Contamination in public evals

Benchmarks are how the field keeps score. When a model's score on a public test rises, we'd like to believe its underlying ability rose too. That belief depends on an assumption that's increasingly hard to guarantee: that the model never saw the test during training.

How tests leak

Public benchmarks are, by design, public. Their questions and answers sit in repositories, papers, blog posts, course materials and discussion threads. Over time they're quoted, translated, paraphrased and reposted. A web-scale training corpus scraped after a benchmark's release is likely to contain some of it, often in forms that exact-match filters won't catch.

This is contamination: overlap between what a model trained on and what it's evaluated on. It doesn't require anyone to cheat. It's a natural consequence of training on the open web and testing on material that has been published on the open web.

Why it matters

A contaminated benchmark measures memory as well as skill. The model may answer correctly because it has seen the answer, not because it can work it out. Scores inflate, comparisons between models become unreliable, and progress on the benchmark can stop tracking progress on the task it was meant to represent.

The effect is hard to see from outside. Two models with the same score may have very different abilities on genuinely new problems. Teams that care about real capability end up building private evaluations, which then face the same pressure once they're shared.

Licensed data has a role here

Proprietary data that has never been published can't have leaked into public training sets in the first place. That makes it useful in two ways.

As training data, it adds signal without adding contamination: real conversations, real studies and real outcomes that no public test was built from. As evaluation data, held-out portions of licensed datasets can serve as fresh tests that no model has seen, as long as their licences keep them out of redistribution.

But licensed data can carry contamination too. An owner's archive might include material copied from public sources: a script that quotes a well-known dataset, a document that reproduces benchmark questions, a training corpus someone assembled years ago. Private doesn't automatically mean clean.

Checking before delivery

So we treat contamination as something to test for, not assume away. Before a dataset ships, it's checked against public benchmarks for overlap, including near-duplicates and paraphrases rather than only exact matches, and deduplicated against the public web. The results are part of the record that travels with the data.

The checks are imperfect, as all such checks are. Overlap can hide in translation or heavy paraphrase, and new benchmarks appear constantly. That's why the record says what was checked, against which sources, and when, so a lab can extend the check against its own evaluation suite.

What labs can do

Contamination won't be solved by any single supplier. But a few habits help: keep provenance for every training source; check new data against your evaluations before it enters a training run, not after; prefer data whose origin is documented; and hold back genuinely private test sets that are never published.

Benchmarks only work if what they measure is new to the model. The more of a training set's history is known and checked, the more its scores can be trusted.