训练数据去污染检测器

真跑 n-gram 与 SHA-256，并把重心放在「检测器本身什么时候会失效」

🧼

污染一直在，变的是「你还检不检得出来」

旧版把这个工具叫「N-gram 指纹匹配」，但它的 detectNgramOverlap()里没有任何 tokenize、没有 n、没有集合求交——它其实是 9 条String.indexOf。重建后这里真跑 n-gram，并且把重心挪到一个更硬的问题上：这台检测器在什么条件下会集体失效。同一条被整段复制的 GSM8K 题，按书里的文档级口径算只有1.57%，按 C(B,T) 算是100%——差 63.7 倍，结论完全相反。而只要再跑 156 步 GRPO，所有检测器的 AUROC 就一起塌回随机线，污染换来的 +7.14% 却一点没掉。

📖 论文值（下列 arXiv 摘要 / 正文逐字转录，未重跑实验）🧮 本站真算（tokenize / n-gram 求交 / SHA-256 / 混淆矩阵）⚠️ 教学素材或插值（不是原始实验数据）· 快照日 2026-10-25

评测样本 B（基准原题）📖

样本 token 数 59 · |N_B| = 47

待检测文档 T⚠️

Question: Natalia sold clips to 48 of her friends in April, and then she sold half as many clips in May. How many clips did Natalia sell altogether in April and May?
Answer: Natalia sold 48/2 = <<48/2=24>>24 clips in May.
Natalia sold 48+24 = <<48+24=72>>72 clips altogether in April and May.
#### 72
1. Storage budgets outgrow the speed of downstream validation.
2. Every batch writes a manifest for reproducible reads.
3. Sampling weights shift whenever the source mixture changes.
4. Document dedup is cheaper than paragraph level dedup.
5. Quality filters over-penalize informal conversational writing.
6. Language errors cluster in short documents and forums.
7. Token budgets differ from document budgets in planning.
8. Checkpoint choice follows the protocol, not the loss curve.
9. Streaming ingestion avoids copying but hinders shuffling.
10. Document boundaries matter more than ablations admit.
11. Embedding clustering scales poorly without hash prefilters.
12. Reproducibility pins code and every external snapshot.
13. Annotation guidelines drift and show up as disagreement.
14. Long context examples are rare in the wild.
15. Filter thresholds rarely transfer across domains unchanged.
16. Logging every drop reason makes later audits possible.
17. Balanced by count can still skew heavily by tokens.
18. Encoding detection precedes every other cleaning step.
19. Storage budgets outgrow the speed of downstream validation.
20. Every batch writes a manifest for reproducible reads.
21. Sampling weights shift whenever the source mixture changes.
22. Document dedup is cheaper than paragraph level dedup.
23. Quality filters over-penalize informal conversational writing.
24. Language errors cluster in short documents and forums.
25. Token budgets differ from document budgets in planning.
26. Checkpoint choice follows the protocol, not the loss curve.
27. Streaming ingestion avoids copying but hinders shuffling.
28. Document boundaries matter more than ablations admit.
29. Embedding clustering scales poorly without hash prefilters.
30. Reproducibility pins code and every external snapshot.
31. Annotation guidelines drift and show up as disagreement.
32. Long context examples are rare in the wild.
33. Filter thresholds rarely transfer across domains unchanged.
34. Logging every drop reason makes later audits possible.
35. Balanced by count can still skew heavily by tokens.
36. Encoding detection precedes every other cleaning step.
37. Storage budgets outgrow the speed of downstream validation.
38. Every batch writes a manifest for reproducible reads.
39. Sampling weights shift whenever the source mixture changes.
40. Document dedup is cheaper than paragraph level dedup.
41. Quality filters over-penalize informal conversational writing.
42. Language errors cluster in short documents and forums.
43. Token budgets differ from document budgets in planning.
44. Checkpoint choice follows the protocol, not the loss curve.
45. Streaming ingestion avoids copying but hinders shuffling.
46. Document boundaries matter more than ablations admit.
47. Embedding clustering scales poorly without hash prefilters.
48. Reproducibility pins code and every external snapshot.
49. Annotation guidelines drift and show up as disagreement.
50. Long context examples are rare in the wild.
51. Filter thresholds rarely transfer across domains unchanged.
52. Logging every drop reason makes later audits possible.
53. Balanced by count can still skew heavily by tokens.
54. Encoding detection precedes every other cleaning step.
55. Storage budgets outgrow the speed of downstream validation.
56. Every batch writes a manifest for reproducible reads.
57. Sampling weights shift whenever the source mixture changes.
58. Document dedup is cheaper than paragraph level dedup.
59. Quality filters over-penalize informal conversational writing.
60. Language errors cluster in short documents and forums.
61. Token budgets differ from document budgets in planning.
62. Checkpoint choice follows the protocol, not the loss curve.
63. Streaming ingestion avoids copying but hinders shuffling.
64. Document boundaries matter more than ablations admit.
65. Embedding clustering scales poorly without hash prefilters.
66. Reproducibility pins code and every external snapshot.
67. Annotation guidelines drift and show up as disagreement.
68. Long context examples are rare in the wild.
69. Filter thresholds rarely transfer across domains unchanged.
70. Logging every drop reason makes later audits possible.
71. Balanced by count can still skew heavily by tokens.
72. Encoding detection precedes every other cleaning step.
73. Storage budgets outgrow the speed of downstream validation.
74. Every batch writes a manifest for reproducible reads.
75. Sampling weights shift whenever the source mixture changes.
76. Document dedup is cheaper than paragraph level dedup.
77. Quality filters over-penalize informal conversational writing.
78. Language errors cluster in short documents and forums.
79. Token budgets differ from document budgets in planning.
80. Checkpoint choice follows the protocol, not the loss curve.
81. Streaming ingestion avoids copying but hinders shuffling.
82. Document boundaries matter more than ablations admit.
83. Embedding clustering scales poorly without hash prefilters.
84. Reproducibility pins code and every external snapshot.
85. Annotation guidelines drift and show up as disagreement.
86. Long context examples are rare in the wild.
87. Filter thresholds rarely transfer across domains unchanged.
88. Logging every drop reason makes later audits possible.
89. Balanced by count can still skew heavily by tokens.
90. Encoding detection precedes every other cleaning step.
91. Storage budgets outgrow the speed of downstream validation.
92. Every batch writes a manifest for reproducible reads.
93. Sampling weights shift whenever the source mixture changes.
94. Document dedup is cheaper than paragraph level dedup.
95. Quality filters over-penalize informal conversational writing.
96. Language errors cluster in short documents and forums.
97. Token budgets differ from document budgets in planning.
98. Checkpoint choice follows the protocol, not the loss curve.
99. Streaming ingestion avoids copying but hinders shuffling.
100. Document boundaries matter more than ablations admit.
101. Embedding clustering scales poorly without hash prefilters.
102. Reproducibility pins code and every external snapshot.
103. Annotation guidelines drift and show up as disagreement.
104. Long context examples are rare in the wild.
105. Filter thresholds rarely transfer across domains unchanged.
106. Logging every drop reason makes later audits possible.
107. Balanced by count can still skew heavily by tokens.
108. Encoding detection precedes every other cleaning step.
109. Storage budgets outgrow the speed of downstream validation.
110. Every batch writes a manifest for reproducible reads.
111. Sampling weights shift whenever the source mixture changes.
112. Document dedup is cheaper than paragraph level dedup.
113. Quality filters over-penalize informal conversational writing.
114. Language errors cluster in short documents and forums.
115. Token budgets differ from document budgets in planning.
116. Checkpoint choice follows the protocol, not the loss curve.
117. Streaming ingestion avoids copying but hinders shuffling.
118. Document boundaries matter more than ablations admit.
119. Embedding clustering scales poorly without hash prefilters.
120. Reproducibility pins code and every external snapshot.
121. Annotation guidelines drift and show up as disagreement.
122. Long context examples are rare in the wild.
123. Filter thresholds rarely transfer across domains unchanged.
124. Logging every drop reason makes later audits possible.
125. Balanced by count can still skew heavily by tokens.
126. Encoding detection precedes every other cleaning step.
127. Storage budgets outgrow the speed of downstream validation.
128. Every batch writes a manifest for reproducible reads.
129. Sampling weights shift whenever the source mixture changes.
130. Document dedup is cheaper than paragraph level dedup.
131. Quality filters over-penalize informal conversational writing.
132. Language errors cluster in short documents and forums.
133. Token budgets differ from document budgets in planning.
134. Checkpoint choice follows the protocol, not the loss curve.
135. Streaming ingestion avoids copying but hinders shuffling.
136. Document boundaries matter more than ablations admit.
137. Embedding clustering scales poorly without hash prefilters.
138. Reproducibility pins code and every external snapshot.
139. Annotation guidelines drift and show up as disagreement.
140. Long context examples are rare in the wild.
141. Filter thresholds rarely transfer across domains unchanged.
142. Logging every drop reason makes later audits possible.
143. Balanced by count can still skew heavily by tokens.
144. Encoding detection precedes every other cleaning step.
145. Storage budgets outgrow the speed of downstream validation.
146. Every batch writes a manifest for reproducible reads.
147. Sampling weights shift whenever the source mixture changes.
148. Document dedup is cheaper than paragraph level dedup.
149. Quality filters over-penalize informal conversational writing.
150. Language errors cluster in short documents and forums.
151. Token budgets differ from document budgets in planning.
152. Checkpoint choice follows the protocol, not the loss curve.
153. Streaming ingestion avoids copying but hinders shuffling.
154. Document boundaries matter more than ablations admit.
155. Embedding clustering scales poorly without hash prefilters.
156. Reproducibility pins code and every external snapshot.
157. Annotation guidelines drift and show up as disagreement.
158. Long context examples are rare in the wild.
159. Filter thresholds rarely transfer across domains unchanged.
160. Logging every drop reason makes later audits possible.
161. Balanced by count can still skew heavily by tokens.
162. Encoding detection precedes every other cleaning step.
163. Storage budgets outgrow the speed of downstream validation.
164. Every batch writes a manifest for reproducible reads.
165. Sampling weights shift whenever the source mixture changes.
166. Document dedup is cheaper than paragraph level dedup.
167. Quality filters over-penalize informal conversational writing.
168. Language errors cluster in short documents and forums.
169. Token budgets differ from document budgets in planning.
170. Checkpoint choice follows the protocol, not the loss curve.
171. Streaming ingestion avoids copying but hinders shuffling.
172. Document boundaries matter more than ablations admit.
173. Embedding clustering scales poorly without hash prefilters.
174. Reproducibility pins code and every external snapshot.
175. Annotation guidelines drift and show up as disagreement.
176. Long context examples are rare in the wild.
177. Filter thresholds rarely transfer across domains unchanged.
178. Logging every drop reason makes later audits possible.
179. Balanced by count can still skew heavily by tokens.
180. Encoding detection precedes every other cleaning step.
181. Storage budgets outgrow the speed of downstream validation.
182. Every batch writes a manifest for reproducible reads.
183. Sampling weights shift whenever the source mixture changes.
184. Document dedup is cheaper than paragraph level dedup.
185. Quality filters over-penalize informal conversational writing.
186. Language errors cluster in short documents and forums.
187. Token budgets differ from document budgets in planning.
188. Checkpoint choice follows the protocol, not the loss curve.
189. Streaming ingestion avoids copying but hinders shuffling.
190. Document boundaries matter more than ablations admit.
191. Embedding clustering scales poorly without hash prefilters.
192. Reproducibility pins code and every external snapshot.
193. Annotation guidelines drift and show up as disagreement.
194. Long context examples are rare in the wild.
195. Filter thresholds rarely transfer across domains unchanged.
196. Logging every drop reason makes later audits possible.
197. Balanced by count can still skew heavily by tokens.
198. Encoding detection precedes every other cleaning step.
199. Storage budgets outgrow the speed of downstream validation.
200. Every batch writes a manifest for reproducible reads.
201. Sampling weights shift whenever the source mixture changes.
202. Document dedup is cheaper than paragraph level dedup.
203. Quality filters over-penalize informal conversational writing.
204. Language errors cluster in short documents and forums.
205. Token budgets differ from document budgets in planning.
206. Checkpoint choice follows the protocol, not the loss curve.
207. Streaming ingestion avoids copying but hinders shuffling.
208. Document boundaries matter more than ablations admit.
209. Embedding clustering scales poorly without hash prefilters.
210. Reproducibility pins code and every external snapshot.
211. Annotation guidelines drift and show up as disagreement.
212. Long context examples are rare in the wild.
213. Filter thresholds rarely transfer across domains unchanged.
214. Logging every drop reason makes later audits possible.
215. Balanced by count can still skew heavily by tokens.
216. Encoding detection precedes every other cleaning step.
217. Storage budgets outgrow the speed of downstream validation.
218. Every batch writes a manifest for reproducible reads.
219. Sampling weights shift whenever the source mixture changes.
220. Document dedup is cheaper than paragraph level dedup.
221. Quality filters over-penalize informal conversational writing.
222. Language errors cluster in short documents and forums.
223. Token budgets differ from document budgets in planning.
224. Checkpoint choice follows the protocol, not the loss curve.
225. Streaming ingestion avoids copying but hinders shuffling.
226. Document boundaries matter more than ablations admit.
227. Embedding clustering scales poorly without hash prefilters.
228. Reproducibility pins code and every external snapshot.
229. Annotation guidelines drift and show up as disagreement.
230. Long context examples are rare in the wild.
231. Filter thresholds rarely transfer across domains unchanged.
232. Logging every drop reason makes later audits possible.
233. Balanced by count can still skew heavily by tokens.
234. Encoding detection precedes every other cleaning step.
235. Storage budgets outgrow the speed of downstream validation.
236. Every batch writes a manifest for reproducible reads.
237. Sampling weights shift whenever the source mixture changes.
238. Document dedup is cheaper than paragraph level dedup.
239. Quality filters over-penalize informal conversational writing.
240. Language errors cluster in short documents and forums.
241. Token budgets differ from document budgets in planning.
242. Checkpoint choice follows the protocol, not the loss curve.
243. Streaming ingestion avoids copying but hinders shuffling.
244. Document boundaries matter more than ablations admit.
245. Embedding clustering scales poorly without hash prefilters.
246. Reproducibility pins code and every external snapshot.
247. Annotation guidelines drift and show up as disagreement.
248. Long context examples are rare in the wild.
249. Filter thresholds rarely transfer across domains unchanged.
250. Logging every drop reason makes later audits possible.
251. Balanced by count can still skew heavily by tokens.
252. Encoding detection precedes every other cleaning step.
253. Storage budgets outgrow the speed of downstream validation.
254. Every batch writes a manifest for reproducible reads.
255. Sampling weights shift whenever the source mixture changes.
256. Document dedup is cheaper than paragraph level dedup.
257. Quality filters over-penalize informal conversational writing.
258. Language errors cluster in short documents and forums.
259. Token budgets differ from document budgets in planning.
260. Checkpoint choice follows the protocol, not the loss curve.
261. Streaming ingestion avoids copying but hinders shuffling.
262. Document boundaries matter more than ablations admit.
263. Embedding clustering scales poorly without hash prefilters.
264. Reproducibility pins code and every external snapshot.
265. Annotation guidelines drift and show up as disagreement.
266. Long context examples are rare in the wild.
267. Filter thresholds rarely transfer across domains unchanged.
268. Logging every drop reason makes later audits possible.
269. Balanced by count can still skew heavily by tokens.
270. Encoding detection precedes every other cleaning step.
271. Storage budgets outgrow the speed of downstream validation.
272. Every batch writes a manifest for reproducible reads.
273. Sampling weights shift whenever the source mixture changes.
274. Document dedup is cheaper than paragraph level dedup.
275. Quality filters over-penalize informal conversational writing.
276. Language errors cluster in short documents and forums.
277. Token budgets differ from document budgets in planning.
278. Checkpoint choice follows the protocol, not the loss curve.
279. Streaming ingestion avoids copying but hinders shuffling.
280. Document boundaries matter more than ablations admit.
281. Embedding clustering scales poorly without hash prefilters.
282. Reproducibility pins code and every external snapshot.
283. Annotation guidelines drift and show up as disagreement.
284. Long context examples are rare in the wild.
285. Filter thresholds rarely transfer across domains unchanged.
286. Logging every drop reason makes later audits possible.
287. Balanced by count can still skew heavily by tokens.
288. Encoding detection precedes every other cleaning step.
289. Storage budgets outgrow the speed of downstream validation.
290. Every batch writes a manifest for reproducible reads.
291. Sampling weights shift whenever the source mixture changes.
292. Document dedup is cheaper than paragraph level dedup.
293. Quality filters over-penalize informal conversational writing.
294. Language errors cluster in short documents and forums.
295. Token budgets differ from document budgets in planning.
296. Checkpoint choice follows the protocol, not the loss curve.
297. Streaming ingestion avoids copying but hinders shuffling.
298. Document boundaries matter more than ablations admit.
299. Embedding clustering scales poorly without hash prefilters.
300. Reproducibility pins code and every external snapshot.
301. Annotation guidelines drift and show up as disagreement.
302. Long context examples are rare in the wild.
303. Filter thresholds rarely transfer across domains unchanged.
304. Logging every drop reason makes later audits possible.
305. Balanced by count can still skew heavily by tokens.
306. Encoding detection precedes every other cleaning step.
307. Storage budgets outgrow the speed of downstream validation.
308. Every batch writes a manifest for reproducible reads.
309. Sampling weights shift whenever the source mixture changes.
310. Document dedup is cheaper than paragraph level dedup.
311. Quality filters over-penalize informal conversational writing.
312. Language errors cluster in short documents and forums.
313. Token budgets differ from document budgets in planning.
314. Checkpoint choice follows the protocol, not the loss curve.
315. Streaming ingestion avoids copying but hinders shuffling.
316. Document boundaries matter more than ablations admit.
317. Embedding clustering scales poorly without hash prefilters.
318. Reproducibility pins code and every external snapshot.
319. Annotation guidelines drift and show up as disagreement.
320. Long context examples are rare in the wild.
321. Filter thresholds rarely transfer across domains unchanged.
322. Logging every drop reason makes later audits possible.
323. Balanced by count can still skew heavily by tokens.
324. Encoding detection precedes every other cleaning step.
325. Storage budgets outgrow the speed of downstream validation.
326. Every batch writes a manifest for reproducible reads.
327. Sampling weights shift whenever the source mixture changes.
328. Document dedup is cheaper than paragraph level dedup.
329. Quality filters over-penalize informal conversational writing.
330. Language errors cluster in short documents and forums.
331. Token budgets differ from document budgets in planning.
332. Checkpoint choice follows the protocol, not the loss curve.
333. Streaming ingestion avoids copying but hinders shuffling.
334. Document boundaries matter more than ablations admit.
335. Embedding clustering scales poorly without hash prefilters.
336. Reproducibility pins code and every external snapshot.
337. Annotation guidelines drift and show up as disagreement.
338. Long context examples are rare in the wild.

文档 token 数 3007 · |N_T| = 2995

文档长度（词）3000

拖动它，看三条口径谁先投降（仅在「英文长网页」预设下生效）

n-gram 的 n13

GPT-3 / Llama 2 = 13；Llama 3 = 8

切分方式

三条判定口径，同一份数据分母不同🧮

交集 |N_B ∩ N_T|

|N_B|（样本 n-gram）

|N_T|（文档 n-gram）

2995

两口径倍差

63.7×

C(B,T) ÷ 文档级比率

文档级重叠率判为干净

|N_B ∩ N_T| / |N_T|

1.57%

分母 = 文档

阈值 > 0.70 判污染

来源：《AI 数据全书》§29.6.2 参考实现

C(B,T) 样本级覆盖率判为污染

|N_B ∩ N_T| / |N_B|

100.00%

分母 = 评测样本

阈值 > 0.80 判污染（n ≥ 13）

来源：通用教科书定义（GPT-3 / Llama 系口径族）

任意命中即标记判为污染

|N_B ∩ N_T| > 0

命中

分母 = （无分母，二值）

阈值命中 ≥ 1 即判污染

来源：GPT-3 附录 C / Llama 2（13-gram）

⭐ 差 63.7 倍，结论完全相反。书里的 70% 阈值只在「整篇文档几乎就是那条评测题」时才可能触发——也就是说文档越长越安全，这与去污染的常识相反。按 🧮 实算，文档超过 80 词 之后，这个口径对这条样本永远不会再报警。

文档级重叠率

≤80 词报警

C(B,T) 样本级覆盖率

全程报警

任意命中即标记

全程报警

誰的口径	规则	n	类型
GPT-3	任意 13-gram 命中即标记	13	二值
Llama 2	任意 13-gram 命中即标记	13	二值
Llama 3	8-gram（n 按经验选）	8	二值
Qwen 2 / 2.5	LCS ≥ 13 token 且覆盖 ≥ 60%	13	LCS + 覆盖
《AI 数据全书》§29.6.2	文档级比率 > 70%	13	比率（分母=文档）

L0 模板快筛 fast path，不是 n-gram

这一层是 25 条正则，String.match 而已。它能抓「格式长得很像」，抓不到任何改写。旧版把它标成「N-gram 指纹匹配」是错的，这里改回本名。

高GSM8KGSM8K 答案标记 ####

高GSM8KGSM8K 计算注释 <<>>

L1 精确匹配 · 行级 SHA-256🧮

浏览器内 crypto.subtle.digest('SHA-256') 真算，逐行规范化后比对。非安全上下文会退化为确定性 FNV-1a，页面会明示。

没有整行完全一致的匹配

命中 0 行

误报演示 · 八条样本跑同一条规则🧮

精确率 TP/(TP+FP)

1.00

召回率 TP/(TP+FN)

0.50

漏检 FN

误报 FP

样本	攻击	真值	判定	依据
逐字复制 · GSM8K	无扰动	🔴 污染	判污染 ✓	L0 命中 3 条（GSM8K 答案标记 ####）；n-gram 交集 47
逐字复制 · MMLU	无扰动	🔴 污染	判污染 ✓	L0 命中 1 条（MMLU 经典前缀）；n-gram 交集 26
逐字复制 · C-Eval（中文）	无扰动	🔴 污染	判污染 ✓	L0 命中 1 条（C-Eval 标准指令）；n-gram 交集 54
改写攻击	同义改写	🔴 污染	判干净 ✕	L0 与 n-gram 都没命中
翻译攻击	中译	🔴 污染	判干净 ✕	L0 与 n-gram 都没命中
变量重命名攻击	标识符替换	🔴 污染	判干净 ✕	n-gram 交集 3
⚠️ 反例：讲 GSM8K 的教程	（不是污染）	🟢 干净	判干净 ✓	L0 命中 2 条（MMLU 经典前缀）
干净文本：数据工程笔记	（无基准内容）	🟢 干净	判干净 ✓	L0 与 n-gram 都没命中

语料规模

8 篇

真值污染率

75%

本规则剔除

3 篇

token 损失

28.0%

「讲 GSM8K 的教程」是真值干净、却被 L0 判高危的样本——这类页面在教程、博客转载、数据集卡片上极其常见。只有真值命中、没有 FP 样本的检测工具不具备教学价值。

🧮 tokenize / n-gram 集合求交 / SHA-256 / 混淆矩阵均为浏览器内实算📖 各家口径与阈值来自 GPT-3 附录 C 一族的公开描述⚠️ 文档语料为本站构造的中性文本，仅用于控制长度

一手源（全部已回源核对标题 / 作者 / 日期）

arXiv:2510.02386 ↗arXiv:2610.05830 ↗arXiv:2603.03203 ↗arXiv:2510.09259 ↗arXiv:2608.12652 ↗arXiv:2610.16152 ↗arXiv:2610.19447 ↗arXiv:2609.27510 ↗

arXiv:2510.02386 · On The Fragility of Benchmark Contamination Detection in Reasoning Models — Wang Han, Li Haoyu, Ko Brian, Zhang Huan（UIUC ASTRAL）（ICLR 2026，2025-09-30）。本页 Tab ② 的 AUROC / Δ / 虚高百分点全部来自这一篇的同一组实验

arXiv:2610.05830 · Measurement-First Auditing of Agentic Leaderboards: Contamination Susceptibility, Matched-Control Re-evaluation, and Scorer Validation — Yang Dishu, Su Qi, Qin Hongbo, Zhang Hansong（arXiv（cs.AI），2026-10-05）。Tab ③ 的 27 项编码网格、Table 1 九行、+10.0 与三个 95% 区间均逐格转录自 HTML 正文

arXiv:2603.03203 · No Memorization, No Detection: Output Distribution-Based Contamination Detection in Small Language Models — Omer Sela（Tel Aviv University，单作者）（arXiv，2026-03-03）。标题即负结论。原 CDD 出自 Dong et al. (2024)，在 7B 上用 LoRA 验证

arXiv:2510.09259 · Detecting Data Contamination from Reinforcement Learning Post-training for Large Language Models — Tao Yongding 等 7 人（PKU）（ICLR 2026，2025-10-10）。Self-Critique 路线 / 策略塌陷 / RL-MIA，AUC 相对基线 +30%

arXiv:2608.12652 · Excess Separability: Nuisance-Controlled Residual-Stream Probing for Benchmark Contamination Detection — Braun, Florian（单作者）（arXiv，2026-08-12）。FPR 0.03–0.99、相对基线 1.30–1.56×；v2 撤销了唯一显著结果

arXiv:2610.16152 · WildTrace: Evaluating Training Data Detection in Realistic Large-Scale LLM Post-training — Zhang Hengxiang, Liu Junxian, Wei Hongxin（arXiv，2026-10-12）。大规模后训练真实场景下最佳方法平均 AUC 0.529 ≈ 随机

arXiv:2610.19447 · BenchChecker: Assessing the Credibility of Bug-Fixing Benchmarks for LLMs — Wu Di, He Xu, Wang Shu, Sun Kun（USENIX Security 2026，2026-10-14）。AUC ≈ 0.9 / 6 benchmark / 过滤污染后 medium 难度相对下降 >20%

arXiv:2609.27510 · Uncheatable Eval: Dynamic Compression-Based Evaluation of Language Models — Tan Kaifeng, Li Yudong, Shen Linlin（arXiv，2026-09-23）。80 模型 × 14 类别，压缩率做评测

回源记录：Tab ③ 的 27 项编码表（Table 1 九行）、+10.0 点估计与六个 95% 区间逐格转录自 arxiv.org/html/2610.05830v1 正文； Tab ② 的 AUROC 与 Δ 来自 2510.02386。摘要里没有的（64 / 110 两个中间检查点的数值）本站一律留白，只标插值，不补数。

未调用任何模型。n-gram tokenize、集合求交、行级 SHA-256、混淆矩阵是 🧮 浏览器内真算；文档语料、八条样本、洗白曲线的中间点是 ⚠️ 教学素材。

内容参考《AI 数据全书》第 29 章 29.6 节「评测闭环与去污染」（旧版描述写的是「第 27 章 27.6 节」，改版后 ch27 = 具身智能与机器人数据，此处已更正）。