Excess Separability: Nuisance-Controlled Residual-Stream Probing for Benchmark Contamination Detection
- Nuisance-controlled protocol for contamination probing: zero-sum depth-profile contrast against a level-matched placebo, tested with a label-permutation null at 2× reference-to-suspect sizing
- Shows naive linear-probe contamination detection fails: false-positive rate ranges 0.03–0.99 under a true null depending on control-set size; a flat-baseline contrast rejects a true null up to 72% of the time
- 6-audit empirical study across transformer/dataset pairs — all 4 well-matched Pile arms return null, the protocol abstains on the confounded temporal split rather than reporting a verdict; implementation, tests, and audits released
Read the abstract
Benchmark contamination is diagnosed today with n-gram overlap, with likelihood-based membership inference, or with canary strings, and each needs something usually unavailable: the training corpus, a well-chosen test statistic, or foresight at dataset release. A recent alternative reads contamination off a linear probe on internal activations — this work shows the natural way to do this does not work, and specifies one that survives measurement. The protocol reports a zero-sum contrast on the depth profile of probe accuracy, recentred on a level-matched placebo baseline, tested against a label-permutation null, with the reference set twice the size of the suspect set. Reporting the level of excess separability rather than its shape makes the false-positive rate track the size of the analyst's own control set, from 0.03 to 0.99 under a true null. On real transformers, baseline depth profiles are measurably not flat, spanning up to 29.1 accuracy points on a temporal split, and their non-flatness tracks the surface difference between item sets (correlation 0.87 over 6 audits) — so the correction is largest exactly where it's needed.