What is data contamination, and why does it make benchmarks unreliable?
Data contamination happens when a language model is trained on data that includes the exact same test questions it will later be evaluated on. This is the most direct form of gaming: the model has effectively seen the answers before. A 2023 position paper defines this as the worst kind of contamination, because it causes an overestimation of the model's true performance and can lead to wrong scientific conclusions being published while correct ones are discarded [5]. The problem is widespread because many benchmarks are built from public code repositories, math competitions, and news articles that are also used to train LLMs [1][2].
A 2025 study on code benchmarks found that after applying simple code refactoring—renaming variables and restructuring code—the overlap ratio between training and test data dropped by 75%, and model performance fell by an average of 19% [1]. This means that nearly one-fifth of the models' apparent skill was actually just pattern matching on memorized code structures, not genuine problem-solving ability.
How else can benchmarks be gamed, even without direct contamination?
Beyond memorization, benchmarks can be gamed through 'benchmark overfitting'—where models are tuned to exploit specific quirks of a test set, such as the format of multiple-choice questions or the distribution of correct answers. A 2024 study introducing LiveBench notes that many recent benchmarks try to avoid this by crowdsourcing new prompts from humans or LLM judges, but these methods introduce their own biases and break down when scoring hard questions [2]. LiveBench itself attempts to resist gaming by using frequently updated questions from recent sources (e.g., arXiv papers, news articles) and scoring answers automatically against objective ground truth, yet even then, top models score below 70% accuracy, showing how difficult it is to create a truly robust benchmark [2].
Another 2024 paper proposes a radical solution: keeping the test dataset entirely private from the model owner, using cryptographic or confidential computing techniques to evaluate models without ever revealing the test data [3]. This approach, called Private Benchmarking, aims to prevent both contamination and gaming by design, but the authors acknowledge that it introduces computational overhead and requires trust in the evaluation infrastructure.
Why don't current solutions fully solve the problem?
Even the most careful benchmark designs have limitations. A 2025 survey on data contamination notes that while the field has moved from static benchmarks (fixed test sets) to dynamic ones (frequently updated questions), there is still no standardized criteria for evaluating how well these dynamic benchmarks actually resist contamination [4]. This means that different research groups may claim their benchmarks are 'contamination-free' based on different standards, making it hard to compare results across studies.
The Private Benchmarking approach [3] is promising but not yet widely adopted, and it requires either specialized hardware (confidential computing) or cryptographic protocols that can be slow. Meanwhile, code refactoring tools like CodeCleaner [1] can reduce contamination effects but only for code-based benchmarks, and they cannot address contamination in natural language or reasoning tasks. The 2023 position paper [5] calls for a community-wide effort to develop automatic detection tools and to flag papers whose conclusions may be compromised by contamination—a sign that the problem is still far from solved.
About These Sources
This answer is built on 5 peer-reviewed studies — published from 2023 to 2025, 4 from 2024 or later, collectively cited 152 times — selected as the most relevant from 5 studies that passed quality screening, drawn from 50 papers retrieved from a database of over 500 million.
Sources used in this answer
CodeCleaner: Mitigating Data Contamination for LLM Benchmarking
CodeCleaner's code refactoring operators reduced training-test overlap by 75% and caused LLM performance to drop by an average of 19%, showing that models relied on memorized surface patterns rather than true understanding [1].
LiveBench: A Challenging, Contamination-Limited LLM Benchmark
LiveBench, a benchmark designed to resist contamination with frequently updated questions from recent sources, found that top models still score below 70% accuracy, highlighting the difficulty of creating robust benchmarks [2].
Private Benchmarking to Prevent Contamination and Improve Comparative Evaluation of LLMs
Private Benchmarking proposes keeping test datasets entirely private using cryptographic or confidential computing methods to prevent contamination, but introduces computational overhead and trust requirements [3].
Benchmarking Large Language Models Under Data Contamination: A Survey from Static to Dynamic Evaluation
A 2025 survey on data contamination notes that while dynamic benchmarks are emerging, there is no standardized criteria for evaluating their resistance to contamination, limiting comparability [4].
NLP Evaluation in trouble: On the Need to Measure LLM Data Contamination for each Benchmark
A 2023 position paper argues that the worst contamination occurs when models are trained on the exact test split of a benchmark, causing overestimation of performance and potentially leading to wrong scientific conclusions [5].