PaperlayerView exact revision on arXiv

Source-linked AI summary

The Illusion of Reasoning: Exposing Evasive Data Contamination in LLMs via Zero-CoT Truncation

Yifan Lan, Yuanpu Cao, Hanyu Wang, Lu Lin, Jinghui Chen

arXiv:2605.21856v1cs.LGcs.AI

TL;DR

Evasive benchmark contamination can evade black-box detectors that depend on verbatim matching, compromising LLM evaluation. ZCP truncates reasoning and compares original with isomorphically perturbed data, robustly detecting direct and evasive contamination while producing low confidence on clean data.

  • Problem

    Black-box contamination detectors often rely on verbatim token memorization, leaving them vulnerable to paraphrased benchmark data and limiting reliable detection of evasive contamination.

  • Method

    ZCP enforces zero-CoT generation, compares original and isomorphically perturbed reference benchmarks, and summarizes evidence with Contamination Confidence.

  • Results

    ZCP detects direct and evasive contamination across contaminated benchmarks and fine-tuned models, with Contamination Confidence approaching 1.000 while clean data yields approximately 0.500.

  • Takeaways & Limitations

    Zero-CoT probing provides a black-box route to distinguish memorization from problem-solving behavior and assess contamination severity beyond binary detection.

  • Takeaways & Limitations

    For closed-source APIs, enforcing zero-CoT currently depends on prompt engineering that may become less effective as models optimize step-by-step reasoning.

Abstract

from arXiv · show

Large language models (LLMs) have demonstrated impressive reasoning abilities across a wide range of tasks, but data contamination undermines the objective evaluation of these capabilities. This problem is further exacerbated by malicious model publishers who use evasive, or indirect, contamination strategies, such as paraphrasing benchmark data to evade existing detection methods and artificially boost leaderboard performance. Current approaches struggle to reliably detect such stealthy contamination. In this work, we uncover a critical phenomenon: a model's generated reasoning steps actively mask its underlying memorization. Inspired by this, we propose the Zero-CoT Probe (ZCP), a novel black-box detection method that deliberately truncates the entire Chain-of-Thought (CoT) process to expose latent shortcut mappings. To further isolate memorization from the model's intrinsic problem-solving capabilities, ZCP compares the model's zero-CoT performance on the original benchmark against an isomorphically perturbed reference dataset. Furthermore, we introduce Contamination Confidence, a metric that quantifies both the likelihood and severity of contamination, moving beyond simple binary classifications. Extensive experiments on both previously identified contaminated models and specially fine-tuned contaminated models demonstrate that ZCP robustly detects both direct and evasive data contamination. The code for ZCP is accessible at https://github.com/Yifan-Lan/zero-cot-probe.

1 Introduction

The paper argues that Chain-of-Thought reasoning can mask memorization, making evasive contamination difficult for surface-overlap detectors to identify. It introduces Zero-CoT Probe, which truncates reasoning and compares performance on original and isomorphically perturbed data, alongside Contamination Confidence for severity estimation.

  • Problem: LLMs’ strong reasoning and benchmark performance make rigorous evaluation vulnerable when benchmark data contaminate training.The introduction highlights this concern across domains including mathematics and code generation.
  • Problem: Surface-level detectors fail on evasive contamination because paraphrasing changes exact benchmark phrasing.The passage also notes that evasive contamination can arise from malicious paraphrasing or inadvertent ingestion of synthetic benchmark-like data.
  • Method: Zero-CoT Probe truncates Chain-of-Thought reasoning to expose shortcut mappings from question semantics x_i to memorized answers y_i.The method is designed to reveal cases where paraphrased training data still produce correct final answers without intermediate reasoning.
  • Method: The approach uses isomorphically perturbed reference data to isolate memorization from intrinsic problem-solving and detect both direct and evasive contamination.The paper presents this as a black-box detection strategy.
  • Contributions: Contamination Confidence quantifies benchmark-level contamination severity beyond binary detection results.The contribution is framed as a new statistical metric for measuring contamination severity.
  • Method: Under Zero-CoT, models can fail on clean questions while correctly answering contaminated ones, exposing memorization masked by full reasoning.Figure 1 contrasts full-CoT behavior, where memorization is indistinguishable from genuine reasoning, with the zero-CoT probe.

2 Related Work

Prior work detects verbatim contamination but remains vulnerable to evasive contamination, while existing defenses face major limitations. CoT research motivates using reasoning interventions to probe LLM internals and contamination.

  • Data Contamination: Data contamination inflates benchmark performance when evaluation data enter a model’s training corpus, and existing methods struggle with evasive contamination.Existing methods can detect standard verbatim contamination but not reliably handle indirect or paraphrased contamination.
  • Data Contamination: Probabilistic detection fails under heavy paraphrasing, similarity-based detection requires full pre-training-data access, and low-variance detection assumes memorization is deterministic.These limitations leave evasive-contamination defenses severely constrained.
  • Research on CoT: CoT interventions have been used to study reasoning faithfulness and reward hacking, motivating zero-CoT analysis of data contamination.The proposed analytical paradigm forces LLMs to bypass reasoning entirely to investigate contamination.

3 Method

The method defines evasive contamination as semantically preserved benchmark data whose surface form is altered, then exposes memorization by forcing zero-CoT answers and comparing performance against a cleaned reference. It culminates in a black-box Contamination Confidence score that measures contamination extent rather than making only a binary judgment.

  • Problem formulation: Evasive contamination paraphrases or syntactically alters benchmark data while preserving its meaning, logical structure, and ground-truth answer.The paper identifies malicious obfuscation, synthetic distillation data, and web-scraped corpora as possible sources.
  • Contamination Confidence: Contamination Confidence C ranges from 0.5 to 1, with C = 0.5 indicating no statistical evidence and C →1.0 indicating definitive memorization.The score is intended to quantify the extent of direct or evasive memorization in a strictly black-box setting.
  • Limitations of existing methods: Existing detectors fail because corpus-dependent overlap methods lack training-data access, while likelihood, reconstruction, and metadata-based methods rely on obfuscatable surface features.Reconstruction remains effective on original contamination but its performance plummets on paraphrased data.
  • Zero-CoT Probe: Zero-CoT truncation bypasses reasoning noise by forcing the model to output the final answer immediately, revealing direct mappings from question semantics to answers.The intervention distinguishes memorization from emitted intermediate reasoning, though intrinsic internal problem-solving can still contribute to zero-CoT performance.
  • Zero-CoT Probe: The method evaluates benchmark-level zero-CoT performance using four metrics designed to capture both discrete correctness and continuous probability distributions.Performance is defined per question and averaged over the evaluation dataset.
  • Reference-based isolation: A cleaned reference dataset is introduced to separate memorization from intrinsic ability to solve complex problems without emitting reasoning steps.This control addresses the possibility that high zero-CoT performance reflects hidden internal calculation rather than contamination.

4 Experiments

The experiments evaluate ZCP through flipped existing-model tests, controlled fine-tuned contamination, ablations, and real-world audits. ZCP detects direct and evasive contamination while distinguishing contaminated data from clean or held-out controls.

  • Experimental scope: ZCP evaluation spans flipped experiments, controlled fine-tuning, ablations, dataset scaling, and audits of open-weight and closed-source models.These four dimensions are explicitly defined in the experimental program.
  • Flipped experiments: ZCP perfectly unmasks direct and evasive contamination, with zero-CoT performance dropping massively from original or paraphrased data to isomorphically perturbed reference data.The shortcut mapping survives textual paraphrasing but breaks under isomorphic numerical perturbations.
  • Flipped experiments: Ccont ≈0.500 on clean GSM1K, where original and reference zero-CoT performance are statistically indistinguishable, indicates no detected contamination.GSM1K was published later than the evaluated models, supporting its use as a clean benchmark.
  • Fine-tuned contamination: Fine-tuning increases performance on contaminated Dataset C while leaving held-out Dataset U stable, indicating contamination-driven gains rather than generalized reasoning improvement.The authentic evasive-contamination pipeline trains on paraphrased data and evaluates both contaminated and uncontaminated partitions.
  • Fine-tuned contamination: Ccont →1.000 on Dataset C and Ccont ≈0.500 on Dataset U demonstrate that ZCP detects evasive contamination while resisting false positives in fine-tuned models.This contrast holds across all reported performance metrics for both the fine-tuned Qwen-MATH and Qwen3 models.

5 Conclusion & Limitation

The paper identifies reasoning traces as a confounder that can mask memorization in evasively contaminated LLMs and introduces ZCP to address this threat. ZCP’s extension to closed-source APIs remains limited by its reliance on prompt engineering.

  • Conclusion: ZCP addresses evasive benchmark contamination by truncating reasoning chains and comparing zero-CoT performance with an isomorphically perturbed reference dataset.The method is motivated by the finding that intermediate reasoning actively masks underlying memorization.
  • Limitation: In open-weight models, ZCP enforces zero-CoT through direct token manipulation.This enforcement mechanism is contrasted with the approach currently required for closed-source APIs.
  • Limitation: For closed-source APIs, zero-CoT enforcement currently relies on careful prompt engineering, which may become less effective as commercial models optimize step-by-step reasoning.The paper identifies improving closed-source-model contamination auditing as future work.

A Derivation of Contamination Confidence from Bayes Factor

The appendix derives Contamination Confidence as the Bayesian posterior probability of contamination from the computed Bayes Factor. Assuming a neutral prior π = 0.5 yields the applied formula Ccont = BF10/(BF10 + 1).

  • Definition: Contamination Confidence Ccont is defined as the posterior probability P(H1 | data), where H1 denotes contamination.The appendix derives this posterior from the computed Bayes Factor BF10.
  • Bayesian Derivation: Bayes’ theorem expresses posterior odds as BF10 multiplied by the prior odds P(H1)/P(H0).Here, BF10 is the likelihood ratio P(D | H1)/P(D | H0).
  • Bayesian Derivation: With π = P(H1), mutually exclusive and exhaustive hypotheses imply P(H0) = 1 − π and P(H0 | D) = 1 − P(H1 | D).Substitution gives P(H1 | D)/(1 − P(H1 | D)) = BF10 · π/(1 − π).
  • General Formula: Rearranging the posterior-odds equation gives Ccont = BF10 · π/(BF10 · π + (1 − π)).This is the generalized Contamination Confidence formula for an arbitrary prior probability π.
  • Applied Formula: π = 0.5 makes the prior odds equal to 1 and reduces the applied metric to Ccont = BF10/(BF10 + 1).The neutral prior is used to avoid injecting subjective bias into the detection metric.

B Multi-model System for Reference Data Construction

The reference dataset ˜Deval is constructed at scale through an automated pipeline combining one generator LLM with two independent judge LLMs. The generator applies isomorphic perturbations to original questions, while inclusion requires strict consensus from both judges.

  • Pipeline design: The system uses one generator LLM and two independent judge LLMs to synthesize the reference dataset ˜Deval.This pipeline operationalizes the cleaning strategy at scale.
  • Sample generation: For each original triplet (xi, ci, yi) ∈ Deval, the generator applies an isomorphic perturbation to question xi, producing cleaned question ˜xi.
  • Validation: Only samples judged valid by a strict consensus between two independent judge models are incorporated into ˜Deval.

C System Prompts for Data Construction · 2. Evasive Paraphrasing Prompt (for Paraphrased Data D′

The appendix specifies system prompts for constructing reference and evasively contaminated datasets, using isomorphic perturbation, aggressive paraphrasing, and independent mathematical verification. These prompts support experiments that isolate memorization and simulate stealthy contamination while preserving controlled mathematical properties.

  • C System Prompts for Data Construction: The automated multi-model pipeline uses three prompt templates to construct carefully controlled reference and contaminated evaluation data.The templates address isomorphic perturbation, evasive paraphrasing, and mathematical verification.
  • C System Prompts for Data Construction: The isomorphic perturbation prompt changes semantic narratives and numerical values while preserving order of magnitude, logical structure, and mathematical difficulty.GPT-o3-mini generates the reference cleaned dataset ˜Deval.
  • 2. Evasive Paraphrasing Prompt (for Paraphrased Data D′: The evasive paraphrasing prompt aggressively varies syntax and entities while retaining every original numerical value and the exact mathematical answer.The resulting data are used to fine-tune target models or conduct clipped experiments.
  • 2. Evasive Paraphrasing Prompt (for Paraphrased Data D′: The mathematical judge prompt uses two independent judge LLMs to verify the equivalence and correctness of generated problems, solutions, and final answers.The judges are GPT-o4-mini and Gemini-2.5-flash.

D Details of Datasets

The study uses representative benchmark subsets to balance evaluation coverage and computational efficiency. Existing-model evaluations sample GSM8K, GSM1K, and MATH questions, while fine-tuned-model evaluations partition Omni-MATH and Multi-domain data into contaminated and uncontaminated subsets.

  • Sampling configuration: The dataset configurations use randomly sampled representative subsets from larger benchmarks to balance comprehensive evaluation with computational efficiency.Exact sample sizes and splits are summarized for existing-model and fine-tuned-model evaluations.
  • Existing-model evaluations: Existing-model evaluations sampled 500 training-split questions from GSM8K, 500 questions from GSM1K, and 700 MATH questions across seven problem types.MATH contributes 100 uniformly sampled questions per problem type.
  • Fine-tuned-model evaluations: Fine-tuned-model evaluations partitioned each benchmark into equal, mutually exclusive contaminated Dataset C and uncontaminated Dataset U subsets.Dataset C supports evasive training, while Dataset U is held out for clean evaluation.
  • Fine-tuned-model evaluations: Omni-MATH was split into 2,172 samples per subset, whereas Multi-domain was split into 1,325 samples per subset.These equal-sized partitions define the contaminated and uncontaminated subsets for fine-tuned-model experiments.

E Training Details of Evasively Contaminated Models … F.1 The Influence of Reasoning Ability

The appendix constructs evasively contaminated models through paraphrased benchmark data, strict mathematical and solution preservation, and a two-stage LoRA fine-tuning pipeline. Full-CoT reasoning masks contamination by making reference-data performance match contaminated-data performance, so CoT truncation is necessary for detection.

  • E Training Details of Evasively Contaminated Models: The evasive-contamination models were created with a two-stage fine-tuning pipeline designed to inject memorization under realistic leaderboard manipulation.The pipeline used paraphrased benchmark data rather than the exact originals.
  • E Training Details of Evasively Contaminated Models: Dataset C was paraphrased into 6 distinct versions to make the model learn shortcut mappings across varied syntactic structures.The augmentation avoided training on the exact original benchmarks.
  • 3. Constraints & Safety: The training used LoRA with rank r = 32 and scaling factor α = 64 across sequential SFT and GRPO stages.SFT learned formatting and reasoning chains from paraphrased Dataset C, while GRPO used an accuracy reward and sampled 5 trajectories per prompt.
  • 1. The Problem: Aggressive Variation & Entity Swapping: The augmentation rewrote narratives and swapped non-mathematical entities while preserving the underlying logic.Numerical values, constants, mathematical relationships, and the answer remained unchanged.
  • 1. The Problem: Aggressive Variation & Entity Swapping: Every mathematical segment was copied verbatim, including delimiters, spacing, internal formatting, and placement in or out of math mode.This enforced mathematical fidelity during paraphrasing.
  • 2. The Solution: Standardization & Rigor: The generated solution preserved the original step-by-step structure, ordering, detail, length, and logical organization while rewriting only the wording.The final result was required to remain strictly identical, with exact LaTeX equation formatting.
  • 3. Constraints & Safety: The output format required a rephrasing plan, an aggressively paraphrased problem, a canonical step-by-step solution, and a mathematically equivalent answer.The system also used an independent Judge LLM to verify mathematical correctness and alignment of generated triplets.
  • F.1 The Influence of Reasoning Ability: Under Full-CoT evaluation, contaminated Qwen-Math performed uniformly highly on original, paraphrased, and reference GSM8K data, causing Ccont to fall to baseline and vanish as a detection signal.Table 13 reports Ccont ≈ 0.500 because reference performance matched or exceeded contaminated-data performance.

F.2 Influence of Dataset Size and Selection of Performance Metric

The study evaluates how evaluation-set size affects ZCP detection stability under practical benchmark constraints. It finds that logit-based metrics provide highly stable contamination detection with very small samples, while accuracy requires a larger dataset.

  • Dataset Size: ZCP’s dataset-size analysis downsamples Omni-MATH from N = 50 to N = 1000 using the evasively contaminated FT Qwen-Math model.The analysis targets practical auditing constraints involving benchmark size and access levels.
  • Operational Tiers: The results identify a trade-off between detection stability and access requirements, organizing metrics into three operational tiers.Contamination Confidence results appear in Figure 4, with detailed metric values in Table 14.
  • Logit-based Metrics: Ccont > 0.94: Pfirst and Pall achieve high contamination confidence with as few as 50 ∼100 samples.Their continuous token probabilities provide denser, finer-grained signals than binary correctness, making them strongly preferred when target-model logits are accessible.

G Detecting Real-world Data Contamination

ZCP detects real-world contamination in both open-weight Qwen models and closed-source GPT models across GSM8K and MATH-500. Its token-level and output-only analyses distinguish severe memorization, benchmark-specific contamination, and baseline-like confidence.

  • Evaluation setup: ZCP audits Qwen and GPT models on GSM8K and MATH-500, using all four metrics for open-weight models but only Acc and Con for API-gated models.The evaluation uses the test splits of both reasoning benchmarks.
  • Open-weight Models (Qwen Series): Qwen-2.5-Math exhibits severe memorization across both GSM8K and MATH-500, detected by granular token-level metrics Pfirst and Pall.Output-only metrics also flag Qwen-2.5-Math on GSM8K.
  • Open-weight Models (Qwen Series): Qwen-3 shows clear contamination on MATH-500, while its GSM8K confidence remains at the baseline, with Ccont ≈0.500 across all four metrics.This pattern strongly suggests that the GSM8K test set is clean for Qwen-3.
  • Closed-source Models (GPT Series): GPT-4o shows definitive contamination on both GSM8K and MATH-500, with contamination confidence scores exceeding 0.85 under output-only probing.Because API access restricts token-level intervention, ZCP enforces zero-CoT through targeted prompt engineering and analyzes final text outputs.
Loading 2605.21856v1…