LLM Benchmark Datasets Should Be Contamination-Resistant

Technical Summary: LLM Benchmark Datasets Should Be Contamination-Resistant

Problem Statement
The reliability of Large Language Model (LLM) evaluation is fundamentally compromised by benchmark dataset contamination. As pretraining corpora grow to include trillions of tokens from nearly all available text data, benchmark samples are increasingly ingested during training. This phenomenon, exacerbated by the public availability of datasets and indirect leakage through distillation or derivative datasets, allows models to memorize rather than generalize. Consequently, reported accuracy often reflects a model's capacity to recall pretraining data rather than its true reasoning capabilities, rendering static benchmarks obsolete and inflating performance metrics. Existing mitigation strategies—such as private benchmarking, dynamic benchmarking, or data decontamination—suffer from significant drawbacks, including stifling independent verification, creating moving targets that hinder longitudinal comparison, or failing to scale against massive, heterogeneous corpora.

Methodology: Contamination-Resistant Datasets (CRDs)
The paper proposes a paradigm shift toward Contamination-Resistant Datasets (CRDs). The core thesis is that benchmark data should be released in a form that is unlearnable during standard pretraining pipelines but remains useful for inference. This is achieved by exploiting the architectural asymmetry between the training and inference pipelines of the Transformer architecture.

1. Training-Inference Asymmetry:

   • Training: Requires access to the full sequence of tokens to compute hidden states and gradients for next-token prediction.
   • Inference: Can proceed using only the Key-Value (KV) cache from previous tokens and the penultimate layer hidden state of the final token, without needing the raw token sequence.
   • Mechanism: Instead of releasing plaintext prompts ($D$), the authors propose releasing a transformed dataset $\phi(D)$ consisting of:
     • The KV cache $\{K^{(l)}_{1:t}, V^{(l)}_{1:t}\}_{l=1}^L$ for each layer.
     • The penultimate layer hidden state $h^{(L-1)}_t$.
     • The ground truth output $Y$ (in plaintext).
   • This format allows a model to perform autoregressive generation (inference) but prevents it from using the data for training (learning), as the raw tokens required to compute gradients are absent.

2. Interoperability Frameworks:
   To address the challenge of evaluating heterogeneous models against a benchmark encoded in a specific model's latent space, the paper outlines two paradigms:

   • Near-Term (Anchor Model + Subspace Alignment): Designate a widely adopted "anchor" model (e.g., a specific LLaMA variant) to encode benchmarks. Target models translate these encodings into their own latent spaces using techniques like Cross-LoRA (subspace alignment via SVD and linear maps) or Trans-LoRA (knowledge distillation). This allows translation without access to the original plaintext.
   • Long-Term (Model-Agnostic Relative Representations): Project all model latent spaces onto a shared coordinate frame defined by a fixed set of anchor samples. Using relative representations (vectors of similarities to anchors), models can communicate zero-shot across architectures without needing a specific canonical encoder.

3. Formal Properties:
   The paper defines three necessary properties for CRDs:

   • Irreversibility: It must be computationally infeasible to reconstruct the original plaintext from the KV cache/hidden states. The paper notes that while inversion attacks exist for Multi-Head Attention (MHA), they are less effective on modern Grouped-Query Attention (GQA) architectures, and lossy abstraction further hinders recovery.
   • Equivalence: The model's performance on the CRD must approximate its performance on the original plaintext ($M(\phi(D)) \approx M(D)$).
   • Interoperability: The CRD must be translatable across different LLM architectures.

Key Contributions

• Conceptual Framework: Formalizes the definition of Contamination-Resistant Datasets (CRDs) and establishes the theoretical basis for unlearnable yet inferable data.
• Architectural Leverage: Identifies and leverages the specific asymmetry in Transformer pipelines (KV cache availability vs. token sequence necessity) as a mechanism to prevent training while enabling inference.
• Interoperability Solutions: Proposes concrete mathematical pathways (subspace alignment and relative representations) to ensure CRDs are not locked to a single model architecture, addressing the "model-specificity" objection.
• Evaluation Framework: Outlines a complete workflow for CRD curation, discovery (translation), and model evaluation, including a "datacard" system to facilitate translation.

Results and Feasibility Analysis
The paper does not present new empirical results from running these benchmarks on specific models but relies on existing literature to validate feasibility:

• Storage Overhead: The authors analyze the storage requirements for releasing KV caches. While a raw KV cache for 100K tokens in a 7B model could be ~50GB, the paper demonstrates that compression techniques (e.g., PyramidKV, quantization, sparse encoding) can reduce this to manageable sizes (e.g., ~350 MB for 100K tokens) with negligible impact on fidelity.
• Translation Fidelity: Citing recent work on model stitching and cross-model adapter transfer, the paper argues that translation between architectures introduces only limited performance degradation, and in some cases, can even improve inference speed.
• Security: The paper acknowledges that inversion attacks are possible on MHA architectures but argues that modern GQA-based models and lossy abstractions make plaintext recovery computationally difficult. It suggests defensive mechanisms like noise injection or differential privacy for high-stakes scenarios.

Significance and Claims
The paper positions itself as a call to action for the community to fundamentally shift how benchmarks are released. Its significance lies in:

1. Restoring Evaluation Integrity: By making benchmarks unlearnable, CRDs aim to restore the validity of LLM evaluation, ensuring scores reflect generalization rather than memorization.
2. Scalability: Unlike private benchmarking (which creates bottlenecks) or dynamic benchmarking (which is short-lived), CRDs offer a scalable, static solution that does not require constant re-creation or centralized control.
3. Practical Path Forward: The authors argue that CRDs are a practical solution that balances the need for open, reproducible evaluation with the reality of data contamination. They call for the community to:
   • Advance contamination-resistant methodologies.
   • Develop supporting platforms and standardized anchor models.
   • Integrate CRD validation into existing pipelines (e.g., Hugging Face).

The paper concludes that while CRDs introduce new complexities (such as storage and translation overhead), these are manageable and necessary to ensure the long-term reliability of LLM benchmarking.