Held-out evaluation

A held-out evaluation tests a model on tasks kept out of its training and development data.

What a held-out evaluation is

A model learns from what it is trained on, and its developers tune it against what they test on. A held-out evaluation uses tasks kept out of both: not in the training corpus, not used to select checkpoints, prompts or hyperparameters, and ideally not visible to anyone who could feed them back in. The score then measures what the model can do rather than what it has memorised or been tuned towards.

The simplest form is the train, validation and test split that every machine-learning course teaches. The stronger form is a private test set that the evaluating party keeps to itself and runs on the model, so the developer never sees the tasks at all. Between the two sit fresh tasks written after a model’s training cut-off, and rotating sets that are published only after they have been used.

For agents, “held out” has to cover the run as well as the training data. A task is not held out if the agent can search for its answer once it starts.

A simple example

Suppose a team is choosing between two coding agents. Both vendors report strong results on a well-known public benchmark. The team writes 50 tasks of its own from recent tickets in a private repository, with a hidden test for each, and runs both agents on them with network access switched off. Agent A resolves 20 tasks, Agent B resolves 32, and the gap is the reverse of what the public leaderboard showed. The team also notices that Agent A’s trace on several tasks starts by trying to fetch the repository’s upstream history, which would have included the fixes. In this hypothetical, the private set told the team something the public scores could not, at the cost of a week spent writing tasks that nobody else will ever see.

Why it matters

Agent benchmarks are published on the web, and models are trained on the web. Once a benchmark’s tasks or solutions are in a training set, a high score says little; this is benchmark contamination. Agents add a second route: an agent that can browse or read files may find the answer key during the task itself.

ARC Prize addressed this by keeping evaluation sets hidden and running the tests itself, so that the leaderboard reflects performance on tasks the models have not seen (ARC Prize, 2024). The cost is that others cannot reproduce the score; the benefit is that the score means something. For a buyer, the same logic applies in miniature: a small private set of realistic tasks is worth more than a large public one.

How it is measured or handled

A held-out evaluation is defined by process rather than by any single number. The evaluating party documents where the tasks came from, who has seen them, and when they were written relative to the model’s training cut-off. Tasks are run under controlled conditions, typically with no network access and a fixed environment image, so the agent cannot fetch answers or depend on state left by a previous run.

Results are usually reported alongside the public benchmark score so the gap is visible. A large gap suggests contamination or overfitting; a small one suggests the public score is still informative. Held out does not mean secret for ever: rotating tasks, publishing them after use and keeping a fresh private set for the next round is the common pattern, and it keeps the evaluation reproducible in hindsight.

Related terms

A held-out evaluation is the main defence against benchmark contamination. Impossible tasks are one kind of held-out task that tests honesty rather than capability, and an LLM-as-judge grader is only as good as the independent ground truth the held-out set gives it. The Agent benchmarks guide covers what a leaderboard must state before its score can be trusted, and the Agent verification guide covers how to design tasks with an independent ground truth.

Where this term is used

• AI agent benchmarks: when to trust a score
• Benchmark contamination: why public scores decay
• How to read an AI agent leaderboard
• How to verify what an AI agent actually did
• False success in AI agents: when "done" isn't done
• What is false success in AI agents?
• Does RLVR create new skills or sharpen old ones?
• The zero-advantage trap in RLVR training
• Custom task environments for AI agents
• Private evaluations for AI agents and models
• Benchmark contamination
• LLM-as-judge
• Inoku Verified™: independent AI agent evaluation