category: data · status: draft · updated: 2026-11-02

Contamination and Decontamination

Imagine studying for an exam and later discovering the answer key was stapled into your textbook. You'd score well and know nothing. That is contamination: benchmark answers leaking into the data a model trains on. Decontamination is the surgery that removes them before training.

Cyber is the worst case in all of machine learning, for one structural reason: the security community publishes its solutions. A CTF ends and everyone posts a writeup — flag, exploit path, commands. A CVE gets patched and a blog explains the bug with a proof-of-concept. Those documents are exactly what scrapers scoop into pretraining corpora. Now build a benchmark out of the same public artifacts — NYU CTF Bench from years of CSAW challenges (arXiv:2406.05590), CyberGym/CVE-Bench from public CVEs (CyberGym, ICLR 2026) — and the test set is continuously excreted into the training distribution. The writeup for challenge X is simultaneously gold training data and the answer sheet for challenge X. Our own rebuild of CyberFactory's recipe inherits this directly: they train on ARVO/OSS-Fuzz/wild CVEs and evaluate on CyberGym's 1,507 CVEs — the same public ecosystem, with no train/eval dedup in the paper (see [[cyberfactory-openaegis]]).

The evidence is now measured, not vibes. CTFusion (arXiv:2605.11504, ICML 2026, code) evaluated the same models on static CTF benchmarks vs live, unreleased CTF challenges during real events — and found static benchmark scores unreliable for agent assessment: published-challenge performance is inflated by memorization. NYU CTF Bench's authors knew this in 2024 — they restricted to pre-2021 CSAW challenges and split by year specifically to expose contamination effects. Hack The Box's data says the same from the product side: they ship weekly-fresh targets as their anti-contamination story, while their AUP bans writeups on active content precisely because writeups destroy eval value ([[htb-ai-range]]).

Why n-gram matching alone fails

The classic decontamination move is the GPT-3-era 13-gram sweep (arXiv:2005.14165): if any 13-token sequence from the test set appears in a training document, drop the document. It catches verbatim copies — and misses almost everything that matters in cyber:

Paraphrase. A writeup restates the solution in its own words; a 10-gram overlap with the challenge text is near zero, yet the leak is total.
Refactoring. The same exploit with renamed variables and reordered steps shares few long substrings.
Translation and format shifts. A Chinese writeup of a CSAW pwn challenge, or a YouTube transcript, shares zero n-grams with the challenge.
The actual poison is semantic, not lexical. What contaminates is the solution method and the flag, not the challenge's wording.

Crank the n down to 3 and you drown in false positives (every import sys matches). N-gram is a good first net, a terrible last one.

The layered pipeline

Treat decontamination as a funnel, cheap and broad at the top, expensive and precise at the bottom:


training corpus ──► 1. MinHash/LSH ──► 2. n-gram ──► 3. embedding ──► 4. LLM judge
                   near-dup sweep     verbatim      retrieval on        final verdict on
                   (Jaccard on        match vs      top-k semantic      surviving pairs:
                   shingles)          eval set      neighbors vs        "does this doc
                                                    eval set            reveal the answer?"

MinHash/LSH. Hash shingles into signatures; near-duplicate documents land in the same bucket. Catches re-uploads, reformatting, and dataset mirrors at web scale for cents. It's the same machinery as lineage clustering ([[dataset-lineage]]) — build it once, use it twice.
N-gram overlap against the eval set. Catches verbatim and near-verbatim. Cheap, standard, insufficient.
Embedding retrieval. Embed every training doc and every eval item; for each eval item, retrieve top-k nearest training docs by cosine similarity. This is what catches the paraphrased writeup — it shares meaning with the challenge even when it shares no 13-grams.
LLM judge. The retrieved pairs (thousands, not millions) get one focused question: given this challenge and this document, does the document contain or reveal the solution? Expensive per pair, but the funnel has already paid for precision.

Only the survivors of layer 3 reach layer 4, so the LLM bill stays small. Every layer trades recall against cost in the right direction: cheap layers over-remove, the judge makes the final call on the gray zone.

Temporal windows

The blunt but effective complement: split by time, not just content. If the eval set is "CVEs disclosed before 2024-01-01," then no document published after that date may enter training — no matter how clean it looks. NYU CTF's pre-2021 restriction is exactly this. Temporal cuts catch the leaks that even embeddings miss (an original writeup can be phrased far from the challenge text). Caveat: dates lie — pages get revised, old CVEs get new writeups, mirrors carry old content forward. Treat time as a moat around the pipeline, never the pipeline itself.

True north: private randomized boxes

All of the above is hygiene for public evals. The ground truth is an eval the model physically cannot have seen: private held-out boxes with per-run randomized flags, generated procedurally — new seeds, new flags, new users/topology each run. You cannot memorize what did not exist at training time. Bugcrowd's ExploitBench proves the pattern at the task level with per-run randomized challenge-response (arXiv:2605.14153); HTB's weekly-fresh-but-static targets show the weaker version — fresh ≠ novel ([[htb-ai-range]]). Our doctrine: decontaminated public benchmarks (CyberGym-E2E, CVE-Bench) for comparability, private randomized fleet boxes as true north. When the two agree, the public number is real. When they diverge, you found contamination.

Why it matters here