Benchmark Contamination

Benchmark contamination — also benchmark data contamination (BDC) — is the leakage of evaluation benchmark data into a model's training corpus. The field's canonical survey defines it as language models "inadvertently incorporat[ing] evaluation benchmark information from their training data, leading to inaccurate or unreliable performance during the evaluation phase," and names GPT-4, Claude-3, and Gemini among the prominent systems affected (Xu et al., survey, submitted 2024-06-06). A contaminated score partly measures memorization of the test set rather than the capability the benchmark claims to measure. The concept lives in the evaluation layer of the agent stack: contamination changes nothing about what a model can do — it changes what published numbers about the model mean.

Why it matters

The direct effect is score inflation. Peer-reviewed analysis states it plainly: "Contamination causes an overestimation of the performance of a contaminated model in a target benchmark," and downstream "the consequences can be very harmful, with wrong scientific conclusions being published while other correct ones are discarded" (Sainz et al., EMNLP Findings 2023). For a team running agents, that failure mode lands in two specific decisions: model selection ("model B beats model A by N points on a public benchmark") and eval gating ("the new configuration clears our benchmark threshold"). If the benchmark is contaminated for one of the models being compared, both decisions are being made on memorization, not capability.

The problem is not an edge case. Measuring the Llama 1 pretraining corpus directly, a Meta-affiliated study found that "for 8 of the 13 datasets that we considered, on average more than 50% of the samples are marked contaminated" — including roughly 10–11% of HumanEval and 10–12% of GSM8K samples (reported 2024-11, Singh et al., ConTAM). Coding and math benchmarks — the ones agent practitioners lean on most — are squarely in scope.

How benchmarks get contaminated

Two pathways are documented in the primary literature.

Direct ingestion from the public web. Benchmarks are published as papers, GitHub repositories, and hosted datasets; web-scale pretraining crawls pick them up. This is the pathway the Llama 1 corpus measurements above quantify (Singh et al.). Domain studies confirm the spread: an analysis of 31 LLMs on mathematical reasoning "uncover[ed] widespread data contamination," and Riddell et al. quantified overlap between code-generation benchmarks and pretraining corpora using both surface-level and semantic-level matching (survey, 2025; Riddell et al., ACL 2024).

Indirect leakage through evaluation practice itself. Researchers evaluating closed models leak test data by the act of evaluating. Auditing papers that evaluated GPT-3.5 and GPT-4 between late November 2022 and early October 2023, Balloccu et al. found that 90 papers (about 42%) accessed ChatGPT through the web interface, exposing roughly 4.7M test samples from 263 benchmark datasets to OpenAI; exposure was heavily bimodal, with 142 datasets (about 53%) having more than 95% of their test data exposed and only 66 (about 25%) staying below 5% (Balloccu et al., EACL 2024). The authors frame this as data the vendor "could have used" for training — exposure, not confirmed ingestion — but once a test set has passed through a consumer interface, its clean status is unrecoverable.

Detection methods

Three method families, distinguished by what access they require:

Family	Signal	Requires	Representative work
N-gram overlap	Test-sample tokens appear in pretraining-corpus n-grams	Full pretraining corpus	GPT-3 decontamination; Llama 2 skip_budget
Probability-based (membership inference)	Seen text lacks low-probability outlier tokens	Token log-probs	Min-K% Prob, Min-K%++
In-context disruption	Confidence drops when in-context examples disrupt memorization	Inference only	CoDeC

N-gram overlap was pioneered for GPT-3 — checking whether tokens from each test sample appear in n-grams of the pretraining corpus — and Llama 2 extended it with a skip_budget hyperparameter that tolerates mismatches at some token positions (survey, 2025). The catch: results swing on hyperparameters. On PIQA, "only 33.8% of examples have nonzero contamination scores at n=10 while 67.9% have nonzero contamination scores [at] n=8" — the stricter setting misses roughly half of what the looser one finds, and the missed examples correlate with real performance gain; the ConTAM authors recommend n=8 with a minimal count of 1 (reported 2024-11, Singh et al.). Corpus access also limits the method to open training sets: nobody outside the vendor can run it against a closed model.

Probability-based methods need only token probabilities. Min-K% Prob rests on the hypothesis that unseen text contains a few outlier tokens with low probability under the model, while seen text does not; it reached 0.72 average AUC on the WikiMIA membership-inference benchmark (a 7.4% improvement over prior methods) and 0.88 AUC on copyrighted-book detection, where applying it to Books3 excerpts against GPT-3 (text-davinci-003) flagged nearly 90% of books with contamination rates over 50% (reported 2023-10, Shi et al.). Min-K%++ sharpened the score function and "outperforms the runner-up by 6.2% to 10.5% in detection AUROC averaged over five models" on WikiMIA (Zhang et al., ICLR 2025).

In-context disruption is the newest direction and needs only inference access. CoDeC measures how in-context examples from a dataset change model confidence: "in-context examples typically boost confidence for unseen datasets but may reduce it when the dataset was part of training, due to disrupted memorization patterns" — the direction of the confidence shift is the detection signal (CoDeC, 2025-10).

Boundaries and misconceptions

Contamination is a training-data property, not test-time behavior. It is distinct from evaluation-awareness, where a model detects that it is being evaluated and shifts behavior. Both corrupt benchmark validity, but through different mechanisms — one is baked in before the eval starts, the other happens during it — and they call for different countermeasures.

Exposure is not ingestion. The 4.7M-sample figure above measures data a vendor could have trained on, per the paper's own framing (Balloccu et al.). Treating exposure numbers as confirmed contamination overstates the evidence; treating them as harmless understates the risk, since the exposed sets can no longer serve as trustworthy held-out data.

"Decontaminated" is relative to a detection configuration. A benchmark declared clean under an n=10 overlap check may be half-contaminated under n=8 (Singh et al.). Vendor decontamination claims are only as strong as the hyperparameters behind them, and those hyperparameters are a choice.

A high score is not, by itself, evidence of contamination. The inference runs one way: contamination inflates scores, but a model can top a benchmark legitimately. Establishing contamination requires one of the detection methods above, not score-watching.

In practice

The title of the Sainz et al. position paper is the operating rule: measure contamination for each benchmark rather than assuming any public benchmark is clean (Sainz et al., EMNLP Findings 2023). For agent-stack decisions this cashes out as three habits:

• Discount small deltas on long-lived public benchmarks. The longer a test set has been on the public web, the more pretraining crawls have had a chance to ingest it — the Llama 1 measurements show what that looks like at corpus scale (Singh et al.). This applies to coding and agentic suites the same way: swe-bench instances are public GitHub data by construction, and newer agentic benchmarks such as osworld, terminal-bench, and humanitys-last-exam each need their own per-benchmark contamination assessment before their leaderboard gaps drive a model choice.
• Keep private eval sets out of consumer interfaces. The indirect-leakage audit shows how routine evaluation through a web UI exposed entire test sets (Balloccu et al., EACL 2024). A team's internal agent evals are only held-out while they stay out of channels where they may become training data.
• Read vendor decontamination reports as claims with parameters. GPT-3-style n-gram checks and Llama 2's skip_budget variant are documented, reproducible procedures (survey, 2025) — but the n-gram sensitivity result means the reported contamination rate is partly an artifact of the chosen n.