Withheld test sets: what can a reader still verify?

A third-party evaluator often cannot publish the test data. Releasing it would let the next model train on it, so withholding is the responsible choice. But a reader of the evaluation report is then asked to take two things on trust that have nothing to do with the evaluator's competence, and both can be evidenced without publishing anything.

What AEF-1 says

AEF-1, the voluntary standard published by the AI Evaluator Forum in December 2025, addresses this directly. Condition 4.1, methodological transparency, states that Evaluators are permitted to withhold testing datasets to maintain the integrity of their evaluations, but should release representative examples of the data used in the evaluation at a minimum.

Condition 5.2, evaluation integrity, carries the recommendation that The evaluations methods were not gamed or leaked, and among its measures: Evaluators should also consider adding canaries to evaluation data to enable later detection of models that have been trained on evaluations.

What canaries cover, and what they do not

A canary is a marker placed in evaluation data so that a model which has seen the data can later be detected. It is a good answer to leakage and contamination. It is not an answer to provenance. A canary says nothing about when the claimed dataset and criteria came into existence, and nothing about whether an object disclosed after the fact is the same object that existed at that time. Those two questions are narrower than leakage, and reading AEF-1 in full we did not find a mechanism elsewhere in it for independently evidencing either point.

This is not a criticism of the standard. AEF-1 sets operating conditions for independence, access and transparency; it says of itself that it does not address the many critical methodological considerations for conducting scientifically valid AI evaluations. The gap described here sits in the space it deliberately leaves.

The two questions, stated precisely

• Timing. The report names a metric, a comparator, a threshold and a dataset. A reader cannot tell from the report when that combination came into existence. A threshold chosen after seeing the numbers and a threshold chosen beforehand produce identical prose.
• Substitution. If the dataset is withheld and later shown, in a dispute, to a regulator, or to a customer under NDA, nothing in the report ties what is shown then to what was used at the time. The withholding that protects the evaluation also removes the reader's ability to detect a swap.

How to close them without disclosing anything

Serialise the criteria object to canonical bytes, hash it, and obtain a time on that hash from a party the evaluator does not control, an RFC 3161 timestamp authority or a public transparency log. Publish the hash and the time. The dataset and thresholds stay private.

Later, when the object is revealed to whoever is entitled to see it, that party canonicalises it and checks it against the original commitment. If it reproduces the digest, it is the same object. If it does not, it is not, and that is visible without anyone having to argue about it.

The pattern is standardised. RFC 9943, which became IETF Standards Track in June 2026, treats a statement made over the hash of a payload rather than the full bytes as a normative mode, for payloads that are too large or too sensitive to send. Its Section 6.3 adds the amendment case: an issuer who knows of a changed state should register a new statement under the same subject, so a justified change to a threshold is dated and sits beside the original rather than replacing it. That matters here, because a standard that forbade all revision would be worse than one that dates it. Singapore's IMDA makes the same point from the practice side, recommending that a baseline be set before testing while allowing thresholds to be refined afterwards with proper justification.

What this establishes, and what it does not

• Establishes: a specific criteria object existed no later than the anchored time, and any later-revealed object either reproduces that digest or does not.
• Does not establish: that the evaluation ran after the commitment. Ordering of that kind is not what a time anchor proves.
• Does not establish: anything about whether the criteria were adequate or the result correct. This is evidence about an artefact, not a judgement about an evaluation.
• Is not an independence claim. AEF-1's own scope section treats assessment that works in the terms set by its developer as a lower standard of independence than an independent audit. A commitment does not change where an evaluation sits on that line.

Sources

• AEF-1, Minimum Operating Conditions for Independent Third Party AI Evaluations, AI Evaluator Forum, December 2025 — conditions 4.1 and 5.2, and the scope section
• RFC 9943, An Architecture for Trustworthy and Transparent Digital Supply Chains, IETF Standards Track, June 2026 — sections 6.2 and 6.3
• Sealed commitment: how do you prove criteria existed without disclosing them? — the mechanism in detail