benchmark contamination

If a student somehow gets the exact exam questions and answers the night before, their high score tells you nothing about whether they learned the subject — only that they saw the test. AI models can suffer the same problem on a massive scale. They are trained on enormous slices of the internet, and the internet contains the very benchmark tests used to evaluate them. Benchmark contamination is when test questions (or their answers) leaked into a model's training data, so its score reflects memorization rather than genuine ability.

Because training datasets are huge and not fully documented, it is often hard to know whether a popular benchmark was swept in. A contaminated model can appear to 'solve' problems it has effectively already seen, inflating its scores and making comparisons between models unreliable. This is one form of a broader issue, benchmark gaming, where scores stop tracking real capability — whether through contamination, or through tuning a model to a specific benchmark's quirks. It is a concrete instance of Goodhart's law: once a benchmark becomes the target, it stops being a good measure.

For safety, contamination cuts both ways and is mostly insidious. It can make a model look more capable than it is (good for marketing, bad for honest assessment), and it erodes trust in the very numbers used to decide whether a model is safe to release. Evaluators fight it with held-out and freshly written tests, private question sets, and contamination checks — but the arms race is permanent, because today's private benchmark is tomorrow's public training data. A headline benchmark score should therefore be read with a grain of salt about what the model actually trained on.