Generalization or Memorization: Data Contamination and Trustworthy Evaluation for Large Language Models (2024)

Abstract: Recent statements about the impressive capabilities of large language models (LLMs) are usually supported by evaluating on open-access benchmarks. Considering the vast size and wide-ranging sources of LLMs’ training data, it could explicitly or implicitly include test data, leading to LLMs being more susceptible to data contamination. However, due to the opacity of training data, the black-box access of models, and the rapid growth of synthetic training data, detecting and mitigating data contamination for LLMs faces significant challenges. In this paper, we propose CDD, which stands for Contamination Detection via output Distribution for LLMs. CDD necessitates only the sampled texts to detect data contamination, by identifying the peakedness of LLM’s output distribution. To mitigate the impact of data contamination in evaluation, we also present TED: Trustworthy Evaluation via output Distribution, based on the correction of LLM’s output distribution. To facilitate this study, we introduce two benchmarks, i.e., DETCON and COMIEVAL, for data contamination detection and contamination mitigation evaluation tasks. Extensive experimental results show that CDD achieves the average relative improvements of 21.8%-30.2% over other contamination detection approaches in terms of Accuracy, F1 Score, and AUC metrics, and can effectively detect implicit contamination. TED substantially mitigates performance improvements up to 66.9% attributed to data contamination across various contamination setups. In realworld applications, we reveal that ChatGPT exhibits a high potential to suffer from data contamination on HumanEval benchmark.1

heading: 1 Introduction
text: In recent years, LLMs have revolutionized the fields of natural language processing (NLP), artificial intelligence, and software engineering. To
*Corresponding author. 1https://github.com/YihongDong/CDD-TED4LLMs
evaluate LLMs’ capabilities in various downstream tasks, such as automatic question answering, natural language reasoning, and code generation, people conduct extensive tests for LLMs based on enormous benchmark datasets (Chen et al., 2021; Cobbe et al., 2021). The results indicate that LLMs exhibit superior performance on these tasks. While marveling at the powerful capabilities of LLMs, people usually want to determine whether an LLM’s excellent performance is due to the genuine understanding of tasks to achieve generalization, or merely because it has seen the test data to form memorization, i.e., suffering from data contamination.
Data contamination, also known as data leakage, refers to the scenario where the test data has been included in the model’s training data (Magar et al., 2022; Dickson, 2023), leading to the model performing exceptionally well on these leaked test data. Owing to the vast size and wide-ranging sources of the pre-trained datasets for LLMs, they are more susceptible to data contamination, which can be primarily categorized into two situations:
1 12039
1) For existing benchmark datasets, they are more easily leaked because of massive text quotes, code reuse, and synthetic data in LLMs’ training data. 2) For upcoming benchmark datasets, newly constructed test data may already exist in the continuously evolving training data of LLMs since people are usually unaware of the specifics of LLMs’ training data. Consequently, it becomes formidable to prevent data contamination for LLMs.
Data contamination exerts a profound and deleterious impact on LLMs (Zhou et al., 2023; Jacovi et al., 2023; Roberts et al., 2023). As shown in Figure 1, with LLMs continuing to learn on contaminated data (i.e., both leaked data and other training data), their performance keeps improving on leaked data but stagnates and even degrades on similar data. This example reflect that data contamination can lead to a substantial overestimation of models’ performance, thus affecting the trustworthiness and effectiveness of LLMs in practical applications. Furthermore, data contamination may also conceal the potential flaws of models, presenting major obstacles for people to identify and improve upon LLMs’ shortcomings. Therefore, it is crucial for LLMs to detect data contamination and ensure trustworthy evaluation.
Although acknowledged the significance, data contamination detection and trustworthy evaluation for LLMs still persist as open and challenging issues (Yang et al., 2023; Huang et al., 2023). The difficulties of data contamination detection can be essentially attributed to three factors: 1) Opaque Training Data. It is usually non-public and comprehensive, while continuously evolving for new LLMs. 2) Black Box Models. The parameters and output probabilities of LLMs may not be available, such as ChatGPT and GPT-4 (OpenAI, 2023). 3) Proliferation of Synthetic Data. It could implicitly introduce the variants2 of test data to training data. Further, the evaluation to mitigate the impact of data contamination has hardly been studied.
In this paper, we overcome the preceding challenges by proposing CDD: Contamination Detection via output Distribution for LLMs. CDD uses the sampled texts to identify the peakedness of LLM’s output distribution for data contamination detection. We follow a hypothesis that training is likely to alter the model’s output distribution, resulting in a more peaked output distribution for
2These variants may include, but are not limited to, translations into other languages, additions of explanations or intermediate processes, and provisions of alternate solutions.
training data, thereby tending the model towards specific outputs on these data. On this basis, we also present TED: Trustworthy Evaluation via output Distribution, which is designed to mitigate the impact of data contamination in evaluation by correcting LLM’s output distribution.
We construct two new datasets, i.e., DETCON and COMIEVAL, for data contamination detection and contamination mitigation evaluation tasks, respectively. Experimental results demonstrate that CDD achieves state-of-the-art (SOTA) performance and is also suitable for identifying implicit contamination, i.e., existing the variants of test data in training data. TED successfully mitigates the impact of data contamination in evaluation across various scenarios. Furthermore, we also provide strong evidence that ChatGPT suffers from data contamination on HumanEval dataset.

heading: 2 Motivation Example
text: A powerful LLM that transcends memorization has the capability to generate diverse outputs in response to a given input. Considering the huge vocabulary size of LLMs, which encompasses a good number of tokens with analogous semantics, the output distribution sampled from LLMs ought to not exhibit peakedness. However, when LLMs solely form memorization via training, LLMs are prone to generate outputs that abnormally resemble their training data, as shown in Figure 2. From a statistical perspective, assuming that the average probability of LLM’s output tokens is 0.95, the likelihood of sampling two outputs that contain the same 100 consecutive tokens is about 0.005 < 0.01, which is an extremely improbable event. Therefore, if an LLM consistently outputs some identical or highly similar texts through sampling, it is most
2
likely caused by memorization.
Figure 3 displays an example of how the LLM’s output distribution changes as the degree of data contamination varies. We model the LLM’s output distribution by computing the edit distances of sampled texts, referred to as edit distance distribution (§ 3.1). As shown in Figure 3, in the absence of data contamination (i.e., occurrence 0), the density of zero edit distance stands at 0.0035, where zero edit distance means that sampled texts exactly match. However, upon the LLM being exposed to the leaked data even once (i.e., occurrence 1) during training, the density of zero edit distance escalates sharply to more than 20 times larger than the original, showing the peakedness. Therefore, the impact of data contamination on the LLM’s output distribution is substantial.
In this paper, to the best of our knowledge, we are the first to consider from the standpoint of LLMs’ output distribution to address the challenges associated with data contamination detection and contamination mitigation evaluation, employing only the sampled texts without access to the output probability and training data.

heading: 3 Methodology
text: In this section, we first establish the edit distance distribution (§ 3.1), and then on this basis, we design CDD for data contamination detection (§ 3.2) and TED for contamination mitigation evaluation (§ 3.3).

heading: 3.1 Edit Distance Distribution
text: Edit distance (Levenshtein et al., 1966) is a measure of similarity between two strings, which is defined as the minimum number of operations required to transform one string into the other. The operations typically include insertion, deletion, or substitution of a single character.
Considering the generation of LLMs is based on tokens instead of characters, we adopt token-level edit distance in this paper. Given two strings a and b, token-level edit distance is calculated as:
ED(a, b) =    Len(a) if Len(b) = 0, Len(b) if Len(a) = 0, ED(Tail(a),Tail(b)) if Head(a) = Head(b), 1 + min    ED(Tail(a), b) ED(a,Tail(b))
ED(Tail(a),Tail(b))
otherwise,
(1)
where Len(a) means the length of tokenized a, Head(a) means the first token of tokenized a, Tail(a) means the string consists of all tokens of tokenized a following Head(a). We use dynamic programming to speed up calculations and rolling arrays to reduce space overhead.
Given an LLM, we can model its output distribution by computing the edit distances of sampled texts S = {s1, s2, ..., sn}, where n is the number of samples. Specifically, we define the density function ρ as:
ρ(d) =
n−1∑ i=1 n∑ j=i+1 I(ED(si, sj) = d)
n ∗ (n− 1)/2 , (2)
where d ∈ Z≥0 and I(·) is the indicator function that outputs 1 if the condition is true, otherwise 0.

heading: 3.2 CDD for Data Contamination Detection
text: Given a test data {x, y} consisting of a prompt x and the corresponding answer y, we aim to detect if this data has been trained by the model M.
We sample S from M with the input x to calculate ρ. For data contamination detection, the calculation of ρ can be simplified as:
ρ′(d) =
n∑ i=1 I(ED(si, y) = d)
n . (3)
However, ρ′(d) assumes that test data must be explicitly leaked in its original form {x, y}, and does not take into account the possible implicit contamination of the variant form, i.e., {x, ŷ}.
3
Through observation, we find that the copy percentage of model outputs increases as the degree of data contamination increases, as shown in Figure 1. Therefore, we approximate y by the model’s output texts and finally choose to replace y with the model’s greedy search text st=0, which can be easily achieved by setting temperature t = 0 when sampling. Thus,
ρ∗(d) =
n∑ i=1 I(ED(si, st=0) = d)
n . (4)
In this work, we employ ρ∗(d) to measure edit distance distribution by default.
Further, we define the peakedness of edit distance distribution as
Peak(M;x) = F (d ≤ α · l) = α·l∑
d=0
ρ∗(d), (5)
where F is the cumulative distribution function, α ∈ [0, 1] is a hyper-parameter to control the similarity, and and l is defined as:
l = max({Len(s) | s ∈ S}). (6)
Through identifying the peakedness, CDD can detect data contamination on test data as: CDD(M;x) = {
Leaked if Peak(M;x) > ξ, Unleaked if Peak(M;x) ≤ ξ,
(7) where ξ ∈ [0, 1] is hyper-parameter to control the threshold. The pseudocode of CDD for data contamination detection is shown in Algorithm 1.
Algorithm 1 The pseudocode of CDD Require: LLM M, the prompt of test data x, and
hyper-parameter α = 0.05, ξ = 0.01. Ensure: Contamination status cs.
1: Sample S from M with the input x. 2: Model ρ∗(d) via Eq. (4) 3: Compute Peak(M;x) via Eq. (5). 4: Detect cs via Eq (7) 5: return cs.

heading: 3.3 TED for Contamination Mitigation Evaluation
text: We achieve contamination mitigation evaluation using TED, which includes two rules to correct the LLM’s output distribution, i.e., exclude peakedness and remove duplicates.
1) Exclude Peakedness. We hope to restore the uncontaminated sampling results by excluding the peakedness in the LLM’s output distribution, while excluding the greedy text st=0 which is most likely to represent the leaked data potentially memorized by the LLM.
Se = {s | s ∈ S ∧ ED(s, st=0) > τ}, (8)
where τ ∈ [0,+∞) is a hyper-parameter to control the difference.
2) Remove Duplicates. It aims to remove the duplicate sampling results, especially those differing from st=0, which are also less likely to duplicately occur in the uncontaminated sampling results.
Sr = {si|si ∈ S ∧ ∀j < i, sj ̸= si}. (9)
In the evaluation phase, an evaluation metric E using TED to mitigate the impact of data contamination can be defined as:
ETED(M;x) ≡ ETED(S;x) = E(Se ∧ Sr;x), (10) The pseudocode of TED for contamination mitigation evaluation is shown in Algorithm 2.
Algorithm 2 The pseudocode of TED. Require: LLM M, the prompt of test data x, eval-
uation metric E , and hyper-parameter τ = 2. Ensure: Evaluation performance ep.
1: Sample S from M with the input x. 2: Exclude peakedness to compute Se via Eq. (8). 3: Remove duplicates to compute Sr via Eq. (9). 4: Obtain ep based on E via Eq. (10). 5: return ep.

heading: 4 Experiment
text: In this section, we first introduce two datasets, DETCON and COMIEVAL, tailored for the tasks of data contamination detection and contamination mitigation evaluation, respectively (§ 4.1). We then evaluate the efficacy of CDD on DETCON dataset (§ 4.2). Following this, we assess the performance of TED on COMIEVAL dataset (§ 4.3). Finally, we demonstrate the application results of both CDD and TED in real-world scenarios (§ 4.4).
3We rephrase leaked data and each problem in the variant of leaked data has another correct solution different from the original solution, where the majority is generated by ChatGPT and about 10% is generated by ChatGPT-assisted humans.
4

heading: 4.1 Dataset
text: Considering the absence of datasets for data contamination detection and contamination mitigation evaluation tasks, we dedicate more than 2100 hours to constructing the DETCON and COMIEVAL datasets, utilizing two A6000 GPUs (48GB × 2).
We simulate data contamination by training LLMs using benchmark data. To cover various scenarios of data contamination, we consider different settings, including two domain benchmarks leaked on four LLMs, two contamination form (i.e. explicit and implicit leaked data), using three different learning rates during training, four mixing ratios of leaked data with other training data, and 21 degrees of contamination (i.e., occurrences). The detailed statistics can be found in Table 1. Due to the high cost of large-scale pre-training, we employ LoRA (Hu et al., 2022) to fine-tune the base models on these various settings. On this basis, we construct the DETCON and COMIEVAL datasets.
DETCON contains 2224 data contamination detection tasks, covering two domains (code generation and logical reasoning) and two contamination
forms (explicit and implicit), which need to detect whether a specific LLM has contamination on a particular data. We randomly select the data from the leaked dataset and the LLM from the settings in Table 1, where occurrence 0 refers to ‘uncontaminated’ and the others denote ‘contaminated’.
COMIEVAL contains 560 contamination mitigation evaluation tasks, consisting of a randomly selected contaminated model from Table 1 and the corresponding uncontaminated model, which need to evaluate the performance of the contaminated model and try to mitigate the impact of data contamination to approach the performance of the uncontaminated model.
The detailed statistics and introductions of DETCON and COMIEVAL datasets can be found in Appendix A.

heading: 4.2 Data Contamination Detection
text: Experimental Setup. We compare CDD with baselines, including 1) N-gram: We employ widely-used 13-gram for both char-level and token level; 2) Embedding Similarity: Use the embed-
5
ding of the base model to compute similarity; 3) Perplexity: Compute the perplexity of the original answer given the prompt; 4) Min-k% Prob: Compute the minimum k% probability of the original answer given the prompt, and 5) LLM Decontaminator: Use other LLM to determinate the similarity and we employ ChatGPT as this LLM. The differences between CDD and baselines are shown in Table 2. For hyper-parameters, we set α = 0.05, ξ = 0.01, the cap of l as 100 for CDD by default, and baselines follow the settings in their paper.
The Effect of CDD. As presented in Table 3, compared with other contamination detection approaches, CDD attains SOTA performance in both code generation and logic reasoning domains. CDD exhibits steady improvements across the Accuracy, F1 Score, and AUC metrics, with the average relative improvement ranging between 21.8% and 30.2%. Moreover, the advantage of CDD is that it only requires the sampled texts of LLMs to detect data contamination, without the need for additional conditions in Table 2.
We compare CDD with the two best-performing approaches besides CDD (i.e., Embedding Similar-
ity and LLM Decontaminator) in Table 3, alongside the most commonly used n-gram in two contamination forms, as shown in Figure 5. In the cases of explicit contamination, as the degree of contamination increases, the detection effectiveness across all approaches improves. CDD outperforms the other approaches at lower contamination degrees, which are more challenging to detect. In contrast, in the cases of implicit contamination, CDD alone maintains robust performance, whereas the other approaches encounter significant limitations.
We fix the hyper-parameter α and ξ intuitively for CDD in the experiments. In Figure 4 (a) and (b), we analyze the influence of α and ξ empirically on DETCON dataset by changing itself and fixing another hyper-parameter. The results indicate that there is still room for further improvements with the better hyper-parameter setup of α and ξ.

heading: 4.3 Contamination Mitigation Evaluation
text: Experimental Setup. We evaluate the effectiveness of TED for contamination mitigation in different learning rates, base LLMs, mixing ratios, contamination forms, and occurrences on COMIEVAL. We set the hyper-parameter τ = 2 and use Pass@1
6
(Chen et al., 2021) as the evaluation metric E .
Effect of TED. TED can steadily mitigate the performance improvements across different settings and occurrences in data contamination scenarios, as shown in Figure 6. Moreover, the advantage of TED is that the performance influence of TED on the uncontaminated model (i.e. 0 occurrences) is small and almost negligible. However, as contamination degrees continue to increase, the performance influence of TED becomes apparent in all of the different settings.
We analyze the effects of each component in TED, as shown in Table 4. The main function is provided by the rule of exclude peakedness, fol-
lowed by the rule of remove duplicates. Both components are beneficial to TED and are also effective when employed alone.
As illustrated in Figure 4 (c), an increase in the hyperparameter τ for TED leads to a more pronounced suppression of performance improvements attributable to data contamination. Meanwhile, it also marginally decreases the performance of the uncontaminated model.

heading: 4.4 Real-World Application
text: Experimental Setup. In real-world applications, we apply CDD and TED for ChatGPT and construct two new datasets to assist evidence: 1) CodeForces2305 comprises 90 of the easiest level programming problems collected from the CodeForces website since May 2023, which is after the most recent update deadline of ChatGPT’s training data, i.e., April 2023. 2) HumanEval_R is reconstructed on HumanEval, which replaces its function signature, translates its requirements into German, French, and Chinese, selects different public test cases from the work (Dong et al., 2023a) to prompt, and remains the private test cases for testing. To enhance the detection precision, we set the hyper-
7
parameters α to 0 and ξ to a larger value of 0.2 for CDD. We keep τ at the default value of 2 for TED.
Data contamination for ChatGPT. As shown in Table 5, on HumanEval dataset, ChatGPT exhibits a high Avg. Peak and Leak Ratio. Considering the implementation of more stringent α and ξ, it is posited that ChatGPT is likely to suffer from data contamination on HumanEval dataset. This hypothesis is further evidenced through evaluations conducted on HumanEval_R and CodeForces2305 datasets. HumanEval_R indicates their high Avg. Peak and Leak Ratio are not easily attributable to the difficulty of problems. By modifying prompt forms through a process of reconstruction, all of the performance, Avg. Peak, and Leak Ratio of ChatGPT are significantly reduced. On CodeForces2305 dataset, which is unlikely to be involved in data contamination, ChatGPT’s performance was markedly lower than anticipated, with the Avg. Peak at less than 0.01 and Leak Ratio of 0. Moreover, TED demonstrates significant effectiveness on both the contaminated HumanEval and HumanEval_R.

heading: 5 Related Work
text: Data contamination detection. The concept of data contamination for LLMs can be derived from the context of GPT-3 (Brown et al., 2020). Due to the vastness of the pre-training corpus of GPT3, it inevitably overlapped with some evaluation benchmarks. Therefore, GPT-3 adopted 13-gram overlap detection to remove the data in the training set that conflicts with the test set of benchmarks.
Some work (Pan et al., 2020; Zhou et al., 2023; Jacovi et al., 2023; Dodge et al., 2021) exposed the serious consequences of data contamination and urged attention to this problem. However, most currently released LLMs did not open their pretraining corpus, which poses a new challenge for data contamination detection. Recent work tried
to detect contamination without access to the pretraining corpus (Oren et al., 2023; Deng et al., 2023; Golchin et al., 2023). Min-k% Prob (Shi et al., 2023) calculated the average of the k% smallest probabilities of generated tokens and considered it as contaminated if it exceeded a certain threshold. The work (Li, 2023) assumed that data leaked into the training set tends to exhibit lower perplexity and utilizes perplexity analysis for detection. However, they often require other model outputs (e.g. probability) in addition to text, presenting challenges in detecting closed-source LLMs like ChatGPT, and they ignore the potential implicit contamination from variants of test data.
Recent investigations (Huang et al., 2023; Yang et al., 2023) have suggested that filtering training data based on n-grams may not effectively address the issue of data contamination, especially concerning semantically equivalent sentence rephrasing. To this end, LLM Decontaminator (Yang et al., 2023) detected the similarity of test data and training data based on other advanced LLMs.
Our work requires only sampled texts to detect LLM’s data contamination via output distribution and considers the potential implicit contamination.
Contamination Mitigation Evaluation. To mitigate the impact of data contamination and ensure trustworthy evaluations, several approaches focus on constructing new evaluation benchmarks (Golchin et al., 2023). The work (Zhu et al., 2023) employs an LLM to paraphrase the contaminated dataset for evaluations. However, LLM’s synthetic data is widely used for training, which already contains lots of paraphrased data (Yang et al., 2023). The work (Li et al., 2023b) leverages temporal information to construct a benchmark beginning from January 2023. However, building a high-quality benchmark is costly and time-consuming, and unfortunately, the training data deadline for ChatGPT and GPT-4 has been updated from September 2021 to April 2023 and continues to be delayed.
Our work achieves contamination mitigation evaluation from the standard of LLM’s output distribution and is orthogonal to the preceding works.

heading: 6 Conclusion
text: In this paper, we have proposed two novel approaches, namely CDD and TED, to deal with data contamination detection and contamination mitigation evaluation for LLMs, considering the LLM’s output distribution. We construct two corre-
8
sponding datasets, i.e., DETCON and COMIEVAL, for these two tasks. Extensive experimental results indicate the superiority and versatility of CDD and TED. Moreover, we also discover that ChatGPT is likely to suffer from data contamination on HumanEval dataset. We hope to shed light on this direction and call more attention to data contamination issues.

heading: 7 Limitations
text: Our work has several limitations, which we aim to address in our future work:
First, the validation of our work is mainly focused on benchmarks for code generation and logical reasoning, which are highly representative and widely adopted. In the future, we will further validate our approaches on other benchmarks.
Second, our approaches require multiple samplings to compute the output distribution, and the more samplings conducted, the better the effect. We can use parallel sampling techniques to speed up sampling, thereby reducing time overhead.
Third, considering the limitation of computational resources, we employ a popular parameterefficient fine-tuning approach, i.e., LoRA, instead of full-parameter fine-tuning to simulate data contamination for LLMs. In future work, we plan to attempt full-parameter fine-tuning.
Finally, in constructing our datasets, we assume that the four base LLMs used do not suffer from data contamination on the selected benchmarks. However, in reality, these LLMs may have slight data contamination. To completely avoid this issue, it might be necessary to retrain an LLM from scratch on a training set known to be entirely free of test data. However, undertaking such a process would be prohibitively costly.

heading: 8 Acknowledgments
text: This research is supported by the National Natural Science Foundation of China under Grant No.62192730, 62192733, 61832009, 62192731, 62072007, the Key Program of Hubei under Grant JD2023008.

heading: A Details of Dataset Construction
text: In this section, we further describes the different data contamination scenarios, as well as how we collect and process data from these scenarios to construct the dataset.
First, we prepare the data and models:
1. Test Data. We choose the HumanEval (Chen et al., 2021) dataset for code generation and the GSM8K (Cobbe et al., 2021) dataset for logical reasoning.
2. LLMs. For code generation tasks, we use CodeLlama-7B (Rozière et al., 2023) and CodeGen-6.7B (Nijkamp et al., 2023); for logical reasoning tasks, we select Llama2-7B (Touvron et al., 2023) and Bloom-7B (Scao et al., 2022).
3. Training Data. Code generation tasks use the training data from StarCoder (Li et al., 2023a), while logical reasoning tasks use RedPajama (Computer, 2023).
Next, we construct the dataset DETCON for data contamination detection, starting with the construction of uncontaminated samples. We directly use the outputs generated by LLMs on the test data, representing uncontaminated data. Then, we construct contaminated samples by simulating different contamination scenarios:
1. Explicit and Implicit Contamination. Explicit contamination refers to the direct use of test data for training, while implicit contamination refers to training with variants of the test data.
2. Proportion in the training data. We use different amounts of training data mixed with test data to train LLMs. The proportions of the test dataset mixed with training data include 1:0, 1:0.1k, 1:1k, 1:10k.
3. Different learning rates. Considering the effect of learning rate on model training, we chose three different learning rates: 1e-3, 2e-4, and 4e-8.
4. Degree of data contamination. Training LLMs with contaminated data for more epochs indicates a higher degree of contamination. Epochs range from 0 to 20, where 0 means no training of LLM, indicating no contamination, reserved for constructing uncontaminated samples.
By combining these four different scenarios, we can construct a variety of composite data contamination scenarios. For each piece of test data, we randomly select the results generated by LLMs under one of the contamination scenarios as the contaminated samples. Following the previous works (Jiang et al., 2023; Dong et al., 2023b,c; Li et al., 2024), in generating these samples, we also record the outputs of greedy search with a temperature parameter of 0 (1 sample) and 50 samples obtained by sampling with a temperature of 0.8.
This construction approach aims to comprehensively cover possible data contamination scenarios, ensuring we can accurately assess the performance of LLMs in the face of different types and degrees of data contamination.
Finally, we construct the dataset COMIEVAL for contamination mitigation evaluation. We selected 560 LLMs and their generated outputs from all the constructed contaminated LLMs as the task inputs. Then, we used the performance of the corresponding uncontaminated LLMs on these two test datasets as the target output, serving as the evaluation criterion. Table 6 demonstrates the statistics of DETCON and COMIEVAL, respectively.
12

heading: Future Work
text: Our work has several limitations, which we aim to address in our future work:
First, the validation of our work is mainly focused on benchmarks for code generation and logical reasoning, which are highly representative and widely adopted. In the future, we will further validate our approaches on other benchmarks. Second, our approaches require multiple samplings to compute the output distribution, and the more samplings conducted, the better the effect. We can use parallel sampling techniques to speed up sampling, thereby reducing time overhead. Third, considering the limitation of computational resources, we employ a popular parameterefficient fine-tuning approach, i. e. , LoRA, instead of full-parameter fine-tuning to simulate data contamination for LLMs. In future work, we plan to attempt full-parameter fine-tuning. Finally, in constructing our datasets, we assume that the four base LLMs used do not suffer from data contamination on the selected benchmarks. However, in reality, these LLMs may have slight data contamination. To completely avoid this issue, it might be necessary to retrain an LLM from scratch on a training set known to be entirely free of test data. However, undertaking such a process would be prohibitively costly