Research map / Large language models / Language, safety and interpretability
The Emperor's New Clothes in Benchmarking? A Rigorous Examination of Mitigation Strategies for LLM Benchmark Data Contamination
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes fidelity and contamination-resistance metrics (normalized Hamming distance over question-level correctness vectors) and a controlled pipeline to evaluate 20 benchmark data contamination mitigation strategies on 10 uncontaminated LLMs and 5 benchmarks, finding no strategy reliably improves resistance while preserving fidelity.
Problem
Existing ways of judging whether updating a benchmark mitigates benchmark data contamination (accuracy drop, accuracy matching) rely on aggregate accuracy and often skip verifying that the LLM is uncontaminated beforehand, so their conclusions can be misleading.
Approach
Assess mitigation strategies at the question level: fidelity measures agreement between clean-model correctness on original vs. updated benchmark, and contamination resistance measures agreement between clean and contaminated model correctness on the updated benchmark, using normalized Hamming distance. Uncontaminated models are verified by three detection methods and then manually contaminated un
Key results
- No semantic-preserving strategy achieves statistically significantly higher resistance than vanilla across all five benchmarks; significant gains appear only for subsets such as MMLU, TruthfulQA, and RepliQA.
- Minor edits (typos, synonym replacement) keep fidelity above 0.9 on most benchmarks but give resistance no better than vanilla, while aggressive MPA drops MMLU fidelity to 0.686 with higher resistance.
- Semantic-altering strategies (mimicking, remember-understand, application, analysis extension) reach resistance around 0.95-0.98 but have fidelity about 0.15 lower on average than semantic-preserving ones.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Apply ITD benchmark update | Contaminated LLMs evaluated on Arc-C · Arc-C | resistance: 0.923 -> 0.937; 0.870 -> 0.917 | No clear effect |
| Apply ITD benchmark update | Contaminated LLMs evaluated on MMLU · MMLU | resistance: 0.882 -> 0.899; 0.852 -> 0.877 | Helped |
| Apply ITD benchmark update | Contaminated LLMs evaluated on TruthfulQA · TruthfulQA | resistance: 0.794 -> 0.829; 0.687 -> 0.742 | Helped |
| Apply MPA-Ques + Trans-CN benchmark update | Contaminated LLMs evaluated on RepliQA · RepliQA | resistance: 0.709 -> 0.965; 0.597 -> 0.964 | Helped |
| Apply MPA benchmark update | Clean LLMs evaluated on MMLU · MMLU | fidelity: 1.000 -> 0.686 | Hurt |
| Generate semantically altered questions | Contaminated LLMs evaluated on Arc-C and MMLU · Arc-C and MMLU | resistance | Helped |
| Generate semantically altered questions | Clean LLMs evaluated on Arc-C and MMLU · Arc-C and MMLU | fidelity | Hurt |
| Use intensive rather than mild contamination | Contaminated LLMs across benchmarks · All evaluated benchmarks | resistance | Hurt |
| Apply minor benchmark modifications, such as syntactic changes or irrelevant context | Contaminated LLMs across benchmarks · All evaluated benchmarks | resistance | No clear effect |
| Apply a semantic-preserving update | Clean LLMs across benchmarks · All evaluated benchmarks | fidelity | Mixed |
Surprising findings
- Strategies that significantly improve resistance (MPA, ITD) also have the lowest fidelity, so no strategy balances both metrics.
- Accuracy matching can be misleading: scalar accuracy can match while question-level correctness differs substantially.
Limitations
- Low fidelity requires manual inspection of updated benchmarks, which raises cost and limits automation.
- Contamination is simulated by fine-tuning, which may not reflect real pretraining contamination.
- Only 10 LLMs in 3B-34B and 5 benchmarks were evaluated; semantic-altering strategies were tested only on Arc-C and MMLU.
Experimental setup
Datasets: Arc-Challenge MMLU TruthfulQA GSM8K RepliQA OpenOrca Alpaca WikiMIA LiveBench
Benchmarks: Arc-Challenge MMLU TruthfulQA GSM8K RepliQA
Metrics: fidelity contamination resistance normalized Hamming distance accuracy inflation proportion of retained correctness perplexity
Baselines: Accuracy drop Accuracy matching Vanilla (no mitigation) Clean-Eval ITD MPA
Builds on: Min-K% Prob Sharded Rank Comparison Test TS-Guessing Clean-Eval ITD MPA
Closest papers by meaning
- Overestimation in LLM Evaluation: A Controlled Large-Scale Study on Data Contamination’s Impact on Machine Translation (ICML 2025 · similarity 0.91)
- Time Travel in LLMs: Tracing Data Contamination in Large Language Models (ICLR 2024 · similarity 0.90)
- ConStat: Performance-Based Contamination Detection in Large Language Models (NeurIPS 2024 · similarity 0.90)
- How Much Can We Forget about Data Contamination? (ICML 2025 · similarity 0.90)
- Training on the Benchmark Is Not All You Need (AAAI 2025 · similarity 0.89)
- Provable Joint Decontamination for Benchmarking Multiple Large Language Models (NeurIPS 2026 · similarity 0.88)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.