How Contaminated Is Your Benchmark? Measuring Dataset Leakage in Large Language Models with Kernel Divergence
Authors: Hyeong Kyu Choi
Maxim Khanov
Hongxin Wei
Yixuan Li
Venue: ICML 2025 poster (2025)
Keywords: Dataset Leakage
Data Contamination
Large Language Model
Primary area: deep_learning->large_language_models

Abstract: Dataset contamination, where evaluation datasets overlap with pre-training corpora, inflates performance metrics and undermines the reliability of model evaluations. Measuring dataset contamination thus becomes essential to ensure that performance evaluations genuinely reflect a model's ability to generalize to unseen data, rather than relying on memorized examples. To address this problem, we propose Kernel Divergence Score (KDS), a novel method that evaluates dataset contamination by computing the divergence between the kernel similarity matrix of sample embeddings, before and after fine-tuning on the benchmark dataset. Leveraging the insight that fine-tuning affects unseen samples more significantly than seen ones, KDS provides a reliable measure of contamination. Through extensive experiments on controlled contamination scenarios, KDS demonstrates a near-perfect correlation with contamination levels and outperforms existing baselines. Additionally, we perform comprehensive ablation studies to analyze the impact of key design choices, providing deeper insights into the components and effectiveness of KDS. These ablations highlight the importance of leveraging fine-grained kernel-based information and confirm the reliability of the proposed framework across diverse datasets and settings.
Code is released in https://github.com/deeplearning-wisc/kernel-divergence-score.

How Contaminated Is Your Benchmark?
Measuring Dataset Leakage in Large Language Models with Kernel Divergence
Hyeong Kyu Choi
Maxim Khanoy
Hongxin Wei? Yixuan Li
Abstract
1. Introduction
When a large language model (LLM) performs remarkably well benchmark, can we confidently attribute its success to true generalization is it simply reflection of what the model has already seen during pre-training? The reality is, we often don't 't know. Beneath the surface of those impres- sive performance scores lies a critical vulnerability: dataset contumination, phenomenon where evaluation datasets overlap with the pretraining data of the model (Golchin & Surdeanu, 2024). This overlap artificially inflates reported performance metries, obscures true generalization capabil- ities, and raises critical concerns about the reliability of benchmark evaluations. This brings us to a pressing and underexplored question: How can we measure the degree of dataset contamination?
Dataset contamination, where evaluation datasets overlap with pre-training corpora, inflates performance metrics and undermines the relia-
bility of model evaluations. Measuring dataset contamination thus becomes essential to ensure that performance evaluations genuinely reflect model's ability to generalize to unseen data, rather than relying on memorized examples. To address this problem, we propose Kernel Divergence Score (KDS), a novel method that evaluates dataset contamination by computing the divergence between the kernel similarity matrix of sample embeddings, before and after fine-tuning on the benchmark dataset. Leveraging the insight that fine-tuning affects unseen samples more significantly than seen ones, KDS provides a reliable measure of contamination. Through extensive experiments on controlled contamination scenarios, KDS demonstrates a near-perfect correlation with contamination levels and outperforms existing baselines. Additionally, we perform comprehensive ablation studies to analyze the impact of key design choices, providing deeper insights into the components and effectiveness of KDS. These ablations high- light the importance of leveraging fine-grained kernel-based information and confirm the relia- bility of the proposed framework across diverse datasets and settings. Code is released in ht ttsp / //github. com deeplearnng wwisc/ kernel-divergenn score.
Addressing this question is crucial to ensuring that perfor- mance evaluations genuinely reflect model's ability to generalize to unseen data, rather than benefiting from over- lap with pretraining data. To formalize the problem, we aim to develop a scoring function S (D,M) + R, that takes a benchmark dataset D as input and produces a score indicative of its relative contamination level with respect to the given model M. A higher score corresponds a greater contamination level. Such score is valuable be- cause researchers can it to rank multiple benchmarks and prioritize the less contaminated ones, enabling more informed comparisons and reliable evaluation. For the score to be reliable, we argue that the scoring function must satisfy two essential properties: monotonicity, which ensures that the score exhibits a positive correlation with the contami- nation level, and consistency, which means that the score remains stable across independently sampled subsets with the same contamination rate.
To measure dataset contamination, we introduce the Kernel Divergence Score (KDS), which computes the divergence of the kernel similarity matrix of sample embeddings before and after fine-tuning on the benchmark dataset. By analyz- ing changes in the kernel similarity matrix, KDS captures how fine-tuning reshapes the embeddings for seen and un- seen data, providing more holistic and nuanced perspective on dataset contamination. This approach is motivated by the fact that fine-tuming teeiitunng has more significant effect on the
'Equal contribution 'Department of Computer Sciences, University of Wisconsin-Madison, United States 'Department of Statistics and Data Science. Southern University of Sci- ence and Technology, China. Correspondence to: Yixuan Li <sharonli wis..
Proceedings of the 4 International Conference Machine Learning. Vancouver, Canada. PMLR 267, 2025. Copyright 2025 by the author(s).

---

mixture of Kernel Divergence Score
D
M
M
Scen
Scon
Pre-trained LLM
Fine-tuned LLM
Scon
Unseon
Unseon
) x A
)x
Kernel Divergence
,
Φ (Z))
Φ(Z')
Kernel similarity matrix
Kernel similurity
Figure 1. Overview of the proposed Kernel Divergence Score (KDS) framework for measuring dataset contamination in large language models. The process involves extracting sample embeddings from the model before and after fine-tuning on the benchmark dataset D, computing the kernel similarity matrix for each stage, and measuring the divergence between the two matrices ((Z) and o(Z') By capturing the changes embeddings induced by fine-tuning, KDS provides a reliable and interpretable score to evaluate the level of dataset contamination.
embeddings of unseen samples, which the model must adapt to, while seen samples exhibit minimal changes due to prior exposure during pre-training Furthermore, as the propor-
We validate Kernel Divergence Score through extensive experiments on controlled contamination scenarios, show- ing strong performance over existing baselines.
tion of unseen samples increases, their cumulative effect on
the kernel divergence score becomes more pronounced. By evaluating these changes, KDS provide a reliable and interpretable measure of dataset contamination, with scores that proportionally reflect the level of contamination.
We perform comprehensive ablations analyze the im- pact of various design choices. Further practical discus- sions presented, providing deeper insights into kernel-baeed approach.
To evaluate KDS, we perform extensive experiments, sys- tematically controlling contamination ratios across multi- ple datasets. Our results demonstrate that KDS achieves near-perfect correlation with contamination levels, generally outperforming existing baselines across multiple datasets. Additionally, we show that KDS is robust to design choices, including kernel functions, kernel bandwidth, and the extrac- tion location of embeddings. Overall, KDS provides stable scores across diverse scenarios, enabling researchers to re- liably identify benchmarks based on contamination levels. We summarize our contributions follows:
2. Problem Statement
2.1. Measuring Benchmark Contamination
The objective is to evaluate the relative degree to which benchmark evaluation dataset, D, has been exposed to the pre-training process of a given LLM,, M. In modern LLMs, the pre-training dataset is typically unavailable, mak- ing it difficult to directly assess the contamination level. Accordingly, we consider generalized characterization of the benchmark evaluation data, modeling both seen and unseen data:
We propose Kernel Divergence Score, reliable dataset- level scoring function to measure benchmark contami- nation. To the best our knowledge, we are the first to leverage the -ne-ina information of kernels for scoring contamination levels.
D D U U Unnseen
D 1/ =
where D the data seen during M's pre-training, Dimneen is the data not seen by M, and À [0, 1] is an unknown
2

---

Kernel Divergence Score
parameter indicating the fraction of seen data in D. Within this framework, we aim to develop dataset-level scoring function
Our approach is motivated by the fact that fine-tuning af- fects the embedding relationships involving unseen samples more significantly than those involving seen samples. For seen samples, the model has already been exposed to similar data during pretraining, leading to minimal shifts in their embedding relationships. In contrast, unseen samples expe- rience more pronounced changes, as the fine-tuning process adjusts the model to better align with the benchmark dataset. By evaluating these changes using the Kernel Divergence Score, we can provide a reliable and granular measure of dataset contamination.
S: (D. - I.,
which measures the relative level of contamination of dataset D with respect to model M. A larger score indicates more contamination and vice versa.
reliable scoring function is practically valuable because allows us to identify datasets that are contaminated with respect to model M. Hence, we now outline the desirable properties that the scoring function S should satisfy.
Kernel similarity matrix. A kemel similarity matrix cap- tures the relationships among data samples, providing fine- grained information on their distribution. Formally, let Z I represent the embeddings of samples in the dataset D, where Z₁ E R is the normalized embedding of i-th sample extracted from the pre-trained LLM M. We define the kernel matrix $ (Z) E RR=x based on the Radial Basis Function (RBF) kernel:
2.2. Reliable Contamination Scores
In this section, we state two essential requirements for reliable contamination scoring function: Monotonicity and Consistency.
Requirement 1. (Monotonicity) If dataset 'D is more inde- pendent of model M than dataset D', i.e., X < X, then
M) < M))
(Z)a,, exp(->1122 Z,11)),
should hold with statistical significance. In other words, a dataset with a smaller X. the fraction of seen data, should have accordingly smaller contamination score M))
where o(Z),,5 is the kernel similarity between samples Z, and Zj. and 7 controls the kernel bandwidth. The kernel matrix captures the pairwise relationships between all sam- ples in the dataset, with values ranging from 0 to 1. An entry close to indicates high similarity (small distance), while value close to 0 indicates low similarity (large dis- tance). The matrix (Z) is both symmetric and positive semidefinite.
Requirement 2. (Consistency) If datasets 'D and D'' both comprise of independently and identically distributed (i.i.d.) samples from a distribution with the same contamination ratio X,
M(D, D2 S(D'.M)
should hold with statistical significance.
Leveraging the effect of fine-tuning, Our proposed Kernel Divergence Score is based on the kernel matrix before and after fine-tuning, Formally, let Z' Raxd represent the embeddings after LoRA (Hu et al., 2022) fine-tuning on dataset D. where Z E R Rixd Accordingly, we can derive the kernel similarity matrix as:
The Monotonicity requirement ensures that the scoring func- tion exhibits positive correlation with the dataset's 's con- tamination rate, even though the true contamination rate is typically unknown in real-world scenarios. A scoring function satisfying this requirement enables reliable ranking of datasets for each model based on their contamination scores. The Consistency requirement, on the other hand, ensures that the scores are robust to variations in the spe- cific samples drawn from the same underlying distribution, under the same A. This property ensures that the random- ness induced from sampling does not substantially affect the overall scoring.
& (Z)) exp( -Z,11)
(2)
Then, we define Kernel Divergence as
1
+ (Z),, log ((2) T ((Z))..)
(3)
E 2==1
3. Method: Kernel Divergence Score
where E v En. (Z),,, is a normalizer. When 7 = 1, our score in Eq. (3) can be equivalently written
In this section, we present our method, Kernel Divergence Score, which leverages information among samples within the model's is embedding space to establish a more nuanced contamination scoring mechanism. In nutshell, we as- sess changes in the kernel matrix of sample embeddings before and after fine-tume tuning, capturing how the relationships between samples evolve as result of fine-tuning.
Σ exp(- - 2,1B)
-
12 2
F 1
(1) Soft gating for originally closely-related samples
(2) Change in distance before and after SFT
(4)
3

---

Kernel Divergence Score
log (z)
4
2(Z)
Φ 2 O
log ((2))
((Z)
0023
67
16
0023
0.000
62
0003
0.00
seen
unseen
Figure 2. Decomposition of the Kernel Divergence Score. Each component of the Kernel Divergence Score function is shown. (b-) denotes the kernel similarity matrix. Z and z' represent normalized sample embeddings before and after fine-tuning, and @ is the Hadamard product. Score and embeddings similarity matrix before line-tuning Note, that diagonal values are zeroed for better visualization, because all diagonal values are in RBF kernels. (Middle) reveals that fine-tuning alters relationships among unseen samples than those among seen samples. (Right) Combining the two panels enhances the distinction between seen and unseen samples, thereby enabling more reliable measurement of contamination levels.
based on Llama-3.1-8B 1-B---11----nnttuuu (Dubey et al., 2024). (Left) shows that the original kernel
Interpretation of kernel divergence. This function quan- tifies how fine-tuning changes the pairwise distances be- tween samples, weighted by their original similarity. Specif- ically, the second term -2 11 -2 -2y 1 [|2] measures the absolute change the squared Euclidean distance be- tween embedding pairs caused by fine-tuning. For unseen samples, fine-tuning tends to create meaningful relation- ships significantly alter their embeddings, making their contribution to the score larger. The first exponential term acts as a soft gating function, assigning a higher weight to pairs of samples that were originally closer to each other. By incorporating this term, the score prioritizes the impact of fine-tuning on pairs that were initially similar, highlighting cases where fine-tuning induces significant changes in their relationships. Overall, larger fraction of unseen examples (or smaller X) can elevate the kernel divergence more signif- icantly. Because we want the scoring function MDD to be positively correlated with the contamination rate X, we define our final scoring function to the negation of kernel divergence:
left panel illustrates the soft gate from Eq. (4), or the kernel similarity matrix using the pre-trained embedding. The middle panel captures the change of pairwise embedding distance after supervised fine-tuning, and the right panel shows the resulting element-wiss score matrix after the Hadamard product of the two. As hypothesized, the middle panel suggests that relationships involving unseen samples are more significantly altered by fine-tuning. By multiplying the soft gate (left panel), unseen sample pairs contribute more to the overall score. Additional examples with varying contamination rates are provided in Appendix B.
4. Experiments
In this section, we conduct a controlled experiment to verify the reliability of our Kernel Divergence Score with respect to the Monotonicity and Consistency requirements (c.f. Sec- tion 2.2). For a comprehensive analysis, we also assess existing non-kernel-basee scoring methods.
4.1. Experimental Setup
1
(())..j
S(D.M)
(Z),. log ((Z))..)
(5)
Dataset and model. Our controlled experiment aims to evaluate the extent to which each method satisfies the Mono- tonicity and Consistency requirements. For this purpose, we utilize three popular pre-training data detection benchmarks, WikiMIA (Shi et al., 2023), BookMIA (Shi et al., 2023), and ArxivTection (Duarte et al., 2024), each comprising samples labeled as 'seen' or 'unseen'. Among the models compatible with the datasets, we select Mistral-7B-Insttueee v0.2 (Jiang et al., 2023) for our main evaluation. We present additional results for other model families in Section
E.
which is expected to be larger as the contamination grows.
Visual demonstration of score components. To provide concrete understanding of the role of each component in our Kernel Divergence Score (Eq. (3) or Eq. (4)), we present the kernel matrix for each component in Figure 2. We use n = 100 samples with a contamination rate À 0.4, meaning 40% of the samples are seen during model pre-training. The

---

Kernel Divergence Score
Table Monotonicity Evaluation. Correlation coefficients averaged across five different subsets are shown. SRCT on BookMIA and Arxi-Tection are omitted due to excessive computation. On average, our Kernel Divergence Score demonstrates the best compliance with the Monotonicity requirement.
WikiMIA
BookMIA
ArxivTectien Tection
Average
Methods
Spearman
Pearson
Spearman
Pearson f Spearman
Pearson
Spearman
Pearson f
Mon-kernel-hasee Methods
Zlib (Carlini et al., 2021)
0.968
0.960
-1.000
-0,997
0.997
0.918
0.322
0.294
Zlib + FSD (Zhang et al., 2025)
0.976
0.966
-0.888
-0.895
0,941
0,947
0.343
0.339
Perplexity (Li, 2023)
0.933
0.929
0.964
0.967
1.000
0,997
0,966
0,964
Perplexity + FSD (Zhang et al., 2025)
0.979
0.967
-0.777
-0.824
0.992
0.982
0.398
0.375
M (Shi ct al., 2023)
0.893
0.899
0.998
0.992
1.000
0,998
0,964
0,964
Min-K% K% FSD (Zhang et al., 2025)
0.932
0.937
-0.526
-0,640
0,988
0,980
0,459
0,420
Min-K*++ (Zhang al., 2024b)
-0.790
-0.833
OOM
OOM
0.996
0.996
0.103
0.082
Min-K%+++ + FSD (Zhang et al., 2025)
-0.790
-0.834
OOM
OOM
0.754
0.809
-0.018
-0.013
SRCT (Oren et al., 2024)
0.080
0.073
0.080
0.073
Kernel-based Method
Kernel Divergence Score (Ours)
0.999
0.993
0.997
0.979
0.975
0.974
0.990
0.982
Baselines. We consider various baseline methods for com- prehensive evaluation. Specifically, we consider Zlib (Car- lini et al., 2021), Perplexity Score (Li, 2023), Min-K% (Shi et al., 2023), Min-K ++++ (Zhang et al., 2024b), Fine-tuned Score Deviation (FSD; Zhang al. (2025)). which evaluate the likelihood of exposure for every sample independently. The overall contamination score of the dataset S(D, M)) is then quantified by averaging these instance-wise scores. In addition, we consider the dataset-level approach that assesses the contamination of dataset as a whole by exam- ining statistical or distributional patterns that differentiate seen vs unseen datasets. This approach provides more holistic view of contamination, capturing aggregate charac- teristics that are not discernible at the individual example level. Specifically, we consider the Sharded Rank Compari- son Test (SRCT; Oren et al. (2024)), the latest dataset-level detection method that identifies datasets showing significant variability in likelihood values across different sample or- derings. For each baseline, we adjusted their score sign so that higher scores indicate more contamination (i.e., bigger A). We include the detailed definition of each baseline in Appendix A.2.
4.2. Experimental Results
Kernel divergence score satisfies the monotonicity re- quirement. To evaluate compliance with the monotonicity requirement, we analyze the correlation between scores and contamination rates E (0.0, 0.05, 0. 0.10..... 0.95, 1.0). The primary metric used is the Spearman correlation coeffi- cient, which directly evaluates the monotonic relationship between scores and contamination rates, ensuring align- ment with the expected trend. Additionally, we compute the Pearson correlation coefficient to provide insight into the linearity of the trends, with higher values indicating a stronger linear pattern in the scores.
In Table 1, we present the correlation coefficients for the three benchmark datasets. We keep the dataset size fixed while varying the contamination ratios. We observe that existing approaches often exhibit highly varying correlation and even reversed signs. For instance, in the BookMIA dataset, our thorough evaluation across five random subsets consistently revealed negative correlation values for several baseline methods. In contrast, KDS consistently achieves near-perfect correlation all datasets. On average, it demonstrates the strongest compliance with the monotonic- ity requirement.
Experimental details. For each dataset, evaluate scor- ing performances on different contamination rates. For in- tegrity across experiments, we fix the data subset size to 700 for WikiMIA and ArxivTection, and 4000 for BookMIA. Then, we run each dataset five times for robust evaluation, each with differently sampled subsets. For methods that require fine-tuning (e.g our Kernel Divergence Score and Fine-tuned Score Deviation (Zhang al., 2025)), train the model for 1 epoch using stochastic gradient descent with a batch size of 4. Furthermore, in determining the bandwidth parameter ? in the RBF kernel (Eq. (2)), we utilize the median heuristic (Garreau et al., 2017). Further implementation details are in Appendix A.
Moreover, it is noteworthy that compared to FSD (Zhang et al., 2025) in Table 1, which also leverages fine-tuning in- formation in detecting pre-training data, our method demon- strates more consistent performance improvements. We attribute this improvement to our KDS's direct assessment of the structural information within model representations, bypassing the reliance on intermediate scoring adjustments in FSD methods. This direct approach allows our score to effectively capture the intrinsic characteristics of the data, leading to more reliable scoring.
5

---

In this section, we conduct an in-depth analysis to under- stand various design choices of our kernel divergence score. Kernel Divergence Score
Kernel Divergence Score
Table 2. Ablation study KDS components. Correlation coef-
WikiMIA
ficients are averaged across 5 independent runs evaluated on the WikiMIA dataset.
0.8
Methods
Spearman
Pearson
0.6
Kernel Divergence Score
0.999
0,993
w/o (1) Soft Gating
0.998
0.990
0.4
w/o (2) Fine-tuning
0.683
0.749
w/ Euclidean Distance Kernel
0.999
0.994
0.2
w/ Cosine Similarity Kernel
0,998
0,990
Dot- Dot-product Kernel
0.998
0,986
0.0
0.0
0.2
0.4
0.6
0.8
1.0
Contamination Rates
2 as the contamination score. Conversely, ablating component (2) is equivalent to disre- garding the effects of supervised fine-tuning, relying solely on the kernel similarity matrix (Z)) before fine-tuning, with the average kernel entry value serving the contam- ination score. The results indicate that removing the soft gating mechanism (Component 1) leads to a marginal de- cline in performance. This suggests that while the gating mechanism enhances the score's 's reliability, the majority of the information is derived from the differential effects ob- served before and after fine-tuning. Indeed, removing the supervised fine-tuning component (Component 2) signifi- cantly degrades the performance, highlighting the critical role of fine-tuning in amplifying the kernel's ability to mea- sure dataset contamination levels.
|| - 2,18
Figure 3. Trend of Kernel Divergence Scores on WikiMIA. The score shows monotonic increase with respect to contamination rate, and the standard deviation over 5 runs is low.
Kernel divergence score satisfies the consistency require- ment. To verify the Consistency requirement, we test whether our score remains stable across independently and identically distributed datasets sampled from the same dis- tribution and with the same contamination rate A. For each contamination rate À E {0.0, 0.05, 0.10, .... 0.95, 1.0), we create datasets by randomly sampling 5 independent subsets from each dataset. Each subset complies with the mixing rate X, consisting of seen and unseen samples in proportions determined by A. All datasets are fixed to the same size to ensure comparability. In Figure 3, we observe that the kernel divergence score demonstrates relatively low stan- dard deviations, indicating compliance with the Consistency requirement. This shows that our method can produce sta- ble and reliable scores, independent of the specific random subset used.
Our method is not sensitive to the choice of kernel func- tion. The Kernel Divergence Score employs the RBF kernel to compute differences after supervised fine-tuning. However, an important question arises: how robust the scoring performance to variations in the kernel function? To address this, evaluate our method using alternative ker- nel functions, including Euclidean pairwise distance, cosine similarity, and dot- prooduct similarity, as shown in Table 2 (bottom). For the Fuclidean pairwise distance and cosine similarity kernels, we replace ((Z) in Eq. (5) with the respective kernel computations. We add 1 to the cosine sim- ilarity kernel matrix to enforce non-negative entries. For the dot-product similarity kernel, compute the mean squared error of the kernel matrices before and after fine-tuning, as the kernel entries may take negative values, making them incompatible with the logarithmic operation used in our scoring function.
5. Ablation Studies
What's the impact of fine-tuning on the score? As de- scribed in Eq. (4), the Kernel Divergence Score comprises two key components: (1) the kernel similarity matrix 4 ZZ) which serves as soft gating mechanism, and (2) the change in pairwise distance, which captures the effects of super- vised fine-tuning. The roles of these two components are qualitatively illustrated in the left and middle panels of Fig- ure 2. To further elucidate their individual contributions, we conducted an ablation study, with results summarized in Table 2 (top). The study evaluates the impact of removing each component.
The results indicate that scoring performance remains con- sistent across different kernel functions. This suggests that the effectiveness of the Kernel Divergence Score lies in its ability to leverage structural information from kernel rep- resentations, rather than being dependent on the specific choice of the kernel. These findings highlight the versatility of our kernel-based approach in measuring contamination levels across diverse settings.
Specifically, ablating component (1) involves omitting the soft gating mechanism, thereby utilizing the average of
6

---

Kernel Divergence Score
Table Efffec of different kernel bandwidths. Scoring perfor- mance metrics are retrieved and averaged over 5 independent runs.
Table 4. Effect of different training configurations. Scoring performance metries are retrieved and averaged over 5 independent runs. Values in parentheses are the standard deviation across runs.
Kernel Bandwidth
Spearman t
Pearson 1
Configuration
Spearman
Pearson
Median
0.999
0.993
Epoch; Stochastic GD
0.999 (0.00)
0.993 (0.00)
0.001
0.999
0,994
1 Epoch; Batch GD
0,908 (0.18)
0.916 (0.13)
7 0.01
0.999
0.994
4 Epochs;
Stochastic GD
0.983 (0.02)
0.643 (0.43)
0.1
0.999
0.994
4 Epochs; Batch GD
0.846 (0.15)
0.875 (0.08)
1.0
0.999
0,994
10.0
0.801
0.838
What's the impact of embedding extraction location? In our main experiments, we use the output embeddings from the final layer of the LLM to compute KDS. To fur- ther analyze the impact of embedding location, evaluate the Spearman and Pearson correlation using embeddings extracted from different layers of the model, as shown in Figure 4 (top). Our results reveal that the strongest corre- lation is observed in the latter layers, indicating that these layers contain the most information relevant to dataset con- tamination. This suggests that the latter layers of the LLM, which are typically fine-tuned align with specific tasks datasets, more sensitive to the effects of contamina- tion compared to earlier layers. These findings support the selection of final layer embeddings for kernel computation, as they provide an informative basis for assessing dataset contamination.
1.0
Spearman Com:
0.8
Pearson Corr.
0.6
0.4
0.2
0.0
1011121314 15 1821111122222222222323333 30
Layer Index
Figure Scoring performance across embedding location. Cor- relation coefficients from different layers are retrieved using Mistral-7B-Instruet-ve on WikiMIA.
How does SFT configuration impact the performance? Table 4 presents the Spearman and Pearson correlation coef- ficients for contamination scores under different SFT train- ing configurations on the WikiMIA dataset. The configu- rations vary in terms of the optimization method (Stochas- tic Gradient Descent vs. Batch Gradient Descent) and the number of fine-tuning epochs (1 vs. 4). The results show that stochastic GD significantly outperforms batch GD, sug- gesting that the finer-grained updates introduced by SGD enhance the sensitivity of the Kernel Divergence Score to dataset contamination. On the other hand, increasing the number of fine mne-ttnnng epochs does not necessarily improve scoring performance. This may be attributed to the repeated exposure of the model to the same samples during training, which could obscure the distinction between seen and un- seen samples. Overall, training with one epoch using SGD leads to the best performance.
How does the kernel bandwidth impact the perfor- mance? In an RBF kemel, the bandwidth parameter 7 controls the sharpness of the kernel's entry distribution. In our approach, we employed the median heuristic (Garreau al., 2017), which sets y as the inverse of the median pairwise distance. To examine the effect of y contam- ination scoring, we evaluate different bandwidth values (0.001, 0.01, 1.0, 10.0}, as shown in Table 3. The re- sults indicate that scoring performance is largely invariant to the choice r. This behavior expected, considering that Eq. (4) with arbitrary y
Σ
exp(-ui.))
|u4,5 wisl.
(6)
E 1,==1 monotonicity preserved
where Wz.j = || - 1 and = = 12 2,1B- The effect of y is limited a constant multiplicative factor on the overall scores, and power factor that controls the sharpness of the soft gate. This does not influence their relative trends across varying contamination rates. This invariance underscores the robustness of our Kernel Diver- gence Score to the choice of bandwidth parameter. However, setting an excessively large value (e.g. 7 = 10.0) may cause numerical errors and degrade scoring performance.
6. Discussions
Temporal shift problems of MIA benchmarks. Recent studies have expressed concerns regarding the temporal shift issues in existing Membership Inference Attack (MIA) benchmarks (Duan et al., 2024; Das et al., 2024; Maini et al., 2024). Notably, datasets such as WikiMIA, BookMIA, and ArxivTectio have been identified as susceptible to temporal
7

---

Kernel Divergence Score
Table Baseline comparison on PILE data subsets.
Methods
Wikipedia PhilPapers
Enron
HackeerNews
Pile_CC
StackExchange
Average
Zlib
0.861
1.000
1.000
-0,956
-0.782
0.990
0.352
Zlib FSD
1.000
0.991
0.999
0.323
0.894
0.999
0.868
Perplexity
-0.886
0,999
0.999
-0,999
-0.251
0.999
0.144
Perplexity FSD
1.000
0.990
0.999
0.118
0.908
1.000
0.836
Min-K%
-0.645
0.996
1.000
-0.955
0.690
0.999
0.348
Min-K% + FSD
0.997
0.952
0.997
0.421
0.908
1.000
0.879
Min-K&++
-0.482
0.960
-0.842
0.561
0.514
0,697
0.235
Min-K%++ FSD
-0,536
0.994
-0.770
0.705
-0.358
0.210
0.041
Kernel Divergence Score (Ours)
0.891
0.982
1.000
0.897
0.895
1.000
0.944
Table Evaluation benchmarks with IID setup. We evaluate the monotonicity of our kernel divergence score on six subsets from the Pile dataset (Gao al., 2020).
Table 7. Evaluation using various models. We evaluate the Mono- tonicity on the WikiMIA datasct.
Model
Spearman
Pearson
Data Subset
Spearman
Pearson
Mistral-7B- Binrrll---nstttut--... (Jiang et al., 2023)
0.999
0.996
Wikipedia
0.891
0.922
Llama-3. 1..83.8--IIstiee Instructt (Duhey al., 2024)
0.982
0.952
Phi-3-small- waw.smmll2---iiniiiii 128k-instruct
(Abdin et al., 2024)
0.892
0.890
PhilPapers
0.982
0.974
Enron
1.000
0.965
HackerNews
0.897
0.920
method reliably scores contamination levels without relying temporal shifts.
Pile-CC
0.895
0.908
StackExchange
1.000
0.998
Average
0.944
0.948
Extension to various model families. We extend our eval- uation to diverse models to demonstrate the versatility of our approach. As presented in Table 7, our approach con- sistently exhibits near-perfect correlation values across all models tested. These findings underscore the robustness and applicability of method across diverse model families.
cues, which can inadvertently simplify the membership in- ference task. This simplification arises because models can exploit temporal information to distinguish between seen versus unseen data, leading a potential overestimation of detection performance.
Computational cost. Our kernel divergence score in- volves fine-tuning step obtain two kernel matrices, fol- lowed by the computation of our scoring function. Given dataset with N samples, the fine-tuning step operates with time complexity of O(c1 NN., where Ci is a constant in- fluenced by factors such average sample length, batch size, and model dimension. The computation of the KDS has complexity O(e2 N2), due to the quadratic ture of kernel matrix operations. In practice, the latency overhead caused by scoring is minimal, as these operations are highly optimized through vectorized computations. As demonstrated in Table 8, the latency measured in seconds for each dataset confirms the efficiency and scalability of our approach.
To ensure the robustness of our approach and mitigate po- tential biases introduced by temporal shifts, we conducted evaluations using 500 samples from six subsets of the Pile dataset (Gao et al., 2020). The subsets include text data from various sources, including expository proses (Wikipedia), academic papers (PhilPapers), emails (Enron), news arti- cles (HackerNews), web-scraped data (Pile-CC), and user- contributed questions and answers (StackExchange). For each subset, the 'train' set is regarded as seen data, while the 'val' set serves as unseen data. We mix these two sets ac- cording to varying contamination rates to assess our model's performance under different conditions. This methodology provides rigorous assessment, ensuring that our model does not exploit temporal cues. In Table we provide the baseline comparison results evaluated on the PILE data subsets. On average, our Kernel Divergence Score (KDS) achieves the highest Spearman correlation coefficient. More- over, as presented Table 6, both the Spearman and Pearson correlation coefficients are near 1.0, averaging at 0.944 and 0.948, respectively. These findings demonstrate that our
7. Related Works
Data contamination (Magar & Schwartz, 2022; Xu et al., 2024; Balloccu et al., 2024; Dekoninck et al., 2024), also known as benchmark leakage, poses a significant challenge in the evaluation of LLMss (Zhou al., 2023; Duan et al.,
8

---

Kernel Divergence Score
capabilities. This contributes to a more rigorous bench- marking process, fostering fair and meaningful comparisons across different models and architectures. Furthermore, the insights gained from this work can inform better practices for dataset curation. This not only reduces the risk of in- flated performance results but also enhances the utility of benchmarks as tools for guiding research and development.
Table Computational cost. We report the computation time in seconds, measured on single RTX H200 GPU.
Dataset
Size (N)
Fine-tuning
Scoring
Complexity
O(ei N)
O(e2- N²
WikiMIA
700
39s
0.0008s
WikiMIA
350
23s
0.0006s
BookMIA
4000
555s
0.0013s
BookMIA
2000
294s
0.0012s
Limitations and Future Work
BookMIA
1000
114s
0.001
In this work, we introduced the Kernel Divergence Score as a method to reliably measure dataset contamination lev- els. Compared to sample-wist scoring methods, our kernel divergence score leverages kernels that require quadratic computation. As shown in Table 8, kernel computation itself is not a significant burden in practice. However, it can become a bottleneck in terms of time and space as dataset size increases substantially. To mitigate this compu- tational challenge, we can reduce the amount of computation by adopting local kernel approaches (Segata & Blanzieri, 2010), and by sequentially computing and accumulating the kernel entries to avoid out-of-memont errors. Another promising direction for future research is the application of Uositive-Unllbeled (PU) learning (Elkan & Noto, 2008), which focuses on constructing classifiers using only positive and unlabeled data. In the context of dataset contamination detection, PU learning could help in estimating the distribu- tion of contaminated data when only a subset of positive (i.e., contaminated) examples available. Additionally, explor- ing kemell calibration methods may enhance the robustness of KDS across different models. By investigating these di- rections, future work can aim to develop more universally applicable contamination scoring mechanism, thereby im- proving the reliability and comparability of contamination assessments across various machine learning models and datasets.
2024). To mitigate this problem, one line of research focuses on "decontaminating" datasets by introducing controlled perturbations to reduce overlap with evaluation (Yang et al., 2023). Another line explores methods for detecting contami- nated datasets or identifying samples seen during LLM train- ing. Membership inference attack (MIA) techniques (Shokri et al., 2017: Truex et al., 2019) have been employed clas- sify individual data as seen or unseen (Yeom et al., 2018; 8; Salem et al., 2019; Mattern et al., 2023), with many recent studies specifically targeting L.MS for pre-training data detection (Carlini et al., 1021:500 Shi et al., 2023; Zhang et al., 2024b; Xie et al., 2024; Li, 2023; Ye et al., 2024). In ad- dition, set-level detection methods have been introduced to identify contamination at broader dataset level (Oren et al., 2024; Zhang et al., 2024a; Golchin & Surdeanu, 2024). Building on this foundation, our work introduced novel ap- proach, Kernel Divergence Score, to scoring contamination levels using information derived from embedding kernel similarity matrices. An expanded literature review of MIA is in Appendix F.
8. Conclusion
In this work, we addressed the critical issue of dataset con- tamination in LLM by introducing the Kernel Divergence Score. By capturing embeddings, KDS provides robust and interpretable mea- sure of contamination. Extensive experiments on controlled scenarios demonstrated the effectiveness of KDS in sat- isfying key properties like monotonicity and consistency, outperforming existing baselines. This work paves the way for more reliable benchmark evaluations, fostering better dataset curation practices in LLM research.
toningn-ndducee shifts in sample
A cknnowledgement
The authors would like to thank Shawn Im and Seongheon Park for their valuable comments on the manuscript. Hyeong Kyu Choi, Maxim Khanov, and Yixuan Li are sup- ported in part by the AFOSR Young Investigator Program under award number 199550-23-1-088-- National Science Foundation under awards IIS-2237037 and I1S-2331669, Office of Naval Research under grant number N00014-23 1-2643, Schmidt Sciences Foundation, and Alfred P. Sloan Fellowship.
Impact Statement
The broader impact of this work lies in its potential to sig- nificantly improve the reliability, transparency, and fairness of large language model evaluation. By enabling the identi- fication and quantification of contaminated datasets, our ap- proach ensures that reported performance metrics are more irustworthy and reflective of a model's 's true generalization
9

---

Kernel Divergence Score
References
Hu, E. J., Wallis, P., Allen- Z., Li, Y., Wang. S., Wang. L.., Chen, W., et al. Lora: Low-rank adaptation of large language models. In International Conference on Learning Representa- tions, 2021.
Abdin, M., Aneja, J., Awadalla, H., Awadallah, A., Awan, A. A., Bach, N., Bahree, A., Bakhtiari, A., Bao, J. Behl, H., et al. Phi-3 technical report: A highly capable language model locally on your phone. arXiv preprint arXiv:2404. 1224444441199 14219, 2024.
Hu, E. J., Shen, Y., Wallis, P., Allen-Zhu, Z., Li, Y., Wang. S., Wang, L., Chen, W., al. Lora: Low-rank adaptation of large language models. ICLR, 1(2):, 2022.
Balloccu, S., Schmidtová, P., Lango, M., and Dušek, O. Leak, cheat, repeat: Data contamination and evaluation malpractices in closed- source Ilms. In Proceedings of the 18th Conference of the European Chapter of the Association for Computational Linguistics (Volume 1: Long Papers). pp. 67 93, 2024.
Jiang, A. Q. Sablayrolles, A., Mensch, A., Bamford, C., Chaplot, D. S., Casas, D. d. I., Bressand, F., Lengyel, G., Lample, G., Saulnier, L., al. Mistral 7b, arXiv preprint arX1v:3310.06825, 2023.
Carlini, N., Tramer, F., Wallace, E., Jagielski, M., Herbert-Voor A., Lee, K., Roberts, A.. Brown, T.,, Song, D., Erlingsson, U.. et al. Extracting training data from large language models. In 30th USENIX Security Symposium (USENIX Security 2.), pp-
Li, Y. Estimating contamination via perplexity: Quantifying memorisation in language model evaluation. arXiv preprint arXiv:2399.1067) 2023.
2633-2650, 2021.
Liu, G., Wang, C.,, Peng, K., Huang, H., Li, Y., and Cheng, W. Socinf: Membership inference attacks on social media health data with machine learning. IEEE Transactions on Computa- tional Social Systems, 6(5):907-921, 2019.
Carlini, N., Chien, S., Nasr, M., Song, S., Terzis, A., and Tramer, F. Membership inference attacks from first principles. In 2022 IEEE Symposium Security and Privacy (SP), pp. 1897-1914. IEEE, 2022.
Liu, G., Xu, T., Zhang, R., Wang, Z., Wang. C., and Liu, L. Gradient-leake Enabling black-bor box membership inference at- tacks against machine learning models. IEEE Transactions on Information Forensics and Security, 2023.
Das, D., Zhang, J., and Tramèr, F. Blind baselines beat member- ship inference attacks for foundation models. arXiv preprint arXiv:2406. 16200 2024.
Dekoninck, J., Müller, M., and Vechev, M. Constat: Performance- based contamination detection in large language models. Ad- vances in Neural Information Processing Systems, 37:92420- 92464, 2024.
Magar, I. and Schwartz, R. Data contamination: From memoriza- tion exploitation. In Proceedings of the 60th Annual Meeting of the Association for Computational Linguistics (Volume 2: Short Pupers). pp. 157-165, 2022.
Duan, M., Suri, A., Mireshghallah, N., Min, S., Shi, W., Zettle- moyer, L., Tsvetkov. Y., Choi, Y., Evans. D., and Hajishirzi, H. Do membership inference attacks work on large language models? arXiv preprint arXiv:2402.07841 2024.
Maini, P. Jia, H., Papernot, N., and Dziedzic, A. Llm dataset inference: Did you train my dataset? arXiv preprint arXiv:2006.06443, 2024.
Mattern, J., Mireshghallah, Jin, Z., Schoelkopf, B., Sachan, M., and Kerg-Kirkpatrick, T. Membership inference attacks against language models via neighbourhood comparison. In Findings of the Association for Computational Linguistics: ACL 2023, pp. 11330-11343, 2023.
Duarte, A. V., Zhao, X., Oliveira, A. L., and Li, L. DE-COP: Detecting copyrighted content in language models training data. In Proceedings of the 4sst International Conference on Machine Learning, volume 235, pp. 11940- 11956, 2024.
Meeus, M., Shilov, I., Jain, S., Faysse, M., Rei, M., and de Mon- tjoye, Y.A. Sok: Membership inference attacks on Iims are rushing nowhere (and how to fix it). arXiv preprint arXiv:2406. 17975, 2024.
Dubey, A., Jauhri, A., Pandey, A., Kadian, A., Al-Dahle, A., Letman, A., Mathur, A., Schelten, A., Yang, A., Fan, A., et al. The Ilama 3 herd of models. arXiv preprint arXiv:2407.2178. 2024.
Oren, Y., Meister, N., Chatterji. N. S., Ladhak, F., and Hashimoto. T. Proving test set contamination in black-box language models. In The Twelfth International Conference on Learning Represen- tations, 2024.
Elkan, C. and Noto, K. Learning classifiers from only positive and unlabeled data, In Proceedings of the 14th ACM SIGKDD international conference Knowledge discovery and data mining, pp. 213-220, 2008.
Salem, A., Zhang, Y., Humbert, M., Berrang, P., Fritz, M., and Backes, M. MI-leaks: Model and data independent membership inference attacks and defenses on machine learning models. In Proceedings 2019 Network and Distributed System Security Symposium. Internet Society, 2019.
Gao, L.,, Biderman, S., Black, S., Golding, L., Hoppe, T., Foster, C., Phang, J., He, H., Thite, A., Nabeshima, N., et al. The pile: An 800gb datasct of diverse text for language modeling, arXiv preprint arXiv:2101.00 0000000000000200 2020.
Garreau, D., Jitkrittum, W., and Kanagawa, M. Large sample anal- ysis of the median heuristic. arXiv preprint 170iv:1707.0777 2017.
Segata, N. and Blanzieri, E. Fast and scalable local kernel ma- chincs. Journal of Machine Learning Research, 11(6), 2010.
Shi, W., Ajith, A., Xia, M., Huang, Y., Liu, D., Blevins, T., Chen. D., and Zettlemoyer, L. Detecting pretraining data from large language models. In The Twelfth International Conference on Learning Representations, 2023.
Golchin, S. and Surdeanu, M. Time travel in lmss: Tracing data contamination in large language models. In The Twelfth Inter- national Conference on Learning Representations, 2024.
10

---

Kernel Divergence Score
Shokri, R., Stronati, M., Song, and Shmatikov, Membership inference attacks against machine learning models. In 2017 JEEE symposium on security and privacy (SP), pp. 3-18. IEEE, 2017.
Truex, S., Liu, L.,, Gursny, M. E., Yu, I.,, and Wei, W. Demystifying membership inference attacks in machine learning service. IEEE transactions on services computing, 140))2007320889 2019.
Xie, R., Wang, Huang, R., Zhang, M., Ge, R., Pei, J., Gong, N., and Dhingra, B. Recall: Membership inference via relative conditional log nigiiiklihoods. In Proceedings of the 2024 Confer- ence on Empirical Methods in Natural Language Processing, 2024.
pp.
Xu, C., Guan, S., Greene, D.. Kechadi, M., et al. Benchmark data contamination of large language models: A survey. arXiv preprint arXiv:2406. 04244, 2024.
Yang. S.. Chiang, W.-L., Zheng, L.,, Gonzalez, J. E., and Stoica, Rethinking benchmark and contamination for language mod- cls with rephrased samples. arXiv preprint vrXiv:231..04855 2023.
Ye, W., Hu, J., Li, L.. Wang, H.. Chen, G., and Zhao, J. Data contamination calibration for black-box llms. arXiv preprint arXiv:2405. 1930, 2024.
Yeom, S.. Giacomelli, I., Fredrikson, M., and Jha, S. Privacy risk in machine learning: Analyzing the connection to overfitting. In 2018 IEEE s1 computer security foundations symposium (CSF), pp. 268-282. IEFE, 2018
Zhang, H., Lin, and Wan, Pacost: Paired confidence signifi- cance lesting benchmark contamination detection in large language models. In Findings of the Association for Computa- tiomal Linguistics: EMNLP 2024, pp. 1794-1809, 2024a.
Zhang, H. Zhang, S., Jing, B., and Wei, H. Fine-tuning can help detect pretraining data from large language models. In ICLR, 2025.
Zhang, J., Sun, J., Yeats, E., Ouyang, Y., Kuo, M., Zhang, J., Yang. H. F., and Li, H. Min-k%+++: Improved baseline for detecting pre-training data from large language models. arXiv preprint 3XXv:2404.029333 2024b.
Zhou, K., Zhu, Y., Chen, Z., Chen, W., Zhao, W. X., Chen, X., Lin, Y., Wen, R., and Han, J. Don't make your Ilm an evaluation benchmark cheater. arXiv preprint arXiv:2311.0196. 2023.

---

Kernel Divergence Score
Appendix
Contents
A Further Experimental Details
12
A.1 Implementation Details
12
A.2 Baseline Definitions
12
B Kernel Decomposition Plots Across Contamination Rates
13
C Consistency Requirement Compliance in Detail
15
D Role of the Normalization Factor
15
Histogram of Change in Embedding Distances
16
Extended Literature Review
16
A. Further Experimental Details
In this section, we append further experimental details and provide formal definitions of the baselines evaluated in the manuscript.
A.1. Implementation Details
For supervised fine-tuning, utilize Low-rank Adaptation (Hu al., 2021). In Table 9, disclose detailed LoRA configurations and other training hyperparameters used for supervised fine-tuning.
Table Supervised Fine-tuning Configurations and Hyperparameters.
Hyperparameter
WikiMIA
BookMIA
AniiTTection
LoRA Dimension
LoRA
32
LoRA Dropout
0.1
LoRA Target Modules
query, value projection layers
SGD Learning Rate
0.0001
Batch GD Learning Rate
0.01
Batch Size
4
Dataset Size
700
4000
700
A.2. Baseline Definitions
Here, we provide formal definitions for each baseline compared in Table 1.
12

---

Kernel Divergence Score
Definition 1. (Zlib Score) is the negated ratio of the log perplexity and the zlib compression size:
1 Ex,ET, log Po(ay)aac))
Zlib(xx,).izz)
where T; is the set of tokens from sample i. (Carlini al., 2021)
Definition 2. (Perplexity Score) is the negated average perplexity across samples:
exp
Σ J
log (zy (225))
(8)
n
TT
where Ti is the set of tokens from sample i. (Li, 2023)
Definition 3. (Min-K% Score) is the negated mean probability from bottom-k% tokens averaged across samples:
log Po(x)lmes))
n |K:
EK
where K2 is the set of bottom-k% from sample i. (Shi et al., 2023)
Definition 4. (Min-K%++ Score) is the negated mean normalized probability from bottom-k% tokens averaged across samples:
log Po(xs)lzes) Maas
(10)
Oxes
i= EKC,
where KG, the set of bottom-k% tokens from sample Hres
is the expected log probability
over the vocabulary of the model, and Oxes V (eepp - (2 is the standard deviation. (Zhang
al., 2024b)
Following the general guideline from Shi et al. (2023), take the bottom 20% tokens for the Min-K% Score and Min-K%++ Score.
Definition 5. (Fine-tuned Score Deviation) is the difference of scores before and after sinerrinsdfimettunnnng averaged across samples:
5(x;0) 8(x;;
(11)
where x; is the i-th sample in the dataset, S(--) is an existing scoring function (e.g., Min-K% or Perplexity Score), and 8, 8 are models before and after fine-tuning, respectively. (Zhang et al., 2025)
Definition 6. (Sharded Rank Comparison Test) the difference between the log likelihood of the canonical dataset sample ordering from the mean over shuffled sample orderings, averaged across dataset shards:
log P([z
(k) p
1 Σ
log
P( nn
(()))))))
(12)
G
dEB
where is the number of shards, G is the set of sample permutaations and [x; in k-thh shard of the dataset. (Oren et al., 2024)
(k) | is the sequence of samples Tı, T2,.... ...,,. Zn
B. Kernel Decomposition Plots Across Contamination Rates
In this section, we extend Figure by providing visualization of kernel components contamination À (0.2, 0.4,0..4406600.3.
In all cases, the pattern shown in kernels consistent with explanation in Section 3.
13

---

Kernel Divergence Score
X
22)
log 1 (
4 + log ((7))
0233
6.04
0433
0012
05
0016
0.2
0.1
0.05
0.0
0.00
0033
8354
0023
8339
0.4
04
8330
8.300
3035
0.6
3033
02
3335
0.000
0.8
84
0,000
2003
01
0,000
Figure 5. Decomposition the Kernel Divergence Score full list.
14

---

Kernel Divergence Score
C. Consistency Requirement Compliance in Detail
To assess the adherence each baseline to the Consistency requirement, we calculate the Mean Absolute Percentage Error (MAPE) over five independent runs.
5 S. S S
MAPE
5
where S, represents the score from the 1-th run, and S denotes the mean score across all five runs. This metric is then averaged across all contamination rates. The results, presented in Table 10, indicate that our Kernel Divergence Score achieves the lowest MAPE among non-FSD--asee methods, highlighting its superior consistency. FSD-based scores generally have lower average MAPE, but they often fail to meet monotonicity requirements (Table I).
Table 10. Consistency Requirement in terms of average MAPE. The average Mean Absolute Percentage Error (MAPE) over 5 independent runs is calculated. Among non-FSD baselines, our Kernel Divergence Score achieves lowest average MAPE.
Methods
WikiMIA BookMIA ArxivTection
Average
Non-FSD-based Scores
0.1300
0.1144
0.5199
0.2548
Perplexity Score
0.1786
0.1974
0.1892
0.1884
Min-K%
0.1966
0.2519
0,1882
0.2122
Min-K%++
0.3281
0.1115
0.3268
0.2554
FSD-based Scores
Zlib FSD
0.1421
0.1460
0.2191
0.1691
Perplexity Score FSD
0.1587
0.1653
0,2490
0.1910
Min-K% FSD
0.2936
OOM
0.2616
0.2776
Min-K%++ FSD
0.2914
OOM
0.2652
0.2783
Kernel Divergence Score
0.1427
0.1500
0.2527
0.1818
D. Role of the Normalization Factor
Recall that in our Kernel Divergence Score, we define the normalizer E' as the square root of the sum of entries in the kernel matrix. We employ this square-root normalizer because, despite the second-order nature of Eq. (4), the sum kernel entries reveals a linear relationship with varying data subset sizes, as shown in Figure A linear fit the data yields an R² value of 0.9766, confirming the linearity of this relationship. Therefore, mitigate the influence of dataset size and prevent over-penalizing the score scale, utilize the square-root normalizer.
Observed Data Linear Fit R² 0.9766
Kernel Entry Sum
140
120
100
80
350
400
450
500
550
600
650
700
Dataset Size
Figure 6. Sum of kernel entries by data subset size. The data subsets are randomly sampled from the WikiMIA dataset.
15

---

Kernel Divergence Score
E. Histogram of Change in Embedding Distances
In Figure we present histograms of the change in embedding distances before and after fine-tuning. We compare three pair types: seen-seen, seen-umse unseen, and unseen-unseen. The figure reveals that unseen-unseen unseen pairs exhibit more significant shifts, with distances increasing more after fine-tuning overall. This suggests that representations of unseen samples tend spread farther apart, highlighting and confirmaing intuition the distributional shift induced by the fine-tuning process.
Seen-Seen
Seen-Unseen
Unseen- Unseen
60030
70020
Count
00000
30000
20030
10020
x -0.10
.0.10 xx 0.00
0.10
0.30
0.10
0.000
0,00 xx c010
0.10
0.10
0.00
0.30
x
0.09
.0.0
.0.10
0.00
Figure Histogram on the values embedding distance change.
F. Extended Literature Review
Here, we provide a more descriptive review of previous works on membership inference attack (MIA) (Shokri et al., 2017; Truex et al., 2019), as is related to the objective of our work in quantifying leakage (i.e., contamination) datasets (Magar Schwartz, 2022; Xu et al., 2024; Balloccu et al., 2024).
Early MIA approaches. Membership inference attacks aim to determine whether specific data sample was part of a model's training dataset. Farly approaches primarily utilized metrics derived from model outputs to achieve this. For instance, Salem al. (2019) employed output entropy as a distinguishing factor, observing that models often exhibit lower entropy (i.e., higher confidence) for training samples compared to non-train non-training ones. Similarly, Liu al. (2019) focused on the model's confidence scores, noting that higher confidence levels could indicate sample's 's presence in the training set, and Carlini al. (2022) proposed likelihood ratio-based approach. Beyond output- based metrics, researchers have explored the impact of training dynamics on MIAs. Yeom et al. (2018) investigated the use of loss values, finding that models tend to produce lower loss for training samples, making loss a viable metric for membership inference. Additionally, Liu et al. (2023) introduced a gradient-based approach, leveraging the observation that the gradients of training samples differ from those non-training samples, thereby serving as an effective indicator for membership inference.
Challenges of MIA on Large Language Models. While MIAs have been effective against traditional machine learning models, applying them to large language models (LLMs) presents unique challenges. Recent studies have highlighted the difficulty of performing MIAs on LLMs. For instance, Duan al. (2024) found that MIAs often barely outperform random guessing when applied LLMs. This limited success is primarily due the vast scale of LLM training datasets and the relatively brief exposure each sample during training-typically only one epoch-resulting in minimal memorization of individual data points. Additionally, the inherent overlap of n-grams between the distinction between seen and unseen data. This overlap creates a fuzzy boundary, making it challenging for MIAs to accurately infer membership. Furthermore, Meeus et al. (2024) identified that distribution shifts between collected member and non-member datasets can lead to misleading MIA performance evaluations. They demonstrated that significant distribution shifts might cause high MIA performance, not due to actual memorization by the model, but because of these shifts. When controlling for such shifts, MIA performance often drops to near-random levels.
and unseen text samples complicates
16

---

Kernel Divergence Score
MIA Large Language Models. Despite challenges, numerous studies have endeavored apply membership inference attacks (MIA) for large language models (LLMs). Building classical appraoches (Yeom al., 2018; Carlini al., 2022), researchers have introduced range of innovative approaches tailored to LLMs. Perplexity-based methods have been utilized, as demonstrated by Li (2023) and Carlini et al. (2021), who leveraged perplexity as key metric to infer membership. Similarly, likelihood-basee based strategies have been explored, with Shi et al. (2023) and Zhang et al. (2024b) employing likelihood scores to distinguish between seen and unseen samples effectively. Other studies have extended traditional metric-based approaches to the LLM domain (Duan et al., 2024; Xie al., 2024; Zhang et al., 2024b; Mattern al., 2023; Ye et al., 2024), while Zhang et al. (2025) further expanded the scope by investigating the influence of fine-tuning various membership-related scores. In addition to individual sample-level techniques, set-level detection methods have been introduced to identify contamination across broader datasets. For example, Oren et al. (2024), Zhang et al. (2024a), and Golchin & Surdeanu (2024) enabled more holistic assessment of dataset contamination. Building on these foundations, our work introduced the Kernel Divergence Score, a novel method for evaluating contamination levels. This approach capitalizes on the differential effect of fine-tuning on embedding kernel similarity matrices, offering a unique perspective on contamination detection and addressing key limitations of existing methods.
17


Reviews:
[{"review_id": "bos8xHH1O8", "reviewer": "Reviewer_J5f8", "summary": "This paper investigates how to quantify dataset leakage in large language models. The proposed method is inspired by the fact that fine-tuning affects the embedding relationships unseen samples more significantly than those seen samples. \n\nThe authors propose Kernel Divergence Score, using kernel similarity matrix between the embeddings before and after fine-tuning to compute a score as the degree of dataset leakage. The proposed method achieves best performance against compared baselines.\n\nBesides, the authors conduct comprehensive ablation studies to investigate the factors like kernel bandwidth and embedding location.", "questions": "", "limitations": "", "rating": 4, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Dear Reviewer J5f8,\n\nWe sincerely appreciate your positive feedback and the time you've dedicated to reviewing our manuscript. Your insights are invaluable to us. Please let us know if you have any further questions.", "claims_and_evidence": "Yes, the claims are well supported by main experiments, ablation studies and visualization.", "methods_and_evaluation_criteria": "Yes, the proposed methods make sense.", "theoretical_claims": "These is not too much theoretical claims.", "experimental_designs_or_analyses": "Yes, the experimental designs are make sense and consistent with previous work.", "relation_to_broader_scientific_literature": "Yes, the proposed method is inspired by findings from previous study.", "essential_references_not_discussed": "No.", "other_strengths_and_weaknesses": "See above.", "other_comments_or_suggestions": "None", "questions_for_authors": "None", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "SujEankaTb", "reviewer": "Reviewer_CbNy", "summary": "The paper introduces the Kernel Divergence Score (KDS), a method to quantify dataset contamination in LLMs by measuring changes in kernel similarity matrices of sample embeddings before and after fine-tuning.", "questions": "", "limitations": "", "rating": 3, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We thank the reviewer for the thoughtful and constructive feedback. Below, we address the key concerns:\n\n---\n_A1. Clarification on problem setting_\n\nWe absolutely agree with your viewpoint that contamination in real LLMs occurs during pre-training! We'd like to clarify that **our central goal is indeed to quantify contamination originating from pre-training, not fine-tuning**. Our methodology and evaluation are designed around pre-training leakage. \n\nIn particular, we ask this question (Sec 2.1):\n\n> Given an LLM $\\mathcal{M}$ and a benchmark dataset $\\mathcal{D}$ (e.g., WikiMIA), to what extent has this dataset been exposed during pre-training?\n\nTo address this, our key idea is the following:\n\n> If the model $\\mathcal{M}$ has already been pre-trained on $\\mathcal{D}$, then if we further fine-tune $\\mathcal{M}$ on $\\mathcal{D}$, the model would have minimal changes in embeddings due to prior exposure during pre-training (vice versa).\n\nHence, we use a lightweight fine-tuning step as a probe to reveal how much of the evaluation dataset was likely seen during pre-training. In other words, **we are not using fine-tuning to inject contamination, but only as a mechanism to probe for the presence of whether $\\mathcal{D}$ is used in pre-training**. This design choice aligns with recent work (e.g., Zhang et al. 2025, FSD) that also leverages fine-tuning to surface memorized content—but our approach uniquely leverages embedding-level structural changes, enabling a more holistic dataset-level assessment.\n\n---\n_A2. \"the contamination is artificially introduced via fine-tuning, not pre-training\"_\n\nWe would like to clarify that **our experimental setup simulates contamination w.r.t. pre-training, which is precisely the phenomenon our method aims to quantify**. Specifically, our controlled experiments leverage datasets such as WikiMIA, with two subsets: seen/unseen in the pre-training corpus of the LLM (e.g., Mistral-7B). By mixing these pre-training seen and unseen subsets at varying proportions, we simulate datasets with known and controllable contamination ratios relative to pre-training—not fine-tuning.\n\n---\n_A3: “Have the authors tested KDS on LLMs with partially known pre-training corpora?\"_\n\nExcellent suggestion! We further evaluated on **Pythia-6.9b**, which is known to be pre-trained on the PILE dataset. The spearman correlation coefficient is **0.999** on the Enron subset.\n\nFurthermore, our evaluation includes WikiMIA, BookMIA, and ArxivTection benchmarks, which label samples that are likely to have been seen in general LLM pre-training as \"seen\". We explicitly simulate varying contamination ratios and show in **Table 1** that **KDS exhibits near-perfect monotonicity and consistency, outperforming all baselines across three datasets.**\n\n---\n_A4. Theory_\n\nWhile our paper primarily focuses on providing a practical and robust empirical method for quantifying pre-training contamination, we agree that theoretical analysis is an important direction. Our core intuition—that fine-tuning shifts the embeddings of unseen pre-training data more significantly than seen data—is empirically grounded, as shown in Figure 2, and supported by strong monotonicity and consistency across all benchmarks (Tables 1, 5, 6). Moreover, the mathematical formulation in Eq. (3–5) provides a principled and interpretable construction of KDS, which integrates:\n- A soft gating function that emphasizes initially similar pairs, and\n- A distance shift measure capturing how much pairwise embedding geometry is altered after fine-tuning.\n\nThat said, we acknowledge that a full theoretical analysis of why kernel divergence correlates with contamination remains nontrivial. Such analysis would require carefully defined assumptions about the structure of the embedding space, the dynamics of fine-tuning, and the underlying data distribution. We consider this a promising direction and plan to explore these theoretical foundations in future work.", "claims_and_evidence": "The central claim—that KDS effectively quantifies contamination—is supported by experiments where contamination is simulated by mixing pre-training \"seen\" data with \"unseen\" data and fine-tuning. However, a critical limitation is that contamination in real LLMs occurs during pre-training, not via post-hoc fine-tuning. The experiments validate KDS in a synthetic setup but lack evidence that it generalizes to pre-training leakage. The correlation results are convincing for the tested scenarios, but the claim’s broader applicability remains unproven.", "methods_and_evaluation_criteria": "The kernel-based approach is novel, leveraging embedding shifts post-fine-tuning. However, evaluating contamination via fine-tuning conflates two distinct processes: pre-training data leakage and adaptation during fine-tuning. The benchmarks (e.g., WikiMIA) are standard, but their use of fine-tuning to inject contamination may not reflect real-world pre-training leakage. The evaluation criteria (monotonicity, consistency) are appropriate but limited to the authors’ experimental setup.", "theoretical_claims": "The paper lacks formal theoretical guarantees for KDS. The intuition that fine-tuning impacts unseen data more is plausible but not rigorously proven. The mathematical formulation (Eq. 3–5) is empirically validated but lacks theoretical analysis of why kernel divergence should correlate with contamination in general settings.", "experimental_designs_or_analyses": "The controlled experiments systematically vary contamination ratios, but the contamination is artificially introduced via fine-tuning, not pre-training. This design choice raises concerns about ecological validity. For instance, real contamination involves memorization during pre-training, which may not manifest the same embedding shifts as fine-tuning. The ablation studies (e.g., kernel function choices) are thorough but do not address this core issue.", "relation_to_broader_scientific_literature": "The work connects to membership inference attacks (MIA) and dataset contamination detection (e.g., Carlini et al., 2021; Shi et al., 2023). However, prior MIA methods focus on individual sample detection, while KDS operates at the dataset level.", "essential_references_not_discussed": "None.", "other_strengths_and_weaknesses": "The methodology of this paper is interesting, but the experimental part is really hard to convince me yet.", "other_comments_or_suggestions": "None.", "questions_for_authors": "1. How does KDS perform when contamination originates from pre-training data rather than fine-tuning? If experiments only use fine-tuning to simulate contamination, the method’s applicability to real-world LLM evaluation (where contamination occurs during pre-training) is unclear. Demonstrating KDS on pre-training leakage would strengthen the claims.\n\n2. Can KDS distinguish between memorization during pre-training vs. adaptation during fine-tuning? The current setup assumes these are equivalent, but they may involve different mechanisms. A response clarifying this would affect the validity of the evaluation.\n\n3. Have the authors tested KDS on LLMs where the pre-training corpus is partially known? This could validate whether KDS correlates with ground-truth contamination in real-world settings.", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "mGmJ5cwBJz", "reviewer": "Reviewer_9vAw", "summary": "This paper proposes the Kernel Divergence Score (KDS) as a measure of dataset-level benchmark contamination for LLMs. KDS is computed as the weighted average of pairwise embedding vector changes across finetuning the model under investigation on the benchmark test dataset. KDS is shown to be robust to many design choices, exhibit a high degree of 'monotonicity', i.e. correlation of contamination degree and score value, and consistency, i.e., similar contamination induces similar scores.", "questions": "", "limitations": "", "rating": 3, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We thank the reviewer for the thoughtful and constructive feedback. Below, we address your concerns in detail.\n\n---\n_A1. Related work_\n\nWe thank the reviewer for pointing out the work by Dekoninck et al. [1], which appears to be highly relevant! It's our oversight at the time of submission and will make sure to discuss it in the updated version.\n\n[1] Dekoninck et al \"Constat: Performance-based contamination detection in LLMs.\" NeurIPS 2024.\n\n---\n_A2. Open weight model_\n\nWe acknowledge that KDS currently requires open-weight models. This is a fair point, and we will clearly note this limitation in the paper. However, we'd like to emphasize that focusing on open-weight models is valuable for academic research because they provide transparency **essential for developing a deeper understanding of how contamination manifests inside LLMs**. In future works, adapter-based probing techniques can be explored to extend its principles to proprietary models.\n\n---\n_A3. Significance w.r.t. min-K%_\n\nWhile Min-K% works well on easy benchmarks such as WikiMIA and BookMIA, its performance degrades significantly on more challenging datasets. For example, **in the three hardest PILE subsets in Table 5, Min-K% has significantly lower performance than KDS**, as shown below (numbers are Spearman correlation):\n\n| PILE | Min-K% | KDS|\n|-|-|-|\n| Wikipedia |-0.645 | **0.891** |\n| Hackernews | -0.955 | **0.897** |\n| Pile-CC | 0.690 | **0.895** |\n\n---\n_A4. Practical utility_\n\nWe agree that absolute contamination estimation is valuable. However, **a necessary step toward this goal** is to ensure that any proposed contamination scoring function satisfies core correctness criteria—namely, monotonicity and consistency with ground-truth contamination levels in controlled settings. **These conditions ensure that the score behaves predictably and reliably in principle, which is essential before deploying it in practical settings**. To our knowledge, no prior work has investigated this practically important angle.\n\nConcerningly, we discovered existing scores do not satisfy these necessary conditions. In contrast, KDS consistently satisfies these conditions under varying benchmarks (including the challenging ones), providing stronger foundations for future method design.\n\nLastly, we would like to emphasize that KDS is also highly practical, because it supports real-world applications such as safety auditing and benchmark selection, where knowing which dataset is more contaminated is often more important. **To further demonstrate the practical utility, we include an in-the-wild evaluation across 11 public benchmarks (Appendix E)**. For these reasons, we believe KDS offers a meaningful and practical step forward for the field.\n\n---\n_A5. Minimal contamination rate to be regarded as \"significantly contaminated\"_\n\nThe required rate to be considered \"significantly contaminated\" is **0.10 (p=0.014)** under significance level $\\alpha=0.05$, and **0.15 (p=0.004)** under $\\alpha=0.01$.\n\n---\n_A6. Histogram on the values of embedding similarity change_\n\nSince plots cannot be updated or shown at this stage, we provide the histogram as a frequency table below. The table is retrieved from a contamination rate of 0.5.\n\n| bins | Seen-Seen | Seen-Unseen | Unseen-Unseen |\n|:-:|:-:|:-:|:-:|\n| x < -0.10 | 0 | 202 | 22 |\n| -0.10 <= x < 0.00 | 21529 | 44112 | 6030 |\n| 0.00 <= x < 0.10 | 40953 | 80338 | 52270 |\n| 0.10 <= x | 18 | 348 | 4178 |\n| **total** | 62500 | 125000 | 62500 |\n\n_A7. Embedding similarities should increase for unseen data. Why take the absolute change?_\n\nWe would like to clarify that the embedding distances increase (i.e., embedding similarities decreases) for previously unseen data after fine-tuning. This is also evidenced in the table above, where $\\log \\frac{\\Phi(Z)}{\\Phi(Z')} = ||Z'_i-Z'_j||^2_2 - ||Z_i-Z_j||^2_2$ is mostly positive for unseen-unseen pairs. \n\nWe take the absolute value of the change to ensure that we capture the magnitude of deviation, regardless of direction. This makes the score robust to mixed behavior and focuses on detecting how much the geometry shifts. We will clarify this in the final version.\n\n---\n_A8. Effect of Fine-tuning and Rephrased Data_\n\nFollowing the suggestion, we fine-tuned \"unseen\" samples from WikiMIA and Arxivtection, observing KDS increases of 22% for WikiMIA, and 11% for Arxivtection. This shows our scoring approach's ability to effectively capture contamination introduced by fine-tuning.\n\nAdditionally, we experimented on WikiMIA by mixing unseen data with rephrased \"seen\" data at varying proportions, yielding a Spearman correlation of -0.791. This outcome is expected, as rephrasing likely blurs the distinction between seen and unseen samples.\n\n---\n_A9. Other suggestions_\n\nThank you for all the constructive suggestions! We will incorporate those comments, to (1) mention the use of LoRA in the main paper, (2) bold-face all the best performances in Table 1, and (3) add a histogram based on our response, A6.", "claims_and_evidence": "Key claims:\n* The proposed KDS has higher(er than baselines) correlation with contamination degree => substantiated with Table 1, although Min-K% performs better on 2/3 benchmarks without requiring weigh-access\n* The proposed KDS has high consistency, i.e., the same contamination level leads to similar scores => Moderately well substantiated in Figure 3. Standard deviation is very large compared to score value, at low contamination rates. I.e. while Scores are not statistically significantly different for the same contamination rates, they will also not be statistically significantly different for moderate differences in contamination rate.", "methods_and_evaluation_criteria": "* The considered datasets are a reasonable choice, which could be extended with experiments investigating contamination introduced in a fine-tuning step, but this is purely optional.\n* The proposed evaluation is suitable to establish the utility of KDS as a metric to rank datasets based on their contamination\n* However, no effort is made to show that it permits the comparison of models (note this is not claimed as an objective)\n* Similarly, no effort is made to show that it permits to show whether or not a specific model is contaminated with a specific dataset (note this is also not claimed as an objective)\n* A range of ablation studies is conducted, showing the (lack of) sensitivity of KDS to many design choices", "theoretical_claims": "Equivalence between (3) and (4) for $\\gamma=1$ is the only claim and it is correct.", "experimental_designs_or_analyses": "* The experimental design is sound and consistent with the claims being made.\n* Note that some claims which I believe would be important for practical relevance (model comparison and establishing absolute instead of relative contamination) are not made and not analyzed.", "relation_to_broader_scientific_literature": "Given the objectives of the proposed method, a reasonable set of baselines is compared to, which are carefully discussed in the appendix. KDS shows strong performance across all three considered benchmarks. However, Min-K% performs better on 2/3 benchmarks, without requiring open-weights / a fine-tuning step with the difference in performance most likely being practically irrelevant (similar or worse performance of their own method in Table 5 and 6 is considered \"near-perfect\").", "essential_references_not_discussed": "An important work on quantifying dataset-level contamination (Dekoninck et al \"Constat: Performance-based contamination detection in large language models.\" NeurIPS'24) is neither referenced nor compared to.", "other_strengths_and_weaknesses": "### Strengths\n* LLM evaluation is a topic of crucial importance and benchmark contamination is an important factor.\n* KDS is conceptually relatively simple (with an even simpler version performing just as well (differences in Euclidean distance -- no soft-gating))\n* KDS shows strong monotonicity across a broad range of settings and models\n\n### Weaknesses\n* Need for Finetuning the model under investigation makes the proposed approach applicable only to open-weight models\n* KDS only permits a ranking of datasets by their contamination for a given model, no comparison between models or absolute statements about the contamination of a model, severely limiting its practical utility.\n* Performance improvement over more broadly applicable Min-K% seems practically irrelevant.", "other_comments_or_suggestions": "* The use of LORA should be mentioned in the main text\n* Boldening only in the average in Table 1. is misleading and hides the fact that Min-K% outperfroms KDS in 2/3 datasets.\n* Figure 2 mid mostly shows that seen-seen change less. Can you create a histogram of values for seen-seen, seen-unseen, unseen-unseen (without taking the absolute value preferably)?\n## Questions For Authors", "questions_for_authors": "* What is the minimal contamination rate required to show it is >0 with a confidence of 95% and 99%? (This should be computable using the results visualised in Figure 3)\n* How do scores correlate with contamination across different models?\n* Can you conduct an experiment, Finetuning with rephrased \"seen\" data, simulating a setting where the model was trained on rephrased benchmark data?\n* Why take the absolute value of change in embedding similarity? The provided intuition indicates that similarities should increase for previously unseen data.\n* Can you conduct an experiment showing the effectiveness of your approach detecting contamination introduced during fine-tuning? (Gradient flow only from answers and data mixed with some background data.)", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "brrIhtDrBW", "reviewer": "Reviewer_5cjP", "summary": "The paper proposes the Kernel Divergence Score to estimate data contamination in large language models. The method makes use of a kernel with layer embeddings to estimate the similarities between samples before and after finetuning. If these embeddings remain similar, the data is likely contaminated. The authors perform experiments on several benchmarks showcasing the effectiveness of their approach.", "questions": "", "limitations": "", "rating": 4, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We sincerely thank the reviewer for the thorough and constructive feedback. Below, we address the concerns in detail.\n\n---\n_A1. Baseline comparison in Table 5 (Pile dataset)_\n\nWe provide the comparison below. KDS achieves the highest average correlation.\n\n| Spearman Corr. | Wikipedia | PhilPapers | Enron | HackeerNews | Pile_CC | StackExchange | **Average** |\n|---|:---:|:---:|:---:|:---:|:---:|:---:|:---:|\n| Zlib | 0.861 | **1.000** | **1.000** | -0.956 | -0.782 | 0.990 | 0.352 |\n| Zlib + FSD | **1.000** | 0.991 | 0.999 | 0.323 | 0.894 | 0.999 | 0.868 |\n| Perplexity | -0.886 | 0.999 | 0.999 | -0.999 | -0.251 | 0.999 | 0.144 |\n| Perplexity + FSD | **1.000** | 0.990 | 0.999 | 0.118 | **0.908** | **1.000** | 0.836 |\n| Min-K% | -0.645 | 0.996 | **1.000** | -0.955 | 0.690 | 0.999 | 0.348 |\n| Min-K% + FSD | 0.997 | 0.952 | 0.997 | 0.421 | **0.908** | **1.000** | 0.879 |\n| Min-K%++ | -0.482 | 0.960 | -0.842 | 0.561 | 0.514 | 0.697 | 0.235 |\n| Min-K%++ + FSD | -0.536 | 0.994 | -0.770 | 0.705 | -0.358 | 0.210 | 0.041 |\n| KDS (Ours) | 0.891 | 0.982 | **1.000** | **0.897** | 0.895 | **1.000** | **0.944** |\n\n\n_A2. Significance over Perplexity_\n\nIn the A1 table above, **KDS outperforms Perplexity on the Pile dataset, with an average correlation of 0.944 compared to 0.144**.\n\n\n_A3. Negative correlations_\n\nWe resonate with the reviewer’s concern. To address the potential causes, **we reviewed our implementation and found no errors**. Since our code directly builds on established prior work, an implementation error is unlikely (code will be released).\n\n---\n_A4. Main metrics and Practical utility_\n\n(1) Main metrics\n\nWe agree that absolute contamination estimation and exact correspondence would be valuable. However, a **necessary step toward this goal** is to first validate the correctness of any scoring functions. The use of Spearman/Pearson correlation in our controlled experiments allows us to rigorously assess whether KDS (and other approaches) produces consistent and monotonic metrics, necessary conditions for any meaningful scoring function. **This provides dev-purpose metric to ensure score behaves predictably and reliably in principle, which is essential for deploying it in practical settings**. To our knowledge, no prior work has investigated this practically important angle.\n\nConcerningly, we discovered existing scores do not satisfy these necessary conditions. In contrast, KDS consistently satisfies these conditions under varying benchmarks (including the challenging ones), providing stronger foundations for future method design.\n\n(2) Practical utility\n\nThe lack of access to pre-training corpora makes ground-truth estimation fundamentally challenging. Moreover, pre-training data is often non-overlapping across models, further complicating any cross-model normalization or comparison. _To our knowledge, there is no existing work that has effectively estbalished correspondence between the scoring function and dataset contamination_. **This reflects the intrinsic difficulty of the problem, rather than a unique shortcoming of our approach**.\n\nThat said, we would like to emphasize that **KDS is highly practical, which supports real-world applications such as safety auditing and benchmark selection**, where knowing which dataset is more contaminated is often more important. It enables dataset creators or auditors to prioritize and select the least contaminated benchmarks for evaluation purposes. We state the practical utility in **Lines 108-117**. \n\n---\n_A5. Correlation between benchmark difficulty and KDS_\n\nThank you for this insightful question. During rebuttal, we computed the correlation of {Llama3.1-8b, Mistral-7b, Qwen2.5-7b}'s performance on {GSM, MPP, MPL, TFQA} with KDS. The correlation values are 0.2, 0.4, 0.2, respectively, which are all very low. This indicates that **benchmark difficulty is not what determines the scale of KDS.**\n\n---\n_A6. Why do we need Requirement 2?_\n\nWhile the two requirements could be combined, separating them into orthogonal objectives offers clearer guidance for future research by isolating distinct performance aspects.\n\n---\n_A7. Clarification on Figure 2 (left)_\n\nIt is true that unseen samples are similar to each other in Figure 2 (left), and we would like to clarify that this is the similarity _before_ fine-tuning. However, **our method relies on the changes in the similarity or distance before and after fine-tuning, which is much more significant for unseen examples**. As shown in Figure 2 (middle, without gating) and Figure 2 (right, with gating), unseen samples exhibit significantly larger shifts in embedding geometry, whereas seen samples remain relatively stable. This differential behavior is the core signal that KDS captures. \n\nPs. The performance of only using Figure 2 (left) is in Table 2 \"w/o (2) Fine-tuning\".\n\n---\n_A8. Is comparison with SRCT accurate?_\n**We preserved the canonical ordering of samples in SRCT** by not shuffling the dataset.", "claims_and_evidence": "Overall, the claims made by the authors are supported by convincing evidence. However, several major concerns (see experimental designs) limit the conclusions that can be drawn from the numbers shown. Furthermore, I am particularly concerned with the very small gain compared to the Perplexity method. This baseline is obviously flawed, as lower perplexity can have any number of causes. Yet, it performs almost perfect on the given benchmark and is only outperformed by 2% by the new method. This indicates very marginal gains over a very basic baseline and therefore does not warrant the additional complexity of the method. Furthermore, the high deviations reported in Table 9 (>16%) indicate that these differences are likely not even significant.", "methods_and_evaluation_criteria": "See experimental designs.", "theoretical_claims": "I have one concern with the current requirements that are listed: Why do the authors use two requirements? Consistency follows from monotonicity (if one replaces the \"if\" with an \"if and only if\", which would be necessary for a good definition of monotonicity). Thus, Requirement 2 is redundant and also plays a much smaller role in the evaluation.", "experimental_designs_or_analyses": "- I am concerned with the main metric used for evaluation (spearman/peason) correlation. In practice, one cannot perform such an experiment: the authors should be provide a clear cutoff at which a benchmark should be considered contaminated, or give an indication which value of their score function corresponds to what level of contamination. Without such a correspondence between the scoring function and contamination, the test has no practical use and cannot be considered a contribution. Thus, I ask the authors to investigate the following aspects:\n  - Do similar values of S for the different benchmarks correspond to the same level of contamination? If not, then no such correspondence exist.\n  -  Do similar values of S for different models correspond to the same level of contamination? If not, then no such correspondence exist.\n- I am furthermore concerned that the test does not measure contamination, but difficulty. Using a similar argument as the authors, one could argue that training on more difficult samples the model is less used to, would cause more deviation on the sample. The fact that the perplexity metric (another metric for which this can be argued) is so close in performance to KDS indicates as well that this might be a problem. Therefore, I urge the authors to:\n  - On the benchmarks presented in appendix E, show the correlation between benchmark difficulty and model score for each model separately. I suspect (but am not sure) the correlation will be significantly above 0.\n  - The authors should clearly argue why this is not the case. If one wants to use this test in practical scenarios to find contamination and accuse model providers that their model is contaminated, there should be no argument what the test is measuring.\n- I am concerned that the shown plots indicate a discrepancy between seen and unseen samples. Specifically, on the left-hand side of each plot, one would expect the square corresponding to seen samples to be as bright as unseen samples: brightness indicates similarity between the samples. It seems here that the unseen samples are very similar while the seen samples are not. The authors should clarify if this is a mistaken interpretation on my side (if so, explain), and if not, see how this can affect their scores as it greatly decreases the difficulty for their method to detect unseen samples.\n- I am concerned with the negative correlations shown for some baselines. The authors only briefly comment on this, but perfect negative correlation (see Zlib) for a benchmark indicates that the method would work perfect if you were to swap the sign for this benchmark. This either indicates (1) the authors have found an issue no prior work has ever been able to find (2) the implementation is wrong, or (3) the metric used is not a good metric for performance. The authors are strongly encouraged to provide evidence that excludes the second and third option, since the first one is quite a strong claim.\n- The authors should compare against baselines in Table 5. Due to the cited papers (Duan et al, Das et al, ...), the numbers presented in Table 1 are a bit meaningless due to the possibility of a temporal split.\n- The comparison with Oren et al. is not accurate. SRCT can only be used on the canonical ordering of samples. Since the authors subsample to report the numbers, the canonical ordering disappears. The authors should ensure that the subsampling happens in such a way that consecutive samples are included for the comparison against Oren et al.", "relation_to_broader_scientific_literature": "The authors do a good job of relating the work to existing work in data contamination. No essential work is missing, and the baselines compared against are accurate. The first paragraph in Section 6 is necessary and appreciated (albeit not entirely complete, see Experimental Designs).", "essential_references_not_discussed": "N/A", "other_strengths_and_weaknesses": "The paper is very well-written and easy to follow.\n\n### update after rebuttal\nI have changed my view on this paper after the rebuttal. Most of my concerns were sufficiently addressed, although some concerns still remain (practical applicability of the method being the main bottleneck). Therefore, I have raised my score to a recommended accept, but would not recommend the paper for a spotlight paper.", "other_comments_or_suggestions": "I am currently leaning towards rejection. If the authors are able to address my concerns, I am willing to increase my score. However, if one of the following aspects is not clarified or improved during the rebuttal, I will further reduce my score:\n- Very marginal gains compared to the perplexity method.\n- Correspondence between S and level of contamination.\n- Is difficulty correlated with KDS?", "questions_for_authors": "See above.", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Meta-review: This paper proposes Kernel Divergence Score (KDS), a method to quantify dataset contamination in LLMs by measuring the divergence in kernel similarities of embeddings before and after fine-tuning. KDS reliably correlates with contamination levels and outperforms existing baselines across benchmarks.

After the author-reviewer discussion, all the reviewers reached a positive consensus (2 weak accept, 2 accept). Their positive comments are mostly based on solid and sound experimental results. I also agree with the reviewers.

Overall, I recommend "Accept" for this paper.
Decision: Accept (poster)