Benchmark contamination

Benchmark contamination is when test tasks or their answers appear in a model's training data.

What benchmark contamination is

A benchmark is meant to be a test the model has not seen. Contamination is the case where the test, or its answers, got into the training data anyway. It needs no intent. Benchmarks are published, discussed on forums, copied into repositories and scraped into the same web corpora that models learn from. Training on the internet and testing with public data makes contamination the default, not the exception.

The effect is that the score measures recall rather than ability. The number rises, the capability it was meant to indicate does not, and the two drift apart without anyone noticing. In machine learning more generally this is a form of data leakage: information from the test set reaches the model before the test.

Agents add a second route. An agent with a browser or a file system may find the answer during the run, for example by locating the merged fix for the issue it was asked to solve. That is contamination at test time rather than training time, and it looks like competence until someone checks how the answer was reached.

A simple example

Suppose a team evaluates a coding agent on a public set of 200 bug-fix tasks drawn from open-source repositories, and the agent resolves 70% of them. Encouraged, the team gives it 200 private bugs from their own codebase, written after the model’s training cut-off, and the rate falls to 30%. Nothing about the agent changed. The public tasks had been on the web for a year, together with their fixes, and the model had seen many of them. On the private tasks it had to work. In this hypothetical the public score was mostly recall; the private score was closer to what the team would get in production. The team would not have known without the second set, and the gap between the two numbers is the only measurement of contamination they will ever get.

Why it matters

Teams buy and deploy agents on the strength of benchmark scores. A contaminated score overstates what the agent will do on new work, and the overstatement is invisible from the score alone. It also feeds false success: a model that recalls what the solution looked like can produce a convincing report without doing the work, and a grader that compares the report with the remembered solution will agree.

Contamination also distorts research. If a new method appears to help on a benchmark the model has memorised, the gain may be an artefact of which examples were recalled. ARC Prize built its evaluation around this problem, keeping test sets hidden and running the models itself (ARC Prize, 2024).

How it is measured or handled

Detection is approximate. Common checks include searching training corpora for exact or near-exact matches of test items, comparing performance on items published before and after a model’s training cut-off, and testing whether the model can complete a test item verbatim from its opening words. None of these is conclusive, because corpora are rarely fully available and paraphrased leaks evade string matching.

Prevention is more reliable than detection. The standard defence is a held-out evaluation on tasks kept private and run by the evaluator, as ARC Prize does (ARC Prize, 2024). Fresh tasks written after the training cut-off, tasks generated on demand, and rotating sets that are published only after use are the other common patterns. For agents, evaluators also restrict network access during the run so the answer cannot be fetched, and read the trace to check how a solution was reached.

Related terms

A held-out evaluation is the direct remedy. Contamination feeds false success and, when an agent fetches the answer during a run, shades into reward hacking. The Agent benchmarks guide covers how contamination inflates leaderboard scores, and the Agent verification guide discusses the trade-offs of private test sets.

Where this term is used

• AI agent benchmarks: when to trust a score
• Benchmark contamination: why public scores decay
• How to read an AI agent leaderboard
• How to verify what an AI agent actually did
• False success in AI agents: when "done" isn't done
• Does RLVR create new skills or sharpen old ones?
• Private evaluations for AI agents and models
• Held-out evaluation
• For AI labs and model builders
• Inoku Verified™: independent AI agent evaluation