CleanScore: Black-Box Benchmark Audits with Negative Controls and Sensitivity Bounds

원문 초록

Public benchmark scores reflect skill, prior exposure to the questions, or both, and for most models the training data are unknown. CleanScore is a black-box audit: the estimator needs only a correct-or-incorrect score for each form, not training data or weights. Each benchmark question becomes a parent item with one public form and two independently written fresh forms that keep its numbers, facts and answer. The audit reports an interval for the public-form advantage, not a verdict, and a private control bank with an explicit transport radius provides a proxy for the ordinary form gap that a rewrite alone can produce. A registered controlled-exposure experiment, a preliminary validation, detects planted exposure in one of two model families. A registered audit of five open models on 200 GSM8K and 200 ARC-Challenge items (ARC with stem-only rewrites, scored by option log probabilities) finds no exposure-consistent advantage, and two reruns declared before they were run (GSM8K at a longer token budget, ARC scored from generated letters) leave that conclusion unchanged. For four of the ten model-benchmark pairs the upper end of the interval is about five points or less, and for none is it above 21 points. The registered claim rule is much less sensitive than the primary interval: it flags a planted ten-point advantage in 5% to 11% of audits. Registered positive controls show what a null can mean. In four models, each trained under four seeds, items leaked into fine-tuning gained 25 points on average over unleaked items on the leaked wording and 19 points on paraphrases the model never saw, so a substantial share of the effect, estimated at 76% (95% interval 50% to 113%), is invisible to a paraphrase audit. A null on surface form says much less about contamination than the name suggests.