Метод Excess Separability позволяет выявлять утечку данных в нейросетях без доступа к обучающей выборке

When an AI lab publishes a new leaderboard score, a quiet infrastructure question hangs in the air: is the model genuinely capable, or has it simply memorized the exam? A paper posted yesterday to arXiv — accepted at MAPR 2026, the 9th International Conference on Multimedia Analysis and Pattern Recognition currently running in Hue City, Vietnam — adds a concrete new answer to that question. Researcher Florian Braun's method, called Excess Separability, reads a model's internal activation geometry to detect benchmark contamination without requiring access to training data, without retraining a reference model, and even when reinforcement learning post-training has already scrubbed the behavioral evidence that prior detection methods rely on. The Braun's Excess Separability preprint is available now on arXiv with full code and artifacts linked through the paper. For AI researchers, enterprise ML teams, and auditors evaluating whether a model's claimed capabilities are real, that combination — no training data, no retraining, survives post-training erasure — resolves the specific configuration of constraints that has left deployed model auditing effectively blind since the contamination problem became serious. Why Benchmark Contamination Has No Clean Solution Yet Popular benchmarks like MMLU, GSM8K, and HumanEval were released publicly years before most frontier models were trained. Web crawls used to assemble training corpora collect anything accessible. The result: a model may have encountered the exact test questions, and their correct answers, before sitting the exam. An independent analysis found approximately 29% of MMLU questions contaminated in Common Crawl data (New, Marone, and Van Durme, NAACL 2024). Controlled experiments have shown that even paraphrased versions of benchmark items — which sail through standard n-gram decontamination filters without triggering an alert — can produce scores that exceed the model's genuine capability (Yang et al. 2023, arXiv:2311.04850). The field has responded with structural fixes that work well going forward: LiveCodeBench harvests fresh competitive programming problems from LeetCode, AtCoder, and Codeforces after their contest dates, making contamination structurally impossible. The SWE-bench Pro leaderboard tops the current contamination-resistant coding rankings by drawing from repositories that cannot have appeared in training data. Humanity's Last Exam benchmark, published in Nature in January 2026, combats contamination by maintaining a private holdout set that has never appeared in web crawls, supplementing its 2,500 public questions. But these structural solutions only help with future benchmarks. For the static benchmarks that still dominate model comparison tables — and for the deployed models whose training corpora are opaque — no retrofit is available. Auditing a model that is already in production, and that a lab claims has been decontaminated, requires access to training data that labs rarely release. Excess Separability changes that. What Prior Methods Miss Current contamination detection techniques divide into three families, each with a structural blind spot. String-matching approaches search a training corpus for verbatim or near-verbatim test items. They require access to the corpus, which is frequently withheld for commercial models, and they miss semantic contamination, where paraphrased versions of test questions carry the same memorized signal through different words. Likelihood-based and membership inference methods measure whether a model assigns anomalously low perplexity to a given text — the logic being that seen data is compressed more tightly than unseen data. These work without training-data access but are sensitive to surface-level properties of text that have nothing to do with contamination: length, formatting, domain vocabulary. A research team at the University of Illinois Urbana-Champaign and University of Washington demonstrated that even a brief GRPO (Group Relative Policy Optimization) RL training run can markedly conceal the perplexity-based signals that most contamination detectors rely on, even when the underlying contamination is strong — see the Wang et al. ICLR 2026 findings. A separate Peking University team published a complementary finding at ICLR 2026: the RL post-training phase, which has become standard practice for improving reasoning in frontier models, creates a gap where existing detection methods largely fail — the full Tao et al. ICLR 2026 paper details this gap. Generation-based probing asks the model to complete benchmark items verbatim and checks whether it can. Interpretable, but trivially evaded by instruction fine-tuning that suppresses direct recitation. None of these methods look inside the model's representations. Braun's paper does. Reading the Geometry of Memory The central claim of Excess Separability is that benchmark contamination leaves a detectable footprint in a model's residual stream — the accumulating sequence of high-dimensional activation vectors that carries information from input tokens through each successive transformer layer to the final output. The residual-stream contamination finding is that this footprint persists even after RL post-training smooths away the behavioral signals that current detectors target. In a transformer, the residual stream is the model's central information highway. Each attention and MLP layer reads from it and writes back to it additively; the output at any given layer is the sum of everything that preceded it. This additive structure has made the residual stream the primary target for mechanistic interpretability research — the field, spearheaded by teams at Anthropic, DeepMind, and independent researchers including Neel Nanda, that attempts to reverse-engineer how specific model behaviors arise from specific internal computations. Braun's key observation is that a model that has trained on a benchmark item does not just score better on it — it encodes something like familiarity at the representational level. The residual-stream vectors for contaminated items become abnormally separable from vectors for unseen items drawn from the same topic domain, even when both groups look identical to a perplexity-based detector. The challenge is that separability is a noisy signal by itself. Many features of an input — its domain, its syntactic complexity, its token length — can cause residual-stream representations to cluster in ways that look like contamination but are not. Excess Separability handles this through nuisance control: before measuring separability, the method explicitly accounts for and removes variance attributable to these confounding factors. The residual — the component of separability that cannot be explained by surface properties — is the contamination signal. This is a direct import from causal inference methodology into machine learning auditing. Controlling for confounders before measuring an effect is standard practice in epidemiology and econometrics; applying it to activation-space geometry for the specific purpose of distinguishing contamination from domain confounds is new. The method requires only inference-time access to a model's intermediate activations. No training corpus is consulted. No reference model is retrained from scratch as a baseline. Where the Residual Stream Meets Interpretability Infrastructure The choice of the residual stream as the diagnostic surface is not incidental. It is precisely the layer that the mechanistic interpretability program has built public tooling for. Sparse autoencoders (SAEs) decompose residual-stream activations into sparse combinations of interpretable directions — directions that, in many cases, correspond to human-recognizable concepts. Google DeepMind's GemmaScope public SAE release trained SAEs across every layer of the Gemma 2 model family and released the results publicly as a shared research resource. The LlamaScope Llama-3.1-8B release extended the same paradigm to the Llama family. The Qwen-Scope SAE collection followed for Qwen3 models earlier this year. An organization that has already trained SAEs on a model for interpretability purposes is operating at exactly the representational layer where Excess Separability runs. The contamination diagnostic requires no separate tooling — it is a natural extension of the infrastructure the interpretability program has already built. Interpretability Tooling Becomes Audit Infrastructure This is the largest implication of the paper — and the one the field has been building toward without naming it explicitly. Mechanistic interpretability began as an effort to explain what models know: which neurons respond to which concepts, how circuits route information, whether truthful and deceptive representations live in the same activation space. Those are all questions about model behavior. Excess Separability repurposes the same infrastructure for a different question: not what the model knows but how it came to know it — specifically, whether a given item was in the training data. That repurposing has a concrete governance implication. Third-party auditors who want to evaluate whether a lab's claimed decontamination efforts are real currently have no pathway that does not depend on lab cooperation or training-data disclosure. An activation-level contamination test that requires only inference access changes that relationship. A regulator or independent evaluation body with inference access to a model's intermediate activations — the kind of access that existing interpretability research already assumes — now has a mechanism for verifying evaluation integrity claims without taking the lab's word for it. This is what the convergence between interpretability and evaluation research, long discussed as a possibility, actually looks like in practice. How Should AI Auditors Use This? Does this work on models exposed only through a standard API? Not directly. The method requires intermediate activations — the residual-stream vectors at each transformer layer. Most commercial APIs return only final token-level outputs. Applying Excess Separability to a deployed commercial model would require either API access that exposes intermediate activations (which most providers do not offer) or access to open-weight models that can be run locally. This is the method's principal practical constraint: it is most useful for auditing open-weight models or for internal lab self-auditing, and less useful for independent third-party auditing of closed-model APIs. A related and concurrent method, LaRA (Layer-wise Representation Analysis, arXiv:2605.29888, published May 2026), also uses internal representations to detect contamination in RL-trained models — see the LaRA representation analysis paper for full details. LaRA introduces three geometric metrics — perturbation sensitivity, directional collapse, and local representation rigidity — and requires running semantic perturbations across multiple forward passes per test item. Excess Separability's approach differs: it measures static separability in the unperturbed residual stream, controlled for nuisances, without requiring semantic variants. Both methods share the key insight that internal geometry is more reliable than output behavior for RL-trained models; they differ in what they measure and what they require. Surface Equivalence Is Not Representational Equivalence Perhaps the most consequential claim in the paper is that contamination can be detectable in the residual stream even when it is invisible in surface performance metrics. This addresses a specific assumption that governs much of current evaluation practice: if a model's scores on contaminated and uncontaminated variants of a benchmark are similar, contamination is probably not distorting the results. Braun's framing inverts this logic. A model might score no better on contaminated test items than on comparable clean ones — if contamination was modest, or if post-training suppressed the behavioral signal — while still carrying a clear representational fingerprint of having seen those items. The paper's representational equivalence finding is that surface equivalence does not imply representational equivalence. This is consistent with what the ICLR 2026 research on RL contamination fragility established: RL post-training smooths out the distributional anomaly that perplexity-based detectors rely on. A method that looks at representations rather than outputs retains an advantage in exactly the deployment regime where the field is most exposed. The paper (arXiv:2608.12652) is available in full, with code and artifacts, through the authors' repository linked from the arXiv submission page. Note: This article reports on publicly available preprint research that has not yet undergone journal peer review. Why AI Leaderboards Have an Integrity Problem That No Single Fix Solves The benchmark landscape in 2026 reflects a field in transition. Frontiers like MMLU and HumanEval have either saturated — with the top models scoring so high that score differences are statistically meaningless — or contaminated their way out of usefulness. SWE-bench Verified, once the standard coding evaluation, was retired from OpenAI's own reporting after the lab's internal audit found that frontier models could reproduce gold patches or problem-statement specifics for specific tasks. The evaluation stack has been rebuilt around contamination resistance: private holdouts, rolling cutoffs, novel task generation. But the models already deployed against the old benchmarks are still in production. Enterprise teams report a 37% gap between benchmark scores and real-world deployment performance across frontier AI systems (Kili Technology, 2026). That gap has many causes, and contamination is one of them. The Excess Separability method does not solve the structural problem — it adds a diagnostic that makes the problem testable in models where it previously could not be tested. Frequently Asked Questions How does this method detect contamination without access to the training data? Instead of comparing model behavior against a training corpus, Excess Separability looks at the geometry of activations inside the model itself. When a model has been trained on a test item, its internal representation of that item — the high-dimensional vector in the residual stream — becomes abnormally easy to separate, using a linear classifier, from representations of items the model has not seen. The method controls for confounders (domain, length, formatting) that would otherwise produce false positives, leaving only the excess separability that traces to memorization. This is the equivalent of detecting whether someone memorized an exam by the specific way their brain encodes the material — independent of how they perform on paper. Can reinforcement learning post-training permanently erase the contamination signal? The short answer is: not in the residual stream. Research published at ICLR 2026 demonstrated that RL post-training (via GRPO and similar methods) can erase the perplexity-based and likelihood-based signals that most existing contamination detectors rely on, making those detectors essentially useless after an RL training stage. Excess Separability operates on activation geometry rather than output behavior, which is why it retains its signal even when the behavioral evidence is gone. The Wang et al. ICLR 2026 research confirms that the geometry of memorization appears to survive the behavioral smoothing that RL produces. How does this change AI auditing for labs and enterprises? The most significant shift is that it decouples contamination testing from training-data access. Independent auditors, enterprise buyers, and regulators have historically had no way to verify a lab's contamination claims without being given access to the training corpus — which labs rarely provide. Excess Separability, when combined with inference access to intermediate activations (as is available for open-weight models), creates a pathway for verification that does not require lab cooperation. For organizations running open-weight models internally, this means a self-audit tool exists that does not depend on reading the training logs. The constraint is commercial API access: closed-model APIs that return only final token outputs cannot be audited with this method. What are the method's key limitations? Three significant constraints limit current applicability. First, API access: the method needs intermediate activations, which most commercial APIs do not expose. Second, detection power: a model that encountered a benchmark item only once or twice in a trillion-token training run may not develop the same strong representational fingerprint as one trained specifically on the benchmark. Third, adversarial evasion: a model deliberately fine-tuned to wash out residual-stream signatures after contamination remains an open frontier — the paper does not address whether such targeted adversarial post-training is feasible or practical. ⓒ 2026 TECHTIMES.com All rights reserved. Do not reproduce without permission.