2026-09-26HOLDOUT6 min read

Your test set is contaminated. Act like it.

There's a paper — "Proving Test Set Contamination in Black Box Language Models" — that does exactly what the title says. Without any access to the model's training data, the authors demonstrate that a black-box model has memorized its evaluation set. The method works on closed commercial APIs. The conclusion is uncomfortable: if a benchmark is public and popular, assume it's in the training data.

The mechanism behind it is plain overfitting — except at industrial scale. A model that has seen the test doesn't perform well on the task. It performs well on the answers. Every number downstream inherits the contamination.

The seal-and-holdout protocol

GOLD's seed protocol is built directly on this reality. Here's the exact sequence, and why each step exists:

1. Commit before you look. Both procedures are fingerprinted (SHA-256 of their source) before the test seed exists. The seed is derived from the commit hash plus fresh entropy — drawn after the code is frozen. This closes data dredging and p-hacking: there is no window in which you can tune after seeing the test.

2. Five fresh sealed seeds. Each seed generates its own instances from the domain's sample function. The procedure must pass all six gates on five independent seeds. This isn't "run it five times and take the best" — it's five independent sealed experiments, each of which must independently earn GOLD.

3. One frozen holdout. After the five seeds pass, one final run on instances generated from a holdout seed that was fixed at the start and never used during development. If the procedure overfit to the development seeds, this is where it dies. It can't game what it has never seen.

seed protocol — verification gate

fresh_seed_0: GOLD=True
fresh_seed_1: GOLD=True
fresh_seed_2: GOLD=True
fresh_seed_3: GOLD=True
fresh_seed_4: GOLD=True
holdout:      GOLD=True   (frozen, never touched)

GATE: True  — 6/6 runs passed

A single GOLD True never counts. Not because one pass is impossible — but because one pass is consistent with luck, and luck doesn't survive a holdout. The protocol is deliberately paranoid: it assumes the procedure wants to overfit and gives it every opportunity to try.

The rule: the loop stops only when all five fresh seeds and the frozen holdout pass. Not five out of six. Not "it passed yesterday."

The takeaway: contamination isn't a hypothetical for popular benchmarks — it's been demonstrated on black-box APIs. The honest response isn't better benchmarks. It's a protocol that assumes the test is compromised and demands proof the procedure didn't just memorize it.