Living with It

Lesson 3 of 3 in Data Contamination.

You cannot un-publish a benchmark, and you cannot audit the internet. Once you accept that public benchmarks are contaminated by default — some badly, some barely, mostly unknowably — the useful question stops being is this score clean? and becomes how much weight should this score carry in my decision?

Four working rules answer it. First: decide on private data. A Held-out set that has never been published cannot be in anyone’s training corpus. For decisions with consequences — choosing a model, approving a prompt change, signing off a migration — your own private set outranks every public number. Second: weight freshness. Test items written after a model’s Knowledge cutoff cannot have been trained on, which makes fresh and regularly refreshed benchmarks structurally more trustworthy — with two caveats: cutoff dates are self-reported, and freshness starts decaying the day the items are published. Third: treat public-benchmark deltas skeptically. When a new model jumps on a years-old public benchmark, capability gain and leakage look identical from scoreboard distance; the jump is a lead to investigate, not a result to act on. Fourth: build your own Golden set from your real traffic, so the first three rules have something to stand on.

How much should this score move you?

Interactive decision tree — outcomes:

  • Trust it most

    Nobody else’s crawl can contain items that were never on the web. This is the one score with a chain of custody you control — provided you guard the set (see In production below). Let it anchor decisions.

  • Strong signal, short shelf life

    Items written after training cannot have been memorized from it. Two caveats keep this honest: cutoff dates are self-reported, and the clock starts the moment items are published — re-check freshness for every new model you evaluate.

  • Bounded, not clean

    A reported overlap scan rules out verbatim contamination above its threshold — and says nothing about paraphrased or translated copies. Use the score as one signal, and corroborate on your own set before it drives a decision.

  • Scoreboard distance

    From here, memory and capability produce the same number and you have no way to tell them apart. Fine for building a shortlist; not fine as the reason you ship. Confirm on your private set first.

Everything above assumes you have a private set worth trusting: items drawn from your real traffic, graded against your definition of good, versioned, and rerun through your Eval harness on every model or prompt change. Building one is a discipline of its own, covered end to end in Building an Eval Harness — and it pays off far beyond contamination, because the same Golden set powers Regression testing when models change under you. (If what you need to evaluate is a multi-step agent’s trajectory rather than a model’s answers, that is our sister AI Agent Academy’s territory — though the guarding rules below apply to its eval sets just the same.)

In production

Your private eval set is the one benchmark nobody else can contaminate. That inverts the threat model: the only party who can leak it is you — by publishing items, pasting them into public threads, or sending them to endpoints that may use inputs for training. Treat the set like credentials.

AWS

Keep the golden set in a private, versioned S3 bucket with least-privilege IAM access, so graders always run against a known revision and copies do not scatter. Before eval traffic touches Amazon Bedrock, confirm in the current service terms and each model provider’s terms whether inputs can be used for model improvement — and route eval runs away from any logging or analytics pipeline that leaves your control.

Azure

Store the set in access-controlled storage with RBAC and versioning, and read the current Azure OpenAI / Azure AI Foundry data-and-privacy documentation before evals run: confirm what is retained, for how long, and whether any review process applies — abuse-monitoring mechanisms, for example, can involve retention you should know about. Keep golden-set items out of shared telemetry and out of playground sessions on loosely governed accounts.

Google Cloud

Same drill on Google Cloud: private, versioned storage behind IAM, and a read of Vertex AI’s current generative-AI data-governance documentation to confirm training-use and retention commitments before your items touch an endpoint. And never “quick-test” golden-set items in consumer-grade chat products — consumer terms often differ from cloud-platform terms precisely on training use.

Interactive checkpoint quiz (2 questions) — open this page in a browser to take it.