ai-research-survey

scan.json (32417B)

---

 {
   "paper": {
     "title": "PaCoST: Paired Confidence Significance Testing for Benchmark Contamination Detection in Large Language Models",
     "authors": [
       "Huixuan Zhang",
       "Yun Lin",
       "Xiaojun Wan"
     ],
     "year": 2024,
     "venue": "Conference on Empirical Methods in Natural Language Processing",
     "arxiv_id": "2406.18326",
     "doi": "10.48550/arXiv.2406.18326"
   },
   "scan_version": 3,
   "active_modules": ["experimental_rigor", "data_leakage"],
   "methodology_tags": ["benchmark-eval"],
   "key_findings": "PaCoST detects benchmark contamination by comparing model confidence on original vs. rephrased benchmark instances via paired t-test, satisfying five desirable properties no prior method achieves simultaneously. In controlled experiments with intentionally contaminated Llama-2 and Mistral models, PaCoST achieves zero false positives and zero false negatives. Applied to 10 open-source LLMs across 6 popular benchmarks, nearly all model-benchmark pairs show some contamination evidence, calling into question the trustworthiness of standard benchmark evaluations.",
   "checklist": {
     "artifacts": {
       "code_released": {
         "applies": true,
         "answer": false,
         "justification": "The paper states 'Our code will be released at https://github.com/lleozhang/PaCoST' (Section 1 footnote). This is a promise of future release, not an actual release."
       },
       "data_released": {
         "applies": true,
         "answer": true,
         "justification": "All benchmarks used are publicly available: WMDP (Li et al., 2024), MMLU, HellaSwag, ARC-E, ARC-C, TruthfulQA, WinoGrande. No proprietary data was collected."
       },
       "environment_specified": {
         "applies": true,
         "answer": false,
         "justification": "No requirements.txt, Dockerfile, or environment setup instructions are provided. The paper does not specify library versions or dependencies needed to reproduce the experiments."
       },
       "reproduction_instructions": {
         "applies": true,
         "answer": false,
         "justification": "No step-by-step reproduction instructions or README with commands are provided. The algorithm pseudocode (Algorithm 1) describes the method but not how to run it."
       }
     },
     "statistical_methodology": {
       "confidence_intervals_or_error_bars": {
         "applies": true,
         "answer": false,
         "justification": "Results are reported as point-estimate p-values (Tables 2, 3, 4) without confidence intervals or error bars. No uncertainty bounds are provided on the p-values or the underlying confidence differences."
       },
       "significance_tests": {
         "applies": true,
         "answer": true,
         "justification": "The entire method is built on a paired samples t-test (Section 4.3). P-values are reported for all experiments, with the standard p < 0.05 threshold for significance. This is the core contribution of the paper."
       },
       "effect_sizes_reported": {
         "applies": true,
         "answer": false,
         "justification": "Only p-values are reported in all results tables (Tables 2, 3, 4). No effect sizes (Cohen's d, mean confidence difference magnitudes, or similar) are provided, making it impossible to assess the practical magnitude of the detected contamination signal."
       },
       "sample_size_justified": {
         "applies": true,
         "answer": false,
         "justification": "Sample sizes of 1000 trained and 400 untrained samples are stated, but the authors note 'The choice of number of samples are just for simplicity' (Section 5.1). No power analysis is provided. Table 3 shows stability across 100-1000 samples but this is post-hoc validation, not justification."
       },
       "variance_reported": {
         "applies": true,
         "answer": false,
         "justification": "Table 7 shows p-values across 5 random seeds but does not report standard deviation or spread of the underlying confidence differences. The main results (Tables 2, 4) appear to be single-run results with no variance information."
       }
     },
     "evaluation_design": {
       "baselines_included": {
         "applies": true,
         "answer": true,
         "justification": "Guided-Prompting (Golchin & Surdeanu, 2023b) is used as the main baseline in Table 2. DCQ and Min-k% Prob are compared in Appendices A and B. A simplified version of PaCoST (Algorithm 2) also serves as a comparison."
       },
       "baselines_contemporary": {
         "applies": true,
         "answer": true,
         "justification": "Baselines include Guided-Prompting (2023), DCQ (2023), and Min-k% Prob (2024) — all recent contamination detection methods. Table 1 compares against all major existing approaches."
       },
       "ablation_study": {
         "applies": true,
         "answer": true,
         "justification": "The simplified version (Algorithm 2) ablates the confidence estimation step by using ground-truth answers instead of model responses. Appendix C tests different rephrase models (Llama vs. Mistral), different contamination types, and different random seeds — all effectively ablating design choices."
       },
       "multiple_metrics": {
         "applies": true,
         "answer": false,
         "justification": "The only metric for PaCoST's performance is the p-value from the paired t-test. No secondary metrics (detection accuracy, AUC, precision/recall) are computed for the main method. Accuracy is reported only for DCQ and Min-k% Prob comparisons."
       },
       "human_evaluation": {
         "applies": true,
         "answer": false,
         "justification": "Human evaluation is used only for rephrase quality assessment (Table 8), not for evaluating the contamination detection outputs. The detection evaluation is entirely automated via the p-value threshold."
       },
       "held_out_test_set": {
         "applies": true,
         "answer": true,
         "justification": "In controlled experiments, 1000 samples are used for contamination and a separate 400 samples from the remaining WMDP data form the clean test set. These splits are clearly separated and used for different evaluation purposes (Section 5.1)."
       },
       "per_category_breakdown": {
         "applies": true,
         "answer": true,
         "justification": "Results are broken down by model (10 models), benchmark (6 benchmarks) in Table 4, by data type (trained/untrained) in Table 2, and by sample size in Table 3. Appendix C provides breakdowns by contamination type and rephrase model."
       },
       "failure_cases_discussed": {
         "applies": true,
         "answer": false,
         "justification": "No failure cases of PaCoST are discussed. The method achieves zero false positives and zero false negatives in all controlled experiments (Table 2). The limitations section discusses structural limitations but not specific cases where the method breaks down."
       },
       "negative_results_reported": {
         "applies": true,
         "answer": true,
         "justification": "The simplified version (Algorithm 2) produces a false negative on contaminated Llama (p=0.94 in Table 2). The authors discuss why this variant fails: 'using ground-truth answer may result in contaminated model behaving similarly on original samples and rephrased samples' (Appendix A)."
       }
     },
     "claims_and_evidence": {
       "abstract_claims_supported": {
         "applies": true,
         "answer": true,
         "justification": "The abstract claims PaCoST 'effectively detect[s] benchmark contamination' (supported by Tables 2-3) and 'almost all models and benchmarks we tested are suspected contaminated' (supported by Table 4). Both claims are backed by experimental results."
       },
       "causal_claims_justified": {
         "applies": true,
         "answer": true,
         "justification": "The key causal claim — that higher confidence on original vs. rephrased data indicates contamination — is validated through controlled experiments where the authors intentionally contaminate models via fine-tuning (Section 5.1). This controlled manipulation establishes the causal link between contamination and the confidence signal."
       },
       "generalization_bounded": {
         "applies": true,
         "answer": true,
         "justification": "The abstract specifies 'open-source LLMs.' The limitations section explicitly states the method requires probability distributions unavailable in black-box models, cannot detect instance-level contamination, and has efficiency costs. Models tested range from 0.5B to 13B parameters."
       },
       "alternative_explanations_discussed": {
         "applies": true,
         "answer": false,
         "justification": "The paper does not substantively discuss alternative explanations for confidence differences beyond contamination. Rephrasing could introduce subtle difficulty changes; certain phrasings might be more common in training data without being benchmark contamination; or model familiarity with certain question formats could affect confidence. None of these alternatives are discussed."
       },
       "proxy_outcome_distinction": {
         "applies": true,
         "answer": true,
         "justification": "The paper explicitly distinguishes between confidence (what is measured via P(True)) and contamination (what is claimed). Section 4.2 justifies why P(True) is a better proxy than raw probabilities or verbalized confidence, and Section 4.3 frames the p-value as 'evidence for potential contamination' rather than proof."
       }
     },
     "setup_transparency": {
       "model_versions_specified": {
         "applies": true,
         "answer": true,
         "justification": "Exact model versions are specified: 'Mistral-7B-Instruct-v0.2', 'Llama-2-7B-Chat', 'Llama-2-Chat (7B, 13B)', 'Llama-3-Instruct (8B)', 'Phi-3 (3.8B)', 'Qwen1.5 (0.5B, 7B)', 'Qwen2 (7B)', 'Yi (6B)', 'DeepSeek (7B)' (Section 5.2)."
       },
       "prompts_provided": {
         "applies": true,
         "answer": true,
         "justification": "Full prompt text is provided in Appendix D for both the rephrase prompt and confidence estimation prompt, including in-context example formatting. The reader can reconstruct the exact prompts used."
       },
       "hyperparameters_reported": {
         "applies": true,
         "answer": false,
         "justification": "No hyperparameters are reported for the fine-tuning process (learning rate, epochs, batch size) or for inference (temperature, top-p, max tokens). The only parameter mentioned is p < 0.05 threshold and k=20 for Min-k% Prob baseline."
       },
       "scaffolding_described": {
         "applies": false,
         "answer": false,
         "justification": "No agentic scaffolding is used. The method is a three-step statistical pipeline (rephrase, confidence estimation, t-test) with direct model calls."
       },
       "data_preprocessing_documented": {
         "applies": true,
         "answer": true,
         "justification": "Section 5.1 documents data preparation: '1000 samples from biology split from the WMDP dataset' for contamination, '400 samples from the remaining data' for clean set. Section 5.2 states 'we randomly sample 400 samples in each benchmark for detection.' The supervised fine-tuning procedure is described (second contamination type)."
       }
     },
     "limitations_and_scope": {
       "limitations_section_present": {
         "applies": true,
         "answer": true,
         "justification": "A dedicated 'Limitations' section discusses three specific limitations: inability to detect instance-level contamination, lower efficiency due to multiple LLM interactions, and requirement for probability distribution access (excluding black-box models)."
       },
       "threats_to_validity_specific": {
         "applies": true,
         "answer": true,
         "justification": "The limitations are specific to this study: 'our method focuses on detecting benchmark-level contamination and is not suitable for identifying instance-level contamination,' 'our method involves multiple interactions with the LLM' causing efficiency concerns, and 'our approach cannot be used to detect benchmark contamination in black-box LLMs.'"
       },
       "scope_boundaries_stated": {
         "applies": true,
         "answer": true,
         "justification": "The paper explicitly bounds scope: benchmark-level only (not instance-level), open-source models only (not black-box), and notes in the Discussion (Section 5.3) that 'we do not intend to accuse any LLM provider of intentional contamination' and 'contamination does not inherently imply that a model is ineffective.'"
       }
     },
     "data_integrity": {
       "raw_data_available": {
         "applies": true,
         "answer": false,
         "justification": "Raw confidence values, per-instance confidence differences, and t-statistics are not released. Only aggregated p-values are shown in tables. There is no supplementary data download."
       },
       "data_collection_described": {
         "applies": true,
         "answer": true,
         "justification": "Section 5.1 describes the controlled contamination procedure: sampling from WMDP, supervised fine-tuning on the biology split. Section 5.2 lists all benchmarks and models used. The three-step pipeline (rephrase, confidence, test) is fully described."
       },
       "recruitment_methods_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in the study. All data comes from standard public benchmarks (WMDP, MMLU, HellaSwag, ARC, TruthfulQA, WinoGrande) and public model checkpoints."
       },
       "data_pipeline_documented": {
         "applies": true,
         "answer": true,
         "justification": "Algorithm 1 documents the full pipeline: rephrase each instance, compute confidence pairs via P(True), calculate mean difference, standard deviation, t-value, and p-value. Section 4 describes each step in detail."
       }
     },
     "conflicts_of_interest": {
       "funding_disclosed": {
         "applies": true,
         "answer": true,
         "justification": "The Acknowledgement section discloses: 'Beijing Science and Technology Program (Z231100007423011), National Science Foundation of China (No. 62161160339) and Key Laboratory of Science, Technology and Standard in Press Industry.'"
       },
       "affiliations_disclosed": {
         "applies": true,
         "answer": true,
         "justification": "Author affiliations are clearly stated: Wangxuan Institute of Computer Technology and School of Foreign Languages, Peking University. The authors are not affiliated with any of the model providers being tested."
       },
       "funder_independent_of_outcome": {
         "applies": true,
         "answer": true,
         "justification": "Funding comes from Chinese government research grants and a university lab, none of which have financial interest in whether specific models or benchmarks are found to be contaminated."
       },
       "financial_interests_declared": {
         "applies": true,
         "answer": false,
         "justification": "No competing interests or financial interests statement is present in the paper."
       }
     },
     "contamination": {
       "training_cutoff_stated": {
         "applies": false,
         "answer": false,
         "justification": "The paper does not evaluate model capability on benchmarks — it detects benchmark contamination. The benchmarks are inputs to the detection method, not targets for capability evaluation."
       },
       "train_test_overlap_discussed": {
         "applies": false,
         "answer": false,
         "justification": "The paper is itself a contamination detection method. It does not evaluate model capability on benchmarks in the traditional sense, so the standard train/test overlap concern does not apply to the paper's own evaluation framework."
       },
       "benchmark_contamination_addressed": {
         "applies": false,
         "answer": false,
         "justification": "Benchmark contamination is the subject of the paper, not a confound of its evaluation. The controlled experiments use WMDP (released May 2024, post-training of tested models) to ensure clean baselines."
       }
     },
     "human_studies": {
       "pre_registered": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in the study. Human annotators evaluated rephrase quality but were not research subjects."
       },
       "irb_or_ethics_approval": {
         "applies": false,
         "answer": false,
         "justification": "No human participants. The Ethics Statement discusses responsible reporting of results but no IRB is needed."
       },
       "demographics_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in the study."
       },
       "inclusion_exclusion_criteria": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in the study."
       },
       "randomization_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in the study."
       },
       "blinding_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in the study."
       },
       "attrition_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in the study."
       }
     },
     "cost_and_practicality": {
       "inference_cost_reported": {
         "applies": true,
         "answer": false,
         "justification": "The Limitations section acknowledges the method 'involves multiple interactions with the LLM, including one for paraphrasing, two for answer generation, and two for confidence estimation' but provides no quantification of wall-clock time, API costs, or tokens consumed."
       },
       "compute_budget_stated": {
         "applies": true,
         "answer": false,
         "justification": "No compute budget is stated for either the fine-tuning experiments or the detection pipeline. GPU hours, hardware specifications, and total compute costs are all absent."
       }
     },
     "experimental_rigor": {
       "seed_sensitivity_reported": {
         "applies": true,
         "answer": true,
         "justification": "Table 7 reports results across 5 random seeds (0, 42, 302, 3407, 9056) for both contaminated and original Llama on trained and untrained data, showing that significance/insignificance is preserved across seeds."
       },
       "number_of_runs_stated": {
         "applies": true,
         "answer": false,
         "justification": "The seed sensitivity experiment uses 5 seeds, which is stated. However, the main results in Tables 2 and 4 do not state how many runs produced them — it appears they are single-run results."
       },
       "hyperparameter_search_budget": {
         "applies": true,
         "answer": false,
         "justification": "No hyperparameter search is described. The fine-tuning hyperparameters are not even reported, let alone any search procedure. The detection method uses fixed settings (p < 0.05) but fine-tuning settings are opaque."
       },
       "best_config_selection_justified": {
         "applies": true,
         "answer": true,
         "justification": "The method uses fixed, pre-determined settings: p < 0.05 threshold (standard statistical convention), Llama-2-Chat-7B for rephrasing (validated in Appendix C with an alternative), and P(True) for confidence (justified in Section 4.2 against alternatives). No configuration search was performed."
       },
       "multiple_comparison_correction": {
         "applies": true,
         "answer": false,
         "justification": "Table 4 performs 60 independent tests (10 models × 6 benchmarks) at p < 0.05, expecting ~3 false positives by chance. No multiple comparison correction (Bonferroni, Holm, Benjamini-Hochberg) is applied or discussed."
       },
       "self_comparison_bias_addressed": {
         "applies": true,
         "answer": false,
         "justification": "The authors compare PaCoST against their own re-implementation or application of baseline methods (Guided-Prompting, DCQ, Min-k% Prob) without acknowledging the potential bias of authors evaluating their own system."
       },
       "compute_budget_vs_performance": {
         "applies": true,
         "answer": false,
         "justification": "The Limitations section acknowledges the method requires 5 LLM interactions per instance (vs. 1-2 for baselines) but does not quantify the compute cost difference or report performance as a function of compute budget."
       },
       "benchmark_construct_validity": {
         "applies": true,
         "answer": false,
         "justification": "The paper does not discuss whether the paired confidence difference actually measures what is claimed. Alternatives — such as the possibility that rephrasing introduces difficulty changes rather than removing contamination signal — are not explored as construct validity concerns."
       },
       "scaffold_confound_addressed": {
         "applies": false,
         "answer": false,
         "justification": "No scaffolding is involved in the method. Models are queried directly with prompts."
       }
     },
     "data_leakage": {
       "temporal_leakage_addressed": {
         "applies": true,
         "answer": true,
         "justification": "For controlled experiments, the authors explicitly select WMDP (released May 2024) to ensure models (Llama-2, Mistral) could not have been contaminated on it, establishing clean temporal separation (Section 5.1)."
       },
       "feature_leakage_addressed": {
         "applies": true,
         "answer": false,
         "justification": "Not discussed. The confidence estimation prompt includes the model's own answer, and whether the P(True) probing setup could leak information about answer quality independent of contamination is not analyzed."
       },
       "non_independence_addressed": {
         "applies": true,
         "answer": false,
         "justification": "The trained (1000) and untrained (400) samples are drawn from different splits of the same WMDP biology dataset. Whether these splits share structural similarities (same question style, topic overlap) that could affect independence is not discussed."
       },
       "leakage_detection_method": {
         "applies": true,
         "answer": true,
         "justification": "The entire paper IS a leakage/contamination detection method. The controlled experiments use temporal splits (WMDP post-training) as the prevention mechanism, and PaCoST itself is the detection method validated against known contamination status."
       }
     }
   },
   "claims": [
     {
       "claim": "PaCoST successfully detects intentionally contaminated benchmarks with zero false positives and zero false negatives in controlled experiments.",
       "evidence": "Table 2 shows p-values < 0.05 for trained data on contaminated models (6e-8 for Llama, 2e-4 for Mistral) and p > 0.05 for all untrained/original conditions. Section 5.1.",
       "supported": "strong"
     },
     {
       "claim": "PaCoST satisfies all five proposed detection requirements (TDA Free, CT Free, TDL Free, SP, T Free) while no existing method does.",
       "evidence": "Table 1 compares PaCoST against 6 existing methods across 5 properties. The requirements are defined in Section 3.2.",
       "supported": "moderate"
     },
     {
       "claim": "The method is stable across sample sizes from 100 to 1000 without generating false positives or false negatives.",
       "evidence": "Table 3 shows consistent significant/insignificant results across 100, 200, 400, 500, and 1000 sample sizes for both contaminated and original models.",
       "supported": "strong"
     },
     {
       "claim": "Almost all tested open-source models and benchmarks show evidence of benchmark contamination.",
       "evidence": "Table 4 shows p < 0.05 for at least 2 benchmarks on 9 out of 10 models, and all 6 benchmarks are flagged for at least some models. Section 5.2.",
       "supported": "moderate"
     },
     {
       "claim": "The method is robust to choice of rephrase model and random seeds.",
       "evidence": "Table 9 (Appendix C) shows consistent results with Llama vs. Mistral for rephrasing. Table 7 shows consistent significance across 5 random seeds.",
       "supported": "strong"
     },
     {
       "claim": "Guided-Prompting, DCQ, and Min-k% Prob are ineffective for benchmark contamination detection.",
       "evidence": "Table 2 shows Guided-Prompting fails to detect contamination and generates false positives. Table 5 (Appendix B) shows DCQ accuracy worse than random. Table 6 shows Min-k% Prob conflates accuracy with contamination detection.",
       "supported": "moderate"
     }
   ],
   "red_flags": [
     {
       "flag": "No multiple comparison correction",
       "detail": "Table 4 performs 60 independent tests at p < 0.05, expecting ~3 false positives by chance alone. Without Bonferroni or similar correction, some of the 'contaminated' findings may be spurious. This weakens the claim that 'almost all models and benchmarks are contaminated.'"
     },
     {
       "flag": "Model anonymization prevents verification",
       "detail": "Table 4 anonymizes the 10 models as 'Model I' through 'Model X,' preventing independent verification of specific contamination claims and making the results unreproducible. While ethically motivated, this undermines scientific transparency."
     },
     {
       "flag": "No effect sizes reported",
       "detail": "Only p-values are reported for all experiments. The magnitude of confidence differences (mean d-bar, Cohen's d) is never shown, making it impossible to assess whether the detected contamination signal is practically meaningful or just statistically detectable."
     },
     {
       "flag": "Suspiciously perfect controlled results",
       "detail": "PaCoST shows zero false positives and zero false negatives across all controlled conditions in Tables 2 and 3, while all baselines fail. The lack of any failure mode in controlled experiments, combined with missing effect sizes, makes it difficult to assess the method's true robustness boundary."
     },
     {
       "flag": "Construct validity gap for rephrasing assumption",
       "detail": "The method assumes confidence differences between original and rephrased questions indicate contamination. However, rephrasing could introduce subtle difficulty changes, unfamiliar phrasing, or distribution shifts unrelated to contamination. This alternative explanation is not tested or discussed."
     }
   ],
   "cited_papers": [
     {
       "title": "Detecting Pretraining Data from Large Language Models",
       "authors": ["Weijia Shi", "Anirudh Ajith", "Mengzhou Xia", "Yangsibo Huang", "Daogao Liu", "Terra Blevins", "Danqi Chen", "Luke Zettlemoyer"],
       "year": 2024,
       "relevance": "Proposes Min-K% Prob for detecting training data membership — a key baseline for contamination detection methods."
     },
     {
       "title": "Time Travel in LLMs: Tracing Data Contamination in Large Language Models",
       "authors": ["Shahriar Golchin", "Mihai Surdeanu"],
       "year": 2023,
       "arxiv_id": "2308.08493",
       "relevance": "Introduces Guided-Prompting for contamination detection via data replication, directly compared as a baseline."
     },
     {
       "title": "Data Contamination Quiz: A Tool to Detect and Estimate Contamination in Large Language Models",
       "authors": ["Shahriar Golchin", "Mihai Surdeanu"],
       "year": 2023,
       "arxiv_id": "2311.06233",
       "relevance": "Proposes the DCQ framework for contamination detection via multiple-choice quizzes, evaluated as a baseline."
     },
     {
       "title": "Generalization or Memorization: Data Contamination and Trustworthy Evaluation for Large Language Models",
       "authors": ["Yihong Dong", "Xue Jiang", "Huanyu Liu", "Zhi Jin", "Ge Li"],
       "year": 2024,
       "arxiv_id": "2402.15938",
       "relevance": "Proposes CDD and TED methods for contamination detection based on LLM output distribution analysis."
     },
     {
       "title": "NLP Evaluation in Trouble: On the Need to Measure LLM Data Contamination for Each Benchmark",
       "authors": ["Oscar Sainz", "Jon Ander Campos", "Iker García-Ferrero", "Julen Etxaniz", "Oier Lopez de Lacalle", "Eneko Agirre"],
       "year": 2023,
       "arxiv_id": "2310.18018",
       "relevance": "Highlights the pervasive data contamination problem in LLM evaluation and the need for per-benchmark contamination measurement."
     },
     {
       "title": "Proving Test Set Contamination in Black Box Language Models",
       "authors": ["Yonatan Oren", "Nicole Meister", "Niladri Chatterji", "Faisal Ladhak", "Tatsunori B Hashimoto"],
       "year": 2023,
       "arxiv_id": "2310.17623",
       "relevance": "Develops sharded-likelihood method for contamination detection in black-box models, addressing a complementary setting to PaCoST."
     },
     {
       "title": "Rethinking Benchmark and Contamination for Language Models with Rephrased Samples",
       "authors": ["Shuo Yang", "Wei-Lin Chiang", "Lianmin Zheng", "Joseph E Gonzalez", "Ion Stoica"],
       "year": 2023,
       "arxiv_id": "2311.04850",
       "relevance": "Studies how rephrasing benchmark samples affects LLM performance, directly motivating PaCoST's rephrasing approach."
     },
     {
       "title": "The WMDP Benchmark: Measuring and Reducing Malicious Use with Unlearning",
       "authors": ["Nathaniel Li", "Alexander Pan", "Anjali Gopal"],
       "year": 2024,
       "arxiv_id": "2403.03218",
       "relevance": "Provides the WMDP benchmark used for controlled contamination experiments, enabling temporal separation from model training."
     },
     {
       "title": "A Careful Examination of Large Language Model Performance on Grade School Arithmetic",
       "authors": ["Hugh Zhang", "Jeff Da", "Dean Lee"],
       "year": 2024,
       "arxiv_id": "2405.00332",
       "relevance": "Examines LLM benchmark performance with attention to contamination concerns in arithmetic evaluation."
     },
     {
       "title": "Scalable Extraction of Training Data from (Production) Language Models",
       "authors": ["Milad Nasr", "Nicholas Carlini", "Jonathan Hayase"],
       "year": 2023,
       "arxiv_id": "2311.17035",
       "relevance": "Demonstrates extraction of training data from production LLMs, establishing the feasibility and severity of memorization in large models."
     },
     {
       "title": "Extracting Training Data from Large Language Models",
       "authors": ["Nicholas Carlini", "Florian Tramer", "Eric Wallace"],
       "year": 2021,
       "arxiv_id": "2012.07805",
       "relevance": "Foundational work on training data extraction from language models, establishing the field of LLM membership inference."
     },
     {
       "title": "GPT-4 Technical Report",
       "authors": ["OpenAI"],
       "year": 2023,
       "arxiv_id": "2303.08774",
       "relevance": "Documents GPT-4's contamination analysis using string matching, illustrating the limitations of vendor-side contamination detection."
     }
   ],
   "engagement_factors": {
     "practical_relevance": {
       "score": 2,
       "justification": "Researchers and benchmark maintainers can apply PaCoST to audit LLMs for contamination, though it requires probability distribution access limiting applicability to open-source models."
     },
     "surprise_contrarian": {
       "score": 2,
       "justification": "The finding that 'almost all models and benchmarks are suspected contaminated' challenges trust in standard LLM leaderboard rankings."
     },
     "fear_safety": {
       "score": 1,
       "justification": "Raises concerns about unreliable LLM evaluation but does not demonstrate a novel attack or safety risk."
     },
     "drama_conflict": {
       "score": 2,
       "justification": "Implies widespread benchmark cheating across the LLM industry, though model anonymization softens the controversy."
     },
     "demo_ability": {
       "score": 0,
       "justification": "Code is promised but not released; no demo or installable tool available."
     },
     "brand_recognition": {
       "score": 1,
       "justification": "From Peking University; tests popular models (Llama, Mistral, Qwen) but not from a headline lab."
     }
   }
 }