💬 NLP

Evaluating Latent Knowledge of Public Tabular Datasets in Large Language Models

This paper proposes a novel framework using controlled query transformations and statistical testing to detect data contamination in large language models on tabular datasets, revealing that performance on four out of eight widely used datasets is likely inflated due to prior exposure rather than genuine generalization.

Original authors: Matteo Silvestri, Fabiano Veglianti, Flavio Giorgi, Fabrizio Silvestri, Gabriele Tolomei

Published 2026-03-31

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Matteo Silvestri, Fabiano Veglianti, Flavio Giorgi, Fabrizio Silvestri, Gabriele Tolomei

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you are a teacher giving a final exam to a class of very smart students (the Large Language Models, or LLMs). You want to know if they truly understand the subject matter or if they just memorized the answer key from a previous year's test.

In the world of AI, this is called data contamination. It happens when an AI model "cheats" by having seen the test questions during its training phase.

This paper is about a new, clever way to catch AI models cheating on tabular data (data organized in rows and columns, like spreadsheets), which has been a blind spot in previous testing methods.

Here is the breakdown of their approach using simple analogies:

1. The Problem: The "Cheat Sheet" vs. Real Learning

Previously, researchers tried to catch cheating by asking the AI to recite specific rows of data word-for-word.

The Old Way: Imagine asking a student, "What was the name of the 45th person on the list?" If they say the name, they cheated. If they don't, they pass.
The Flaw: This is too easy to fool. A smart student might have memorized the pattern of the list (e.g., "People with high salaries usually have PhDs") without memorizing the specific names. They can answer correctly without having the "cheat sheet" in their pocket. The old tests were too blunt; they missed the subtle cheating.

2. The Solution: The "Shape-Shifting" Test

The authors created a framework that acts like a magical shape-shifting test. They take a real dataset (the "Real" version) and create three "trick" versions of it to see how the AI reacts.

Think of it like testing a detective's knowledge of a crime scene:

The Real Version: The original crime scene photo.
The "Like" Version (The Shuffle): Imagine taking all the clothes from the suspects' lockers and mixing them up randomly. The types of clothes are the same, but no one is wearing their original outfit. If the AI still gets it right, it just knows general fashion trends, not the specific crime.
The "Swapped" Version (The Code): Imagine the police report where every name is replaced with a code (Suspect A, Suspect B) and every location is a number. The relationships are the same, but the labels are gone. If the AI gets this right, it understands the logic of the case, not just the names.
The "Obfuscated" Version (The Blur): Imagine the photo is so blurry and the text is so scrambled that you can't read any words or recognize any faces. If the AI gets this right, it's using pure logic.

3. The Two Games They Play

To test the AI, they play two specific games with these shape-shifted versions:

Game A: "Fill in the Blanks" (Completion)
- The Setup: They show the AI a row of data but hide one piece (like hiding a person's job title).
- The Question: "Based on the other info, what is the missing job?"
- The Trap: If the AI guesses correctly on the Real version but fails on the Shuffled or Code versions, it means it didn't just learn general rules; it specifically memorized that specific person's file. That is contamination.
Game B: "Spot the Imposter" (Existence)
- The Setup: They show the AI five different rows of data. One is real; four are fake but look very similar.
- The Question: "Which one of these actually exists in the original dataset?"
- The Trap: If the AI can spot the real one in the Real version but gets confused when the names are scrambled (Obfuscated), it proves it recognized the specific "fingerprint" of the data it saw before.

4. The Results: Catching the Cheaters

The researchers tested this on 8 famous datasets (like the Titanic passenger list or adult income data) using 7 different AI models.

The Old Test (Memorization): Failed to find cheating on most datasets. It was like asking the student to recite the whole phone book; they said "I don't know," so the teacher thought they were honest.
The New Test: Caught the AI "cheating" on 4 out of the 8 datasets (including the famous Titanic and Adult datasets).
- The AI performed amazingly well on the Real version (knowing the specific rows).
- But when they scrambled the data (Swapped/Obfuscated), the AI's performance dropped significantly.
- Conclusion: The AI wasn't just smart; it had seen this specific data before and memorized the specific combinations.

5. Why This Matters

This is a big deal because:

Scores are Inflated: If an AI gets a high score on a benchmark because it memorized the answers, we think it's smarter than it actually is. It's like a student getting an 'A' because they memorized the test, not because they learned the math.
Model Size Matters: The bigger the AI model, the better it was at "cheating." This suggests that as models get huge, they are more likely to have accidentally swallowed the test data during training.
Trust: We need to know if an AI is truly learning or just recalling. This new "shape-shifting" test is a magnifying glass that reveals the cheating that the old tests missed.

In a nutshell: The authors built a "lie detector" for AI data. Instead of asking "Do you remember this exact sentence?", they ask, "Do you remember this specific pattern, even if we change the words?" The answer is often "Yes," proving that many popular AI models have been cheating on their exams all along.

1. Problem Statement

The paper addresses the critical issue of data contamination in Large Language Models (LLMs), specifically within the domain of tabular data.

Definition: Contamination occurs when a model's training data overlaps with its evaluation (test) data. This leads to inflated performance metrics that reflect memorization rather than genuine generalization.
The Gap: While contamination in text benchmarks is well-studied, it remains largely unexplored for tabular data. Existing detection methods rely on verbatim memorization tests (checking if a model can reproduce exact rows). The authors argue these are too coarse; a model can be contaminated (possessing prior knowledge of a dataset's distribution) without being able to reproduce specific rows verbatim.
Consequence: Current evaluations of LLMs on public tabular benchmarks (e.g., Titanic, Adult, Iris) may be invalid, as high scores could stem from prior exposure rather than true reasoning capabilities.

2. Methodology: The Proposed Framework

The authors introduce a novel framework to detect contamination by moving beyond verbatim recall to latent knowledge assessment. The core idea is to generate controlled dataset variants and use comparative evaluation to isolate contamination signals.

A. Dataset Variants

For any given public tabular dataset, the framework generates four aligned variants to test different types of knowledge:

Real: The original, unmodified dataset.
Like: Columns are independently resampled from their empirical marginal distributions. This preserves column-level statistics but destroys row-level dependencies (joint distributions). High performance here suggests knowledge of general statistics, not specific rows.
Swapped: Applies a within-column bijection (permutation) to categorical values and a linear map to numerical values. No value maps to itself. This preserves row structure and co-occurrence patterns but removes semantic meaning.
Obfuscated: Feature names and categorical values are replaced with anonymous codes (e.g., $f_1, c_2$ ). This removes all semantic cues, testing if the model knows the specific structural patterns of the dataset without relying on world knowledge or feature names.

B. Evaluation Probes

The framework uses five-way multiple-choice queries aligned across all variants:

Completion Task: A row is partially masked (e.g., 20% of columns hidden), and the model must select the correct values for the missing cells from five options.
Existence Task: The model is shown five complete rows (one real, four distractors) and must identify which one exists in the dataset.

C. Baselines and Statistical Testing

To distinguish between general statistical reasoning and contamination, the framework compares LLM performance against three non-neural baselines:

Random Baseline: Uniform random selection (chance level).
Deterministic Baseline: Selects the option with the highest probability based on column-wise empirical marginals (Laplace smoothing).
Stochastic Baseline: Samples options based on the marginal probability distribution.

Decision Rule: Contamination is detected if the LLM performs significantly better than the random baseline on the Real variant (using McNemar's test, $\alpha=0.01$ ). Furthermore, the framework analyzes performance drops across variants:

If performance drops on Like, the model relies on row-level structure, not just marginals.
If performance drops on Swapped or Obfuscated, the model relies on specific dataset semantics or exact row memory.

3. Key Contributions

First Framework for Tabular Contamination: Introduces a dual-task (completion/existence) multiple-choice benchmark specifically designed to detect latent knowledge in tabular datasets, rather than just verbatim memorization.
Principled Detection Criteria: Proposes a statistical testing procedure comparing LLMs against non-neural baselines to formally identify contamination, avoiding the ambiguity of raw accuracy scores.
Empirical Evidence of Contamination: Demonstrates that existing memorization-based tests fail to detect contamination in many cases, whereas the proposed framework reveals significant contamination in widely used datasets.
Contamination Registry: Provides a comprehensive registry of contamination status across 8 datasets and 7 LLMs of varying scales.

4. Experimental Results

The authors evaluated 7 LLMs (Mistral-7B, Qwen-7B/14B/32B, Llama-8B/70B, GPT-OSS) on 8 public datasets (Adult, Blood, Credit, Diabetes, Gamma, Iris, Mushroom, Titanic) and a synthetic control.

Failure of Memorization Tests: Standard verbatim row-reconstruction tests (e.g., Bordt et al., 2024) failed to detect contamination on canonical datasets like Adult and Titanic, showing near-zero accuracy.
Success of Proposed Framework:
- Detected Contamination: The framework found clear evidence of contamination in 4 out of 8 datasets: Adult, Credit, Iris, and Titanic.
- Scale Dependency: Contamination signals generally became stronger as model parameter size increased (e.g., Llama-70B showed stronger signals than Llama-8B).
- Task Sensitivity: The Completion task was found to be more sensitive to contamination than the Existence task.
- Negative Controls: The framework correctly returned negative results for the Mushroom dataset and the Synthetic dataset (which was guaranteed to be unseen), proving it does not falsely flag all public benchmarks.
Interpretation of Variants:
- On Titanic, models performed well on Real but dropped significantly on Swapped and Obfuscated, indicating the contamination relies on the specific semantic structure of the original dataset.
- On Adult, models performed well on Real and Like, suggesting they may have learned strong marginal distributions, but the statistical test against baselines still confirmed contamination.

5. Significance and Implications

Validity of Benchmarks: The findings suggest that performance on downstream tabular tasks involving public datasets may be substantially inflated. Claims of "generalization" or "reasoning" on these benchmarks are questionable if contamination is not ruled out.
Model Comparison Bias: Contamination can bias comparisons between model sizes. Larger models may appear superior not because they generalize better, but because they are better at exploiting prior exposure to the benchmark data.
Methodological Shift: The paper argues that contamination assessment should become a standard part of LLM evaluation, similar to dataset documentation or significance testing.
Limitations: The framework can detect the presence of contamination but cannot prove its absence (a negative result means no evidence was found, not that the model is clean). It is also less sensitive to very old, widely circulated datasets where the signal might be too diffuse.

In conclusion, this work provides a rigorous, fine-grained tool to expose the "hidden" prior knowledge LLMs possess about tabular data, challenging the reliability of current evaluation practices in structured data domains.