📄 AntiLeakBench: Preventing Data Contamination by Automatically Constructing Benchmarks with Updated Real-World Knowledge

Summary

Large language models are usually tested on public, static benchmarks, and those test items can leak into the training data of later models, which inflates their scores. Earlier "live" benchmarks gather freshly published material, but new text can still restate older facts, and refreshing those benchmarks usually needs manual annotation. AntiLeakBench takes a different approach. It mines Wikidata for facts whose value changed after a model's knowledge cutoff, such as a footballer joining a new club. It uses start/end time qualifiers and drops cases where the value later reverted. For each changed fact, it retrieves a post-change Wikipedia revision as a supporting document. It then generates question-answering items, both single-hop and multi-hop, in free-generation and multiple-choice formats, optionally mixed with distracting documents. The pipeline needs no human labor, so the benchmark can be rebuilt whenever new models appear. Across open-source and proprietary LLMs, scores generally drop on post-cutoff samples. This suggests that contamination inflates results on older data. The benchmark also remains difficult for most models.

Key points

• Knowledge source and change detection: Wikidata (subject, relation, object) triplets are grouped by subject and relation and ordered by start time. When the object differs after the cutoff, the fact is treated as new knowledge; one case is Lionel Andrés Messi, whose sports-team membership switched from Paris Saint Germain to Inter Miami.
• Supporting documents: these come from the Wikipedia revision history rather than LLM generation. A revision is accepted only if its article summary mentions both the subject and the object, or their aliases.
• Generation-format results: GPT-4o has the best average EM/F1 (77.2 / 87.9), while the strongest open-source model reaches 53.9 / 62.0. Most models stay below 50.
• Difficulty factors: scores fall as distracting documents increase (N_d from 3 to 7) and on multi-hop questions. For example, Longchat-v1.5-7B drops from 75.5 to 38.8 EM between Single-Hop Gold and Multi-Hop Gold. The multiple-choice format is noticeably easier.
• Contamination evidence and availability: on post-cutoff samples, Mistral-Nemo picks the correct option less often (91.0% → 85.5%) and the outdated option more often (6.4% → 13.3%). Code and data are at github.com/bobxwu/AntiLeakBench.