🤖 AI

A Controlled Audit of Pretraining Contamination in Public Medical Vision-Language Benchmarks

This paper audits public medical vision-language benchmarks for pretraining contamination and finds measurable image-source overlap and text-exchangeability signals, while demonstrating that cohort-relative detectors like Min-K%++ are unreliable for small medical cohorts due to false positives from non-medical models.

Original authors: Bruce Changlong Xu, Lan Wu, Alexander Ryu

Published 2026-06-10

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Bruce Changlong Xu, Lan Wu, Alexander Ryu

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you are a teacher trying to grade a student's final exam. You want to know if the student truly understands the material or if they just memorized the answers from a cheat sheet they found in the library.

This paper is like a very strict, scientific audit of that situation, but instead of a student, we are looking at AI models (specifically, "Vision-Language Models" that can look at medical images and answer questions). Instead of a library, the "cheat sheet" is the massive amount of data these AI models were trained on before they ever saw the exam questions.

Here is the breakdown of what the researchers did and found, using simple analogies:

The Setup: The "Leaked" Exam

Medical AI models are tested on public datasets (like SLAKE, PathVQA, and VQA-RAD). These datasets have been available online for 3 to 7 years. The problem is that these same datasets might have been accidentally included in the "training library" (the internet data) the AI studied before the test. If the AI saw the exact same questions and pictures during training, its high score isn't proof of intelligence; it's proof of cheating (or "contamination").

The researchers wanted to find out: Did the AI cheat? And more importantly, can we trust the tools we use to catch cheaters?

The Four "Detectives"

The team used four different methods (detectors) to try and catch the AI. Think of these as four different ways to spot a cheater:

The "Look-Alike" Detective (Image Side): This detective looks at the medical pictures in the test and asks, "Does this picture look exactly like a picture in the training library?"
The "Order" Detective (Text Side): This detective checks if the AI performs better when the questions are in the exact order they were originally released online. If the AI knows the order, it might have memorized the sequence.
The "Group Average" Detective (Tail Enrichment): This detective compares one AI's answers to the average of a group of other AIs. If one AI is much better at specific hard questions than its friends, it might have seen them before.
The "Friendship" Detective (Cross-Model Overlap): This detective looks at two different AIs. If they both get the same specific hard questions right, they might be sharing the same cheat sheet.

The Findings: Who Got Caught?

1. The "Look-Alike" Detective found a lot of "Source Overlap" on SLAKE.

The Finding: About 20% of the pictures in the SLAKE test had a "twin" in the training library.
The Twist: When the researchers looked closely, they realized these weren't exact copies (like a photocopy). They were pictures of different patients but taken from the same angle and using the same type of machine (e.g., two different people's chest X-rays).
The Verdict: The AI didn't memorize the specific patient's photo. However, the test and the training data came from the same "neighborhood." It's like the student studied a textbook that had the same types of diagrams as the exam. It's a source overlap, not a direct copy-paste cheat.

2. The "Order" Detective found one real cheater.

The Finding: One model (Qwen2.5-VL) seemed to know the SLAKE test questions too well when they were in their original order.
The Verification: The researchers tried to trick the AI by shuffling the questions. The AI's "cheating" signal disappeared. They also tested a non-medical AI (BLIP-2) on the same test, and it didn't show this signal.
The Verdict: This is strong evidence that this specific model likely saw the SLAKE questions during training.

3. The "Group Average" and "Friendship" Detectives were unreliable.

The Finding: These detectors flagged several models as cheaters.
The Twist: When the researchers added a "control" model (BLIP-2) that definitely didn't study medical data, this control model also got flagged!
The Verdict: These detectors are broken for small groups of medical AIs. They are confusing "being good at simple questions" with "cheating." It's like a teacher assuming a student is cheating just because they got the easy math problems right, while the other students in the class were bad at math. The detectors need a "non-medical" baseline to work correctly.

4. The "Clean" Benchmark: VQA-RAD.

The Finding: The VQA-RAD test was clean. None of the detectors found evidence of cheating on this specific dataset.
The Verdict: If you want to test a medical AI safely, use VQA-RAD. It's the "safest" exam.

The Big Lesson: How to Audit Audits

The most important part of this paper isn't just about which AI cheated; it's about how we catch cheaters.

The researchers discovered that some popular tools for detecting data leaks (the "Group Average" and "Friendship" detectors) give false alarms if you don't have a "control group" (a model that definitely didn't cheat) to compare against. Without that control, you might accuse an honest student of cheating just because the other students in the class were struggling.

Summary of Recommendations

Based on their audit, the authors suggest:

Use VQA-RAD as the safest test for medical AI.
Be careful with SLAKE: Many images there look like training data, so results might be inflated.
Don't trust the "Group Average" detectors unless you compare them against a non-medical baseline.
OmniMedVQA is contaminated: Don't use the public version of this dataset for testing; it's too likely to be in the training data.

In short: The researchers built a better "lie detector" for AI testing, found that some existing lie detectors are broken, and identified which medical exams are safe to use and which ones might be rigged.

Technical Summary: A Controlled Audit of Pretraining Contamination in Public Medical Vision–Language Benchmarks

Problem Statement
Medical Vision–Language Models (VLMs) are evaluated on a small set of public benchmarks (e.g., SLAKE, PathVQA, VQA-RAD) that have been freely downloadable for 3–7 years. Reported accuracy metrics implicitly assume these examples were absent from model pretraining. However, these datasets appear in widely scraped open mixes like PMC-OA-beta, creating a risk of "benchmark leakage" where models have memorized test examples, inflating performance metrics. While text-LLM contamination and general-VLM contamination have been audited, medical-VLM contamination remains largely unaudited. Furthermore, existing leakage detectors have not been rigorously stress-tested against external baselines in the medical domain, raising concerns about false positives driven by cohort calibration heterogeneity rather than actual data exposure.

Methodology
The authors conduct a controlled audit of four open VLMs (InternVL3-8B, Qwen2.5-VL-7B-Instruct, CheXagent-8b, LLaVA-OneVision-Qwen2-7B) across three held-out medical VQA benchmarks (SLAKE-En, PathVQA, VQA-RAD). A text-side extension includes a fifth model, MedGemma-4B-IT, on a public mirror of OmniMedVQA.

The study employs and stress-tests four distinct contamination detectors:

Image-side Near-Neighbour Overlap: Embeds benchmark images and PMC-OA-beta figures (1.85M images) using SigLIP backbones (ViT-B-16 and ViT-SO400M). Flags images with extreme cosine distance proximity to PMC figures.
Canonical-Order Exchangeability: Tests if the joint log-likelihood of a dataset is invariant to ordering. A significant deviation suggests the model was trained on the data in its canonical release order.
Cohort-Relative Min-K%++ Tail Enrichment: Identifies examples where a target model's "surprise" (Min-K%++ score) is anomalously low compared to the median of the cohort.
Cross-Model Top-K Overlap: Measures Jaccard similarity of the top-K easiest examples across different models, assuming shared training data causes shared ease.

Control Mechanisms
Crucially, every detector is calibrated against external pre-domain baselines to distinguish true leakage from artifacts:

Image-side: Manual adjudication of flagged images and negative controls using out-of-domain images (paintings, natural photographs) and in-domain clean images (VQA-RAD).
Text-side: Introduction of BLIP-2 (a non-medical, pre-2023 baseline) and InstructBLIP as external baselines. If a detector flags a medical model but also flags BLIP-2 (which cannot have medical VQA exposure), the signal is attributed to cohort calibration or benchmark structure rather than memorization.
Ordering Ablation: Re-running exchangeability tests on content-derived orderings (e.g., hash-based) to distinguish between training exposure and release-order artifacts (e.g., grouping by source slide).

Key Results

Image-Side Source Overlap (SLAKE-En): 19.8% of SLAKE-En images have an extreme near-neighbour in PMC-OA-beta under SigLIP-B-16 (4.2% under SO400M). Manual adjudication of 20 flagged images revealed these are same-modality, same-projection images of different patients, not pixel-level duplicates. This indicates source/distributional overlap rather than verified per-image memorization. The effect on gold-answer likelihood is negligible (below the cross-model noise floor).
Text-Side Exchangeability:
- Qwen2.5-VL × SLAKE-En: Produced a significant signal ( $p = 5.0 \times 10^{-4}$ ) that survived ordering ablation and external baseline checks (BLIP-2 and InstructBLIP were clean). This is the only robust evidence of text-side leakage in the held-out audit.
- LLaVA-OneVision × PathVQA: Produced a significant signal, but it was retracted as a release-order artifact. BLIP-2 reproduced the signal, and the signal vanished under hash-based reordering, implicating the benchmark's grouping by source slide rather than model-specific exposure.
- OmniMedVQA: Exchangeability fired for all five medical/general models but remained clean for BLIP-2, suggesting the public mirror is contaminated for text-side evaluation.
Failure of Cohort-Relative Detectors (Min-K%++ and Top-K):
- On SLAKE-En, Detectors 3 and 4 flagged CheXagent and LLaVA-OneVision for tail enrichment and top-K overlap.
- Falsification: Adding BLIP-2 to the cohort reproduced these exact signals (BLIP-2 showed the same tail enrichment and top-K overlap). Since BLIP-2 cannot share medical VQA exposure, the detectors are shown to be unreliable as standalone membership-inference signals on small medical cohorts. The signals are driven by inter-model calibration heterogeneity (some models are systematically "easier" on low-entropy closed-form answers) rather than shared training data.
Clean Benchmarks: VQA-RAD remained clean across all signals and models, serving as a reliable sanity check.

Claims and Significance
The paper claims to provide the first controlled audit of medical-VLM contamination, offering a methodological framework that prioritizes external pre-domain baselines and manual adjudication over raw detector scores.

Methodological Contribution: The study demonstrates that cohort-relative detectors (Min-K%++, Top-K overlap) are prone to false positives due to calibration heterogeneity and must be paired with external baselines. It validates image-side near-neighbour detection as a measure of source overlap (not necessarily memorization) and canonical-order exchangeability as a robust text-side signal when supported by ablation and baselines.
Practical Recommendations:
1. Prefer VQA-RAD as the safest held-out benchmark.
2. Inspect or down-weight SLAKE-En images flagged for source overlap before reporting.
3. Treat the public OmniMedVQA mirror as contaminated for text-side evaluation.
4. Never use cohort-relative Min-K%++ or top-K overlap as standalone leakage signals without an external pre-domain baseline.
Limitations: The audit is limited to four primary VLMs and specific benchmarks. The findings identify statistical contamination signals, not provable training-data inclusion. The authors emphasize that positive signals are circumstantial evidence requiring careful interpretation to avoid unfairly discrediting benchmarks or models.

Conclusion
The audit reveals that while some medical benchmarks (SLAKE-En) suffer from significant source overlap with pretraining corpora, this does not necessarily equate to per-image memorization that inflates performance. More critically, the study exposes a methodological flaw in relying on cohort-relative detectors without external baselines, showing that such signals can be entirely driven by model calibration differences rather than data leakage. The paper advocates for a more rigorous, controlled approach to contamination auditing in medical AI.