Detecting and preventing data contamination in LLM evaluation

Develop reliable, scalable techniques to detect and prevent data contamination—defined as any overlap between training data and test data that causes benchmark results to overestimate generalization performance—in the pretraining and evaluation pipelines of large language models.

Background

The paper defines data contamination (also called test-set contamination) as any overlap between a model’s training data and the benchmark test data that inflates reported generalization. The authors note that the scale and limited curation of modern pretraining corpora amplify these concerns for LLM evaluations.

While the paper’s main focus is on a distinct issue—training on the test task—it acknowledges that robustly detecting and preventing contamination remains unresolved despite multiple recent efforts. The authors cite contemporary work highlighting the difficulty of tracing and mitigating contamination and emphasize the need for principled solutions that can function at the scale of current LLM pipelines.

References

However, detecting and preventing data contamination is currently an open problem~\citep{gunasekar2023textbooks,yang2023rethinking, golchin2023time}.

— Training on the Test Task Confounds Evaluation and Emergence  (2407.07890 - Dominguez-Olmedo et al., 2024) in Section 7 (Related work), Data contamination paragraph

Although Zhou et al. confirmed 108 detecting leaked APPS samples in the StarCoder-7B pre-training corpus, the remaining APPS samples cannot be strictly guaranteed to be free from undiscovered leakage. Therefore, the samples used as negatives in our evaluation are more accurately treated as samples with unconfirmed leakage status rather than verified non-leaked samples. As a result, the reported Precision, MCC, and AUC values may still be influenced by potential label noise in the evaluation set. To mitigate over-interpretation, we primarily frame RQ5 as evaluating CGMIA’s ability to recover detecting known leaked benchmark samples under a realistic pre-training leakage scenario, with particular emphasis on Recall for the confirmed leaked subset. Future work could further improve negative-sample verification through stronger contamination-detection heuristics or more direct access to pre-training corpus snapshots when available.

— Keep Evaluation Fair: Detecting Data Leakage in Code Generation Benchmarks via Membership Inference Attacks  (2609.09865 - Zhao et al., 9 Sep 2026) in Section 10, Threats of validity, item (8)

As we do not necessarily have access to the original training datasets, we cannot confidently determine whether contamination has occurred.

— Using Small Language Models to Reverse-Engineer Machine Learning Pipelines Structures  (2610.10261 - Lacroix et al., 7 Oct 2026) in Section 6.1, Internal Validity

Overlap among the remaining media has not been ruled out.

— Redirecting Teacher Supervision: Temporal-Response-Guided Latent Distillation for Video-Language Models  (2610.13045 - Lu et al., 9 Oct 2026) in Appendix D, Section Media overlap and score sensitivity