The Gold Standard of Experimental Design | Benchmark Contamination Through Pretraining, Data Lineage and Hidden Memorisation

1. Define the contamination event and evaluation claim

Back to contents

Specify whether contamination means exact test items, answer keys, solution traces, close paraphrases, shared source documents or task templates in training data. The relevant definition depends on the claim. Exact item exposure threatens item-level generalisation; broad domain knowledge may be legitimate learning.

Name the training stages in scope: pretraining, continued pretraining, supervised fine-tuning, preference data, tool logs and synthetic-data generation. A clean final fine-tuning set does not repair contaminated pretraining.

2. Build a lineage graph rather than a dataset list

Back to contents

Record source URLs, collection dates, snapshots, licences, transforms, deduplication, filters, benchmark versions and derived corpora. Hash exact records while preserving semantic provenance for paraphrases and shared source passages.

Lineage should connect each evaluation item to possible ancestors and mirrors. If training data are unavailable, document that opacity as a limitation rather than converting “not found” into “not present.”

3. Detect exact, partial and transformed overlap

Back to contents

Use exact hashes and normalised n-grams for direct copies, then test longer substrings, code structure, answer-option combinations and semantic similarity for transformed records. Examine both questions and answers; an explanation page may expose the solution without reproducing the prompt.

Thresholds create false positives and false negatives. Validate matches manually on a stratified sample and report which transformations the detector can and cannot find.

4. Separate memorisation from exploitation

Back to contents

A model can store aspects of an exposed item yet fail to use them under the evaluation prompt. Conversely, contamination can improve performance without verbatim regeneration. Compare exposed and unexposed items, vary prompts, test completion of canonical sequences and examine whether gains track exposure frequency.

Do not infer mechanism from accuracy alone. Distinguish evidence of corpus inclusion, memorised form and performance exploitation.

5. Use black-box contamination tests with calibrated claims

Back to contents

When weights and corpora are closed, tests can probe canonical ordering, guided completion, likelihood patterns or recognition among perturbed options. These methods depend on exchangeability, model access and behavioural assumptions. A negative result does not certify a clean corpus.

Predefine the test, account for multiple comparisons and retain controls known to be exposed and unexposed where possible. Report the false-positive guarantee or empirical error rate that actually applies.

6. Worked example: a reading benchmark hidden in pretraining

Back to contents

A language model scores 94% on a public reading benchmark and 76% on a newly written matched set. The training inventory contains no benchmark folder, so the original score is initially called clean. Lineage analysis later finds answer-explanation pages and translated copies in web snapshots used for pretraining.

The team reports the original score as potentially contaminated, compares exact and semantic overlap strata, and treats the fresh matched set as the primary generalisation estimate. It does not claim that all of the 18-point gap is memorisation because item difficulty and time also differ.

7. Design a confirmation set with controlled exposure

Back to contents

Create items after the training cutoff, restrict access, separate item writers from model developers and record every release. Match constructs, difficulty and scoring to the public benchmark without copying surface forms. Freeze the model and evaluation protocol before access.

A small fresh set may have wider uncertainty. Report intervals and item composition rather than trading contamination risk for unacknowledged sampling error.

8. Changed-context transfer check: genomic foundation models

Back to contents

Move from text benchmarks to a genomic model where sequences can overlap by ancestry, homology and shared reference assemblies. The transferable problem is training–test dependence and lineage. Exact-string deduplication is no longer enough.

Split by chromosome, organism, clade, collection site or time according to the scientific claim, and measure sequence similarity across partitions. Biological relatedness is not misconduct, but it changes what generalisation means.

9. Trace synthetic and derivative contamination

Back to contents

Synthetic training examples may be generated by models already exposed to the benchmark, and tutorials can reproduce its logic without its exact wording. Record generator models, prompts, retrieval sources and filtering. Test whether benchmark names, canonical ordering or answer patterns survive in derivatives.

Paraphrase-based filtering helps but can remove legitimate domain data and still miss conceptual leakage. Preserve an audit sample and state the detector’s scope.

10. Audit versions, cutoffs and every evaluation touchpoint

Back to contents

Retain training manifests, crawler dates, repository commits, benchmark versions, item hashes, semantic-match outputs, manual adjudications, model checkpoints and first-access logs. Verify whether evaluators, tools or retrieval systems can fetch public solutions during the test.

Contamination can occur after pretraining through prompt caches, retrieval indexes or repeated evaluation. The audit must cover the full system used to produce the score.

11. Frequently asked questions

Back to contents

Does a high score prove contamination? No. Does no exact overlap prove a clean benchmark? No; variants and shared sources may remain. Can contaminated benchmarks still be useful? Yes, for development or descriptive comparison when the limitation is explicit. Is a fresh private set automatically valid? No; construct match, sampling, security and statistical precision still matter.

12. The gold standard protects the meaning of generalisation

Back to contents

Benchmark integrity depends on provenance across training, derivation and evaluation. Define the threatened claim, map lineage, search exact and transformed overlap, distinguish memorisation from exploitation, calibrate black-box tests and reserve controlled confirmation evidence.

The gold standard does not dismiss every public benchmark or every strong model. It makes exposure uncertainty part of the design, so a performance claim does not quietly change from solving unseen problems to recognising material already absorbed by the system.