Data Contamination Report from the 2024 CONDA Shared Task

Oscar Sainz, Iker García-Ferrero, Alon Jacovi, Jon Ander Campos, Yanai Elazar, Eneko Agirre, Yoav Goldberg, Wei-Lin Chen, Jenny Chim, Leshem Choshen, Luca D'Amico-Wong, Melissa Dell, Run-Ze Fan, Shahriar Golchin, Yucheng Li, Pengfei Liu, Bhavish Pahwa, Ameya Prabhu, Suryansh Sharma, Emily Silcock, Kateryna Solonko, David Stap, Mihai Surdeanu, Yu-Min Tseng, Vishaal Udandarao, Zengzhi Wang, Ruijie Xu, Jinglin Yang · CONDA 2024 · 2024

In one sentence

The CONDA 2024 shared task built a public, community-maintained Data Contamination Database, compiling 566 contamination entries over 91 evaluation datasets and 42 contaminated corpora and models from 23 contributors so researchers can avoid reporting results on known-contaminated benchmarks.

Abstract

The 1st Workshop on Data Contamination (CONDA 2024) focuses on all relevant aspects of data contamination in natural language processing, where data contamination is understood as situations where evaluation data is included in pre-training corpora used to train large scale models, compromising evaluation results. The workshop fostered a shared task to collect evidence on data contamination in current available datasets and models. The goal of the shared task and associated database is to assist the community in understanding the extent of the problem and to assist researchers in avoiding reporting evaluation results on known contaminated resources. The shared task provides a structured, centralized public database for the collection of contamination evidence, open to contributions from the community via GitHub pool requests. This first compilation paper is based on 566 reported entries over 91 contaminated sources from a total of 23 contributors. The details of the individual contamination events are available in the platform. The platform continues to be online, open to contributions from the community.

Questions this paper answers

Is there a public list of which test sets have turned up inside the training data of language models?
Does a centralized registry of documented evaluation-data contamination in pre-training corpora and LLMs exist?
Where can I look up whether a benchmark I want to use has already leaked into pre-training data?
Before I report scores on a benchmark, can I check a shared contamination registry for it?
The CONDA 2024 shared task created the Data Contamination Database, a structured, centralized public registry where researchers submit evidence of evaluation datasets appearing in pre-training corpora or models via GitHub pull requests. Submissions are discussed openly before admission.
Holds for: Community-submitted evidence about NLP evaluation datasets, corpora and language models; entries are not independently re-verified by the organizers. The database remains open after the June 23rd, 2024 snapshot used for the report.
The 2024 CONDA report compiles 566 contamination entries covering 91 evaluation datasets and 42 contaminated sources (pre-training corpora or models), submitted by 23 contributors.
Holds for: Snapshot of submissions collected on June 23rd, 2024; a convenience sample of what contributors chose to report rather than a systematic audit of datasets or models.
Which write-up actually collects real reported cases of benchmark data leakage instead of proposing a new way to detect it?
What work compiles documented contamination evidence across pre-training corpora and models rather than introducing a detection method?
I want evidence that benchmark contamination happens in practice, not another detection algorithm -- what should I cite?
Is there a single reference I can point colleagues to for organized evidence that evaluation data leaks into training corpora?
The CONDA 2024 report addresses the gap that although many state-of-the-art model reports mention data contamination, there was little organized, compiled knowledge about documented cases of contamination in practice.
Holds for: As of mid-2024, and about NLP evaluation resources; only works whose evidence was submitted to the shared task are covered.
The CONDA 2024 shared task created the Data Contamination Database, a structured, centralized public registry where researchers submit evidence of evaluation datasets appearing in pre-training corpora or models via GitHub pull requests. Submissions are discussed openly before admission.
Holds for: Community-submitted evidence about NLP evaluation datasets, corpora and language models; entries are not independently re-verified by the organizers. The database remains open after the June 23rd, 2024 snapshot used for the report.
How many reports of test-set leakage were gathered in the 2024 community effort, and how many benchmarks do they cover?
What is the size of the CONDA 2024 contamination database in entries, evaluation datasets and contaminated sources?
How much documented contamination evidence would I be searching through if I used the CONDA database?
Is the CONDA contamination database large enough to be worth consulting for my benchmark?
The 2024 CONDA report compiles 566 contamination entries covering 91 evaluation datasets and 42 contaminated sources (pre-training corpora or models), submitted by 23 contributors.
Holds for: Snapshot of submissions collected on June 23rd, 2024; a convenience sample of what contributors chose to report rather than a systematic audit of datasets or models.
Of the 566 entries in the CONDA report, 432 are contamination events and 144 are non-contamination events. The 432 contamination events break down into 20 train-set, 95 dev-set and 317 test-set reports, a contamination event being any report above 0% contamination.
Holds for: Counts are per (source, dataset split) report; evidence comes from heterogeneous data-based and model-based methods that are hardly comparable to each other.
Which big text collections used to train language models most often contain benchmark test data?
Which pre-training corpora accumulate the most reported contamination events with evaluation datasets?
I am about to pre-train on C4 or RedPajama -- how many benchmark leaks have been reported in each?
If I train on the Pile or OSCAR, how much documented test-set overlap am I inheriting?
Among pre-training corpora, the CONDA report records 35 contamination events for C4, 32 for RedPajama v2, 30 for the Pile and 29 for OSCAR. It records 6 for CommonCrawl itself, 2 each for TheStack and ProofPile, and 1 for xP3.
Holds for: Counts of reported test sets per corpus in the June 2024 snapshot; reflect how much attention each corpus received from contributors, so a lower count does not mean a cleaner corpus.
Which language models have the most reported cases of having seen benchmark test data?
How does reported contamination evidence distribute across closed models such as GPT-3, GPT-4 and PaLM versus open models?
How do I find out how many contamination reports exist for the model I plan to evaluate?
I am choosing between an API model and an open-weights model for evaluation -- which has more documented benchmark contamination?
Most reported contamination evidence in the CONDA report concerns closed models. The counts are 24 events for GPT-3, 17 for GLaM, 16 for GPT-4, 13 for GPT-3.5, 8 for PaLM, 3 for PaLM-2, 2 for GPT-3.5 Turbo and 1 for Claude 3 Opus.
Holds for: Test-set contamination events in the June 2024 snapshot; evidence for closed models comes from model-based membership-inference style methods or from vendors' own technical reports, not from inspecting pre-training data.
For open models the CONDA report records 14 contamination events for models fine-tuned with FLAN data, 5 for Mistral and 3 for Llama 2. It records 2 each for Qwen, Llemma and Aquila 2, and 1 each for mT0 and BLOOMZ.
Holds for: Test-set contamination events in the June 2024 snapshot; counts depend on which open models contributors examined and with which detection method.
Are the popular leaderboard benchmarks everyone uses among the ones reported as leaked?
Which task formats and widely downloaded evaluation datasets dominate reported contamination, and do they overlap with Open LLM Leaderboard suites?
How do I tell whether the benchmarks I use for leaderboard comparisons are among the contaminated ones?
Should I trust MMLU or GLUE numbers when picking a model?
The most-contaminated task types reported to CONDA are text-scoring, QA and multiple-choice QA. They include heavily downloaded benchmarks such as MMLU, GLUE and ai2_arc that are standard in community leaderboards like the Open LLM Leaderboard.
Holds for: Task labels are the Hugging Face hub task_id of each dataset, and popularity is measured by Hugging Face download counts; the same dataset can appear as contaminated for one model and uncontaminated for another.
Are old benchmarks or recent ones more likely to show up in a model's training data?
How do reported contaminated test sets distribute by publication year, and does a model's release date shift that distribution?
If I want a benchmark unlikely to be in a given model's pre-training data, does the benchmark's publication year help me choose?
For evaluating a model released in 2023, is picking an older benchmark safer or riskier than a newer one?
Test sets reported in the CONDA contamination database cluster in the 2018 to 2021 publication period, for both contamination events above 0% and non-contamination events at 0%.
Holds for: Publication years of the datasets contributors submitted, so the distribution partly reflects which benchmarks were popular enough to be tested for contamination.
Newer models in the CONDA report are contaminated with newer benchmarks. GPT-3, launched in 2020, is predominantly contaminated with datasets from 2016, while GPT-4, released in 2023, is mainly contaminated with datasets from 2018 to 2022.
Holds for: Based on the 3 models with the most reported contamination instances, GPT-4, GPT-3 and GPT-3.5; a descriptive pattern in submitted reports, not a controlled comparison.
What are the broad ways people check whether a benchmark ended up in a model's training data?
How does the CONDA report taxonomize contamination detection into data-based and model-based approaches, and how does data or model openness split each family?
How do I check for contamination when the pre-training corpus is not available to search?
I only have API access to a model -- which contamination check can I actually run?
The CONDA 2024 report organizes contamination-detection work into data-based approaches, which search the pre-training corpus for evaluation data, and model-based approaches, which probe a model's outputs without corpus access. Each family is split further by whether the data or model is proprietary or open.
Holds for: A taxonomy of only the works whose evidence was used in the shared task, not a comprehensive survey of contamination-detection methods.
If a benchmark is not listed in the community contamination registry, does that mean it is clean?
What coverage limitations qualify the CONDA 2024 contamination database as evidence, including its non-contamination entries?
How should I interpret the absence of my benchmark from the CONDA contamination database?
Can I treat a benchmark missing from the CONDA database as safe to evaluate on?
The CONDA report states that it covers only a small sample of the exploration space of possible contamination cases, namely those reported during the shared task period in mid-2024.
Holds for: The June 2024 snapshot; the database continues to accept submissions and is intended to be updated as new models and datasets appear.
Of the 566 entries in the CONDA report, 432 are contamination events and 144 are non-contamination events. The 432 contamination events break down into 20 train-set, 95 dev-set and 317 test-set reports, a contamination event being any report above 0% contamination.
Holds for: Counts are per (source, dataset split) report; evidence comes from heterogeneous data-based and model-based methods that are hardly comparable to each other.
Can new evidence of benchmark leakage still be added to the community contamination registry?
Is the CONDA Data Contamination Database open to further contamination-evidence submissions beyond the 2024 shared task period?
How do I submit contamination evidence I found for an evaluation dataset?
I found a test set inside a pre-training corpus -- where do I report it so others see it?
The CONDA 2024 shared task created the Data Contamination Database, a structured, centralized public registry where researchers submit evidence of evaluation datasets appearing in pre-training corpora or models via GitHub pull requests. Submissions are discussed openly before admission.
Holds for: Community-submitted evidence about NLP evaluation datasets, corpora and language models; entries are not independently re-verified by the organizers. The database remains open after the June 23rd, 2024 snapshot used for the report.
The CONDA report states that it covers only a small sample of the exploration space of possible contamination cases, namely those reported during the shared task period in mid-2024.
Holds for: The June 2024 snapshot; the database continues to accept submissions and is intended to be updated as new models and datasets appear.

Claims and scope

Common misreadings

Terminology in this paper

contamination event
In the CONDA Data Contamination Database, a single report that a given split of an evaluation dataset was found at above 0% contamination in a given pre-training corpus or model; reports of exactly 0% are recorded as non-contamination events.
data-based approach
A contamination detection method that inspects the pre-training corpus itself for evaluation data, typically by string or sub-string matching such as 13-gram, 50-character or full-string overlap.
model-based approach
A contamination detection method that estimates a model's contamination by prompting it or analysing its output probabilities, without access to the pre-training data, formulated as a membership inference attack.

How to cite

@inproceedings{DBLP:journals/corr/abs-2407-21530,author       = {Oscar Sainz and
                  Iker Garc{\'{\i}}a{-}Ferrero and
                  Alon Jacovi and
                  Jon Ander Campos and
                  Yanai Elazar and
                  Eneko Agirre and
                  Yoav Goldberg and
                  Wei{-}Lin Chen and
                  Jenny Chim and
                  Leshem Choshen and
                  Luca D'Amico{-}Wong and
                  Melissa Dell and
                  Run{-}Ze Fan and
                  Shahriar Golchin and
                  Yucheng Li and
                  Pengfei Liu and
                  Bhavish Pahwa and
                  Ameya Prabhu and
                  Suryansh Sharma and
                  Emily Silcock and
                  Kateryna Solonko and
                  David Stap and
                  Mihai Surdeanu and
                  Yu{-}Min Tseng and
                  Vishaal Udandarao and
                  Zengzhi Wang and
                  Ruijie Xu and
                  Jinglin Yang},
  title        = {Data Contamination Report from the 2024 {CONDA} Shared Task},
  year         = {2024},
  url          = {https://doi.org/10.18653/v1/2024.conda-1.4},
  doi          = {10.18653/V1/2024.CONDA-1.4},
  eprinttype    = {arXiv},
  eprint       = {2407.21530},
  timestamp    = {Thu, 26 Feb 2026 00:00:00 +0100},
  biburl       = {https://dblp.org/rec/conf/conda/SainzGJCEAGCCCDDFGLLPPS24.bib},
  bibsource    = {dblp computer science bibliography, https://dblp.org},
  editor       = {Oscar Sainz and
                  Iker Garc{\'{\i}}a{-}Ferrero and
                  Eneko Agirre and
                  Jon Ander Campos and
                  Alon Jacovi and
                  Yanai Elazar and
                  Yoav Goldberg},
  booktitle    = {The First Data Contamination Workshop, {CONDA} 2024, August 16, 2024,
                  Bangkok, Thailand, Proceedings of the Workshop},
  pages        = {41--56},
  publisher    = {Association for Computational Linguistics}
}

References

See the full reference list in the paper.