How Contaminated Is Your Benchmark? Quantifying Dataset Leakage in Large Language Models with Kernel Divergence
Not on the map. Why?
Abstract (arXiv)
Dataset contamination, where evaluation datasets overlap with pre-training corpora, inflates performance metrics and undermines the reliability of model evaluations. Measuring dataset contamination thus becomes essential to ensure that performance evaluations genuinely reflect a model's ability to generalize to unseen data, rather than relying on memorized examples. To address this problem, we propose Kernel Divergence Score (KDS), a novel method that evaluates dataset contamination by computing the divergence between the kernel similarity matrix of sample embeddings, before and after fine-tuning on the benchmark dataset. Leveraging the insight that fine-tuning affects unseen samples more significantly than seen ones, KDS provides a reliable measure of contamination. Through extensive experiments on controlled contamination scenarios, KDS demonstrates a near-perfect correlation with contamination levels and outperforms existing baselines. Additionally, we perform comprehensive ablation studies to analyze the impact of key design choices, providing deeper insights into the components and effectiveness of KDS. These ablations highlight the importance of leveraging fine-grained kernel-based information and confirm the reliability of the proposed framework across diverse datasets and settings. Code is released in https://github.com/deeplearning-wisc/kernel-divergence-score.
Key facts. Cited by 15 papers in the map (data through 14 Oct 2026). Builds on 29 of its 37 references that are in the map. First posted on arXiv 2 Feb 2025.
Builds on
29 of 37 references.
References · 29
- 2024The Llama 3 Herd of Modelscited by 14,715
- 2021LoRA: Low-Rank Adaptation of Large Language Modelscited by 14,380
- 2023Mistral 7Bcited by 3,164
- 2020The Pile: An 800GB Dataset of Diverse Text for Language Modelingcited by 2,411
- 2016Membership Inference Attacks against Machine Learning Modelscited by 2,281
- 2020Extracting Training Data from Large Language Modelscited by 2,189
- 2024Phi-3 Technical Report: A Highly Capable Language Model Locally on Your Phonecited by 1,917
- 2021Membership Inference Attacks From First Principlescited by 878
- 2018ML-Leaks: Model and Data Independent Membership Inference Attacks and Defenses on Machine Learning Modelscited by 498
- 2023Detecting Pretraining Data from Large Language Modelscited by 387
- 2023Membership Inference Attacks against Language Models via Neighbourhood Comparisoncited by 258
- 2022Data Contamination: From Memorization to Exploitationcited by 236
17 more
- 2023Proving Test Set Contamination in Black Box Language Modelscited by 230
- 2024Leak, Cheat, Repeat: Data Contamination and Evaluation Malpractices in Closed-Source LLMscited by 229
- 2023Rethinking Benchmark and Contamination for Language Models with Rephrased Samplescited by 195
- 2024Do Membership Inference Attacks Work on Large Language Models?cited by 195
- 2023Don't Make Your LLM an Evaluation Benchmark Cheatercited by 194
- 2023Time Travel in LLMs: Tracing Data Contamination in Large Language Modelscited by 177
- 2024Benchmark Data Contamination of Large Language Models: A Surveycited by 147
- 2024LLM Dataset Inference: Did you train on my dataset?cited by 110
- 2024Min-K%++: Improved Baseline for Detecting Pre-Training Data from Large Language Modelscited by 103
- 2024DE-COP: Detecting Copyrighted Content in Language Models Training Datacited by 74
- 2024Blind Baselines Beat Membership Inference Attacks for Foundation Modelscited by 69
- 2024ReCaLL: Membership Inference via Relative Conditional Log-Likelihoodscited by 64
- 2024SoK: Membership Inference Attacks on LLMs are Rushing Nowhere (and How to Fix It)cited by 59
- 2023Estimating Contamination via Perplexity: Quantifying Memorisation in Language Model Evaluationcited by 48
- 2024ConStat: Performance-Based Contamination Detection in Large Language Modelscited by 33
- 2024Data Contamination Calibration for Black-box LLMscited by 24
- 2024Fine-tuning can Help Detect Pretraining Data from Large Language Modelscited by 8
Built on by
Citing papers per year: 2025: 6; 2026: 9.
15 papers.
Sort:
By area:
- 2025BeyondBench: Contamination-Resistant Evaluation of Reasoning in Language Modelscited by 8
- 2025Evaluating the Robustness of Large Language Model Safety Guardrails Against Adversarial Attackscited by 5
- 2025Membership Inference Attacks on Tokenizers of Large Language Modelscited by 3
- 2026TSFMAudit: Data Contamination Auditing in Forecasting Time Series Foundation Modelscited by 3
- 2025One Patient, Many Contexts: Scaling Medical AI with Contextual Intelligencecited by 2
- 2025ArenaBencher: Automatic Benchmark Evolution via Multi-Model Competitive Evaluationcited by 2
- 2025Contamination Detection for VLMs using Multi-Modal Semantic Perturbationcited by 1
- 2026Unmasking Reasoning Processes: A Process-aware Benchmark for Evaluating Structural Mathematical Reasoning in LLMscited by 1
- 2026When Agents Look the Same: Quantifying Distillation-Induced Similarity in Tool-Use Behaviorscited by 1
- 2026Is Domain Adaptation Always Helpful? A Frozen-Backbone Study of Cross-Domain Sentiment Transfercited by 1
- 2026From Unfamiliar to Familiar: Detecting Pre-training Data via Gradient Deviations in Large Language Modelscited by 0
- 2026Provable Joint Decontamination for Benchmarking Multiple Large Language Modelscited by 0
3 more
- 2026LaRA: Layer-wise Representation Analysis for Detecting Data Contamination in RL Post-Trainingcited by 0
- 2026MC-PDD: Masked Corpus-Level Pretraining Data Detection for Black-Box Large Language Modelscited by 0
- 2026WildTrace: Evaluating Training Data Detection in Realistic Large-Scale LLM Post-Trainingcited by 0
- 2026WildTrace: Evaluating Training Data Detection in Realistic Large-Scale LLM Post-Training12 Oct 2026
- 2026Is Domain Adaptation Always Helpful? A Frozen-Backbone Study of Cross-Domain Sentiment Transfer7 Jul 2026
- 2026MC-PDD: Masked Corpus-Level Pretraining Data Detection for Black-Box Large Language Models6 Jun 2026
- 2026LaRA: Layer-wise Representation Analysis for Detecting Data Contamination in RL Post-Training28 May 2026
- 2026TSFMAudit: Data Contamination Auditing in Forecasting Time Series Foundation Models24 May 2026
- 2026Provable Joint Decontamination for Benchmarking Multiple Large Language Models20 May 2026
- 2026When Agents Look the Same: Quantifying Distillation-Induced Similarity in Tool-Use Behaviors23 Apr 2026
- 2026From Unfamiliar to Familiar: Detecting Pre-training Data via Gradient Deviations in Large Language Models5 Mar 2026
- 2026Unmasking Reasoning Processes: A Process-aware Benchmark for Evaluating Structural Mathematical Reasoning in LLMs31 Jan 2026
- 2025Evaluating the Robustness of Large Language Model Safety Guardrails Against Adversarial Attacks27 Nov 2025
- 2025Contamination Detection for VLMs using Multi-Modal Semantic Perturbation5 Nov 2025
- 2025ArenaBencher: Automatic Benchmark Evolution via Multi-Model Competitive Evaluation9 Oct 2025
- 2025BeyondBench: Contamination-Resistant Evaluation of Reasoning in Language Modelscited by 8
- 2026Unmasking Reasoning Processes: A Process-aware Benchmark for Evaluating Structural Mathematical Reasoning in LLMscited by 1
- 2026LaRA: Layer-wise Representation Analysis for Detecting Data Contamination in RL Post-Trainingcited by 0
- 2026LaRA: Layer-wise Representation Analysis for Detecting Data Contamination in RL Post-Training28 May 2026
- 2026Unmasking Reasoning Processes: A Process-aware Benchmark for Evaluating Structural Mathematical Reasoning in LLMs31 Jan 2026
- 2025BeyondBench: Contamination-Resistant Evaluation of Reasoning in Language Models29 Sep 2025
- 2026TSFMAudit: Data Contamination Auditing in Forecasting Time Series Foundation Modelscited by 3
- 2025ArenaBencher: Automatic Benchmark Evolution via Multi-Model Competitive Evaluationcited by 2
- 2026Is Domain Adaptation Always Helpful? A Frozen-Backbone Study of Cross-Domain Sentiment Transfercited by 1
- 2026From Unfamiliar to Familiar: Detecting Pre-training Data via Gradient Deviations in Large Language Modelscited by 0
- 2026Provable Joint Decontamination for Benchmarking Multiple Large Language Modelscited by 0
- 2026MC-PDD: Masked Corpus-Level Pretraining Data Detection for Black-Box Large Language Modelscited by 0
- 2026WildTrace: Evaluating Training Data Detection in Realistic Large-Scale LLM Post-Trainingcited by 0
- 2026WildTrace: Evaluating Training Data Detection in Realistic Large-Scale LLM Post-Training12 Oct 2026
- 2026Is Domain Adaptation Always Helpful? A Frozen-Backbone Study of Cross-Domain Sentiment Transfer7 Jul 2026
- 2026MC-PDD: Masked Corpus-Level Pretraining Data Detection for Black-Box Large Language Models6 Jun 2026
- 2026TSFMAudit: Data Contamination Auditing in Forecasting Time Series Foundation Models24 May 2026
- 2026Provable Joint Decontamination for Benchmarking Multiple Large Language Models20 May 2026
- 2026From Unfamiliar to Familiar: Detecting Pre-training Data via Gradient Deviations in Large Language Models5 Mar 2026
- 2025ArenaBencher: Automatic Benchmark Evolution via Multi-Model Competitive Evaluation9 Oct 2025