Benchmark Contamination Has Made Model Leaderboards Harder to Read Than the Numbers Suggest

The credibility problem facing AI benchmarks is structural rather than the result of bad faith. Models are trained on large scrapes of the public internet; benchmark test sets are published on the public internet so that results can be reproduced. The intersection is unavoidable, and it means a model can score well on an evaluation because it has the underlying capability, or because the test items and their answers appeared somewhere in its training data. The score is identical in both cases. This is not an accusation about any particular lab — it is a property of the setup that applies to everyone training on web-scale data. Detection is genuinely difficult. The obvious approach, checking for verbatim overlap between training corpus and test set, catches only the crudest case; a benchmark question restated on a forum, translated, or worked through in a tutorial provides the same advantage without matching any string. Researchers have developed indirect indicators — comparing performance on original items against freshly written equivalents, checking whether a model can reproduce a test set's formatting or item ordering, measuring performance gaps between benchmark items published before and after a training cutoff — but these produce evidence rather than proof, and the labs best positioned to check are the ones with the least incentive to publish a negative result about their own model. The mitigations in use each cost something. Held-out private test sets prevent contamination but require trusting the evaluator, and cannot be independently reproduced. Continuously refreshed benchmarks with newly written items sidestep the training cutoff but make results incomparable across time, since a score on this quarter's items is not a score on last quarter's. Dynamic evaluations that generate problems procedurally resist memorization but tend to measure a narrower and more artificial skill than the static benchmark they replaced. There is no option that is simultaneously reproducible, contamination-resistant, and comparable across model generations. The practical consequence for anyone selecting a model is that public leaderboard position is weak evidence for a specific deployment. The evaluation that survives this problem is the boring one: a held-out set of real examples from the actual task, written or collected by the team deploying the model, never published anywhere. It does not generalize, it does not produce a number comparable to anyone else's, and it is the only measurement in this space with no contamination pathway — which is why teams that have been burned by a benchmark-topping model underperforming in production almost always end up building one.