What is it?
Imagine a student who saw the exam questions beforehand. Their high mark says little about what they can do. AI models are trained on enormous amounts of web text, which can include the very tests used to judge them.
Also known as: data contamination, test set leakage, training on the test set, benchmark leakage, contaminated benchmark, LiveCodeBench, canary string, memorization benchmarks.
Technical definition
Contamination can be exact (verbatim overlap), partial (paraphrases, translations) or indirect (derived datasets, solutions on forums). Detection methods include n-gram overlap checks, membership-inference-style probes and performance gaps between original and rephrased/perturbed or newer items; none is conclusive, especially for closed training data. Mitigations include time-split ("live") benchmarks, private test sets, dynamic generation and rephrasing, and canary strings.
Entity type: concept · Freshness class: evolving.
When should I use it?
Consider whenever you rely on a public benchmark number.
Implementation patterns
- Evaluate on items created after the model's training cutoff.
- Rephrase or perturb questions and compare scores.
- Keep your own evaluation set private.
- Report contamination checks with results.
Technologies and frameworks
Commonly associated: n-gram overlap detection, LiveCodeBench-style time-split sets, private held-out sets, perturbed-question variants. Names are examples of what exists, not recommendations, and projects change quickly.
Practical guide
- Create a private eval set from real data.
- Keep it out of training and prompts.
- Add fresh items regularly.
- Compare to perturbed variants.
- Document provenance.
Common failure modes
- Assuming absence of evidence of contamination is evidence of absence.
- Public test sets reused for years.
- Leaking your private eval into prompts or fine-tuning data.
- Treating a rephrased item as independent when it is not.
Troubleshooting
- Suspiciously high score — Compare against perturbed or newer items; examine failures on new variants.
- Your own eval is leaking — Separate eval data from any training or few-shot examples; restrict access.
Contrasted with
- Overfitting and Regularization — Overfitting is memorising training data generally; contamination is specifically the test data being in training.
Questions this page answers
- What is benchmark contamination?
- How do I know if a model was trained on the test set?
- How can I build a contamination-free evaluation?
- Why do models score high but fail in practice?
Typical goals: judge whether a score is trustworthy; design leak-resistant evaluations.
Sources and verification
Status: not independently verified. This entry was authored on 2026-10-06 from general technical knowledge, without live checking of the sources below. Treat every source as a lead to confirm (identifier, title, authorship, current version) before publication or citation.
Freshness class: evolving — Established techniques whose best practice shifts as research and tooling move. Re-review every 6 months.
Canonical sources (unverified leads):
- Xu et al., Benchmark Data Contamination of Large Language Models: A Survey (2024) — arXiv:2406.04244
- Jain et al., LiveCodeBench (2024) — arXiv:2403.07974