Benchmark Contamination

Programs like ChatGPT learn by processing enormous amounts of text from the internet. Afterward, their capabilities are tested using fixed sets of tasks known as benchmarks. These are standardized tests with math problems, programming tasks, or knowledge questions whose correct solutions are known. For such a test to be meaningful, the program must not have encountered the tasks beforehand. But that is exactly what often happens: the tasks, along with their solutions, sit freely on the web and end up in the training material. This problem is called benchmark contamination.

Why inflated test results become costly

Benchmark numbers are the currency of the AI industry. When a company introduces a new model, it almost always shows a table of scores from well-known tests. Journalists pick up these numbers, investors value companies based on them, developers decide which system to integrate based on this data. A contaminated number therefore distorts not just a footnote, but an entire chain of decisions.

What is especially troublesome is that contamination scrambles the ranking between models. A system that has learned many test tasks by heart can, on paper, outperform a system that is actually better. Anyone who then chooses the seemingly stronger one only notices the difference in everyday use. That is where exactly the tasks that appear in no benchmark show up.

For research, the damage is even more fundamental. Progress can only be measured if the yardstick stays stable. If popular benchmarks have leaked out after a few years, no one can be certain anymore whether the models have actually gotten better or merely better informed. One compares a result from 2025 with one from 2022 and, in truth, measures two different things.

How test tasks slip into training

The most common route is simple carelessness. Training data is collected from billions of web pages, often automatically. But benchmarks sit exactly there: on GitHub, in forums, in blog posts with sample solutions, in academic papers. No one needs to cheat for the tasks to get copied along. It is enough that the dataset is not filtered thoroughly enough.

Things get trickier with indirect contamination. Here the task does not appear verbatim, but reworded, translated, or embedded in a discussion of the solution. Plain text comparisons do not catch this. That is why researchers additionally test with tricks: they slightly alter numbers in a task or swap out names. If the hit rate then drops sharply, that points to rote memorization rather than genuine understanding.

The most important countermeasure is tests that did not yet exist at training time. Benchmarks are built that are regularly replaced with new tasks, or part of the tasks is kept entirely secret. Some competitions let models compete only through an interface, without ever publishing the tasks. Related to this is the deliberate variant, so-called benchmark hacking, in which a system is specifically optimized toward the test. Contamination is usually an accident, but the outcome looks similar.

How to spot suspicious top scores

In news about new AI models, you usually encounter the term as criticism. A company announces a top score, and shortly afterward researchers show that parts of the test were present in the training material. Such debates have arisen, among others, around well-known math and coding benchmarks. Serious technical reports therefore now include dedicated sections on contamination checks.

You can try out the principle yourself. Give a chatbot a well-known puzzle task and then change a small detail, such as a number or a condition. If it keeps responding with the solution to the original, it has recalled the task rather than thought it through. This is the same effect as with a class test whose questions were circulating beforehand: the grades go up, the knowledge does not.