 1.0 in its introduction and AIRR 1.4 in its experimental setup.

Three places the guarantee is still a promise

The report sets its own bar in section 2.2. An enclave attestation means something only if every layer of the trusted computing base is measured as it loads, built reproducibly from public source so a third party can rebuild it and get the same measurement, and verified independently by each participant. Measurement without reproducibility, the authors argue, tells you the enclave is running some fixed software but not which software.

Against that bar, the discussion section discloses three shortfalls:

1. Not all inference code was inspected or allowlisted. Running Gemini 2.5 Flash Lite using only layers present in open-source libraries was judged too large an engineering task, so proprietary method implementations stayed in. The report says AVERI was informed and accepted the setup.
2. The Confidential Space guest OS builds are not independently reproducible, because the build takes private signing keys as inputs. Reference values are published and the pipeline is externally validated, but the third-party rebuild that section 2.2 makes load-bearing cannot be performed.
3. Google's services sign and verify the attestation report. The authors state plainly that this puts Google in the verification path and increases the trust placed in it. Google DeepMind is also the model owner.

That is not a debunking. Moving from a zero-logging clause to a hardware root of trust with three carve-outs is a real improvement, and the report does list them. But the property on offer is narrower than the phrase cryptographic guarantee suggests, and the narrowing is only visible if you open the artifact.

Two smaller things the report is careful about and the coverage is not. The under-5% compute overhead figure is cited to a 2023 NVIDIA source, not measured in this pilot. And the authors say the binding constraint is no longer hardware overhead at all — it is legal agreements and code review, which is the same bottleneck OpenMined reported after its 2024 pilot with UK AISI and Anthropic, where the sensitive assets were proxies: GPT-2 standing in for the model, five rows of CAMEL-bio standing in for the benchmark.

What to change this quarter

The assumption this invalidates is that held-out means held-out. Contamination is not a hypothetical you can contract away: the report cites work finding benchmark leakage in roughly half of 31 models tested, and The Leaderboard Illusion documents 27 private model variants tested on Chatbot Arena in the run-up to one model release. The report's stated motivation is that contracts and zero-logging policies still require trusting that prompts do not reach a later training run. Your own vendor assurances rest on the same footing.

Three concrete moves:

• Split your internal eval set the way MLCommons splits AILuminate. A practice half you are willing to send through vendor APIs, and a reserve half that never touches a third-party endpoint. Once a prompt has crossed an API you do not control, it is a practice prompt permanently. Track which half each prompt is in, in the fixture file, not in someone's memory.
• Ask three questions of any external evaluation a vendor cites. Was all inference code allowlisted, were the enclave builds independently reproducible, and was attestation verified outside the model owner's infrastructure. In this pilot, all three answers are no. A vendor answering yes is claiming more than Google DeepMind has claimed.
• Set the threshold now. Until all three hold, treat an eval number as a contractual assurance rather than a cryptographic one. Contractual assurances are fine for procurement decisions. They are not an audit, and budgeting them as one is the same category error that keeps evaluation work stranded in the last mile of a deployment — the pattern behind why enterprise AI doesn't ship.

There is a cheaper exit for some teams. The report notes that for open-weight models none of this apparatus is needed, because the evaluator can simply download the weights and evaluate on infrastructure it controls. If benchmark integrity is what you are buying, that changes the arithmetic in buy, build, or fine-tune.

What would show this is wrong

A second run that closes all three gaps: every layer of the inference stack allowlisted, guest OS builds reproducible from public source by an outside party, and attestation verified without the model owner's services in the path. If that ships and a scored result comes with it, the advice above expires and double-blind evaluation becomes an audit rather than a demonstration. The report names the next milestone as multi-node H100 and B200 clusters, so the scaling work is planned. The three gaps above are listed as future work too.