Source
Borgeaud et al. (2021), LIT-060 — Retro, which proposes “an evaluation aware of proximity of test documents with the training set”.
Srivastava et al. (2022), LIT-077 — BIG-bench, which states its own exposure and ships a probe for future models.
Gemini Team, Google (2023), LIT-510 — read as NOTE-255 — which does both and measures the size of the effect.
What it is worth, measured
LIT-510 supplies the number this practice lacked. An additional hundred fine-tuning steps on website extracts corresponding to the HellaSwag training set — extracts that were not in the pretraining data — take validation accuracy to 89.6% for Gemini Pro and 96.0% for Gemini Ultra at 1-shot, against GPT-4’s measured 92.3% 1-shot.
A hundred steps is nothing against any pretraining budget. So the distance between a contaminated and an uncontaminated number, on a popular benchmark, is smaller than the distance between two frontier models — and it is purchasable with a rounding error of compute.
Two things follow, and the report does both. The extensive post-training leak analysis led them to drop LAMBADA rather than report it. And HellaSwag is reported decontaminated at 10-shot only, alongside new benchmarks chosen or built to be leak-free: WMT23, Math-AMC 2022-2023, and Natural2Code, the last generated from non-web sources.
This is a frontier lab stating its exposure against its own interest, which is
exactly what the consensus_note above says almost nobody does.
The claim
Two things, and the second is the cheap one.
Proximity is continuous, not binary. Contamination is usually treated as a
yes/no question answered by exact-match deduplication, and LIT-060 proposes
grading evaluation by how close each test document is to the training set.
That matters for every language model and, as the paper says, especially for
retrieval-augmented ones “since they have direct access to the training dataset
during evaluation” — a retrieval model can retrieve the answer, which is not
contamination in the usual sense and has the same effect.
State your exposure, and ship a probe. BIG-bench’s handling is the model to
copy: training data for every evaluated model except PaLM predates the
repository, so direct leakage is impossible by construction; indirect leakage
through text already on the internet is acknowledged rather than assumed
away; and a training_on_test_set task ships so future models can be probed.
That is three sentences of disclosure and one task. It is not a research contribution and almost nobody does it.
Conditions
LIT-060 proposes the proximity-aware evaluation and does not establish a
standard threshold; what counts as “too close” is unresolved and probably
task-dependent.
The disclosure half has no conditions. It costs nothing and its absence is not evidence of cleanliness.
Known implementations
- BIG-bench’s
training_on_test_settask - Retro’s proximity-filtered evaluation splits