Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

When Benchmarks Leak: Inference-Time Decontamination for LLMs

Jianzhe Chai, Yu Zhe, Jun Sakuma

TL;DR

This work addresses benchmark contamination in open-weight LLMs, where test items leak into training and inflate scores. It introduces DeconIEP, an inference-time method that applies small, bounded embedding perturbations guided by a less-contaminated reference model to suppress memorization-driven shortcuts without modifying model weights. By training a lightweight perturbation generator under a KL-divergence surrogate, DeconIEP demonstrates strong decontamination (low residual contamination) with minimal benign-utility loss across multiple benchmarks and model scales, including code-generation tasks. The approach preserves semantics better than rewriting or patching strategies and offers a controllable RC–BUD trade-off via the perturbation budget, making it practical for robust, reproducible evaluation in open-weight LLM ecosystems.

Abstract

Benchmark-based evaluation is the de facto standard for comparing large language models (LLMs). However, its reliability is increasingly threatened by test set contamination, where test samples or their close variants leak into training data and artificially inflate reported performance. To address this issue, prior work has explored two main lines of mitigation. One line attempts to identify and remove contaminated benchmark items before evaluation, but this inevitably alters the evaluation set itself and becomes unreliable when contamination is moderate or severe. The other line preserves the benchmark and instead suppresses contaminated behavior at evaluation time; however, such interventions often interfere with normal inference and lead to noticeable performance degradation on clean inputs. We propose DeconIEP, a decontamination framework that operates entirely during evaluation by applying small, bounded perturbations in the input embedding space. Guided by a relatively less-contaminated reference model, DeconIEP learns an instance-adaptive perturbation generator that steers the evaluated model away from memorization-driven shortcut pathways. Across multiple open-weight LLMs and benchmarks, extensive empirical results show that DeconIEP achieves strong decontamination effectiveness while incurring only minimal degradation in benign utility.

When Benchmarks Leak: Inference-Time Decontamination for LLMs

TL;DR

This work addresses benchmark contamination in open-weight LLMs, where test items leak into training and inflate scores. It introduces DeconIEP, an inference-time method that applies small, bounded embedding perturbations guided by a less-contaminated reference model to suppress memorization-driven shortcuts without modifying model weights. By training a lightweight perturbation generator under a KL-divergence surrogate, DeconIEP demonstrates strong decontamination (low residual contamination) with minimal benign-utility loss across multiple benchmarks and model scales, including code-generation tasks. The approach preserves semantics better than rewriting or patching strategies and offers a controllable RC–BUD trade-off via the perturbation budget, making it practical for robust, reproducible evaluation in open-weight LLM ecosystems.

Abstract

Benchmark-based evaluation is the de facto standard for comparing large language models (LLMs). However, its reliability is increasingly threatened by test set contamination, where test samples or their close variants leak into training data and artificially inflate reported performance. To address this issue, prior work has explored two main lines of mitigation. One line attempts to identify and remove contaminated benchmark items before evaluation, but this inevitably alters the evaluation set itself and becomes unreliable when contamination is moderate or severe. The other line preserves the benchmark and instead suppresses contaminated behavior at evaluation time; however, such interventions often interfere with normal inference and lead to noticeable performance degradation on clean inputs. We propose DeconIEP, a decontamination framework that operates entirely during evaluation by applying small, bounded perturbations in the input embedding space. Guided by a relatively less-contaminated reference model, DeconIEP learns an instance-adaptive perturbation generator that steers the evaluated model away from memorization-driven shortcut pathways. Across multiple open-weight LLMs and benchmarks, extensive empirical results show that DeconIEP achieves strong decontamination effectiveness while incurring only minimal degradation in benign utility.
Paper Structure (69 sections, 1 theorem, 36 equations, 11 figures, 6 tables, 1 algorithm)

This paper contains 69 sections, 1 theorem, 36 equations, 11 figures, 6 tables, 1 algorithm.

Table of Contents

  1. Introduction
  2. Contributions
  3. Related Work
  4. Benchmark Contamination and Detection
  5. Inference-time Decontamination (Black-box)
  6. Inference-time Decontamination (White-box)
  7. Problem Setup
  8. Model
  9. Data Contamination
  10. Objective
  11. Methodology
  12. Overview
  13. KL Divergence as a Surrogate Objective
  14. Embedding-Space Perturbation for Inference-Time Mitigation
  15. Generator Design
  16. ...and 54 more sections

Key Result

Theorem 1

Fix a test set $D_{\mathrm{test}}$ and suppose for some utility $u(x,y)\in[0,1]$. Then, $\Delta_{\mathrm{perf}}$ is bounded by: In particular, if the average KL divergence between $p_{\mathrm{con}}(\cdot\mid x)$ and $p_{\mathrm{clean}}(\cdot\mid x)$ is at most $\varepsilon$, then $\Delta_{\mathrm{perf}} \le \sqrt{\varepsilon/2}$.

Figures (11)

  • Figure 1: Overview: DeconIEP keeps the prompt fixed and adds a bounded embedding perturbation $\delta=G_\theta(e(x))$ to suppress memorization shortcuts on leaked samples, steering inference toward reasoning and recovering clean performance.
  • Figure 2: Average Residual Contamination (RC) of all models across leakage occurrences $o$ under different contamination levels (lower is better).( $\zeta=10^{-3}$)
  • Figure 3: Scaling behavior on Qwen2.5-Instruct models ($o=3$). We compare RC on exact domian and BUD across model sizes (1.5B/3B/7B/14B) on (a) TruthfulQA and (b) MMLU. Our method remains effective and stable under scaling with a fixed embedding perturbation budget $\zeta=10^{-3}$.
  • Figure 4: Semantic invariance under embedding perturbations. Mean cosine similarity between original and perturbed embeddings (orig vs. orig+$\delta$) versus $\zeta$ on MMLU and TruthfulQA. Dashed lines show orig vs. paraphrased as a semantic-preserving reference.
  • Figure 5: Test accuracy under increasing contamination in the reference model.
  • ...and 6 more figures

Theorems & Definitions (2)

  • Theorem 1: KL upper bound on performance gap
  • proof : Proof