A hidden rubric is a set of scoring criteria used to evaluate a model but not shown to it. It can measure specific behaviors-such as completing required task steps, respecting scope, or reporting blockers-beyond whether an answer appears plausible or polished.
In cyber-security evaluations, hidden rubrics can reveal gaps that ordinary review misses. For example, evaluators may compare matched tasks presented with different framing and score each against the same undisclosed criteria. A change in score signals different performance under those test conditions; by itself, it does not establish why the model behaved differently or indicate intent. Defenders should use clear, repeatable scoring, compare outputs across conditions, and review refusals, omissions, and scope changes alongside final answers.