ConStat: Performance-Based Contamination Detection in Large Language Models
Authors: Jasper Dekoninck
Mark Niklas Mueller
Martin Vechev
Venue: NeurIPS 2024 poster (2024)
Keywords: large language models
model evaluation
contamination detection
Primary area: natural_language_processing
TL;DR: We present a statistical method that aims to detect contamination in language models as artificially inflated and non-generalizing benchmark performance.

Abstract: Public benchmarks play an essential role in the evaluation of large language models.  However, data contamination can lead to inflated performance, rendering them unreliable for model comparison. It is therefore crucial to detect contamination and estimate its impact on measured performance. Unfortunately, existing detection methods can be easily evaded and fail to quantify contamination. To overcome these limitations, we propose a novel definition of *contamination as artificially inflated and non-generalizing benchmark performance* instead of the inclusion of benchmark samples in the training data. This perspective enables us to detect *any* model with inflated performance, i.e., performance that does not generalize to rephrased samples, synthetic samples from the same distribution, or different benchmarks for the same task. Based on this insight, we develop ConStat, a statistical method that reliably detects and quantifies contamination by comparing performance between a primary and reference benchmark relative to a set of reference models. We demonstrate the effectiveness of ConStat in an extensive evaluation of diverse model architectures, benchmarks, and contamination scenarios and find high levels of contamination in multiple popular models including Mistral, Llama, Yi, and the top-3 Open LLM Leaderboard models.

ConStat: Performance-Based Contamination Detection in Large Language Models
Jasper Dekoninck', Mark Niklas Müller! Martin Vechev!
Department of Computer Science!
LogicStar.ai
ETH Zurich, Switzerland
(jasper dew..inckk,,kkckoooooo martin. vechev)@inf .ttz..c
markelogicstar.at
Abstract
Public benchmarks play an essential role in the evaluation of large language models. However, data contamination can lead to inflated performance, rendering them unreliable for model comparison. It is therefore crucial to detect contamination and estimate impact on measured performance. Unfortunately, existing detection methods can be easily evaded and fail to quantify contamination. To overcome these limitations, we propose novel definition of contamination as artificially inflated and gon-generalizing benchmark performance instead of the inclusion of benchmark samples the training data. This perspective enables us to detect any model with inflated performance, i.c., performance that does not generalize to rephrased samples, synthetic samples from the same distribution, or different benchmarks for the same task. Based on this insight, develop CONSTAT, statistical method that reliably detects and quantifies contamination by compar- of
ing performance between primary and reference benchmark relative reference models. We demonstrate the effectiveness CONSTAT in an extensive evaluation of diverse model architectures, benchmarks, and contamination scenar- ios and find high levels of contamination in multiple popular models including MISTRAL, LLAMA, Y1, and the top-3 Open LLM Leaderboard models]
Introduction
As large language models (LLMs) become increasingly effective at wide range of tasks, many
companies and research institutions compete develop better models 5 28 36). To facilitate
this development, a variety of benchmarks have been proposed that allow standardized in-depth
comparison of model performance across diverse tasks [15 26 33
Data Contamination Modern LLMs are trained on vast amounts of internet-soureed data, raising the risk of unintentionally including benchmark samples in the training set. Such data contamination can lead to artificially inflated benchmark performance that does not accurately reflect model's true ability to generalize to unseen tasks. However, model providers argue that the impact of this contamination on model performance is negligible 2 [4] (6) and the enormous size of current training sets almost guarantees contamination to some extent. This casts doubt on the relevance of this traditional definition of contamination in the context of LLMs.
This Work: New Perspective on Data Contamination We propose a new perspective on contamination, defining it based on its effect on model performance rather than its cause. Specifically, we define contamination as artificially inflated, non- ron-genrrraiiing performance, i.e., we say a model contaminated if and only if its performance relative to other models is significantly higher on the original benchmark than on a similar reference benchmark. This definition captures the essence the contamination problem, i.c., performance measurements becoming unreliable for model comparisons.
Cooee available htttps://gittub..com cow.et......com......t..o.....t wtt.://o///ossr//nnsssttteeee sri/ConStat
38th Conference on Neural Information Processing Systems (NcurIPS 2024).

---

1. Define Problem
2. Select References
3. Compute Test
4. Extract Results
M
M2
Reference Models
80%-
Bru Mudi
M
51 35.1 16.11-31 +.1 1 0.01% !
M
Marraa
Mer.3
Beaclenc Peclorannce
Reference Benchmark
61
5058
Benchmark D
Rephrased Dett R3
82 4.1 5.1 p 30%
33%
72. %
72.1%
Synthetic Dre
D
Which model contaminated?
Similar Dist f
25%
10%
5556
70%
8555
Reference Performance
Figure I: Overview our method. We first select models to check for contamination, then select ref-
erence models and benchmarks, and finally compute CONSTAT detect and quantify contamination.
Furthermore, it enables principled detection methods that are robust against evasion attacks by malicious providers as this would require generalizing performance improvements.
Traditional Contamination Detection Existing contamination detection methods
18
24
31
49 aim to detect the inclusion of benchmark samples in the training data as of contamination. However, these approaches show limited success, cannot quantify the contamination's effect on model performance, and have to make strict assumptions about the contamination process, making them easy evade 11
B4
37
40
41
This Work: A Statistical Test for Contamination In contrast, leverage our novel performance- based definition of data contamination to propose statistical contamination test called CONSTAT, illustrated in Fig. Given target model (M1 or M2) check for contamination (first step in Fig. [. we select set of reference models for performance comparison and reference benchmark D that similar the original benchmark D (second step). This reference benchmark can be rephrased version of the original benchmark, a synthetic benchmark generated from the same distribution, or different benchmark measuring performance on the same task. We then evaluate the reference models on both benchmarks D and Drer and fit the difficulty correction function D.. describing the relation between performance on the reference and original benchmarks (blue curve). By evaluating HD,,, at the target model's performance on the reference benchmark, we predict its expected performance on the original benchmark (third step). Finally, we compute the difference å between this expected performance and the model's ''s actual performance on the original benchmark. Using bootstrapping, obtain an estimate the contamination magnitude and a p-value that quantifies the likelihood observed performance difference under the null hypothesis that the target model is not contaminated (fourth step). In the illustrated case, model Mj achieves 60% on the reference benchmark, which translates to expected performance of 37% the original benchmark. However, the measured performance of 72% indicates large contamination effect ò = 35% and thus strong contamination with p-vulue of 0.01%. In contrast, model M2 shows signs of contamination.
We evaluate CONSTAT wide range of contamination scenarios and model architec- tures, demonstrating that it is significantly more effective at detecting contamination than any prior method. We then CONSTAT study range of popular open and proprietary models and find high levels of contamination in MISTRAL-7b-ve
Evaluation
[28). LLAMA-3-70b [2]. LLAMA-2-NSSTUUCT-700 Y1-34b [53] and range of top Open LLM Leaderboard models.
43
Key Contributions
Our key contributions are:
We propose new performance-basee definition of benchmark contamination ($2)
We introduce CONSTAT, statistical test that detects and quantifies contamination in language models 3
We empirically demonstrate CONSTAT'S effectiveness in an extensive evaluation across various contamination scenarios 4.4.
We leverage CONSTAT to study range of popular models and find contamination for MISTRAL, LLAMA, Yı, and the top-3 Open LLM Leaderboard models 44.5

---

2 Defining Contamination
Before formalizing novel definition, we first informally contrast the traditional, information-flov- based perspective on contamination with our novel performance based one.
Information-Flow Perspective In traditional machine learning, contamination typically refers to any information flow between the benchmark used for performance measurement and model training. In the context of L.LMs, this is usually restricted the direct inclusion of test set samples (or their
semantic equivalents) in the training dataset [37 39 51 56].
However, this perspective suffers from several drawbacks. First, it does not fully capture the core issue of contamination, which whether it renders test set performance an unreliable predictor of real-world performance. Second, in the era of zero-shot learning, aim to measure performance "unseen" tasks, yet we train on internet-scale data that likely contains samples of almost any task. This makes the threshold for contamination blurry. Third, limiting the definition to test sample inclusion neglects the possibility of model and hyperparameter selection based on benchmark performance as a source of contamination. Finally, even with this narrow definition, detecting contamination without access to the training data is challenging, which makes it easy to circumvent 17]
Performance Perspective To overcome these limitations, we propose to define contamination based on its outcome, rather than its cause. Informally, we define contamination as artificially inflated performance on a benchmark that does not generalize real-worke performance on the corresponding task, regardless of how it was achieved. This definition aligns better with the practical implications of contamination and enables a more principled detection method that makes evasion difficult.
To detect contamination, we compare the performance of a model M on a benchmark D to its performance reference benchmark Diet, the choice of which will discuss later. It is crucial to account for differences in difficulty between D and Dret. Otherwise, a slightly harder reference benchmark Dief would falsely indicate inflated performance on D. Thus, direct performance compar- ison is only valid if the distribution over sample difficulties is the same for both benchmarks, which a very strong assumption that is rarely true. To address this, we compare performances relative to a set of reference models, allowing us to determine if model's performance on D is significantly higher than expected, given its difficulty. In the next section, we make this definition more formal.
2.1 Formal Definition Performance-Bee Contamination
Reference Models To accurately compare performance between benchmarks, we use reference models to correct for benchmark difficulty differences. For this purpose, we consider the set of all reliable LLMs Mie from reputable sources estimate the performance distribution of uncontam- inated models. Although we cannot guarantee these models are uncontaminated, we can perform leave-one-out contamination detection to remove suspicious models from the reference set. Further- more, including contaminated models in Mier will only make our test more conservative, making it less likely for uncontaminated models to be detected as contaminated.
Contamination Detection For each benchmark D, define a scoring function Sp: M R that assigns a score (e.g., accuracy) to every model from the space of all possible language models M. Applied the reference models Miss it induces cumulative distribution function FD over the uncontaminated performance on this benchmark.
We now use the cumulative distributions ED and FD.. predict the performance of model M on D given its performance on Dref- Specifically, we first map the performance on the reference data DS
Sp (M) to percentile g (S (M)) and then map this percentile to the corresponding per- formance on the original benchmark FD (q) using the percentile function FT To simplify notation, define the hardness correction function H : R + R H F FD This allows to estimate the effect of contamination on the model's 's performance as (D) H (S (M)) and gives our formal definition of contamination:
Definition .6-Coonamination). model M E M 5-contaminated on benchmark D with respect reference benchmark Dro if (D(M) (SD,(D, 8.
3

---

2.2 Types of Contamination
Depending on the choice of reference benchmark Diet, we can measure different types of contamina- tion, depending on how poorly the inflated performance generalizes.
Syntax-Specific Contamination occurs when the model fails to generalize to semantically equivalent samples. That is, the model has memorized the exact samples in the benchmark, and its performance drops as soon as the wording changes. We therefore consider it to be the worst kind of contamination. To measure syntax-specific contamination create our reference benchmark Dier by rephrasing the samples in the original benchmark D to obtain a semantically equivalent benchmark.
Sample-Specific Contamination occurs when the model fails to generalize new samples from the benchmark distribution. That is, while the model generalizes to samples that are semantically equivalent to those in the original benchmark, it does not generalize to new samples from the same distribution. To accurately measure sample-specifie contamination, we would preferably generate samples for Drer following the same steps used to produce D. As this is often infeasible in practice, we instead generate synthetic samples for Deer by querying strong LLM using few-shot prompting and varying the provided few-shot examples increase diversity.
Benchmark-Spede Contamination occurs when the model fails to generalize to different benchmarks that aim to measure performance on the same task. That is, the model generalizes new samples from the original benchmark distribution but does not generalize to closely related benchmarks. To measure benchmark-specific contamination MathQA) that aims to measure performance on the same task as D (c.g., GSM8k). We note that benchmark-spee specific contamination is by far the least severe type of contamination. Further, while strong sensitivity to the exact benchmark is undesirable, is important to recognize that even small differences between benchmarks can impact model performance. Therefore, benchmark-specinn contamination requires a more nuanced interpretation that takes into account these differences.
create (or select) different benchmark Diet (c.g..
3 CONSTAT: A Statistical Test for Detecting Contamination
We now present CONSTAT, novel method for detecting contamination as defined in by computing confidence bounds on the estimated contamination effect using a statistical test.
Reference Models To approximate the underlying distribution of reference models Mier we select a diverse sample of m models Mrer = {Mee,,,.... M C M We additionally include an inherently uncontaminated random-gues geddon-guessing model to extend the coverage of our reference set.
Null Hypothesis To rigorously test for contamination, we derive a null hypothesis based on definition of contamination. The null hypothesis is the assumption that the model M is not contaminated, meaning its actual score on the original data is at most 5 worse than the predicted one: Sp(M) Ha. DS.
where d E Rzo can be chosen freely.
Estimating the Hardness Correction Function To compute the hardness correction function Dar we first estimate the CDFs F'D and P'D as the empirical CDFs Ep and FD respectively. To this end, let i,,..., in be an index such that Sp (MMr,))) & (AMetti We obtain the CDF Fp as
(0
if x < SD(M,,
FD(2)= k/n if Sp(Mi.) & x SD(())))) if (D.,..) x
Similarly, Fo... can be obtained from an index jı. .h.. In such that Sp. & Using Eq. (1). we find that D.. (S..,,,,,,) = (M,,). ). Applying the empirical CDFs directly to other points E [0, 1] would result in a step function estimate of D leading to overly rough approximation of the hardness correction function. Thus, we compute the approximate hardness function A by fitting the points (M ). Sp SS((M (Mi)) using smoothing spline, minimizing the following loss function:

---

+ L Hb
(SD(M
(x) dæ
(2)
where À is smoothing parameter that is chosen using generalized cross-validation [46
Significance Estimation We determine the statistical significance for rejecting the null hypothesis via bootstrapping over both the reference models and the samples in the benchmark, using pivotal intervals [42] to correct for uncertainty in the bootstrapping process. By bootstrapping the models, we consider the effect of our reference model selection M By bootstrapping the samples, we additionally include the error in our estimation of the scores themselves. Thus, given the estimate 8 (D(M D.d ( (M)) and corresponding bootstrap estimates 81 ..., o,, compute the ..,... p-confidence lower bound for as 81-p = 28 81-p where 8 is the q-quantile of 81, ..., 8n. From this, obtain the p-value by inverting this lower bound with respect q. Thus, reject the null hypothesis for given 8 with significance level p by computing the lowest such that 25 8 8.
Threat Model In accordance with [7]. we briefly outline the threat model assumed by CONSTAT. Since only require the ability measure the performance of the model the benchmark, method is a black-box benchmark-level detection method that is robust to semantic preserving op- erations. Furthermore, However, we do rely on the existence of reference models which we can use to estimate the perfor- mance of uncontaminated models. Notably, however, we do not assume these reference models to have a similar performance or architecture as the model we wish to test.
make no additional assumptions potential metadata contamination.
Evaluation
In this section, we evaluate CONSTAT empirically. We first demonstrate CONSTAT'S effectiveness, showing it outperforms prior methods in detecting and quantifying contamination across range of intentionally contaminated models ($4.2). Next, we investigate the contamination of our chosen reference models ($4.3), popular model families ($4.4), and top Open LLM Leaderboard models ($4.5). Further, we conduct an ablation study in a simulated environment in App. B to validate several design choices of CONSTAT.
4.1 Experimental Setup
Reference Models We select 20 models from reputable providers, including Meta's LLAMA model
families 2 43). Microsoft's PH1-2 [27] and PH1-3 M. Google's ' GEMMA-1.1 (21). several MISTRAL
models 28 FALCON-7b (3). and the fully open-source OLMO 25 detailed overview of these
reference models is available in A
Benchmarks We select diverse of four of the most popular LLM benchmarks evaluate CONSTAT: GSM8k [16] is benchmark for mathematical reasoning, ARC-Challenge [15] is multiple-choice benchmark for science questions, MMLU 26 is multiple-choice general purpose benchmark and Hellaswag (54) is dataset for commonsense natural language inference. Due to computational constraints, we limit the number samples in each benchmark to 2000.
Reference Benchmarks To generate reference data for syntax-specific and sample-specific contam- ination we query GPT-4-TURBO (36] rephrase samples from the original benchmark and generate new synthetic samples. We generate around 1000 synthetic samples per benchmark and refer to App.[C further details on the generation process. To detect benchmark-specce
contamination, we select appropriate reference benchmarks that measure performance on the same task: for GSM8k, we use MathQA 4 for ARC-Challenge we use SCIQ [47], and for Hellaswag we use the Lambada- OpenAl benchmark (38) For MMLU, we did not select any reference benchmark and thus measured only syntax- and sample-specific contamination.
For evaluation, we use the LM Evaluation Harness 20 in a 5-shot setting. We report estimated effects along with the p-value for the null hypothesis that the effeet 8 is less than 0.
Evaluation
5

---

4.2 Validating Contamination Detection with CONSTAT in a Controlled Setting
In this section, we demonstrate the effectiveness of CON STAT in detecting and quantifying contami- nation in controlled setting and compare multiple baselines. For this purpose, we finetune both and PHI-2 using a variety of hyperparameters and contamination scenarios on each benchmark separately. We vary the number of epochs, the learning rate, the portion of contaminated training samples, whether or not few-shot examples are used during fine-tuning, and whether the model is trained on the original benchmark samples or on rephrased data. For more details, we refer to App.Cr [ We trained a total of 70 models, 9 of which finished training at a loss spike and were therefore excluded from further analysis. 46 of the remaining models were trained on the actual benchmark and should therefore exhibit both syntax- and sumple-specifer contamination. The rest were trained on rephrased benchmark data and should therefore only exhibit sample-specife contamination. To quantify the true sample-specific contamination effect, we only use half of each benchmark for contamination and measure the performance gap to the other half.
Detecting Contamination We first check whether CONSTAT can accurately detect the presence of contamination. We compare CONSTAT against several baselines [12] 35
52 that aim to detect contamination based on the presence of benchmark samples in the training data. Most of these baselines [12] 35 52] require detection threshold be chosen for each model and benchmark separately. This tuning process requires uncontaminated samples, making it impossible to apply these methods in practice. For comparison to CONSTAT, we tuned these thresholds on the uncontaminated half of the benchmark, which is the most ideal (but unrealistic) scenario. We extract a p-value for these baselines by bootstrapping the samples in the benchmarks and checking how often TPR @ 1%FPR is bigger than 1%. Models are considered contaminated for any method if < 0.05. realistie setting is Shi 440 and we use their recommendation to
The only baseline applicable consider a model contaminated if the score returned by their method is above 0.85.
Results in Table 1 show that CONSTAT sig- nificantly outperforms all other methods with- needing prior knowledge of uncontaminated samples. In particular, we find that CONSTAT can detect 89% of syntax-specifically contami- nated models, while the best baseline achieves only 85%. The gap widens further for sample- specific contamination, where CONSTAT detects 98% of contaminated models, while the best baseline only detects 71%. The only baseline that can be applied in realistic setting, Shi (40. performs significantly worse than CONSTAT.
Table Percentage of syntax- and sample-specte contaminated models detected by several methods.
Method
Syntax [%}
Sample [%)
Carlini et al. 12
76.1"
65.6"
Mireshghallah al. 35
76.1"
68.9*
Yeom 52
78.3"
67.2*
Shi al. 41
84.8"
70.5"
Shi 40
21.7
16.4
CONSTAT
89.1
98.4
indicates that the method needs unrcalistic access to uncontaminated samples for hyperparameter selection.
We thus conclude that CONSTAT is the only contamination detection method that can reliably detect contamination and significantly outperforms all baselines even if they are tuned optimally using oracle access the uncontaminated samples.
Quantifying Contamination To evaluate CONSTAT'S ability to estimate the sample- specific contamination effect, we compare its estimate to ground truth measurements contaminated samples. As shown in Fig. 2 we observe excellent predictiveness at coefficient of determination of ,² = 0.94. The only three models that show a significantly higher estimate than the true effect achieve a perfect score on the contaminated samples, capping the true effect and explaining the overestimation.
75%-
Estimated 8
50%
25%
Ideeniity Coutaminated Mode!
0%-
0%
25%
50%
75%
Actual 8
Figure Estimated 8 as function of the true 5 for the finetuned models. 2-sigma intervals are shown.
Detailed Analysis on GSM8k We conduct an in-depth analysis of contaminated models finetuned on GSM8k, referring to App. A.2 for a detailed table with all p- p-values. We finetuned 18 models on this benchmark, one of which remained undetected under sample-specifer contamination detection.

---

Table 2: Contamination results for the reference models on centax-specific. sample-specifes and benchmark-spede contamination. We only report tests for which the multiple testing corrected p-value is lower than 5% and include the non-corrected p-value, the estimated effect å, the 95% lower bound of the effect 80.95 and the model performance the benchmark. stands for sample-specine and B for benchmark -peciffi contamination. All numbers are reported in percentages.
Model
Benchmark
Type
Perf. [%]
p [%]
ö [%]
00.95 [%]
LLAMA-3-70b
ARC
69.03
0.03
6.61
3.21
MISTRAL-7b-vO.I
GSM8k
S
39.04
0.15
8.25
4.48
MISTRAL-77--0.11
Hellaswag
S
83.65
0.24
3.14
1.27
LLAMMA---INSTTRUCT-700
Hellaswag
85.55
0.41
3.37
1.29
MISTRRAI-INSTTRUCT::1--...2
ARC
62.46
0.04
10.62
5.95
MISTRAAL-INSTTRUCI--6--002
Hellaswag
B
81.55
0.18
3.52
1.56
PHI-2
GSM8K
58.91
10
36.42
26.46
PHI-3-MINI
GSM8K
76.65
0.29
16.30
6.33
OLMO-INSTRUCT-P1
GSM8k
B
11.75
< 10
8.86
4.99
For the detected syntax-specifically contaminated models, observe average increase in å with a factor of 2.28 when transitioning from syntax-specific to samplc-specific contamination. This indicates that the models still generalize somewhat semantically equivalent samples. Furthermore, the models that were not detected by the syntax-specifte contamination detection are exactly those models that were trained on rephrased data or were trained for just one epoch. This indicates that these models can still generalize to semantically equivalent samples. Since these scenarios are also more contamination
likely occur in practice, this shows that it crucial also consider sample-speste when applying CONSTAT. Finally, the model that remained undetected by the sample-spech contamination detection was PHI-2 model trained with lower learning rate. For this model, the actual contamination effect is approximately 5%, which is relatively small and thus indicates that CONSTAT not missing any major contamination.
4.3 Contamination of Reputable Reference Models
To determine if our set of reference models exhibit signs of contamination, we perform a leave-one-out analysis, where we evaluate the contamination of model M using M,et {M} } as reference models. To control for performing multiple p- p-value tests and reduce the chance false positives, we apply the Denjarini-Hochbery [9] procedure per benchmark and contamination type control the false discovery rate at 5%. We report all significant results Table and we discuss them for each type of contamination below.
Syntax-Specifte Contamination As expected, we do not find syntax-specific contamination in any reference model, i.e., none of the models fail to generalize semantically equivalent samples.
Sample-Specific Contamination We find four instances of sample-specific contamination, all with very significant p-values of less than = 0.5% and considerable estimated contamination effects between 3% and 8%. Specifically, we find contamination of LLAMA-3-70b on ARC, of MISTRAL-7b-vO.. and LLAMA-2-INSTRUCE note that the contamination of LLAMA-2 -----N-TTUUUT-70000 on Hellaswag is noted by its model provider
Hellaswag, and MISTRAL-7b-vO.. on GSM8k.
43 but the other model providers do not provide any contamination report for their models.
We investigate these models further on the other benchmarks where the corrected p-value using the procedure was not significant. We discuss these results below and refer to App. for a full overview of their sample-specific contamination. We find that MISTRAL-7b-WK achieves relatively low p-values on both remaining benchmarks (8% for ARC, 15% for MMLU). Furthermore, we additionally evaluated MISTRAL-7b-v0.2 after obtaining these results and found similar results for this model (see Table 17 in (D). Therefore, we exclude MISTRAL--b-vOl from our set reference models. While particular LLAMA-3-70b also exhibits low p-values for other benchmarks, none fall below & 1%. It is thus highly likely that also LLAMA-3-70b and LILA MA 2- INSTRUCT-70b are contaminated across several benchmarks, but we keep both as reference models ensure that do not obtain higher false positive rate in our further analysis.
Benjamini-
7

---

Benchmark-Specine Contamination While we find several instances of benchmark- -ppeciff contamination the reference models, several at very low p-values (p < 0.01%). this requires a more nuanced interpretation. For example, both PHT models exhibit very large effect sizes (> 15%) and small p-values (p < 0.01 %) for contamination on GSM8k. We suspect that this due to their reasoning- focused training process and small model size. While GSM8k allows free text answers, giving the model tokens to reason, MathQA is a multiple-choice benchmark that requires the model to answer with a single token indicating the chosen option and therefore gives no room for this reasoning ability to shine.
4.4
Contamination of Popular Model Families
We now use CONSTAT to detect contamination in four popular model families, discussing results for QWEN- 1.5 6 and YI [33 below, while deferring discussions of STABLELM-2 [ and INTERNLM- 2 to App. A.1
QWEN-1.5 We evaluate all chat models from the QWEN-1.5 model family, with sizes 1.8b, 4b, 7b, 14b, 72b, and 110b. The only case of sample-specific contamination is for the 4b model on GSM8k with p < 10 and an estimated effect of 5.4%. The larger models show significant benchmark- specific contamination on ARC and Hellaswag, with p- p-values smaller than 1% and estimated effects between 8% and 14%.
YI We evaluate both the 6b and 34b parameter base models of the YI model-family. Only YI-34b shows significant contamination, with sample-specific contamination at p < 0.2% and estimated effects of around 6% on both ARC and Hellaswag. We find additional sample-specific contamination on GSM8K of around 4% a p-value of p = 6% and syntax-spest specific contamination on Hellaswag at p-value of p = 5%. Thus, we conclude that this model shows significant contamination across multiple benchmarks.
4.5 Contamination of Top Open LLM Leaderboard Models
We use CONSTAT to investigate contamination in the top three 7B models on the open LLM Leader- board
and MTSAIR/-
MULTI_ VERSE_MODER and find that all three models exhibit significant benchmark-specific con- lamination. Specifically, all models show strong contamination with estimated effects of å > 10% for the benchmarks where the reference benchmark is not included in the Open LLM Leaderboard (GSM8K, Hellaswag, and ARC). Further, all models show significant sample-spese contamination on GSM8k with â ~ 9%. For more detailed results, we refer to App.
This inflated performance could be caused by model selection bias, the Open LLM Leaderboard features thousands of models. This issue is exacerbated by the recent trend of merging models 22 50) where hyperparameters are frequently selected based on their benchmark performance. We therefore urge the community to be more cautious when selecting models from the leaderboard.
5 Related Work
Contamination Detection Contamination detection methods can be broadly divided into two main categories. The first category [10 14 directly to identify overlaps with the benchmarks used for model evaluation. However, training data is rarely shared, even for open-wen weight models, making it irrelevant for third- party contamination
19
22
36
43 45 [1] focuses on analyzing the training data
40 relies solely on access to the model and its predictions, aiming to detect contamination through model queries. As noted by Dekoninck et al. [17, some of these methods require metadata (e.g., benchmark name, canonical ordering) to be leaked along with the benchmark samples in the training data 23 24 37 Methods that do not require metadata depend on perplexity-basee metrics to measure the model's uncertainty on benchmark samples, but these can be easily circumvented by training on rephrased samples [17]. It is important to note that none of these methods can estimate the influence of contamination and that they are outperformed by CONSTAT in terms of detection accuracy (see
detection. The second category [8] 23 24
Rank on Open LLM Leaderboard of the 4th of May 2024.
8

---

An alternative approach is presented by Zhu et al. [57]. who measure model performance on rephrased benchmarks instead of the original benchmarks to obtain more accurate estimates of model perfor- mance. However, their results vary significantly across benchmarks, they do not provide a statistical framework for contamination detection, and they only demonstrate that evaluating on rephrased samples partially recovers the results of uncontaminated base models. Furthermore, they do not go beyond measuring performance on rephrased benchmarks and can therefore also be evaded by training on rephrased samples [17].
Reference Benchmarks Recent studies have introduced new benchmarks designed to evaluate performance on tasks similar to those in prior popular benchmarks and thus can be used estimate the degree of contamination. GSMIk (55) was developed to closely replicate the efforts behind GSM8K and compare model performances between these benchmarks. However, GSMIK lacks a statistical test, and the slight variations between GSM8K and GSMIK might partially explain the contamination levels observed in their analysis. Another recent benchmark, SWE-bench [30], focuses on evaluating performance on coding tasks. By comparing their results with those of Human Eval [3] one can visually interpret potential contamination in Human- Eval. However. the absence of a statistical test hinders precise contamination detection. In both scenarios, CONSTAT can improve their findings, enabling accurate estimations of contamination in existing models.
Discussion
Limitations Our method estimates the effect of contamination on performance relative to a set of reference models. Therefore, if these reference models are also contaminated, our method only measures the effect relative to this base level of contamination. However, our leave-one-out experiment, presented in $4.3, helps identify and exclude contaminated models, partially mitigating this limitation. Furthermore, is important to note that accurate relative performance measurements are sufficient for both model selection and to assess methodological improvements, which are the most important use cases of benchmarks.
Further. our work uses an LLM to generate synthetic samples, introducing potential distributional biases into the synthetic benchmark Diet. We briefly discuss these biases here. Firstly, synthetic benchmark may contain more mislabeled samples. However, since these samples equally affect all models, CONSTAT accounts for this its difficulty correction. Secondly, synthetic samples generated by model are likely easier for that model itself to solve. Therefore, contamination results for the model used to generate the samples would be unreliable for sample-specific contamination detection. However, these limitations are not inherent flaws of CONSTAT, and can be mitigated by using more sophisticated synthetic benchmark generation techniques.
Impact Model evaluation is crucial part of LLM development, with benchmarks playing a key role in evaluating model performance on tasks like code generation, question answering, and summariza- tion. Contamination of these benchmarks can inflate performance estimates, potentially misleading researchers and practitioners. To address this, CONSTAT provides a statistical framework to estimate the impact of contamination on model performance. This enables more accurate evaluations and allows for the removal of suspicious models from leaderboards, ensuring a fairer evaluation of model capabilities. Furthermore, it is important to note that CONSTAT can be applied to any model, not just LLMs, as long as the model's performance can be measured on benchmark.
7 Conclusion
We present CONSTAT, a statistical framework designed to detect contamination and estimate its effect on model performance. Unlike existing methods, CONSTAT is based on a novel, performance- based definition of contamination and compares performance with various reference benchmarks to obtain a detailed contamination analysis that distinguishes between syntax-, sample-, and benchmark- speecifcc contamination. We investigate CONSTAT'S 's effectiveness in an extensive control study and demonstrate that it not only outperforms existing methods but also, contrast to them, does not require prior knowledge about uncontaminated samples. Finally, we use CONSTAT to investigate contamination in popular models and find, among others, very high levels of contamination in MISTRAI-7b-vO. 1 and Y Y1-34b and high levels of contamination in LLAMA-3-708 and

---

Acknowledgements
This work has been done as part of the EU grant ELSA (European Lighthouse on Secure and Safe AI, grant agreement no. 101070617) and was funded in part by the Swiss National Science Foundation (SNSF) [200021 200021_207967]. Views and opinions expressed are however those of the authors only and do not necessarily reflect those of the European Union or European Commission. Neither the European Union nor the European Commission can be held responsible for them.
The work has received funding from the Swiss State Secretariat for Education, Research and Innova- tion (SERT).
References
[1] Marah Abdin, Sam Ade Jacobs, Ammar Ahmad Awan, Jyoti Aneja, Ahmed Awadallah, Hany Awadalla, Nguyen Bach, Amit Bahree, Arash Bakhtiari, Harkirat Behl, Alon Benhaim, Misha Bilenko, Johan Bjorck, Sébastien Bubeck, Martin Cai, Caio César Teodoro Mendes, Weizhu Chen, Vishrav Chaudhary, Parul Chopra, Allie Del Giorno, Gustavo de Rosa, Matthew Dixon, Ronen Eldan, Dan Iter, Amit Garg, Abhishek Goswami, Suriya Gunasekar, Emman Haider, Junheng Hao, Russell J. Hewett, Jamie Huynh, Mojan Javaheripi, Xin Jin, Piero Kauffimann, Nikos Karampatziakis, Dongwoo Kim, Mahoud Khademi, Lev Kurilenko, James R. Lee, Yin Tat Lee, Yuanzhi Li, Chen Liang, Weishung Liu, Eric Lin, Zeqi Lin, Piyush Madan, Arindam Mitra, Hardik Modi, Anh Nguyen, Brandon Norick, Barun Patra, Daniel Perez- Becker, Thomas Portet, Reid Pryzant. Heyang Qin, Marko Radmilac, Corby Rosset, Sambudha Roy. Olatunji Ruwase. Olli Saarikivi, Amin Saied, Adil Salim, Michael Santacroce, Shital Shah, Ning Shang. Hiteshi Sharma, Xia Song, Masahiro Tanaka, Xin Wang. Rachel Ward, Guanhua Wang, Philipp Witte, Michael Wyatt, Can Xu, Jiahang Xu, Sonali Yadav, Fan Yang, Ziyi Yang, Donghan Yu, Chengruidong Zhang, Cyril Zhang, Jianwen Zhang, Li Lyna Zhang, Yi Zhang, Yue Zhang, Yunan Zhang, and Xiren Zhou. Phi-3 technical report: A highly capable language model locally on your phone, 2024.
[2] AI Meta. Llama 3 model card. 2024. BRRLittts////iitubbccmm/ http://hhhoohoooooeeeemmmmmoam/a main/MODEL_ CARD.md
(amma/Laam3//booo
[3] Ebtesam Almazrouei, Hamza Alobeidli, Abdulaziz Alshamsi, Alessandro Cappelli, Ruxandra Cojocaru, Merouane Debbah, Etienne Goffinet, Daniel Heslow, Julien Launay, Quentin Malartic, Badreddine Noune, Baptiste Pannier, and Guilherme Penedo. The falcon series of language Towards open frontier models. 2023.
models:
[4] Aida Amini, Saadia Gabriel, Shanchuan Lin, Rik Koncel-Kedziorsie Yejin Choi, and Hannanch Hajishirzi. Mathqa: Towards interpretable math word problem solving with operation-based for- malisms. In Jill Burstein, Christy Doran, and Thamar Solorio, editors, Proceedings of the 2019 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, NAACL- 2019, Minneapolis, MN, USA, June 2-7, 2019, Vol- une I (Long and Short Papers), pages 2357-2367 Association for Computational Linguisties, 2019. doi: 10.18653/VI/N199 1245. URL httpp::///oo..... org/10 18653/v1/n199 1245
[5] Rohan Amil, Sebastian Borgeaud, Yonghui Wu, Jean-Baptiste Alayrac, Jiahui Yu, Radu Soricut, Johan Schalkwyk, Andrew M. Dai, Anja Hauth, Katie Millican, David Silver, Slav Petrov, Melvin Johnson, Ioannis Antonoglou, Julian Schrittwieser, Amelia Glaese, Jilin Chen, Emily Pitler, Timothy P. Lillicrap. Angeliki Lazaridou, Orhan Firat, James Molloy, Michael Is- ard, Paul Ronald Barham, Tom Hennigan, Benjamin Lee, Fabio Viola, Malcolm Reynolds, Yuanzhong Xu, Ryan Doherty, Eli Collins, Clemens Meyer, Eliza Rutherford, Erica Moreira, Kareem Ayoub, Megha Goel, George Tucker, Enrique Piqueras, Maxim Krikun, lain Barr, Nikolay Savinov. Ivo Danihelka, Becca Roelofs, Anais White, Anders Andreassen, Tamara von Glehn, Lakshman Yagati, Mchran Kazemi, Lucas Gonzalez. Misha Khalman, Jakub Sygnowski, and al. Gemini: A family of highly capable multimodal models. CoRR, abs/2312. 11805, 2023. doi: 10.48550/RRIIV233222 18005
[6] Jinze Bai, Shuai Bai, Yunfei Chu, Zeyu Cui, Kai Dang, Xiaodong Deng, Yang Fan, Wenbin Ge, Yu Han, Fei Huang, Binyuan Hui, Luo Ji, Mei Li, Junyang Lin, Runji Lin, Dayiheng Liu, Gao Liu, Chengqiang Lu, Keming Lu, Jianxin Ma, Rui Men, Xingzhang Ren, Xuancheng
10

---

Ren, Chuanqi Tan, Sinan Tan, Jianhong Tu, Peng Wang, Shijie Wang, Wei Wang, Shengguang Wu, Benfeng Xu, Jin Xu, An Yang, Hao Yang, Jian Yang. Shusheng Yang, Yang Yao, Bowen Yu, Hongyi Yuan, Zheng Yuan, Jianwei Zhang, Xingxuan Zhang, Yichang Zhang. Zhenru Zhang, Chang Zhou, Jingren Zhou, Xiaohuan Zhou, and Tianhang Zhu. Qwen technical doi: 10.48550/ARXIV.23000 16609. URL https
report. CoRR, abs/2309. 16609, 2023.
48550//rXiii //doi. oldoi..rg/.... wtt.:oor11....55//r...... 23699
[7] Edward Beeching, Clémentine Fourrier, Nathan Habib, Sheon Han, Nathan Lambert, Nazneen Rajani, Omar Sansevicro, Lewis Tunstall, and Thomas Wolf. Open Ilm leaderboard. hntps
Ulm leaderboard 2023.
[8] Marco Bellagente, Jonathan Tow, Dakota Mahan, Duy Phung, Maksym Zhuravinskyi, Reshinth Adithyan, James Baicoianu, Ben Brooks, Nathan Cooper, Ashish Datta, Meng Lee, Emad Mostaque, Michael Pieler, Nikhil Pinnaparju, Paulo Rocha, Harry Saini, Hannah Teufel, Niccoló Zanichelli, and Carlos Riquelme. Stable LM 2 1.6b technical report. CoRR, abs/2402.11884 URL http:::/ddooooorgg/// 48550// 2462
2024. doi: 10.48550/RRXI.2402...77 17834
[9] Yoav Benjamini and Yosef Hochberg. Controlling the false discovery rate: A practical and powerful approach to multiple testing. Journal of the Royal Statistical Sociery: Series B (Methodological), 57(1):289-300 1995. doi: https://doi.ooo http:///oo.oo/11100/// wttp///..11////11111111.1
tb02031.x. URL https://rss on wwweonnnnnnnarreeeeeeeeeeeaaaaaa 1995 tb62631.x
http://sww.....ioooooooooooo/o// www.eyyccom/oo/////////// 1111/j 22517
[10] Tom B. Brown, Benjamin Mann, Nick Ryder, Melanie Subbiah, Jared Kaplan, Prafulla Dhariwal, Arvind Neelakantan, Pranav Shyam, Girish Sastry, Amanda Askell, Sandhini Agarwal, Ariel Herbert-Voss, Gretchen Krueger, Tom Henighan, Rewon Child, Aditya Ramesh, Daniel M. Ziegler, Jeffrey Wu, Clemens Winter, Christopher Hesse, Mark Chen, Eric Sigler, Mateusz Litwin, Scott Gray, Benjamin Chess. Jack Clark, Christopher Berner, Sam McCandlish, Alec Radford, Ilya Sutskever, and Dario Amodei, Language models are few-shot learners. In Proc. of NeurlPS, 2020.
[11] Zheng Cai, Maosong Cao, Haojiong Chen, Kai Chen, Keyu Chen, Xin Chen, Xun Chen, Zehui Chen, Zhi Chen, Pei Chu, Xiaoyi Dong, Haodong Duan, Qi Fan, Zhaoye Fei. Yang Gao, Jiaye Ge, Chenya Gu, Yuzhe Gu, Tao Gui, Aijia Guo, Qipeng Guo, Conghui He, Yingfan Hu, Ting Huang, Tao Jiang, Penglong Jiao, Zhenjiang Jin, Zhikai Lei, Jiaxing Li, Jingwen Li, Linyang Li, Shuaibin Li, Wei Li, Yining Li, Hongwei Liu, Jiangning Liu, Jiawei Hong, Kaiwen Liu, Kuikun Liu, Xiaoran Liu, Chengqi Lv, Haijun Lv, Kai Lv, Li Ma, Runyuan Ma, Zerun Ma, Wenchang Ning, Linke Ouyang, Jiantao Qiu. Yuan Qu Fukai Shang, Yunfan Shao, Demin Song, Zifan Song, Zhihao Sui, Peng Sun, Yu Sun, Huanze Tang. Bin Wang. Guoteng Wang, Jiaqi Wang, Jiayu Wang, Rui Wang, Yudong Wang, Ziyi Wang, Xingjian Wei, Qizhen Weng, Fan Wu, Yingtong Xiong, and al. Internlm2 technical report. CoRR, abs/2403. 2024. doi: 10:48550/ARXIV.240.. 17297. URL httpttss////oooorr// ottp:///oo...////1.44//5//////// 2403. 17297
48550/
[12] Nicholas Carlini, Florian Tramèr, Eric Wallace, Matthew Jagielski, Ariel Herbert- Voss, Kather- ine Lee, Adam Roberts, Tom B. Brown, Dawn Song, Úlfar Erlingsson, Alina Oprea, and Colin Raffel. Extracting training data from large language models. In 30th USENIX Security Symposium, USENIX Security 2021, August 11-13, 2021, 2021.
[13] Mark Chen, Jerry Tworek, Heewoo Jun, Qiming Yuan, Henrique Pondé de Oliveira Pinto, Jared Kaplan, Harrison Edwards, Yuri Burda, Nicholas Joseph, Greg Brockman, Alex Ray, Raul Puri, Gretchen Krueger, Michael Petrov, Heidy Khlaaf, Girish Sastry, Pamela Mishkin, Brooke Chan, Scott Gray, Nick Ryder, Mikhail Pavlov. Alethea Power, Lukasz Kaiser, Mohammad Bavarian, Clemens Winter, Philippe Tillet, Felipe Petroski Such, Dave Cummings, Matthias Plappert, Fotios Chantzis, Elizabeth Barnes, Ariel Herbert- Voss, William Hebgen Guss, Alex Nichol, Alex Paino, Nikolas Tezak, Jie Tang, Igor Babuschkin, Suchir Balaji. Shantanu Jain, William Saunders, Christopher Hesse, Andrew N. Carr, Jan Leike, Joshua Achiam, Vedant Misra, Evan Morikawa, Alec Radford, Matthew Knight, Miles Brundage, Mira Murati, Katie Mayer, Peter Welinder, Bob McGrew, Dario Amodei, Sam McCandlish, Ilya Sutskever, and Wojeiech Zaremba. Evaluating large language models trained on code. CoRR, abs/2107.033 03374, 2021. URL httttttts//axxiiii wwtparawwiivrrrbbrbbaaabaaaae 03374

---

[14] Aakanksha Chowdhery, Sharan Narang, Jacob Devlin, Maarten Bosma, Gaurav Mishra, Adam Roberts, Paul Barham, Hyung Won Chung, Charles Sutton, Sebastian Gehrmann, Parker Schuh, Kensen Shi, Sasha Tsvyashchenko, Joshua Maynez, Abhishek Rao, Parker Barnes, Yi Tay, Noam Shazeer, Vinodkumar Prabhakaran, Emily Reif, Nan Du, Ben Hutchinson, Reiner Pope, James Bradbury, Jacob Austin, Michael Isard, Guy Gur-Ari, Pengcheng Yin, Toju Duke, Anselm Levskaya, Sanjay Ghemawat, Sunipa Dev, Henryk Michalewski, Xavier Garcia, Vedant Misra, Kevin Robinson, Liam Fedus, Denny Zhou, Daphne Ippolito, David Luan, Hyeontaek Lim, Barret Zoph, Alexander Spiridonov, Ryan Sepassi, David Dohan, Shivani Agrawal, Mark Omernick, Andrew M. Dai. Thanumalayan Sankaranarayana Pillai, Marie Pellat, Aitor Lewkowycz, Erica Moreira, Rewon Child, Oleksandr Polozov, Katherine Lee, Zongwei Zhou, Xuezhi Wang, Brennan Sacta, Mark Diaz, Orhan Firat, Michele Catasta, Jason Wei, Kathy Meier-Hellsterm, Douglas Eck, Jeff Dean, Slav Petrov, and Noah Fiedel. Palm: Scaling language modeling with pathways. CoRR, abs/2204.02311, 2022. doi: (0.485500/rXx..22244..2.
[15] Peter Clark, Isaac Cowhey, Oren Etzioni, Tushar Khot, Ashish Sabharwal, Carissa Schoenick, and Oyvind Tafjord. Think you have solved question answering? try are, the A12 reasoning challenge. ArXiv preprint, abs/1 100.00557. 2018.
[16] Karl Cobbe, Vineet Kosaraju, Mohammad Bavarian, Mark Chen, Heewoo Jun, Lukasz Kaiser, Matthias Plappert, Jenry Tworek, Jacob Hilton, Reiichiro Nakano, Christopher Hesse, and John Schulman. Training verifiers to solve math word problems. ArXiv preprint, 0ts/2110.14166 2021.
[17] Jasper Dekoninck, Mark Niklas Müller, Maximilian Baader, Mare Fischer, and Martin T. Vechev. Evading data contamination detection for language models is (too) easy. CoRR, abs/2402.0255 2024. doi: 10.48550/ARXIV.24000 02823
URL https://doi.org//// http:///11.45555//11111 2402
[18] Chunyuan Deng. Yilun Zhao, Xiangru Tang, Mark Gerstein, and Arman Cohan. Investigating data contamination in modern benchmarks for large language models. CoRR, abs/23 0obs/2311.09733 1.09783, 2023. doi: 10.48550/ARXIV.2311 1.09783.
[19] Jesse Dodge, Maarten Sap, Ana Marasović, William Agnew, Gabriel Ilharco, Dirk Groeneveld, Margaret Mitchell, and Matt Gardner. Documenting large webtext corpora: A case study on the colossal clean crawled corpus. In Proc. of EMNLP, 2021. doi: 10. 1/225//11222...mmmlppp 98.
[20] Leo Gao, Jonathan Tow, Baber Abbasi, Stella Biderman, Sid Black, Anthony DiPofi, Charles Foster, Laurence Golding, Jeffrey Hsu, Alain Le Noac'h, h, Haonan Li, Kyle McDonell, Niklas Muennighoff, Chris Ociepa, Jason Phang, Laria Reynolds, Hailey Schoelkopf, Aviya Skowron, Lintang Sutawika, Eric Tang, Anish Thite, Ben Wang, Kevin Wang, and Andy Zou. A framework for few-shot language model evaluation, 2023.
[21] Thomas Mesnard Gemma Team, Cassidy Hardin, Robert Dadashi, Surya Bhupatiraju, Laurent Sifre, Morgane Rivière, Mihir Sanjay Kale, Juliette Love, Pouya Tafti, Léonard Hussenot, and et al. Gemma. 2024. doi: 10.34740KAAGGLE///333 URL https: /wwww//wwwwwwooo kaggle. com/m/
3301
[22] Charles Goddard, Shamane Siriwardhana, Malikeh Ehghaghi, Luke Meyers, Vlad Karpukhin, Brian Benedict, Mark McQuade, and Jacob Solawetz. Arcee's 's mergekit: A toolkit for merging large language models. CoRR, abs/2403. 13257, 2024. doi: 10.4850/ARXXV.240..133 URL
https://dol.org// wtt.:/o/gg.....5///ra...... 13257
48550/arXiv
[23] Shahriar Golchin and Mihai Surdeanu. Data contamination quiz: A tool to detect and estimate contamination in large language models. CoRR, abs/2311 0123311.0623, 2023, doi: 10.48550/ARXIV. 2311.0..33.
[24] Shahriar Golchin and Mihai Surdeanu. Time travel in Ilms: Tracing data contamination in large language models. CoRR, abs/2308. 008493, 2023. doi: 10.4850/ARXIV.2008.00 08493.
[25] Dirk Groeneveld, Iz Beltagy, Pete Walsh, Akshita Bhagia, Rodney Kinney, Oyvind Tafjord, Ananya Harsh Jha, Hamish Ivison, Ian Magnusson, Yizhong Wang, Shane Arora, David Atkin- son, Russell Authur, Khyathi Raghavi Chandu, Arman Cohan, Jennifer Dumas, Yanai Elazar,
12

---

Yuling Gu, Jack Hessel, Tushar Khot, William Merrill, Jacob Morrison, Niklas Muennighoff Aakanksha Naik, Crystal Nam, Matthew E. Peters, Valentina Pyatkin, Abhilasha Ravichander, Dustin Schwenk, Saurabh Shah, Will Smith, Emma Strubell, Nishant Subramani, Mitchell Wortsman, Pradeep Dasigi, Nathan Lambert, Kyle Richardson, Luke Zettlemoyer, Jesse Dodge, Kyle Lo, Luca Soldaini, Noah A. Smith, and Hannaneh Hajishirzi. Olmo: Accelerating the science of language models. CoRR, abs/2402. 008388 2024, doi: 10.46550/ARXXV.22220008333 URL (RLt:tts:////ooorrgo 18w50199.855///i11.. 2482. .0838
[26] Dan Hendrycks, Collin Burns, Steven Basart, Andy Zou, Mantas Mazeika, Dawn Song, and Jacob Steinhardt. Measuring massive multitask language understanding. In Proc. of ICLR, 2021.
[27] Mojan Javaheripi, Sébastien Bubeck, Marah Abdin, Jyoti Aneja, Caio César Teodoro Mendes, Weizhu Chen, Allie Del Giorno, Ronen Eldan. Sivakanth Gopi. Suriya Gunasekar, et al. Phi- 2: The surprising power of small language models. https://wwi http:/www...oooooooo cww/coom///ceeee us/
researchh/loo//hhi-22 the surprising power -tarrooo-samaatllmm small- aanguage-modeess. 2023.
[28] Albert Q. Jiang, Alexandre Sablayrolles, Arthur Mensch, Chris Bamford, Devendra Singh Chap- lot, Diego de Las Casas, Florian Bressand, Gianna Lengyel, Guillaume Lample, Lucile Saulnier, Lélio Renard Lavaud, Marie-Anne Lachaux, Pierre Stock, 'even Le Scao, Thibaut Lavril, Thomas Wang. Timothée Lacroix, and William El Sayed. Mistral 7b. CoRR, abs/2310.0682/ 2023. doi: 10.48550/AXII.23000000
[29] Minhao Jiang, Ken Ziyu Liu, Ming Zhong, Rylan Schaeffer, Siru Ouyang, Jiawei Han, and Sanmi Koyejo. Investigating data contamination for pre-training language models. CoRR, abs/2401.06038 2024. doi: 20-48550/ARXIV.240..00 066599. URLhhttps. https:////oo.or//..ooo
arXiv. 2401. 06059
[30] Carlos E. Jimenez, John Yang, Alexander Wettig, Shunyu Yao, Kexin Pei, Ofir Press, and Karthik Narasimhan. Swe-bench: Can language models resolve real-world github issues? CoRR, abs/2310.06770, 2023, doi: 10.4550AAXXW.2100007770 URL htttt:://doi.orr///// 48550/arXiv. 2310. 23107.66770
[31] Yucheng Li. An open source data contamination report for large language models. CoRR, abs/2310. 17589, 2023. doi: 10:4850/ARRIV.230017555
[32] Wing Lian, Bleys Goodson, Eugene Pentland, Austin Cook, Chanvichet Vong, and "Teknium" Openorca: An open dataset of gpt augmented flan reasoning traces. httpp://https //huggingface. wwt.pooo Orca/OpenOrca 2023.
[33] Stephanie Lin, Jacob Hilton, and Owain Evans. TruthfulQA: Measuring how models mimic human falsehoods. In Proc. of ACL, 2022. doi: 10.18653/v1/2022 1865:////222...c-ooon22222
[34] Justus Mattern, Fatemehsadat Mireshghallah, Zhijing Jin, Bernhard Schölkopf, Mrinmaya Sachan, and Taylor Berg- Kirkparrka...... Membership inference attacks against language mod- els via neighbourhood comparison. In Findings of ACL, 2023. doi: 10.18653/V1/2023.
FINDINGS-ACL.1
[35] Fatemehsadat Mireshghallah, Kartik Goyal, Archit Uniyal, Taylor Berg-Kirkpatrick, and Reza Shokri. Quantifying privacy risks of masked language models using membership inference attacks. In Proc. of EMNLP, 2022. doi: 10.1653N1/200.EENPPPA.....
[36] OpenAL. GPT-4 technical report. CoRR, abs/2303.08774, 2023. doi: 10.48550/arxiv.22003. (87774.
[37] Yonatan Oren, Nicole Meister, Niladri S. Chatterji, Faisal Ladhak, and Tatsunori B. Hashimoto. Proving test set contamination in black box language models. CoRR, abs/2310.17623, 2023. doi: 10.4850/ARXIV.231..1166
[38] Denis Paperno, Germán Kruszewski, Angeliki Lazaridou, Quan Ngoe Pham, Raffaella Bernardi, Sandro Pezzelle, Marco Baroni, Gemma Boleda, and Raquel Fernández. The LAMBADA dataset: Word prediction requiring a broad discourse context. In Proceedings of the 54th Annual Meeting of the Association for Computational Linguistics, ACL 2016, August 721 2016, Berlin,
13

---

Germany, Volume 1: Long Papers. The Association for Computer Linguisties, 2016. doi: 1144
10.18653NV/116-1144 1144. DRLL
[39] Oscar Sainz, Jon Ander Campos, Iker García-Ferrero, Julen Etxaniz, Oier Lopez de Lacalle, and Eneko Agirre. NLP evaluation in trouble: On the need measure LLM data contamination for each benchmark. In Findings of the Association Computational Linguistics: EMNLP 2023, Singapore, December 6-10, 2023, 2023.
[40] Weijia Shi. Detect-peerainnccddccoottnnnnnne detect- pretrain- contammiioooonnntnnattiiiion 2023.
https:///github..ommss/p//
[41] Weijia Shi, Anirudh Ajith, Mengzhou Xia, Yangsibo Huang, Daogao Liu, Terra Blevins, Danqi Chen, and Luke Zettlemoyer. Detecting pretraining data from large language models. CoRR, abs/2310.16789, 2023. doi: 1044850/ARXIV2330.16633
[42] Robert J Tibshirani. Bootstrap confidence intervals. Stanford University. Department of Statistics. Laboratory for Computational ..... 1984.
[43] Hugo Touvron, Louis Martin, Kevin Stone, Peter Albert, Amjad Almahairi, Yasmine Babaci, Nikolay Bashlykov, Soumya Batra, Prajiwal Bhargava, Shruti Bhosale, Dan Bikel, Lukas Blecher, Cristian Ferren-Ferrer, Moya Chen, Guillem Cucurull, David Esiobu, Jude Fernandes, Jeremy Fu, Wenyin Fu, Brian Fuller, Cynthia Gao, Vedanuj Goswami, Naman Goyal, Anthony Hartshomn, Saghar Hosseini. Rui Hou, Hakan Inan, Marcin Kardas, Viktor Kerkez, Madian Khabsa, Isabel Kloumann, Artem Korenev, Punit Singh Koura, Marie-Anne Lachaux, Thibaut Lavril, Jenya Lee, Diana Liskovich, Yinghai Lu, Yuning Mao, Xavier Martinet, Todor Mihaylov, Pushkar Mishra, Igor Molybog, Yixin Nie, Andrew Poulton, Jeremy Reizenstein, Rashi Rungta, Kalyan Saladi, Alan Schelten, Ruan Silva, Eric Michael Smith, Ranjan Subramanian, Xiao- qing Ellen Tan, Binh Tang, Ross Taylor, Adina Williams, Jian Xiang Kuan, Puxin Xu, Zheng Yan, Iliyan Zarov, Yuchen Zhang, Angela Fan, Melanie Kambadur, Sharan Narang, Aurélien Rodriguez, Robert Stojnic, Sergey Edunov, and Thomas Scialom. Llama 2: Open foundation and finettuedd chat models. CoRR, abs/2307. abss22307.09288, 2023. doi: 10.48550/ar2iv.2307 009288.
[44] Pauli Virtanen, Ralf Gommers, Travis E. Oliphant, Matt Haberland, Tyler Reddy, David Cournapea,, Evgeni Burovski, Pearu Peterson, Warren Weckesser, Jonathan Bright, Stéfan J. van der Walt, Matthew Brett, Joshua Wilson, K. Jarrod Millman, Nikolay Mayorov, Andrew R. J. Nelson, Eric Jones, Robert Kern, Eric Larson, C Carey. ilhan Polat, Yu Feng, Eric W. Moore, Jake VanderPlas, Denis Laxalde, Josef Perktold, Robert Cimrman, Ian Henriksen, E. A. Quintero, Charles R. Harris, Anne M. Archibald, Antônio Ribeiro, Fabian Pedregosa, Paul van Mulbregt, and SciPy 1.0 Contributors. SciPy 1.0: Fundamental Algorithms for Scientific Computing in Python. Nature Methods, 17:261-271 2020. doi: 10. 1.93///1.592-099- 2.
[45] Thuy-Trang Vu, Xuanli He, Gholamreza Haffari, and Ehsan Shareghi. Koala: An index for quantifying overlaps with pre-training corpora. In Proc. EMNLP, 2023.
[46] Grace Wahba. Estimating the Smoothing Parameter, pages 45-65. 1990. doi: 10.113 9781611970128.0 URL https://epubs.. aaw.aa..org/ooo//ab////// 0137/1.978161197811 ch4
[47] Johannes Welbl, Nelson F. Liu, and Matt Gardner. Crowdsourcing multiple choice science questions. In Leon Derezynski, Wei Xu, Alan Ritter, and Tim Baldwin, editors, Proceedings of the 3rd Workshop on Noisy User-generater Text, NUT@ @ EMNLP 2017, Copenhagen, Denmark, September 2017, pages 94-106. Association for Computational Linguistics. 2017. doi: 10.18655/V1/W17-441 URL
[48]
Thomas Wolf. Lysandre Debut, Victor Sanh, Julien Chaumond, Clement Delangue, Anthony Moi, Pierric Cistac, Tim Rault, Remi Louf, Morgan Funtowicz. Joe Davison, Sam Shleifer, Patrick von Platen, Clara Ma, Yacine Jernite, Julien Plu, Canwen Xu, Teven Le Scao, Sylvain Gugger, Mariama Drame, Quentin Lhoest, and Alexander Rush. Transformers: State-of-the--ar natural language processing. In Proc. of EMNLP, 2020. doi: 10.18653/v1/2020.coom wttp///00.mmmmdmmmo.....mm
[49] Ruijie Xu, Zengzhi Wang, Run-Ze Fan, and Pengfei Liu. Benchmarking benchmark leakage in large language models, 2024.
14

---

[50] Prateck Yadav, Derek Tam, Leshem Choshen, Colin A. Raffel, and Mohit Bansal. Ties- merging: Resolving interference when merging models. In Alice Oh, Tristan Nau- mann, Amir Globerson, Kate Saenko, Moritz Hardt, and Sergey Levine, editors, Ad- vances Neural Information Processing Systems 36; Annual Conference on Neural Information Processing Systems 2023, NeurlPS 2023, New Orleans, LA, USA, Decem- ber 10 16, 2023, 2023. URL http:://ppprs...iii.. nips http://ww...ppppppp.eeeee//////a /ites//aaperr//22////sl 1444c3887Ba111114444666672228
[51] Shuo Yang, Wei-Lin Chiang. Lianmin Zheng, Joseph E. Gonzalez, and lon Stoica. Re- thinking benchmark and contamination for language models with rephrased samples. CoRR, abs/2311. 1.04550, 2023. doi: 0044550/ARXXIV2311...5
[52] Samuel Yeom, Irene Giacomelli, Matt Fredrikson, and Somesh Jha. Privacy risk in machine learning: Analyzing the connection to overfitting, In 31st IEEE Computer Security Foundations Symposiun, CSF 2018, Oxford, United Kingdom, July 9-12, 2018, 2018. doi: 10.1109/CST 2018.00027
[53] Alex Young, Bei Chen, Chao Li, Chengen Huang, Ge Zhang, Guanwei Zhang, Heng Li, Jiangcheng Zhu, Jianqun Chen, Jing Chang, Kaidong Yu, Peng Liu, Qiang Liu, Shawn Yue, Senbin Yang. Shiming Yang, Tao Yu, Wen Xie, Wenhao Huang, Xiaohui Hu, Xiaoyi Ren, Xinyao Niu, Pengcheng Nie, Yuchi Xu, Yudong Liu, Yue Wang. Yuxuan Cai, Zhenyu Gu, Zhiyuan Liu, and Zonghong Dai. Yi: Open foundation models by Ol.ii CoRR, abs/2403 04652, 2024. doi: 10.48550/ARXIV2400....
URL https:://doi..... htt./do..orgggg// org/10 48550/arXiv.. 2403. 84652
[54] Rowan Zellers, Ari Holtzman, Yonatan Bisk, Ali Farhadi, and Yejin Choi. Hellaswag: Can a machine really finish your sentence? In Anna Korhonen, David R. Traum, and Lluís Mårquez, editors, Proceedings of the 57th Conference of the Association for Computational Linguistics, ACL 2019, Florence, Italy, July 28- August 2019, Volume Long Papers, pages 4791 1- 4800. Association for Computational Linguistics, 2019, doi: 10. 10.18653/V1/119-1444 URL fttts:://doi.org/100 18653/v11p19-141)/
[55] Hugh Zhang. Jeff Da, Dean Lee, Vaughn Robinson, Catherine Wu, Will Song, Tiffany Zhao, Pranav Raja, Dylan Slack, Qin Lyu, Sean Hendryx, Russell Kaplan, Michele Lunati, and Summer Yue. A careful examination large language model performance on grade school arithmetic, 2024.
[56] Kun Zhou, Yutao Zhu, Zhipeng Chen, Wentong Chen, Wayne Xin Zhao, Xu Chen, Yankai Lin, Ji-Rong Wen, and Jiawei Han. Don't make your LLM an evaluation benchmark cheater. CoRR, abs/2311.01966 2023. doi: 1144550/ARXIV2211.00099
[57] Wenhong Zhu, Hongkun Hao, Zhiwei He, Yunze Song, Yumeng Zhang, Hanxu Hu, Yiran Wei, Rui Wang, and Hongyuan Lu. CLEAN-EVAL: clean evaluation on contaminated large language models. CoRR, abs/2311.0915 2023. doi: 10.48550/ARXIV.2 1.9954..
15

---

Table 3: Full overview of sample-specific contamination in MISTRAL-7b-VO.11 LLAMA-2-INSTRUCT 70b and LLAMA-3-70b. All numbers are reported in percentages.
Model
Benchmark
Perf. [%]
p [%]
8 [%]
00.85 [%]
LLAMA-2-INSTRUCTEE
ARC
61.86
14.68
1.96
-1.01
GSM8k
55.80
58.60
-0.41
-4.42
Hellaswag
85.55
0.41
3.37
1.29
MMLU
56.85
32.91
0.71
-2.0
LLAMA-3-70b
ARC
69.03
0.03
6.61
3.21
GSM8k
81.58
15.45
2.05
-1.9
Hellaswag
86.45
1.01
2.86
0.90
MMLU
76.46
5.76
3.35
0.21
MISVRAL-7b-v0.1
ARC
58.96
7.91
2.21
0.40
GSM8k
39.04
0.15
8.25
4.48
Hellaswag
83.65
0.24
3.14
1.27
MMLU
58.01
15.23
1.88
-.05
A Additional Results
We present the complete results for the experiments discussed in $4 here and include a discussion on the STABLELM-2 and INTERNLM-2 model families. We provide table with the results for all evaluated model families where p < 1% in Table
A.1 Discussion on INTERNLM-2 and STABLELM-2
INTERNLM-2 We evaluated four models in the INTERNLM-22 model family: the models with size 1.8h and 7b, and the math-base and math models, also of parameters. Overall, we found very little evidence of contamination in these models, with no model showing significant (p < 1%) sample- specific contamination. However, we did find some evidence for benchmark-specifte contamination for GSMSk and Hellaswag for several models in the model family. Specifically, INTERNLM-2-77 and INTERNLM- M-2-MMM-------------- show significant
mmnchmark-speciffe contamination on GSMSK with p 0.3% and estimated effects of 20% and 40% respectively. The size of this effect is likely due to the same reasons as the measured contamination in the PHI models, where the models are too small to solve mathematical questions in go and have been trained/inetuned to perform thain-of-thougle mathematics. The benchmark-specific contamination on Hellaswag is present for all three 7b models in the family, with 0.5% p 1% and estimated effects of 6% 11%.
STABLELM-2 For STABLELM-2, we evaluated 6 models in the model family (12b, INSTRUCT- 12b. 1.6b, INSTRUCT-L.CO ZEPHYR-3b and ALPHA-7b-v2). We found only one instance of sample- specific contamination, with the 12b model showing slight (p = 0.7%) contamination for ARC. Notably, found that all of the models in this family show benchmark-speciff. contamination for GSM8k with estimated effects between 15% and 40%.
A.2 Results for GSM8k Contaminated Models
We present the complete results for the contaminated models finetuned on the GSM8k benchmark in T For a detailed explanation of each of the settings, we refer to App C We do mention here that in the realistic setting, we only train for epoch, without any few-shot samples in the prompt and with additional background instruction-tumi -uning data from the OpenOrca dataset 32
16

---

Table 4: Complete results for all evaluated model families for all tests with result < 1%. All numbers the table are reported in percentages.
Model
Benchmark
Type
Perf. [%]
p [%]
8 [%)
80.95 [%]
TWEN-INSTRUCT-1.555
56.91
0.71
11.77
5.94
OWEN-INSTRUN INSTRUCT-L.5-726
ARC
B
64.68
0.01
12.59
7.61
QWEN-INSTRUN INSTRUCT-1.5-110b
ARC
B
69.45
0.12
9.33
4.47
QWEN-INSTRUN IN55RUCT-1.5.4D
GSM8K
6.52
10
5.35
4.01
DWENNINSTTRICT-1.5-11
Hellaswag
78.65
0.74
7.46
3.00
Hellaswag
B
82.15
0.07
6.48
3.74
QWEN-INSTTRUCT-155522
Hellaswag
86.35 B
10
8.24
6.05
Y1-34b
ARC
S
63.99
0.20
5.00
2.12
Y1-34b
Hellaswag
86.15
10-2
6.51
4.40
Y1-34h
Hellaswag
B
86.15
0.14
3.96
1.89
INTERNLM-2-77
GSM8k
62.09
0.43
19.27
7.98
INTERNLM 2-122-MA 2-MATH-76
GSM8k
B
72.93
1002
39.40
27.15
INTERNI.-2--17
Hellaswag
80.10
0.41
6.58
3.19
INTERNI M-H---
Hellaswag
77.65
0.90
8.55
3.11
INTERNIM-22-MATH-BAAAEES
Hellaswag
79.65 B
0.40
11.41
5.51
STABLELM-2-12h
ARC
59.47
0.68
4.61
1.59
STABLEL.--21104
GSM8k
B
18.88
10
16.56
12.95
STABLEL 1-NNT
GSM8k
42.00
< 10
27.79
19.27
PAARLAL.M-2-ZEPPII
GSM8k
B
51.63
10
48.78
44.34
STABLELM--2-12
GSM8k
58.00
0.39
17.92
6.96
STABLELM-2-INSTRUCCT-D
GSM8k
68.84
10
32.93
21.09
Hellaswag
86.25 B
10
7.04
4.88
YAM-PLEEGEXPEEIMEENPD-77
ARC
B
72.44
10
22.36
17.28
GSM8k
74.53
0.24
3.19
GSM8k
B
74.53
10-2
29.69
18.15
Hellaswag
B
88.60
10-2
13.11
10.27
BARRAHOMEMMISTROLLTTO--
ARC
72.53
10
22.21
17.06
GSM8k
74.53
0.34
7.34
3.05
GSM8k
B
74.53
10-2
29.28
17.77
Hellaswag
88.60
10
12.95
10.15
MTSAIR/MULTI WERSLLLLLLEEEEEEEEEEEEEEEEEEEEEE MODEL
ARC
72.44
10
22.12
16.97
GSM8k
S
74.68
0.53
7.20
2.65
GSM8k
74.68
10
29.84
18.43
Hellaswag
88.55
< 10-2
12.14
9.56
17

---

Table 5: Complete results for the contaminated models finetuned on GSM8k. LLAMA-2 is the DAAMA---INSTRUCTE model. is the actual effect measured on the uncontaminated samples. The other values are the estimates p-values and effects for syntax- and sample-specific contamination. All numbers the table are reported in percentages.
Model
Setting
Perf. [%]
[[]
Phystox
&gyntx [%]]
Pemmpe [%]
òammpla
LLAMA-2
Default
92.11
79.38
10
40.35
10
82.77
Default, rephrased
64.64
50.40
99.14
-6.80
10
55.72
learning rate
73.29
69.96
< 10
43.60
< 10
72.18
learning rate 10
38.85
15.51
< 10
12.62
< 10
19.08
Trained for 1 epoch
25.19
7.92
0.94
5.42
< 10-2
11.94
Other few-shot samples
89.53
76.35
10 100-2
38.08
< 10
82.80
No few-shot samples
80.27
10
10
71.74
Realistic
69.80
50.71
< 10
32.38
< 10
56.99
Realistic, rephrased
40.52
20.67
94.50
-4.47
< 10
25.65
PHI-2
Default
79.51
36.03
< 10-2
14.96
10
41.46
Default, rephrased
69.20
19.95
94.93
4.07
< 10
22.31
learming rate 10 learning rate
82.25
62.25
10
33.39
10
68.42
60.09
6.45
39.06
0.64
21.38
2.27
Trained for epoch
55.39
0.05
10.34
Other few-shot samples
81.34
< 10
19.95
43.56
No few-shot samples
64.19
20.55
0.75
6.48
< 10
21.61
Realistic
59.79
12.06
4.93
4.30
< 10
16.45
Realistie, rephrased
60.55
6.30
88.04
-2.73
1.48
6.92
18

---

B Ablation Study via Simulation
To further investigate the performance of CONSTAT, we conduct an ablation study using simulations. This approach allows to test various scenarios and understand the behavior of CONSTAT under different conditions without the need for finetuning or computationally intense evaluations. Further- more, it helps in verifying the p-values returned by various tests while avoiding the risk of tuning our final test to our analysis in $
We first explain the simulation setup and then present the results.
B.1 Simulation and Setup
Simulation In the simulation, samples are modeled as real numbers representing their complexity. Each sample x: in a benchmark D is drawn from a benchmark-speciftr distribution D. Therefore, benchmark D can be specified by a number E Zyn, indicating the number of samples, and distribution D, from which the samples are drawn. Given the benchmarks (n,, D) and (Mret, Drer), a model is represented as M (m, m,et) E R2, where each number indicates the quality of the model on the respective benchmarks. The probability that a model M answers a sample x E D correctly is given by the formula min(1, exp(- (xx)-)/m)) Note that this probability increases as the quality of the model m grows and decreases as the complexity of the sample x increases.
If mye m for given model, the model is contaminated. Reference models can be drawn from a distribution M over the real numbers such that myet = m for each reference model. To simulate noise in the evaluation of models, can add noise to the quality of the reference models, resulting in Myet R3 m.
Statistical Tests We compare CONSTAT against various other statistical tests that one could construct. First, we include various variants of CONSTAT. CONSTAT-NO-SORE does not sort the reference models by their and fits the hardness correction function HD,, directly on the scores (M.), SD(,)) reference models. not over the reference models.
CONSTAT-NO-RANE RO-RANDOM does not include random model in the set of
COSSTAAT---BOOSSTTTEE only performs bootstrapping over the samples and
We also include two alternative tests. MEAN-TEST directly compares performance on the reference and original benchmarks, considering a model contaminated if its performance on the original bench- mark is significantly higher. NORMALIZED- TEST instead computes the normalized performance with respect to the models by computing the means μDD A.D,, and standard deviations OD. Dra of the reference models on each benchmark. It then bootstraps the reference models and samples to obtain the p-value as the probability that the normalized performance dp (M) - μD) of the model on the original benchmark is higher than on the reference benchmark. Therefore, NORMALIZED- -EST essentially corrects for first- and second-order distributional differences between D and Dief-
Reporting Results We report results for specific distributions M, D and Drer for a model M for which we aim to detect possible contamination. For each choice of distributions, we run 1000 simulations, each drawing new reference models and benchmarks from the given distributions and performing the tests described before. This ablation focuses on the uncontaminated case, where m Mief as avoiding false positives is crucial. In Fig. 3al we show example plot of the resulting CDF of the returned p-value when D = Drar. As expected, the CDF for each method very close to the identity line for the uncontaminated model. Ideally, the curve for uncontaminated models should be as close as possible to this identity line to ensure reliable p-values. Above the line is especially problematic, this would be the cause of false positives. Furthermore, by swapping the distributions D and Diefs one would obtain a mirror image of the plot. This means that a CDF that is below the identity line in given situation, would be above the identity line in the mirror image, and is therefore also problematic for the same reason.
We now report results for various scenarios. In each case, we aim to ensure that specific test fails and explain why this the case. all explored scenarios, CONSTAT performs as expected, while the other methods fail. Unless specified otherwise, we use 20 reference models and 1000 samples for each benchmark, in line with our results presented in $4 A full overview of each parameter setting can be found in Table 6 We always set the quality of the model under consideration to (1, 1).
19

---

Table Settings for the simulation scenarios. We use the union of two distributions indicate the distribution that samples from both distributions with equal probability. The a column indicates the noise added to the reference models, using a normal distribution with mean 0 and standard deviation σ. A normal distribution is denoted using the notation N M(u, o) where a is the standard deviation.
Scenario
M
Dret
0
Different Distributions
(13,0.3)
(0.4, 0.3)
N 0.2)
Non-Linearity
0.0.
W(0.8, 0.1) (.1(1.4,0.)
N 0.1) U.(11,
0
Noise
(.4,0.4 0.0.
(.44
0.05
Bootstrapping Models
1)
W(0.8, U.).8.
( 0.1) (.(11,
0.1
No Random Model
1(4,1)
(4,,0.)) 0.8)
(00.8,
0.05
B.2 Results
Different Distributions The MRAN-TEST should fail if the difficulty of one benchmark is different than the other. We slightly decrease the difficulty of the samples in the original benchmark to make MEAN-TEST return false positives, as shown in Fig. 3b Despite M being uncontaminated, the p-values returned by MEAN-TEST show a very steep CDF.
Non-Linearity NORMALIZED-TESS assumes linear relationship between performances refer- ence and original benchmarks, but non-linear relationships can occur. For instance, is non-linear for sample-specific contamination in the GSM8k benchmark (see Fig. [ Therefore, we change the benchmark distributions to ensure a non-linear relationship. The result shown in Fig, shows that NORMALIZED-TI -ESTTTTETT returns very steep CDF. We note that CONSTAT-NO-SONN also returns steep CDF in this particular case.
Noise When reference models do not have the same quality both benchmarks, noise is introduced in the signal that the test receives. Our theoretical analysis in correets for this noise by sorting the reference models by performance on each benchmark. this noise. We showcase this for an uncontaminated model in Fig. 3d by keeping D = Dres. but now adding a small amount of noise to the reference models. CONSTAT-NO-Son returns a steep CDF and should not be used in practice due to the noisy nature of real-world scenarios.
is more susceptible to
Bootstrapping Models Bootstrapping over reference models is necessary for reliable p-values. Without bootstrapping, the test would rely on the specific instantiation of the reference models, leading to p-values that are either too certain, always returning 0 or 1. We repeat the non-linear scenario with added noise to the reference models and a wider distribution over them. As shown in Fig. 3e SOTTA--NO-BOOTTTRRR returns a CDF that very steep at either edge.
Adding random model to the reference models in CONSTAT provides further regularization. The effect of this addition only becomes apparent when we use fewer reference models in non-linear scenario. In such cases, all reference models are relatively close together and the smoothing spline overfits to this local part of the curve. We demonstrate this in Fig. 31 using only five reference models and non-linear relationship between the benchmarks. shows a rather steep CDF this scenario.
No Random Model
We conclude that CONSTAT is robust to various scenarios and provides reliable p-values in all cases. The other tests fail in the scenarios we have presented, highlighting the importance of the design choices made in CONSTAT.
20

---

1.0- ConStal
1.0-
0.8
Normaliass--o Toxt
0.8
Sor:
Bostssrop
0.6
ComStat-Ne-Rommlnn
0.6
lientily
CouStac: Moan: Test
0.4
0.4
NormalinadkTal
CouStac-NoSSet
0.2-
0.2-
ConStac No Bootstrop
ConStac-No
Identity
0.0
0.0
0.0
0.2
0.4
0.6
0.8
1.0
0.0
0.2
0.4
0.6
0.8
1.0
P
simple scenario where all tests should return CDF close to the identity line.
A scenario where make the distributions of the benchmarks different.
1.0-
0.6
0.6
Fb
ConSter:
ConStar
Mosn-Tost
Moun-Tos
Normalized:
Normaltzed
CouStar-NoSart
CouStac-NoSaet
0.2
CouStar: No Boctstrop
0.2
CouSta: No. Dootstrap
ComStas-No-amie
lientit
Identit
0.0
0.0-
0.0
0.2
0.4
0.6
0.8
1.0
0.0
0.2
0.1
0.6
0.8
1.0
The relationship between performances the refer- and original benchmarks is non-linear.
The reference models noisy and the relationship between the benchmarks is linear.
1.0
1.0-
Motn Test
0.8-
Normaliasl: Tost
0.8
CouStai-No-Sar.
ComStai-Ni-Rootteee
0.6
ConStai-No-
0.6
F5
Identity
ConStac
0.1
Mean-Tist
Normalizai-Tol
CouStacsNo-Sett
0.2
CouStac No Bootstrop
ConSter-No-Ronde
0.0
0.0
Identity
0.0
0.2
0.4
0.6
0.8
1.
0.0
0.2
0.4
0.6
0.8
1.0
p
T.A small number of reference models and non-linear relationship between the benchmarks. CONSTAT-NN BOOTSTRAP and CONSTAT are the same in this case.
The reference models are noisy and the relationship between the benchmarks is non-linear.
Figure 3: CDF of various statistical tests for uncontaminated models in different scenarios.
21

---

C Experimental Details
We describe the full details for the experiments presented in $ This includes the preprocessing stage of the benchmarks, the data generation process, the fine-tuning of the models on the benchmarks, and the evaluation of the models, including the reference models used. Additionally, we provide details on the computational resources necessary to rum the experiments. Licensing information for all assets used in the experiments is provided in App. D
Preprocessing We select four benchmarks for our experiments, ARC [3], GSM8K [6]] Hellaswag 54 and MMLU [26] Due to the large size of MMLU, we first select a subset of the topics from which it consists. Specifically, we select the following topics: Abstract Algebra, Anatomy, Astronomy, Business Ethics, Clinical Knowledge, College Biology, College Chemistry, College Computer Science, College Mathematics, College Medicine, College Physics, Computer Security, Conceptual Physics, Econometrics, and Electrical Engineering. We randomly select 2000 samples from each of the benchmarks. These samples were then split into two equally-sized sets, one of which was used for contaminating the fine-tuned models.
For the chosen reference benchmarks we limit the number of samples 2000. We choose this number based on the trade-off between tight confidence bounds and computational budget. Computational complexity increases linearly with the number of samples, while the size of confidence intervals decreases. We found that 2000 samples provide tight confidence bounds and allow us to evaluate over 50 models within our budget.
Data Generation For each benchmark, we generate rephrased version of the benchmark and synthetic benchmark. For both these purposes, we use GPT-4-TURBO [36]. Specifically, for the rephrased benchmarks, options for multiple-choice benchmarks) of given sample. We use a different system prompt to generate rephrased training samples, including the input and output, to finetune the models trained on rephrased data for our experiments in $4.2 By using separate prompts for training and evaluation, we ensure that the evaluation did not occur on the same data as the training.
system prompt asking the model to rephrase the input (including
For the synthetic benchmarks, we write a system prompt that asks to generate new synthetic samples for the benchmark. To obtain faithful synthetic samples, use few-shotting where the model is given several examples of the benchmark. By placing these generated samples in the "assistant" field of the chat model and changing the given few-shot examples for each sample generate, ensure both faithful and diverse samples. We generate 1000 samples for each benchmark.
To ensure high data quality for rephrasing and synthetic sample generation, we performed the following procedure:
We manually tested around 10 samples for each benchmark with various system prompts, iteratively refining the prompts until we were satisfied with the output quality.
We performed a manual check of approximately 100 samples for each benchmark to identify common mistakes and evaluate overall data quality. For instance, for the GSMSK benchmark. we found that some generated samples did not result in an integer answer, or the model used rounding operation. These samples were removed by checking if the answer was an integer and ensuring no rounding was involved.
Post-processing was then applied to the synthetically generated benchmark samples. First, duplicates within the synthetic samples were removed by searching for high I-gram overlap ratios between two samples. Second, we removed samples with a high 1-gram overlap ratio with the original benchmark samples, ensuring the synthetic samples were not too similar the originals.
The system prompts used for the rephrased benchmarks and synthetic benchmarks are available in the code repository.
We explain the finetuning process for the PHI-2 and DEA-MA---ISSTRUCT-75 models that were used in $4.2 We use the Hugging Face Transformers library [48 for the finetuning process.
Finetuning
Specifically, we applied full finetuning with batch size 16 and the Adam optimizer on different datasets and using different hyperparameters. We use the following default hyperparameters:
22

---

A learning rate of 5 10
The dataset on which we train is the contaminatable part of given benchmark.
We train 5 epochs.
The prompt includes the few-shot samples used for evaluation.
We then train 8 other models where we always change specific parameters in this default setting. Specifically, we train models that diverge from the default setting the following ways:
1. Instead of training with the exact samples from the benchmark, we train the rephrased benchmark.
2. We change the learning rate 10-5
3. We change the learning rate 10-4
4. We only train for epoch.
5. We train without any few-shot samples in the prompt.
6. We train with a random set few-shot samples instead of the few-shot samples from the benchmark.
7. We do not include any few-shot samples in the prompt, include additional background instruction-tuninn -unnnnnn data from the OpenOrea dataset 33), and only train for epoch.
8. We do the same in the previous setting, with the additional change that train the rephrased benchmark instead of the actual one.
By including such a wide range of possible settings, we ensure that cover wide range of possible contamination effects. As can be seen in Fig. 2 the resulting models indeed show varying levels of contamination from 0% up to 80%.
Reference Models The following models were used as reference models in our experiments: PHI-2, PHI-3, LLAMA-2 -2-b, LLAMA 2--NNSTRUCT776 LLAMA-2 -2 13b, LLAMA-2-INSTRUCC 13b, LLAMA- 2-INSTRUCT-70N LLAMA-3-8b,
LLAMA-3-70b, LLAMA-3-INSTRUCT 70b, MISTRAI.-7--00.1. MISTRRAI-IISTTRRITTT-bb.... MISTRRAIIINSSTTRUCTT----022222 MIXTRAL- CON.ON77..F...OONNNSTTITTT---- GEMMA-1.1 we removed MISTRAL-
INSTRUCT-8x7b MIXTRAI--INSTRUCTTO
7b, GEMMA- 1...-..-IINN J.I-INSTRUCT-7 OLMO-INSTRUCT-PN As discussed $4.3
1 from the reference models after contamination analysis.
Evaluation evaluate models with v0.4. of the LM Evaluation Harness 20 evaluation for all models and provide the custom fork of the evaluation harness to allow for the evaluation on all the synthetic and rephrased benchmarks in our code repository.
We use 5-shot
Compute We spent around 300 USD the OpenAl API to generate all benchmarks. Furthermore, we used a single Nvidia H100 GPU for around month to finetune and evaluate models. Finally, for models that were too large to fit on single GPU, we used the Together API to run inference. We spent an additional 263 USD on this platform.
23

---

D Licensing Information
We include the license for all models, benchmarks and other assets used in this paper in Table
Table 7: Table with assets used, description of their use and the license under which they are distributed. Sections split by the type of asset: benchmarks, code repositories and then models.
Asset
Description & Use
License Name
MMLU 20
General purppoe benchmark used for evaluation
MIT License
Hellaswag 54
General-purpose purpose benchmark used for evaluation
MIT License
GSM8K 66
General-purpon purpose benchmark used for evaluation
MIT License
ARC-Challenge
15
General-purpose benchmark used for evaluation
CC-BY-SA-4.0
OpenOrca
Instruction-tuning dataset used in finetuning pro-
MIT License
cess
LM Evaluation Harness
20
Framework used to perform evaluations Repository to run the [40] baseline
MIT License
40
Not Specified
Scipy
4
Adapted code for smoothing spline fitting
BSD 3-Clause License
LLAMA-2
3
Includes all LLAMA-2 models, were evaluated for contamination and used for finetuning
Llama 2 Community
License Agreement
LLAMA-3
Includes LLAMA-3 models, were evaluated contamination
Llama Community
License Agreement
FALCON
Includes all FALCON models, were evaluated for contamination
Apache 2.0 License
GEMMA-1.1
Includes all GEMMA-1.1 models, evaluated contamination
Gemma Terms of Use
YAM-PELLEG/EXPPRIIMENTZG
Was evaluated for contamination
Apache 2.0 License
7b
BARRAAHOME//ISTROLLL.
Was evaluated for contamination
MIT License
v2.2
Was evaluated contamination
Apache License Apache 2.0 License
MISTRAL 28
Includes all MISTRAL models, were evaluated for contamination
PHI-2 27
Was evaluated for contamination and used for fine- tuning
MIT License
PHI-3
Was evaluated for contamination.
MIT License
QWEN- 1.5 6
Includes all QWEN- 1.5 models, were evaluated for contamination
Tongyi Qianwen Li- Agreement Stability Ai Non- Commercial Research Community License Agreement Apache 2.0 License
STABLELM
Includes all STABLELM-2 models, were evaluated for contamination
INTERNI.M-2
Includes all INTERNI.M-2 models, were evaluated contamination
OLMO 25
Includes all OLMo models, were evaluated for contamination
Apache 2.0 License
Y1 53
Includes all Y1 models, were evaluated for contam- ination
Yi Series Models Community License Agreement OpenAl Terms of Use
GPT-4-TUREO
Used to generate synthetic and rephrased bench- marks
24

---

Table
Contamination results for YAN-PPLISG/XXPERMENTT6/ MTSAIR/- B is baachmark-specinfe is
MULTI VERSE_ _MODEL BARR.HOME/IITRROLL7OYYY sample-specific and Y is syntax-specifie contamination. All numbers are reported percentages.
Model
Benchmark
Perf. [%]
Type
p [%]]
8 [%]
80.95 [%]
BAKKAHOME/MISTROLL
ARC
72.53
10
22.21
17.06
S
55.90
-0.22
-.88
Y
88.15
-3.09
-7.26
GSM8K
74.53
10
29.28
17.77
S
0.34
7.34
3.05
Y
34.00
0.79
2.49
Hellaswag
88.60
10
12.95
10.15
96.48
3.25
66.11
Y
12.88
1.35
-0.57
MMLU
58.89
35.65
0.71
2241
85.66
-1883
4.62
MTSAIR/MULTI, BERRRR/MMLILLLLEEEEEEEEEE VERSE MODEL
ARC
72.44
10
22.12
16.97
S
51.07
0.13
4.49
87.29
2.91
66.9
GSM8k
74.68
10
29.84
18.43
S
0.53
7.20
2.65
47.26
0.12
3.02
Hellaswag
88.55
10
12.14
9.56
96.40
3.19
5.92
Y
10.12
1.50
00.0
MMLU
58.98
33.99
0.82
2.33
81.48
4.30
wwN.PELEGG/EXPFRIMMENZZG.
ARC
72.44
<. 10
22.36
17.28
S
60.10
0.53
5.26
90.97
3.81
88.09
GSM8k
74.53
10
29.69
18.15
S
0.24
7.60
3.19
14.74
2.07
-1.19
Hellaswag
88.60
10--
13.11
10.27
S
96.52
-3.25
-6.00
Y
13.35
1.36
-0.99
MMLU
59.03
23.81
1.36
1179
78.91
11.6
-417
E All Test Results
We present all results for each performed test in this section. Tables Table results, grouped by model family.
Table 23
contain these
25

---

Table 9: Contamination results for QWEN-INSTRUCT-I..55 QWEN-INSTRUCT, 1.5-bb, QWEN-
INSTRUCT-I.5- 1.5----... B is benchmark-specific, S is sample-specific and Y is syntax-specific contami- nation. All numbers are reported in percentages.
Model
Benchmark
Perf. [%]
Type
p [%]
å [%]
80.95 [%]
QWEN-INSTRUCT-I 1.5..8
ARC
38.40
97.39
6.47
12.37
S
65.23
-1.17
-6.66
75.55
11.8
-4.2
GSM8k
31.16
16.59
6.43
-4.08
S
26.48
1.46
-2.38
Y
5,62
3.43
-0.13
Hellaswag
60.90
B
100.00
9.29
-13 -13.98
99.73
7.34
-11.27
82.43
2.45
-7.91
MMLU
41.69
5
34.60
0.56
-243
32.23
0.79
2.15
QWEN-INSTRUCT-I 1.5-4b
ARC
42.06
30.33
6.03
22.11
32.46
0.79
33.6
86.90
2.10
5.24
GSM8k
6.52
99.82
25.43
36.93
S
10
5.35
4.01
11.87
1.59
0.61
Hellaswag
69.35
93.97
3.53
7.06
S
66.77
0.85
-422
26.14
1.36
3300
MMLU
50.36
45.01
0.25
2287
88.31
2.14
5.09
DOWNNINSTRUUC--
ARC
55.12
3.05
14.29
2.24
S
59.77
0.47
33.1
57.67
0.33
3328
GSM8k
55.12
59.20
1.38
11.91
S
9.79
3.73
-1.9
29.53
1.16
-2.4
Hellaswag
78.65
0.74
7.46
3.00
90.61
-1.77
-4.88
15.20
1.74
-.16
MMLU
57.82
S.
69.80
1.02
-.37
50.88
0.02
3301
26

---

Table 10: Contamination results for OWEN-INSTRUCT- 1.5-1-,,1,,,,,, OWEN-INSTRUN 1.5-72b, QWEN-
INSTRUCT- 1.b. B is benchmark-specifie, S is sample-specific and Y is syntax contami- nation. All numbers are reported percentages.
Model
Benchmark Perf. [%]
Type
p p[%]
[%]
60.95 [%]
QWEN- OWVEN-NNTRUCTT-LE
ARC
69.45
0.12
9.33
4.47
54.00
-0.20
-4.13
Y
56.38
00.25
-3.29
GSM8k
82.11
B
79.77
-215
-7.64
20.01
2.05
-1.9
7.08
2.80
0.35
Hellaswag
84.25
B
29.03
0.69
1148
S
93.86
2231
-4.71
Y
25.42
0.93
1.50
MMLU
74.00
65.01
0085
-.87
67.92
0.72
3.40
QWEN-INSTRUCT-
ARC
56.91
B 0.71
11.77
5.94
88.65
2.50
5.72
Y
32.93
0.77
2.11
GSM8K
68.39
5.12
10.28
0004
1.13
6.37
1.89
Y
75.33
1.45
4.94
Hellaswag
82.15
B
0.07
6.48
3.74
98.89
3.14
5.39
3.41
2.61
0.27
MMLU
64.94
70.02
1.12
4.76
Y
34.23
0.67
2.02
DEEN-INSTRUCT-L.---2
ARC
64.68
B
0.01
12.59
7.61
70.96
1.34
5.42
Y
6.07
2.77
-0.17
GSMBk
79.45
B
5.76
9.74
0.42
38.33
0.77
3.41
98.90
4.39
7.54
Hellaswag
86.35
B
< 10 2
8.24
6.05
S
14.24
1.48
0.76
Y
27.24
0.76
1.31
MMLU
74.29
11.91
2.65
1118
Y
22.85
1.23
-148
Table 11: Contamination results for OLLMO-INSTRUCT-PN benehmark-specific, S sample- specific and Y is syntax--pecifie contamination. All numbers are reported in percentages.
Model
Benchmark
Perf. [%]
Type
p [%]
8 [%]
80.90 [%]
OLMO-INSTRUCCT-7
ARC
46.08
B
22.68
7.22
-1.30
S
45.29
0.16
-2.33
53.61
-0.10
-3.0
GSM8k
11.75
B
< 10-2
8.86
4.99
S
7.31
2.14
0.33
Y
57.97
0.25
2.52
Hellaswag
79.95
2.99
2.63
0.41
S
5.04
2.38
0.00
Y
17.90
1.14
11008
MMLU
41.94
S
70.97
-0.69
22.8
48.80
0.03
-2.1
27

---

Table Contamination results for GFMMA-1, I-I.I-NTUCT--.,. Denchmark-speciifee S is samplc-specifie and Y is syntax-specific contamination. All numbers reported in percentages.
Model
Benchmark
Perf. [%]
Type
p [%]
8 [%]
80.95 [%]
GEMMA-1.1 INSTRUCT-2D
ARC
41.71
99.47
-7.12
-1.799
S
26.13
0.69
2.88
Y
73.27
-0.96
-3.51
GSM8K
10.61
B 100.00
288.17
-3.877
90.87
-1.80
-3.67
Y
95.11
-243
-4.22
Hellaswag
63.25
B
89.68
-4.47
-9.01
87.14
-2.47
-5.07
21.24
0.64
-485
MMLU
35.64
74.14
-.93
3374
Y
85.61
1.75
-1.77
GEMMA-L.1-INSTRUCT-N
ARC
58.02
B
9.31
3.61
-1.2
10.48
2.13
-074
44.06
0.21
-244
GSM8K
50.80
98.63
13.67
23.14
81.05
-223
6610
Y
64.59
-0.72
4.00
Hellaswag
76.85
1.79
5.79
1.59
3.21
3.18
0.40
Y
13.92
1.76
-.16
MMLU
53.70
58.46
0.31
3.06
Y
90.68
2.09
4458
28

---

Table 13: Contamination results for INTERNLM-2-1 INTERNLM-2-MATH-N INTERNLM-
2- 2-MATH-BASE-1H INTERNIM--21.8h. is benchmark-speciffc,, sample-specific and Y syntax-specific contamination. All numbers reported in percentages.
Model
Benchmark Perf. [%]
Турe
[%]
[%]
00.95 [%]]
ENTERNI.-2--1-
ARC
39.93
B
100.00
19.05
23.95
85.40
-2.29
-6.76
75.13
-1.28
-4.52
GSM8k
24.03
B
5.93
7.98
00.37
S
19.37
1.64
-1.22
Y
91.30
-2.33
55.83
Hellaswag
63.05
98.31
-684
11.65
43.03
0.03
5.80
Y
10.35
0.33
5.29
MMLU
41.26
S
82.17
-1.51
-.35
Y
52.23
-0.13
3.12
INTERNLM M--2-b
ARC
55.55
100.00
13.68
18.74
3.51
3.44
0.34
62.09 27.51
Y
0.92
- 1.79
GSMBK
B
0.43
19.27
7,98
11.63
3.17
1.21
80.10 84.26
Y
2.10
5.58
Hcllaswag
B
0.41
6.58
3.19
2.64
2.73
0.46
Y
30.02
0.65
1.53
MMLU
57.77
33.66
0.80
2.38
Y
9.90
2.20
0.62
INTERNLM-22 MATH-7b
ARC
52.82
B
84.86
-.14
- 8.28
41.52
0.41
3.09
Y
21.28
1.52
11.1
GSMBk
72.93 < 10
B
39.10
27.15
64.34
0.89
-187
Y
71.92
L.16
4.36
Hellaswag
77.65
0.90
8.55
3.11
5.57
2.80
0.11
Y
33.90
0.64
2.48
MMLU
57.48
33.57
0.86
2.49
Y
53.43
0.14
3.15
ARC
56.23
64.31
0.99
5.50
21.60
1.49
1.68
Y
38.46
0.52
2.32
GSMBk
35.63
B
83.69
-7.17
18.75
1.48
5.45
1.57
Y
14.23
2.36
-125
Hellaswag
79.65
B
0.40
11.41
5.51
S
4.63
2.11
0.05
Y
35.40
0.48
-1.0
MMLU
52.83
48.63
33.66
Y
11.60
2.36
0.93
29

---

Table 14: Contamination results for DAA-AMA---ISTTUCT---- LLAMA-2-1 2-7b, LLAMA-2-INSTRUCE 13b, LLAMA-24 2-1b,, LLAMA-2-NSTTRUCT-00 B is senchmark-specifee S is sample-specife and Y syntax--spciin contamination. All numbers are reported in percentages.
Model
Benchmark
Perf. [%)
Type
p [%)
8 [%]
0o.05 0s.05
[%]]
LLAMA-2-13b
ARC
56.23
98.26
5.46
9943
13.56
1.62
0.92
Y
48.39
0.07
-2.02
GSM8K
23.81
B
72.02
-3.41
-13.88
13.14
1.74
-1.24
78.51
-1.33
-4.12
Hellaswag
82.35
B
97.33
22011
-3699
2.07
2.38
0.51
51.41
0.03
-.49
MMLU
48.52
73.33
0.88
3.21
Y
70.56
0.76
3.14
LLAMA-2-7B
ARC
52.56
B
59.44
0.66
55.1
4.07
2.89
0.21
18.31
1.14
-1.6
GSMSk
13.42
38.75
1.60
5.56
35.13
0.37
11.8
Y
53.37
0.09
2.38
Hellaswag
78.95
98.22
22.22
4.35
5.41
2.03
0.05
44.09
0.13
1.66
MMLU
41.31
7.68
2.91
- 0.54
Y
14.99
1.54
-114
LLAMA-2-INSTRUCHE
ARC
56.57
3.70
4.98
0.49
72.99
0.89
Y
78.67
1.15
3.56
GSMSK
36.69
B
35.55
2.70
8.22
35.35
0.62
-292
35.94
0.66
-2.66
Hellaswag
82.35
77.82
-085
-275
18.86
1.05
0.95
Y
10.86
1.30
0.17
MMLU
46.83
80.09
1.26
3.55
86.45
L.72
4.08
LLAMA-2- 2INTRRUCCC-
ARC
61.86
28.49
1.34
2.70
14.68
1.96
- 1101
Y 87.74
1.77
-421
GSM8k
55.80
7.23
9.18
-1.11
58.60
-0.41
-442
Y
57.70
0.33
3.55
Hellaswag
85.55 B
6.44
1.64
0015
0.41
3.37
1.29
71.66
00.2
-2111
MMLU
56.85
32.91
0.71
2210
Y
43.26
0.25
-2.5
LLAMA-2 2LAMA-2-INSTRUCT- INSTRUCT-76
ARC
51.02
4.74
5.01
0.13
82.83
1.52
4.05
76.26
0.96
3319
GSM8k
22.74
16.17
5.40
-2.2
68.05
0.59
3.00
Y
7.90
2.35
-0.11
Hellaswag
78.10
91.52
1.61
93.08
-1888
-389
Y
53.49
-0.2
-2.13
MMLU
43.24
86.64
-1.67
-3.78
Y
43.76
0.20
-2.22
30

---

Table 15: Contamination results for LLAMM---INNTRUCT---5- is benchmark -specfffi,,, S is sample-specific and is syntax-specific contamination. All numbers reported in percentages.
LLAMA-3-706. LLAMA-3-8h
Model
Benchmark
Perf. [%]
Type
p [%]
8 [%]
60.95 [%]
LLAMA-3-706
ARC
69.03
46.06
0.26
4.05
0.03
6.61
3.21
1.95
3.35
0.73
GSM8k
81.58
B
92.86
-5.03
-9.55
15.45
2.05
-1.49
Y
23.24
1.13
-.60
Hellaswag
86.45
77.74
0.74
2.43
1.01
2.86
0.90
Y
94.19
-2.1
-382
MMLU
76.46
5.76
3.35
-0.21
55.02
-0.12
-2.1
LLAMA-3-8h
ARC
56.91
99.41
6.46
10.30
62.47
-0.39
-2.8
Y
49.13
0.04
-2.99
GSM8K
49.36
99.38
15.27
24.75
4.06
-0.99
1.94
4.52
1.04
Hellaswag
80.90
B
99.26
2.66
4.35
44.87
0.15
1.70
94.78
-1.48
-294
MMLU
61.16
4.18
3.01
0.18
Y
10.88
1.78
0.63
LLAMA-3-INSTRUUCT-700
ARC
70.22
B
28.64
1.45
2.80
75.48
1.37
5.12
68.86
0.52
-2799
GSM8k
89.99
73.62
-121
- -7.54
9.39
3.05
- -.03
Y 20.00
1.23
-1 1150
Hellaswag
85.30
18.97
0.87
0.88
97.73
2.45
4.38
Y
89.67
1.24
2.67
MMLU
77.53
43.27
0.17
-356
Y 15.82
1.18
-107
ARC
60.75
45.04
0.25
-377
66.87
-0.77
3388
Y
44.33
0.20
-2.09
GSM8k
75.89
B
7.93
8.40
-1.00
23.07
1.49
2.25
70.85
0.89
3.63
Hellaswag
78.10
99.46
3.02
4.95
98.96
-296
- 4,85
Y
90.89
-1.3
33.8
MMLU
62.23
76.69
-1.77
3380
27.51
0.74
-1.33
31

---

Table 16: Contamination results for PHI12, PHI-3-MINI, PHI-3-SMALL, PHI-3-MEDIUM. B is benchmark-specific, sample-specific and syntax- contamination. numbers are reported in percentages.
Model
Benchmark
Perf. [%]
Type
[%]]
[%]
80.95 [%]]
PHI-2
ARC
58.45
B
70.14
-1.29
5.43
97.63
-4.5
-7.80
53.03
-0.08
-2.99
GSM8K
58.91
B
< 10022
36.42
26.46
56.18
-0.66
4.03
Y
28.20
1.04
-2.99
Hellaswag
76.30
B
4.64
3.46
0.08
S
100.00
4.80
6.73
Y
26.31
0.83
1.68
MMLU
51.96
99.39
5.01
7.87
10.50
0.32
2.16
PHI-3-MINI
ARC
59.90
B 59.70
0.61
-4.72
99.78
6.94
10.60
Y
49.33
0.05
2.51
GSM8k
76.65
0.29
16.30
6.33
89.75
2.86
6.29
Y
86.35
- 1.73
4.29
Hellaswag
80.55 100.00
B
1.15
3.38
1.17
6.34
8.37
Y
62.19
2.26
MMLU
63.49
99.01
4.94
8.05
Y 40.40
0.29
2.15
PHI-3-SMALL
ARC
67.83
B
74.84
1188
6.62
63.09
-0.76
4.55
26.75
1.15
1.84
GSMBk
87.95
B
0.58
15.04
5.04
61.30
0.70
5.04
Y
58.49
0.36
3.31
Hellaswag
84.70
0.02
3.38
81.51
1.14
3.27
Y
71.57
- 0.60
-240
MMLU
71.33
89.80
2.89
6.67
40.60
0.37
-2.99
PHI-3-MEDIUM
ARC
66.55
83.99
2273
7.16
87.56
2.68
6.57
Y
91.94
2.57
5.55
GSMBk
86.35
B
0.03
21.11
10.78
37.34
0.76
33.3
Y
65.15
0066
33.9
Hellaswag
86.05
B
0.02
4.54
2.51
S
92.41
-188
-3.7
Y
20.51
0.87
-0.89
MMLU
74.14
63.19
-0.73
-464
Y
51.35
0.04
-2.64
32

---

Table 17: Contamination results for MISTRAL-7D-VO.L, MISTRAL-7D-VO.2. B is benchmark-speciffc.
S is sample-specific and Y syntax-specific contamination. All numbers are reported in percentages.
Model
Benchmark
Perf. [%]
Type
p[%]
[%]]
80.95 [%]
MISTRAL-7b-vO.1
ARC
58.96
B
95.01
-4.46
8.76
S
7.91
2.21
-0.40
Y
28.07
0.79
-1.52
GSM8K
39.04
B
87.59
-7.71
18.04
S
0.15
8.25
4.48
Y
66.44
-0.87
4.42
Hellaswag
83.65
B
65.34
-0.42
22199
S
0.24
3.14
1.27
16.97
0.94
0.68
MMLU
58.01
S 15.23
1.88
1.05
Y
11.08
1.88
0.69
MISTRAL-7b-v0.2
ARC
58.19
B 98.02
5.63
10.01
S 23.24
1.17
-.38
45.61
0.15
2.11
GSM8K
37.60
B
89.88
- 8.55
18.87
S
0.54
6.57
2.68
Y
76.32
-1.53
5.07
Hcllaswag
82.80
58.14
00.5
2.11
S
1.28
2.60
0.69
Y
50.08
-0.11
1.60
MMLU
56.71
S
49.62
0.06
2.87
27.94
0.89
-1.61
33

---

Table 18: Contamination results for MISTRRA-IINTRRICT-----3.. MISTRAAL-INSTRRUCT----09.
MISTRAL-INSTRUCTTT--... benchmark-speeiie is sample-specific and Y syntax-specific contamination. All numbers are reported in percentages.
Model
Benchmark
Perf. [%]
Type
[%]
8 [%]
80 60.95 [%]
MISTRAL- MISTRAL- INSTRUCT--UUU
ARC
54.35
B
99.97
-9.04
12.92
S
95.10
-2.83
-5.40
Y
73.29
-0.86
-3.17
GSM8K
35.86
98.51
13.89
23.86
S
85.29
2.45
-563
Y
90.91
2.67
-5.8
Hellaswag
74.90
B
90.11
-1.68
33.7
97.12
-247
-.62
Y
53.04
0.13
2.51
MMLJU
49.69
S
29.29
0.77
1176
Y
72.16
0.87
3336
MISTRAL-INSTTRUCT----002
ARC
62.46
B 0.04
10.62
5.95
64.89
0.70
4.17
Y 80.34
1.29
3.80
GSM8k
42.61
B 80.76
5.71
16.01
94.39
4.26
-.35
Y
84.91
2.10
5.24
Hellaswag
84.55
B
0.18
3.52
1.56
S
81.26
1.04
3.01
Y
12.47
1.10
0.56
MMLU
55.06
18.63
1.48
-128
Y
42.67
2221
MISTRALLINNTTRUCI-7--.033
ARC
62.37
B
88.82
3.24
-759
S
94.57
3.64
7.38
Y
66.69
-062
3306
GSM8k
48.22
B
94.33
10.60
20.56
S
35.14
1.03
33.8
Y
89.74
2.69
6.15
Hellaswag
84.25
B
5.20
1.90
0.02
S
62.58
0.40
2.42
Y
37.49
-131
MMLU
56.56
S
14.15
1.88
-0.93
Y
34.01
0.63
-189
34

---

Table 19: Contamination results for MIXTRAI--NNTTRUC-&K22] MIXTRAL-INSTRUCT-SS
Denchmark-speciffe S is samplc-specifie and Y is syntax-specific contamination. All numbers reported in percentages.
Model
Benchmark
Perf. [%]
Type
p [%}
[%]
60.93 [%]
MIXTRALLINSTRUUCT-92h
ARC
72.95
0.77
6.01
2.00
S
10.63
2.64
-1.07
Y
20.07
1.10
-1.42
GSM8K
85.97
B
44.60
0.69
-3.86
65.36
-0688
-4.37
21.06
1.18
-1.46
Hellaswag
89.00
B
14.01
1.19
-0.22
S
22.49
0.82
-1.13
26.36
0.62
-1.25
MMLU
74.14
S
29.85
0.97
-257
59.95
0.23
2.12
MIXTRAL-INSTRUCT--87b
ARC
69.54
B
73.09
1.49
5.59
17.27
0.11
3.48
68.30
2285
GSM8k
65.66
95.56
8.84
18.06
S
69.87
- 1.06
4.53
83.79
- -178
-4.33
Hcllaswag
87.60
20.79
0.82
-0.85
14.57
1.15
0.76
6.31
1.34
0.10
MMLU
66.73
S
26.75
1.07
-193
77.86
0.98
33.99
35

---

Table 20: Contamination results for TTABBELM-2-122 MABBLELM---ZEPHYYEE STABLELM-
2-1.6b, STABLELM-22ALLHH--DO is benchmark-specific, sample-specific and Y is syntax-specific contamination. All numbers are reported in percentages.
Model
Benchmark
Perf. [%]
Type
p [%]
å [%]
d0 [%]
ST STABLELM-2-ALPHH--DO--
ARC
44.28
B
100.00
10.65
15.06
S
60.46
00.88
33.9
45.14
0.14
-2.76
GSM8k
5.31
61.89
-1.0
-7.51
S
27.98
0.65
-1.12
90.92
11722
-3.80
Hellaswag
77.20
100.00
5.41
7.36
3.88
2.65
0.23
43.34
0.15
2.18
MMLU
42.13
S
3.20
4.00
0.49
26.45
1.11
-187
STABLELM-2-ZEPEE
ARC
44.80
23.74
5.20
10.17
75.44
-1.43
4.93
56.38
0.32
33.5
GSM8K
51.63
10
48.78
44.34
3.29
5.47
0.54
75.39
1.45
4.92
Hellaswag
72.95
35.74
0.74
3.18
100.00
-7.45
99.3
44.96
0.15
3.67
MMLU
40.29
83.87
1.61
4.45
35.87
0.63
2.16
ST2BLELM-2-I.66
ARC
43.43
B
100.00
26.35
31.68
S
14.90
2.41
2.41
56.10
0.30
33.9
GSM8k
18.88
B
10
16.56
12.95
S
23.94
1.22
1.64
49.96
0.00
2.92
Hellaswag
71.05
100.00
5.16
7.61
S
5.19
4.31
-0.06
31.06
1.02
2.93
MMLU
35.69
29.73
1.25
2234
32.27
-2.0
STABLELM-24
ARC
59.47
99.97
14.01
19.28
S
0.68
4.61
1.59
1.10
3.78
1.12
GSM8k
58.00
0.39
17.92
6.96
11.92
3.10
1.34
17.98
1.85
1.51
Hellaswag
84.45
18.16
0.98
-0.77
S
2.96
2.16
0.25
JSSS
30.69
-.15
MMLU
56.51
77.34
-1.46
-.67
72.72
-0.88
-3.70
36

---

Table 21: Contamination results for STABLELMM--NNSTRUCTTH STABLELM---INSTRICT-IG
benchmark-speciffe S is sample-specific and is syntax-specific contamination. All numbers are reported in percentages.
Model
Benchmark
Perf. [%]
Type
p [%]
å [%]
80.05 [%]
ARC
42.66
29.38
5.53
199.03
70.33
-1.20
-5.11
48.97
0.00
-3.39
GSM8K
42.00
100-
27.79
19.27
26.27
-2667
62.76
0.67
-4.32
Hellaswag
69.60
31.25
1.08
-4.38
S
100.00
5.99
-850
68.68
1.21
5.21
MMLU
38.31
61.21
0.66
1.05
9.37
2.50
0.64
STABLELM-2 2- 2-INSTRUCT--IE 12
ARC
64.25
2.17
26,11
5.20
S
67.88
-1.15
5.28
18.72
-.31
GSM8k
68.84
< 10
32.93
21.09
S
17.74
2.37
-1.6
32.26
0.88
22.11
Hellaswag
86.25
< <10-2
7.04
4.88
S
98.40
33.43
-584
3.32
2.18
0.24
MMLU
55.50
90.13
-2.9
-567
44.42
0.25
2.74
Table 22: Contamination results for FALCON-INSTRUCI-76 FALCON-7b. B is benchmark-speeific S is sample-specific and Y is syntax-specific contamination. All numbers are reported in percentages.
Model
Benchmark
Perf. [%]
Type
[%]
[%]
80.90 [%]
FALCON-7b
ARC
46.84
B
99.96
-8.77
-12.77
S
78.77
-1.23
-3.80
Y
39.48
0.30
-2.10
GSM8k
4.25
95.19
8.40
-15.69
S
89.76
-136
-2.70
Y
79.29
-0.3
-250
Hellaswag
78.50
B
100.00
-4.13
5..7
2.47
2.67
0.44
62.41
0..2
-2.9
MMLU
26.10
S
68.27
- 00.9
-213
Y
16.74
1.35
-1.88
FALCON-INSTRRUCT-2b
ARC
45.05
71.90
1.48
5.71
94.92
3.15
5.90
77.85
1.17
3.64
GSMBk
4.40
B
94.97
- 8.50
- 15.86
S
49.71
0.04
1.47
41.32
-1.33
Hellaswag
69.15
99.80
-4.81
-7.94
S
81.96
-167
-1.77
Y
95.80
-3.33
6623
MMLU
26.30
S
31.59
0.38
1.52
54.78
-0.16
2263
37

---

Table 23: Contamination results for Y1-34b, YI-6b. B is benchmark-speccffic, S is sample-specific and Y is syntax-specific contamination. All numbers are reported in percentages.
Model
Benchmark
Perf. [%]
Type
p [%]
ò [%]]
80.95 [%]
Y1-34b
ARC
63.99
99.86
14.18
20..9
S
0.20
5.00
2.12
16.29
1.58
- -1.06
GSM8k
66.79
95.95
-9.04
-18.47
S
6.10
4.29
-0.30
59.86
-0.52
33885
Hellaswag
86.15
B
0.14
3.96
1.89
10 2
6.51
4.40
4.97
1.75
0.01
MMLU
71.48
S
41.94
0.49
-322
24.43
1.09
1.57
Y1-6b
ARC
54.44
100.00
15.81
20.49
4.82
3.03
0.03
40.58
0.35
2.22
GSM8k
33.59
B
70.57
3.51
11.79
S
28.13
1.35
2250
22.92
1.91
Hellaswag
77.30
51.87
0.10
-2.7
S
8.65
1.94
-0.39
68.03
0.65
-292
MMLU
57.38
42.25
0.40
-3.03
57.89
0.33
-3.2
38

---

NeurIPS Paper Checklist
1. Claims
Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
Justification: We show the effectiveness of our method in $4 and give detailed analysis of the contamination of the model families mentioned in the abstract and introduction.
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No or
NA answer to this question will not be perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings.
is fine to include aspirational goals as motivation as long as is clear that these goals not attained by the paper.
2. Limitations
Question: Does the paper discuss the limitations the work performed by the authors?
Answer:
[Yes]
Justification: In we explicitly discuss the limitations of approach.
Guidelines:
The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.
The authors are encouraged to create a separate "Limitations" section their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g., independence assumptions, noiseless settings, model well-specification, asymptotic approximations only holding locally). The authors should reflect how these assumptions might be violated in practice and what the implications would be.
The authors should reflect on the scope of the claims made, e.g., if the approach was only tested on few datasets or with few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect on the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution is low images are taken in low lighting. Or speech-to-text system might not be used reliably to provide closed captions for online lectures because it fails to handle technical jargon.
The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and fairness.
While the authors might fear that complete honesty about limitations might used by reviewers as grounds for rejection, worse outcome might be that reviewers discover limitations that aren't 't acknowledged judgment and recognize that individual actions in favor of transparency play impor- tant role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations.
the paper. The authors should use their best
3. Theory Assumptions and Proofs
Question: For each theoretical result, does the paper provide the full set of assumptions and complete (and correct) proof?
Answer: [NA]
39

---

Justification:
We do not include any theoretical results in this paper. However, in 3 we do discuss how CONSTAT can be derived from statistical principles.
Guidelines:
The answer NA means that the paper does not include theoretical results.
All the theorems, formulas, and proofs in the paper should be numbered and cross- referenced.
All assumptions should be clearly stated or referenced the statement of any theorems.
The proofs can either appear in the main paper or the supplemental material, but if they appear in the supplemental material, the authors are encouraged to provide short proof sketch provide intuition.
Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix or supplemental material.
Theorems and Lemmas that the proof relies upon should be properly referenced.
4. Experimental Result Reproducibility
Does the paper fully disclose all the information needed to reproduce the main ex- perimental results of the paper to the extent that it affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided or not)?
Question:
Answer: [Yes]
Justification: We provide experimental details and App. and publish the code for reproducing the results.
Guidelines:
The answer NA means that the paper does not include experiments.
If the paper includes experiments, a No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
If the contribution is dataset and/or model, the authors should describe the steps taken make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is novel architecture, describing the architecture fully might suffice, or if the contribution a specific model and empirical evaluation, it may be necessary either make it possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data is often one good way accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g., in the case of large language model), releasing of a model checkpoint, or other means that appropriate to the research performed.
While NeurlPS does not require releasing code, the conference does require all submis- sions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) the contribution is primarily a new algorithm, the paper should make clear how reproduce that algorithm. (b) If the contribution is primarily new model architecture, the paper should describe the architecture clearly and fully.
(c) the contribution is a new model (e.g., a large language model), then there should either be way to access this model for reproducing the results or way to reproduce the model (e.g., with an open-source dataset instructions for how to construct the dataset).
(d) We recognize that reproducibility may be tricky in some cases, in which case authors are welcome deseribe the particular way they provide for reproducibility. In the case of closed-source models, it may be that access to the model is limited in some way (e.g., to registered users), but it should possible for other researchers to have some path to reproducing or verifying the results.
5. Open access to data and code
40

---

Does the paper provide open access to the data and code, with sufficient instruc- tions faithfully reproduce the main experimental results, as described in supplemental material?
Question:
Answer: [Yes]
Justification: We will publish the code to reproduce our results with clear instructions on how to reproduce them. We note that we will not include the synthetically generated benchmarks to avoid further contamination LLMs. However, our code includes instructions on how to generate these benchmarks.
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurlPS code and data submission guidelines (https://nips.cc/ for more details.
While we encourage the release of code and data, we understand that this might not be possible, so "No" is an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for new open-source benchmark).
The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurlPS code and data submission guidelines (https
/ //nips http://bbwccggide/eeeeeeecae/ SonideSSuuiissioooooo ssionPolicy for more details.
The authors should provide instructions on data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc.
The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. only subset of experiments are reproducible, they should state which ones are omitted from the script and why.
At submission time, preserve anonymity, the authors should release anonymized versions (if applicable).
Providing as much information as possible in supplemental material (appended to the paper) recommended, but including URLs to data and code permitted.
6. Experimental Setting/Details
Question: Does the paper specify all the training and test details (e.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?
Answer: [Yes]
Justification: We provide an overview of the experimental setup in $4.1 Further details are provided in App.
Guidelines:
The answer NA means that the paper does not include experiments.
The experimental setting should be presented in the core of the paper to a level of detail that is necessary appreciate the results and make sense of them.
The full details can provided either with the code, appendix, or as supplemental material.
7. Experiment Statistical Significance
Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Question:
Answer: [Yes]
Justification: CONSTAT is statistical test and thus has well-defined statistical significance which always report our experiments.
Guidelines:
The answer NA means that the paper does not include experiments.
The authors should answer "Yes" if the results are accompanied by emoor bars, confi- dence intervals, or statistical significance tests, least for the experiments that support the main claims of the paper.
41

---

The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall run with given experimental conditions).
The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)
The assumptions made should be given (e.g., Normally distributed errors).
It should be clear whether the error bar is the standard deviation or the standard error of the mean.
is OK to report 1-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have 96% CI, if the hypothesis of Normality of errors is not verified.
For asymmetric distributions, the authors should be careful not to show in tables or figures symmetric error bars that would yield results that are out range (e.g. negative еπτог rates).
If error bars are reported in tables or plots, The authors should explain in the text how they were calculated and reference the corresponding figures or tables text.
8. Experiments Compute Resources
For each experiment, does the paper provide sufficient information the com- puter resources (type of compute workers, memory, time of execution) needed to reproduce the experiments?
Question:
Answer: [Yes]
Justification: We give brief explanation of the cost for reproducing our experiments in App. C
Our code also includes details on the computing resources needed.
Guidelines:
The answer NA means that the paper does not include experiments.
The paper should indicate the type of compute workers CPU GPU, internal cluster, or cloud provider, including relevant memory and storage.
The paper should provide the amount of compute required for each of the individual experimental runs well estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary or failed experiments that didn't make into the paper).
9. Code Of Ethics
Question: Does the research conducted in the paper conform, in every respect, with the NeurIPS Code of Ethics
http://wwwwereee.pppeeettttttett lines]
Answer: [Yes]
Justification: We confirm that all authors have read and understood the NeurIPS Code of Ethics and that the research conducted in this paper conforms to
Guidelines:
The answer NA means that the authors have reviewed the NeurIPS Code of Ethics.
If the authors answer No, they should explain the special circumstances that require deviation from the Code of Ethics.
The authors should make to preserve anonymity (e.g., s if there is special consid- eration due to laws or regulations in their jurisdiction).
10. Broader Impacts
Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?
Answer: [Yes]
Justification:
We discuss the impact of this work a separate paragraph in $
Guidelines:
The answer NA means that there is no societal impact of the work performed.
42

---

If the authors answer NA or No, they should explain why their work has no societal impact or why the paper does not address societal impact.
Examples of negative societal impacts include potential malicious or unintended uses (e.g., disinformation, generating fake profiles, surveillance), faimess considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
The conference expects that many papers will be foundational research and tied to particular applications, let alone deployments. However, if there is direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used intended and functioning correctly, harms that could arise when the technology is being used as intended but gives incorrect results, and harms following from (intentional unintentional) misuse of the technology.
If there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms to monitor how system learns from feedback over time, improving the efficiency and accessibility of ML).
11. Safeguards
Does the paper describe safeguards that have been put in place for responsible release of data models that have high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?
Question:
Answer: [NA]
Justification: None of the data or models released in this paper pose high risk for misuse.
Guidelines:
The answer NA means that the paper poses such risks.
Released models that have high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere usage guidelines or restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards challenging, and many papers do not require this, but encourage authors to take this into account and make best. faith effort.
12. Licenses for existing assets
Question: Are the creators or original owners of assets (e.g., code, data, models), used in the paper. properly credited and are the license and terms of use explicitly mentioned and properly respected?
Answer: [Yes]
Justification: We provide the necessary licenses and terms of use in App. D We obliged by all these licenses.
Guidelines:
The answer NA means that the paper does existing assets.
The authors should cite the original paper that produced the code package or dataset.
The authors should state which version of the asset used and, possible, include a URL.
The name of the license (e.g., CC-BY 4.0) should be included for each asset.
For scraped data from a particular source (e.g., website), the copyright and terms of service of that source should be provided.
43

---

If assets are released, the license, copyright information, and terms of use in the package should be provided. For popular datasets, paper rnperswiten thcode com/datasets has curated licenses for some datasets. Their licensing guide can help determine the license of dataset.
For existing datasets that are re-packaged, both the original license and the license of the derived asset (if has changed) should be provided.
If this information not available online, the authors are encouraged to reach out to the asset's s creators.
13. New Assets
Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer: [Yes]
Justification: We release code with Apache-2.0 License. We provide README file with instructions on how to use our code and generate the benchmarks.
Guidelines:
The answer NA means that the paper does not release new assets.
Researchers should communicate the details the dataset/code/model as part of their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent was obtained from people whose asset used.
At submission time, remember to anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.
14. Crowdsourcing and Research with Human Subjects
Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well details about compensation (if any)?
Answer: [NA]
Justification: We do not include crowdsourcing experiments or research with human subjects in this paper.
Guidelines:
The answer NA means that the paper does involve crowdsourcing nor research with human subjects.
Including this information in the supplemental material is fine, but if the main contribu- tion of the paper involves human subjects, then as much detail as possible should be included in the main paper.
According the NeurIPS Code of Ethics, workers involved in data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.
15. Institutional Review Board (IRB) Approvals or Equivalent for Research with Human Subjects
Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or an equivalent approval/review based on the requirements of your country or institution) were obtained?
Answer: [NA]
Justification: We do not include crowdsoureing experiments research with human subjects in this paper.
Guidelines:
The answer NA means that the paper does not involve crowdsoureing nor research with human subjects.
44

---

Depending on the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors to adhere to the NeurIPS Code of Ethics and the guidelines for their institution.
For initial submissions, do not include any information that would break anonymity (if applicable), such as the institution conducting the review.
45


Reviews:
[{"review_id": "pYEcCojMv2", "reviewer": "Reviewer_xz9Q", "summary": "The paper introduces a new performance-based definition of data contamination, shifting the focus from the cause of contamination to its effect on performance. The paper also presents ConStat, a statistical method that detects and quantifies contamination by comparing performance on primary and reference benchmarks using a set of reference models. The effectiveness of ConStat is demonstrated through extensive evaluations on diverse model architectures, benchmarks, and contamination scenarios, revealing significant contamination in several popular models.", "questions": "See the weaknesses above.", "limitations": "Yes, the authors included a limitations sections.", "rating": 5, "confidence": 4, "soundness": 3, "presentation": 2, "contribution": 3, "strengths": "1. The motivation for proposing new definition of contamination is clear and easy to understand.\n2. The experiments are extensive to demonstrate the effectiveness of the proposed method. It shows that ConStat can outperform the previous methods on contamination detection and is effective for contamination quantification.\n3. The paper extends the analysis to the current model families to show that these models are contaminated in different degrees for current benchmarks. And the observation basically matches other papers' findings, suggesting that these methods can be potentially used for contamination examination of LLMs in the future applications.", "weaknesses": "1. The assumptions in the paper are too strong for me. I don't think the difference of performance in different benchmarks means that there would be contamination. The abnormal high performance in one dataset but normal performance in other benchmarks only imply higher possibility of contamination.\n2. On line 152, the authors mentioned \"additionally include an inherently uncontaminated random-guessing model\". I wonder if more details could be provided about this.\n3. I think the descriptions and writings in the methodology section should be re-written to provide more details and motivations for how the method is developed. The current version is somewhat hard to follow and lacks explanations.\n4. Missing citations to many recent works. E.g., https://arxiv.org/abs/2311.04850 (Yang et al.), https://arxiv.org/abs/2401.06059 (Jiang et al.), etc.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We thank the reviewer for their detailed review and insightful questions. We are pleased to hear that they appreciate the extensive experiments and find the new definition clear and easy to understand. Below, we address their questions.\n\n**Does an abnormally high performance on your reference benchmark always imply information-flow based contamination on the actual benchmark?**  \nPlease see our detailed answer in the main response.\n\n**What is the random-guessing model that you add to the set of reference models?**  \nThe random-guessing model randomly guesses the answer to a query. It serves as an equivalent to including a very poor model in the reference set (e.g., gpt2-small). For open-form questions, this model's answers are always incorrect, resulting in 0% accuracy. For multiple-choice questions, it has a 1/k probability of being correct, where k is the number of options. Adding this model regularizes the hardness correction function's fit, ensuring it remains valid outside the score range of the other reference models. Figure 3f in Appendix B illustrates the impact of excluding the random-guessing model: without it, the hardness correction function overfits the reference models and fails to detect contamination accurately for weaker models. Including the random-guessing model prevents this issue.\n\n**Could you provide more details on the motivation for how the method is developed?**  \nCertainly! In the methodology section, our goal is to develop a method that compares model performance across two related benchmarks and detect significant performance differences. Ideally, we would want to compute the performance of the model on both benchmarks and directly compare these results. We would like to conclude it is contaminated if the model scores high on one benchmark, but poorly on another. However, this straightforward approach is problematic because benchmarks often vary in difficulty, making direct performance comparisons unreliable. To address this, we introduce the hardness correction function, which maps performance from one benchmark to the corresponding expected performance on the other. This adjustment allows for performance comparisons, corrected for benchmark difficulty. The other parts of the section describe how to transform this method into a statistical test to calculate p-values for contamination.\nWe note that all other reviewers found our paper well-written, with some even describing it as a joy to read. Thus, we believe our paper's structure and explanations are clear and precise. However, if the reviewer has further questions, we are more than happy to provide additional clarification.\n\n**Why have you not included citations to some recent works like Yang et al. and Jiang et al.?**  \nPlease see our detailed answer in the main response.\n\n\n\nWe hope our answers address all of the reviewer’s concerns, remain happy to answer any further questions, and look forward to the reviewer’s response.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "nCKOUBoVNu", "reviewer": "Reviewer_E2e6", "summary": "This paper targets the problem of contamination detection of LLMs by proposing ConStat, a performance-based statistical approach. \n- Instead of detecting the inclusion of test samples as contamination, the authors define interpretation as \"abnormal\" performance on benchmarks.\n- ConStat builds on this definition, and leverages reference models and synthetic benchmarks for statistical testing at syntax-, sample-, and benchmark-specific levels.\n- ConStat is empirically verified as effective. The authors also provide comprehensive analyses.", "questions": "- According to lines 1118-1120, it seems that the authors only used 1000 samples for fine-tuning. How is this number determined and will the number of chosen samples affect the performance? if so, how?\n- The above question applies to the number of synthetic data samples.", "limitations": "The authors offered a limitation paragraph in Section 6.", "rating": 6, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 2, "strengths": "- The definition of contamination from a performance-based perspective is novel and interesting to my knowledge.\n- Based on the definition, the proposed ConStat is intuitive and looks effective based on experiments. The experiments and analyses are comprehensive and solid.\n- Contamination detection is timely and important in the current community.\n- The paper is well-written and a joy to read.", "weaknesses": "- As the paper discussed in Section 6, it can only estimate the contamination relative to reference models. \n- It would be a little costly to construct a synthetic dataset using close-sourced LLMs each time we want to detect contamination of a specific benchmark.\n- This paper lacks some related works that need to be discussed. I just list a few below.\n\n[1] Yang, Shuo, et al. \"Rethinking benchmark and contamination for language models with rephrased samples.\" arXiv preprint arXiv:2311.04850 (2023).\n\n[2] Jiang, Minhao, et al. \"Investigating data contamination for pre-training language models.\" arXiv preprint arXiv:2401.06059 (2024).", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We thank the reviewer for their detailed review and insightful questions. We are happy to hear that they find our paper a joy to read, our definition novel and interesting, and our experiments comprehensive and solid. Below, we address their questions.\n\n**Is measuring contamination relative to a set of reference models sufficient for contamination detection?**  \nPlease see our detailed answer in the main response.\n\n**Do we need to construct a synthetic dataset each time we want to measure contamination? If so, is this expensive?**  \nNo, we do not need to generate a new synthetic dataset each time we measure contamination. As long as our synthetic datasets remain private, they can be reused for future models. Of course, we will share these datasets with other interested parties if requested.\n\nA contamination analysis on other benchmarks would require us to create a new synthetic dataset. However, the cost of generating these datasets is relatively low compared to the total inference cost of model evaluation. Specifically, generating the synthetic dataset was only around five times as expensive as a single model evaluation. Since we evaluate 50 models on all benchmarks, the total cost of generating the synthetic dataset is much lower than the total inference cost of model evaluation. Finally, specifically for rephrasing, this task can be performed by cheaper open-weight models, further reducing costs.\n\n**Why have you not included citations to some recent works like Yang et al. and Jiang et al.?**  \nPlease see our detailed answer in the main response.\n\n**How does the number of samples in the synthetic dataset affect ConStat’s performance?**  \nWe choose the number of synthetic samples based on the trade-off between tight confidence bounds and computational budget. Computational complexity increases linearly with the number of samples, while the size of confidence intervals decreases. We found that 1000 samples provide tight confidence bounds and allow us to evaluate over 50 models within our budget. \n\n**Similarly, how does the number of samples used for fine-tuning affect results?**  \nWe again chose the number of samples used for fine-tuning in our ablation study and for comparison to other methods based on the trade-off between tight confidence bounds and computational complexity. While using more samples (a larger portion of the dataset) would yield tighter confidence bounds, it would also increase the cost of finetuning.\n\nWe hope our answers address all of the reviewer’s concerns, remain happy to answer any further questions, and look forward to the reviewer’s response.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "m7jy6yxDx2", "reviewer": "Reviewer_tnxc", "summary": "The authors introduce a definition for “contamination” based on its outcome rather than its cause, unlike many previous approaches. The authors propose ConStat, a novel method for quantifying the contamination of a model on some benchmark and demonstrate that it outperforms other methodologies for detecting contamination.", "questions": "1. Why did the authors not select a reference benchmark for MMLU?\n2. Do the authors believe this methodology will work well when the measured task between the benchmark and reference benchmark is similar (e.g. coding) but the \"form\" between the benchmark and reference benchmark is significantly different, for example, multiple choice question answering evaluation vs. open-ended agentic evaluation?\n3. What further research are the authors excited to see in this area? Are the authors planning on discussing this within the paper?", "limitations": "The authors sufficiently address this.", "rating": 8, "confidence": 3, "soundness": 3, "presentation": 4, "contribution": 4, "strengths": "- This paper was a pleasure to read. It is both written and structured in a clear way that communicates the ideas well\n- The authors used ConStat to show strong contamination of some models from the Open LLM Leaderboard on specific benchmarks. This research can be used to build trust in our evaluations", "weaknesses": "The authors generated a synthetic version of each benchmark they used in their experiments. They described their methodology for doing so in Appendix C. I don’t believe the authors used a sufficiently rigorous method to ensure this generated dataset was sufficiently high-quality. For example, it is possible that some of their samples did not have a high 1-gram overlap but did ask similar questions. I believe a manual review of a subset of the dataset for duplication, and perhaps other traits, would be necessary to guarantee data quality. Though I view this as a minor weakness given that their methodology was successful despite potential problems with this dataset.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We thank the reviewer for their detailed review and insightful questions. We are happy to hear that they found our paper a pleasure to read and that our research can be used to build trust in our evaluations. Below, we address their questions.\n\n**How did you ensure that the generated dataset had a sufficiently high quality? Is the deduplication process using 1-grams sufficient?**    \nTo ensure high data quality for rephrasing and synthetic sample generation, we performed the following procedure:\n- We manually tested around 10 samples for each benchmark with various system prompts, iteratively refining the prompts until we were satisfied with the output quality.\n- We performed a manual check of approximately 100 samples for each benchmark to identify common mistakes and evaluate overall data quality. This process revealed issues such as non-integer answers in some GSM8k samples, which were therefore excluded.\n- For deduplication, we computed the highest 1-gram overlaps between synthetic samples and manually reviewed around 50 samples to set an appropriate exclusion threshold. We used a similar method to ensure no synthetic samples were present in the original test set.\n\nIt is important to note that low-quality synthetic data would not significantly impact ConStat’s predictions. For instance, a sample with an incorrect label would be consistently answered incorrectly by all models. The hardness correction function would adjust for this automatically, ensuring contamination prediction remains unaffected. \n\nFurthermore, the inclusion of test set samples in the synthetic data set would also only reduce the effectiveness of ConStat: these samples would reduce the estimated performance difference and therefore make ConStat’s estimates less accurate. The fact that our estimates are quite accurate, suggests that our approach was sufficient to prevent inclusion of test set samples in our synthetic data.\n\n**Why did the authors not select a reference benchmark for MMLU to measure benchmark-specific contamination?**  \nMMLU is a broad benchmark designed to evaluate knowledge across diverse tasks. Benchmark-specific contamination detection requires a reference benchmark closely aligned with the target benchmark’s task. We could not find a sufficiently similar benchmark to MMLU, and including a dissimilar benchmark might lead to false positives. Therefore, we chose not to include benchmark-specific contamination detection for MMLU to maintain the accuracy of our analysis.\n\n**Do you expect your approach for measuring benchmark-specific contamination to work well when the reference benchmark uses a significantly different form than the original benchmark (e.g. multiple-choice instead of completion)?**  \nThe reviewer is correct to point out that an analysis would need to take this difference into account. For example, GSM8k (free-form) and MathQA (multiple-choice) are included in our experiments. We found that the Phi model family performed particularly badly on the MathQA dataset. This is likely due to the focus of the authors on textbook datasets during training. We believe the chain-of-thought capabilities of these models greatly increased because of this, but their ability to perform single-step mathematical computations, as required for MathQA, does not. This explains the very large discrepancy in performance between the two benchmarks. Therefore, conclusions here might not be indicative of information-flow-based contamination but do bring up a flaw in the model, i.e., its inability to perform well on mathematical operations without chain-of-thought reasoning.\n\n**What further research are the authors excited to see in this area? Are the authors planning on discussing this within the paper?**  \nThere are several exciting areas in data contamination that would benefit greatly from future research:\n- **Improving Information-Flow Based Contamination Detection**: Our method currently outperforms this traditional approach, but advancements here could provide more detailed contamination insights. For example, detecting specific contaminated samples could have applications in identifying the use of copyrighted materials.\n- **Extending ConStat to Multimodal Models**: Applying our approach to multimodal models, such as those involving images, would be valuable. Synthetic sample generation for complex data types like tabular images presents unique challenges, but overcoming these would increase the applicability of contamination detection.\nUnfortunately, due to space constraints, we did not discuss these topics in the NeurIPS submission. We will therefore not include it.\n\nWe hope our answers address all of the reviewer’s concerns, remain happy to answer any further questions, and look forward to the reviewer’s response.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "g8FSBykQIg", "reviewer": "Reviewer_hKkW", "summary": "The paper proposes a performance-based approach to detect data contamination in large language models. First, a set of reference models is evaluated on the original benchmark and a proxy of it. Next, a difficulty correction function is fitted to find the relationship between the performance from the original benchmark and the proxy benchmark. Then, the performance of a target model is evaluated on the proxy benchmark, and using the correction function, the expected performance on the original benchmark is predicted. Lastly, the difference between the actual performance on the original benchmark and the expected performance is computed and checked for significance to label the target model as contaminated.", "questions": "**Question:**\n1. In Table 1, what is the difference between \"Shi et al. [40]\" and \"Shi [39]\"?\n\n**Comment:**\n1. Lines 11-14 and 343-345: Your method does not quantify/measure contamination.", "limitations": "1. The outcomes cannot be interpreted individually. Specifically, detection heavily depends on the reference models and how they generalize/behave. This means that better generalization or steerability in models can be mistaken for contamination. Also, if the reference models are contaminated, this contamination can spread to the target models and go undetected.\n2. The proposed method does not detect contamination, as none of the scenarios studied in Section 2.2 involve contamination. Instead, the method captures the lack of generalization or situations with excessive memorization.", "rating": 5, "confidence": 4, "soundness": 2, "presentation": 4, "contribution": 2, "strengths": "1. The paper is well-written.\n2. The experiments are comprehensive.\n3. The proposed method can be used with both open-weight and closed-weight models, which is important.", "weaknesses": "1. The main weakness of the proposed method is that it identifies data contamination based on changes in performance. Performance can change for several reasons, so it cannot be solely the indicator of contamination. In fact, the method assumes that any performance increase means contamination, leading to a high rate of false positives in situations where performance improvements come from other sources. For example, this method incorrectly detects contamination when performance improves due to unsupervised domain adaptation while it is not.\n\n2. This method can only be applied to models that are similar to the reference models, especially in terms of size, architecture, and pre-training data, as it detects contamination with respect to these reference models. This limits its generality and makes it unsuitable for models that differ from the reference set. For example, if a target model just generalizes better than the reference models, the method incorrectly identifies this as contamination. Conversely, a contaminated model can be deemed uncontaminated if it cannot translate the contamination into improved performance, e.g., when a model is contaminated with a dataset but cannot follow instructions very well. Therefore, the proposed method measures the lack of generalization relative to the reference models rather than actual contamination. In short, this method does not guarantee whether a model has seen the datasets or not.\n\n3. Building on the previous comment, this method does not actually measure contamination; it captures situations where excessive memorization has replaced generalization. In fact, the scenarios discussed in Section 2.2 **are not types of contamination**. Instead, they are examples of excessive memorization, which the method captures.\n \n4. The results of the proposed method are relative, not absolute. In this method, detection is only meaningful when compared to the reference models. So, if the reference models are contaminated, the target model will still appear uncontaminated.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We thank the reviewer for their detailed review and insightful questions. We are pleased to hear that they found our paper well-written, our experiments comprehensive, and the applicability of our method to closed-source models interesting. Below, we address their questions.\n\n**Should contamination be viewed from a perspective of performance generalization?**  \nYes, we argue that information-flow-based contamination can be viewed from this perspective for two main reasons. \n\nFirst, in benchmark evaluation, the only relevant consequence of information-flow-based contamination is an artificial increase in performance on benchmarks. Although there are other areas of influence, such as detecting the use of copyrighted data, our focus lies specifically on its effect on performance measurements. Given the large datasets involved in training LLMs, some level of information-flow-based contamination is almost inevitable. Therefore, any model can be said to show some level of information-flow-based contamination. Thus, a detailed contamination report that includes its effect on benchmark performance is more interesting and easily obtainable using ConStat. \n\nSecond, syntax- and sample-specific contamination imply information-flow-based contamination. As we argue in Q1 of our main reply, a model showing syntax- or sample-specific contamination can distinguish between two benchmarks drawn from the same or a very similar distribution. This is only possible if one of these benchmarks was seen during training. Otherwise, the model should treat the two benchmarks identically, resulting in similar performance on both.\n\n**Is it possible that performance changes for reasons other than information-flow-based contamination?**  \nPlease see our detailed answer in the main response.\n\n**Can the method only be applied to models that are similar to the reference models?**  \nNo, **none** of our experiments rely on this assumption. Our reference models encompass a range of architectures, sizes, and pre-training data. Therefore, our results demonstrating the accurate detection and estimation of performance-based contamination in Section 4.2 do not rely on similarity assumptions. This robustness also allows us to detect contamination in various model architectures and sizes in Section 4.3 and reproduce contamination results from some model providers without access to their training data.\n\n**What kind of contamination does the method measure? Does it measure excessive memorization rather than contamination?**  \nYes, our method redefines contamination based on its influence on performance, which can also be seen as excessive memorization. As argued above and in the paper, this is a key effect of information-flow-based contamination, and the only aspect worth measuring for the purpose of benchmark integrity. While ConStat might miss information-flow-based contamination that does not affect performance, this is by design, as such contamination has no practical consequences on benchmark integrity.\n\n**Would the method incorrectly detect contamination when the target model’s performance generalizes worse than the reference models due to reasons other than contamination?**  \nFor uncontaminated models, this should only occur when detecting benchmark-specific contamination. As previously argued, syntax- and sample-specific contamination imply information-flow-based contamination. Therefore, the absence of information-flow-based contamination also implies the absence of syntax- or sample-specific contamination. We acknowledge other factors influencing benchmark-specific contamination in the paper and are cautious in our conclusions about this type. However, measuring this contamination is important. If a model excels on specific benchmarks but performs poorly on others for the same task, it indicates problematic behavior. While this might not be information-flow based contamination, it may result from a focus on a subset of the task during training because of a drive to perform well on a specific benchmark. Benchmark-specific contamination can reveal this issue and indicate how representative reported scores are with regard to overall task performance.\n\n**Is measuring contamination relative to a set of reference models sufficient for contamination detection?**  \nPlease see our detailed answer in the main response.\n\n**In Table 1, what is the difference between \"Shi et al. [40]\" and \"Shi [39]\"?**  \nThese are two different methods by the same authors. Shi et al. [40], known as TopKMin, measure the perplexity of each token in the answer, retain the k% tokens with the highest perplexities, and average these to obtain a contamination measure. In contrast, Shi [39] generates 30 alternative completions of the first half of each question in the benchmark using an uncontaminated base model. It then measures the perplexities of these completions with the target model, and contamination is detected by the percentile of the actual answer's perplexity among these completions. If this percentile is consistently low, the model is deemed contaminated.\n\nWe hope our answers address all of the reviewer’s concerns, remain happy to answer any further questions, and look forward to the reviewer’s response.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "pGiTloSBvD", "reviewer": "Reviewer_UkYs", "summary": "Authors propose a new definition of contamination: \"artificially inflated and non-generalizing benchmark performance\" rather than \"the inclusion of benchmark samples in the training data\". They develop ConStat, a statistical method that reliably detects and quantifies contamination by comparing performance between a primary and reference benchmark relative to a set of reference models.  They demonstrate the effectiveness of ConStat through an evaluation of diverse model architectures, benchmarks, and contamination scenarios, and find high levels of contamination in multiple popular models.", "questions": "•\tThere is a short paragraph explaining results on benchmark-specific contamination, could authors elaborate more? How does it compare to other methods?\n\n•\tSome statements need clarification, e.g.\n“MathQA is a multiple-choice benchmark that requires the model  to answer immediately and therefore gives no room for this reasoning ability to shine.” ->•\tThere is a section on exposing the limitations. Maybe authors could further comment on the limitation of experiments due to computational complexity. what does it mean that requires the model to answer immediately? Could authors further support “no room for this reasoning ability to shine”", "limitations": "•\tThere is a section on exposing the limitations. Maybe authors could further comment on the limitation of experiments due to computational complexity.", "rating": 6, "confidence": 3, "soundness": 2, "presentation": 2, "contribution": 2, "strengths": "•\tA new method to detect benchmark contamination from a new perspective\n\n•\tGreat performance on syntax and sample-specific contaminated models\n\n•\tGood motivation, presentation and organisation", "weaknesses": "•\tThe paper uses reference datasets that are synthetically composed, authors briefly comment on this in the limitations. More ellaboration on this is need it since it is one of the basis of the experiments. Authors could potentially estimate by human analysis what is the expected error on their approach.\n\n•\tBenchmark-specific contamination is complex and it is not covered with enough in-depth.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We thank the reviewer for their detailed review and insightful questions. We are happy to hear that they found our motivation, presentation, and organization very good, and the performance of our method great. Below, we address their questions.\n\n**Could you elaborate more on the effect of the synthetic nature of the synthetic data on your approach?**  \nWe first note that the low quality of the synthetic datasets would not significantly affect the predictions made by ConStat. For instance, the inclusion of a sample with an incorrect label would lead to incorrect answers by all models. The hardness correction function would adjust for this incorrectness automatically, without affecting the contamination prediction.\n\nFurthermore, we performed extensive manual checks to ensure high data quality and fidelity of the synthetic data. Specifically, we followed this procedure:\n- We first manually tested around 10 samples for each benchmark with several system prompts and checked the output quality of the model. We adjusted the prompts until we were satisfied with the quality of these 10 samples.\n- We then conducted a manual check of around 100 samples for each benchmark to identify common mistakes and ensure overall data quality. This process helped us detect and exclude some synthetic samples in the GSM8k dataset that did not have integer answers.\n- We performed deduplication by computing the samples with the highest 1-gram overlap for each synthetic sample. We manually checked around 50 samples and their 1-gram overlaps to set the threshold for excluding a sample. We used a similar approach to check whether a synthetic sample was included in the original test set.\n\n**Could you elaborate more on benchmark-specific contamination? How does it compare to other methods?**  \nBenchmark-specific contamination is the most generic and least problematic type of contamination. As we explain in Section 2.2, it occurs when a model fails to generalize to benchmarks that measure performance on the same task as the original benchmark. This implies that a model is only effective on specific questions or formats in the original benchmarks. Users should be cautious when applying this model to real-world scenarios, as its performance may not be consistent across the entire task.\n\nHowever, we note that this inconsistency can arise for reasons other than information-flow-based contamination. For instance, a focus during training on the particular type of questions in the original benchmark can cause benchmark-specific contamination. We acknowledge this in the paper and are careful in drawing major conclusions from this type of contamination. We will clarify this point in the paper to ensure that readers understand the necessary caution in interpreting results regarding benchmark-specific contamination and the conclusions that can be drawn from it.\n\n**Could you clarify the statement “MathQA is a multiple-choice benchmark that requires the model to answer immediately and therefore gives no room for this reasoning ability to shine.”?**  \nThis statement refers to our use of the LM Evaluation Harness, a popular framework for language model evaluation. The LM Evaluation Harness implements MathQA as a multiple-choice benchmark, where the framework measures the perplexity of the answer options and selects the option with the lowest perplexity. In contrast, for GSM8k, the framework extracts the answer from a free-form response created by the language model. We believe the Phi model family performs better in free-form evaluations than in multiple-choice evaluations, leading to the conclusion in the statement. This distinction is unrelated to computational complexity since we would have evaluated MathQA using free-form answers if the LM Evaluation Harness implemented the benchmark like this.\n\n**Could you comment on the computational complexity of your method, e.g., in the context of the prior statement?**  \nAs explained above, the computational complexity is not related to the multiple-choice evaluation of MathQA. However, ConStat does require evaluating several models on multiple benchmarks, which entails some computational complexity. Despite this, the total cost of our entire evaluation, amounting to a couple of thousand dollars, is negligible compared to the cost of training a model and serving it via an inference API. Therefore, we believe this does not pose a serious limitation, as our method can be applied by any organization with reasonable funds.\n\nWe hope our answers address all of the reviewer’s concerns, remain happy to answer any further questions, and look forward to the reviewer’s response.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:
$\newcommand{R}{\textcolor{green}{E2e6}}$ $\newcommand{S}{\textcolor{blue}{tnxc}}$ $\newcommand{T}{\textcolor{purple}{hKkW}}$ $\newcommand{X}{\textcolor{red}{UkYs}}$ $\newcommand{Y}{\textcolor{brown}{xz9Q}}$ 

We thank the reviewers for their detailed reviews and insightful questions. We are pleased to hear that they found our paper well-written ($\R,\S,\T,\X$), our new definition of contamination novel and interesting ($\Y,\R,\X$), and our experiments comprehensive and solid ($\Y,\R,\S,\T$). We identified several questions shared among reviewers that we address here. Reviewer-specific questions are answered in the respective responses.


**1. Does an abnormally high performance on your reference benchmark always imply information-flow based contamination on the actual benchmark? ($\Y,\T$)**  
Yes, we argue that in the case of syntax- and sample-specific contamination, an abnormally high performance always implies information-flow based contamination. 

To demonstrate this, let us first assume that our synthetic benchmarks are drawn from the same distribution as the original benchmark. A non-contaminated model should achieve a similar performance on both benchmarks. Indeed, if the model obtains a much higher score on one benchmark, we could distinguish between samples from the synthetic and original benchmark with non-random probability, contradicting the assumption that samples are drawn from the same distribution. Therefore, a model that shows abnormally high performance on one of the benchmarks has to be contaminated with that benchmark. 

Our synthetic datasets are designed to closely approximate the original benchmark distribution. Figure 2 shows that this approximation is highly accurate, as we can predict the exact performance difference between the original benchmark and another benchmark known to be drawn from the same distribution. Hence, syntax- and sample-specific contamination imply information-flow-based contamination.

In contrast, for benchmark-specific contamination, the reviewers are correct to point out that differences in performance do not always indicate information-flow based contamination. We acknowledge this in our paper and draw more cautious conclusions regarding this type of contamination. However, measuring benchmark-specific contamination remains important. Common practice often involves evaluating performance on only one or two benchmarks for a specific task, such as mathematics or coding. If a model excels on these benchmarks but performs poorly on others measuring the same task, we argue that this indicates problematic behavior. While this might not be information-flow-based contamination, it may result from a focus on a subset of the task during training because of a drive to perform well on a specific benchmark. Benchmark-specific contamination can reveal this issue and indicate how representative reported scores are with regard to overall task performance.


**2. Why have you not included citations to some recent works like Yang et al. and Jiang et al.? ($\Y,\R$)**  
The papers mentioned are part of a large subfield in contamination detection for LLMs that assumes access to training data. This subfield analyzes contamination and develops efficient algorithms to detect benchmark samples in the extensive training datasets of current LLMs. However, these works strongly assume access to training data. This makes them only relevant for model providers since training data is rarely shared, even for open-weight models. In contrast, ConStat does not make this assumption. Furthermore, these works rely on additional assumptions about the training data to measure the influence of the contamination on performance. For instance, they cannot determine the contamination's impact on performance if all benchmark samples are included in the training data.

We were aware of this research, including both works, but did not discuss it due to its strong assumptions and inability to quantify contamination. Since two reviewers highlighted these works, we will update the paper to discuss them in our Related Work section, highlighting that they require access to the training data while ConStat does not.


**3. Is measuring contamination relative to a set of reference models sufficient for contamination detection? ($\R,\T$)**  
Yes, as the primary goal of benchmarking is to compare the performance of different approaches/models accurately. Using these results for model selection and to track progress in the field only requires a relative performance measurement. For instance, a 5% performance increase across all models due to contamination will leave the model rankings untouched. Accurate absolute performance estimates primarily enable comparisons with a golden standard, such as human performance. While valuable, this is not the main goal of benchmarks, as can be seen by the fact that human performances are mostly ignored and are sometimes not even known. Thus, we argue that relative contamination measurement is almost as valuable as absolute measurement and worth pursuing.

Meta-review: The paper proposes ConStat, a statistical method for detecting and quantifying contamination in large language models by comparing performance between a primary benchmark and a reference benchmark relative to a set of reference models. 

The paper contributes: a new performance-based definition of contamination as "artificially inflated and non-generalizing benchmark performance" rather than just the inclusion of benchmark samples in training data; a novel method that can detect contamination in both open and closed-source models without access to training data. The paper also performs extensive evaluation demonstrating ConStat's effectiveness across diverse model architectures, benchmarks, and contamination scenarios. The paper finds high levels of contamination in several popular models like Mistral, Llama, Yi, and top Open LLM Leaderboard models.

**Strengths**: Novel performance-based approach to contamination detection; comprehensive experiments demonstrating effectiveness, especially for syntax and sample-specific contamination; generalization to both open and closed-source models.

**Weaknesses**: reliance on synthetic reference datasets, which may introduce errors; limited analysis of benchmark-specific contamination; arguably, the method detects performance differences rather than direct contamination, which could lead to false positives in some cases; the method only provides results that are relative to reference models, not absolute measures of contamination.

Overall, this is a solid paper with novel ideas and good empirical results.
Decision: Accept (poster)