Data Contamination — AI Glossary

Reference details

Related terms

• Benchmark Contamination
• Data Deduplication
• Evaluation Harness

How it works

1. The direct method requires the corpus: index it, then query it with the benchmark's own items and look for extended verbatim spans, which settles the question outright when that access exists.
2. A canary string is the preventive version — a unique marker published inside the test set so that a model reproducing it has demonstrably seen the file.
3. That only works if the marker was planted before the corpus was collected, so it protects future benchmarks and can say nothing about existing ones.
4. The behavioural method needs neither: compare the model's perplexity on the test items against its perplexity on freshly written text from the same distribution.
5. Unusually low perplexity on the exact published phrasing — rather than on paraphrases of it — is the signal, because memorised text is predicted more confidently than equivalent unseen text.
6. That comparison needs only output probabilities, which is why it is the one method applicable to a closed model, and why its result is an inference from behaviour rather than a finding about a corpus.

Example: You cannot audit what you cannot see

Detection works by looking for benchmark text inside training data: long exact n-gram matches, canary strings planted in test sets, or checking whether a model is suspiciously fluent on the exact phrasing of test items. Every one of those methods needs either the corpus or unusual access to the model. For a closed API model you have neither, so a contamination claim about it is inference from behaviour — a plausible one, but not an audit. This is the practical asymmetry: open-weight models can be checked and are therefore sometimes reported as contaminated, while closed models are simply unverified, and the two are easy to confuse for a quality difference.

Commonly confused with

Contamination is not the same as memorisation, and not the same as overfitting. Memorisation is reproducing training text; overfitting is failing to generalise from a training set. Contamination is specifically the evaluation set leaking into training, which breaks the measurement rather than the model — the model may be fine, but the number describing it is not.

When to use it

Reach for it when:

• Reading any benchmark result, as the first question about what it can support
• Choosing benchmarks: post-cutoff and held-out designs exist precisely to resist it
• Publishing results, where a decontamination pass against the eval sets is the minimum

Reach for something else when:

• As a blanket dismissal of all benchmarks, which leaves you with no measurement at all
• Assuming a model card's silence is a clean bill of health — most are silent
• Treating a behavioural inference about a closed model as a verified finding

Continue your research

Use these connected ModelRefs sections to compare alternatives, inspect implementation paths, and review the evidence and governance boundaries relevant to Data Contamination — AI Glossary.

• Browse models
• Review providers
• Inspect benchmarks
• Explore workflows
• Learn AI concepts
• Read decision guides
• Review trust and methodology
• Start a decision path