Detecting benchmark contamination that survives RL post-training
Every leaderboard number carries a quiet question: did the model learn the material, or memorize the exam? A preprint posted to arXiv this week gives auditors a sharper way to tell the difference — one built for the exact regime where today's detectors go blind.
A new protocol proposes detecting benchmark contamination from a model's internal activations rather than its outputs — and it is designed to keep working after RL post-training, the stage that erases the signals existing detectors rely on. "Excess Separability," a single-author paper by Florian Braun posted August 12, reads the residual stream — the activation vectors that flow through each transformer layer as input moves toward output. The claim is that items a model trained on become abnormally separable, in activation space, from unseen items in the same domain. The novel part is the nuisance control: before measuring that separability, the protocol accounts for confounders like domain, syntax, and length that would otherwise produce false positives, and it reports the result against a placebo baseline with a label-permutation null. No training corpus needed, no reference model retrained — just inference-time access to intermediate activations.
Why that matters: RL post-training, now standard for frontier reasoning models, shapes behavior through trajectory-level rewards rather than token likelihoods. Research at ICLR 2026, from teams at Illinois and Peking University (cited in the coverage), showed that a brief GRPO run can conceal the perplexity-based signals most contamination detectors depend on. In other words, the field's most exposed spot — evaluating models that went through RL — is exactly where the old tools stop working. A protocol that reads internal geometry instead of output behavior is aimed straight at that gap, and its statistical hygiene is a departure: most contamination research reports a score; this paper specifies the nulls, the baselines, and the failure modes of each design choice it rejected.
What's refreshing is the restraint. The paper explicitly does not establish that transformers carry a "familiarity direction" at all — its only positive result sits on a split where the comparison's assumptions fail, and all four well-matched control arms return null. Tech Times' coverage sells it as proof that contamination leaves a footprint inside model internals; the preprint itself is more honest: it specifies a protocol that survives measurement, and the negative results are the point. Practically, the method decouples contamination checks from training-data access — a real shift for auditors, since labs rarely release training corpora. The catch: it needs intermediate activations, so it works on open-weight models and internal self-audits, not on closed APIs that return only final tokens.
The bigger picture is the same trust problem behind this week's MLS-Bench: frontier models can't invent new ML methods: benchmarks keep raising questions about what scores actually certify. An NAACL 2024 analysis found roughly 29 percent of MMLU questions contaminated in Common Crawl data, and SWE-bench Verified was retired from OpenAI's own reporting after an internal audit found frontier models could reproduce gold patches. Structural fixes like private holdouts only protect future benchmarks — models already in production stay unauditable. Excess Separability doesn't solve that; it makes the problem testable where it previously wasn't. A concurrent method, LaRA, also digs into representations of RL-trained models, confirming the direction: once RL is involved, internal geometry beats output behavior.
What to watch: whether open-weight labs start running this kind of audit before publishing scores — and whether closed labs ever open activation access to outsiders.
If a lab won't expose activation-level access, should that count against its leaderboard claims? Tell us in the comments.
