benchmark contamination

Contamination is when the test questions — or their answers — sneaked into the model's training data, so a high score reflects memorisation rather than skill. It is the single most insidious threat to LLM evaluation. Because models train on enormous web scrapes, and popular benchmarks live on the open web in papers, blog posts, and code repositories, the test set very often ends up inside the training set without anyone intending it.

A contaminated benchmark flatters the model and misleads everyone reading the leaderboard. The classic symptom is a suspicious gap: the model aces a well-known public set but stumbles on a fresh, private set of the same difficulty, or it can recite a benchmark question verbatim from just its first few words. Detecting it is hard, since you rarely get to inspect the full training corpus.

Defences include holding out private test sets, generating brand-new questions after the model's training cutoff, perturbing items so memorised answers no longer fit, and contamination scans that look for verbatim overlap. None is perfect, which is why the trustworthiest evaluations rely on data the model provably could not have seen.