LBG: LNE-based Blocking Generation Against Data Contamination on Large Language Models

Thank you sincerely for your thorough reading of our work and detailed suggestions for improvements. We are glad that you recognize the significance of the problems and appreciate the motivation discussed in Section 2.

We would like to address your concerns in the following.

Weakness one:

Our approach aims to restore the performance of the contaminated model to that of the uncontaminated model by interrupting the model’s "ground truth" memory. As you rightly pointed out, we cannot fully eliminate the influence of the memory content on the candidate tokens after performing the blocking operation. However, we believe that the impact of data leakage on the candidate tokens is much smaller than its impact on the greedy decoded tokens. The fact that LNE-Blocking is effective in recovering the performance of the contaminated model to be closer to the uncontaminated model supports this argument.

Furthermore, to the best of our knowledge, we are the first to explore restoring the performance of contaminated models based on logits. More mechanistic and detailed studies on this topic could be the focus of future research.

Thank you sincerely for your thorough reading of our work and detailed suggestions for improvements. We are glad that the paper addresses a highly significant topic and that the proposed method demonstrates originality.

We would like to address your concerns in the following.

Weakness one:

Thank you for your valuable feedback. Considering this factor, we perform the blocking operation starting from the generation of the first token and continue until the required number of blocking operations for the current sample is reached, as described in section 4.3.1 of the revised paper. This ensures that subsequent tokens use the newly generated variable names, thereby maintaining consistency throughout the output.

Additionally, we have included a heatmap of token replacement frequency during the blocking operation in the Appendix C of the revised paper. Below are some examples for your reference.

Replace _if with _return:

if not numbers:
    return 0.0
mean = sum(numbers) / len(numbers)
return sum(abs(x - mean) for x in numbers) / len(numbers)

↓↓↓

return float((sum(abs(x - mean(numbers)) for x in numbers)) / len(numbers))

Replace _return with _ret:

return [x + 1 for x in l]

↓↓↓

ret_l=[]
for i in l:
    ret_l.append(i+1)
return ret_l

Replace _return with return:

return number % 1.0

↓↓↓

returnnumber=number%1
return return number

Weakness two:

Thank you for pointing this out. We apologize for the lack of clarity. The terms "Fixed Blocking 1, 2, and 5" refer to the fixed number of blocking operations applied for any given question, as opposed to the dynamic approach where the count of blocking operations is determined based on contamination detection scores for specific samples. Now, we provide a clear definition of these terms in the revised version of the paper.

Weakness three:

Thank you for pointing this out. We have reviewed and addressed some typographical issues, including the mismatched quotation marks in the caption of Figure 1 ("Cont.").

Novelty Beyond Technique

Last but importantly, we would like to emphasize the novelty of our approach, highlighting its broader implications beyond the technical aspects:

1. Although many studies have explored contamination detection of LLMs, we further deepen the application of these methods by integrating a blocking strategy to restore the performance of contaminated LLMs.

2. While there have been numerous works on contamination-free performance evaluation methods for models, some[2] require the creation of new uncontaminated datasets, which is highly resource-intensive, while others[3] rely on using other LLMs for dynamic evaluation, making it difficult to establish a static and consistent leaderboard. Only a few studies have conducted contamination-free performance evaluations using existing datasets, and these methods often involve extensive preprocessing[4] or multiple sampling iterations[5], making them highly time-consuming.

   LNE-Blocking is the first strategy that evaluates the performance of contaminated models through two inferences without modifying the original dataset.

As such, we are wondering whether there is anything else we could do or explain to increase your appraisal beyond "rejection". If there are other things we could do during the discussion period or before publication that you think would substantially improve the paper, please let us know.

References

[1] Qintong Li, Leyang Cui, Xueliang Zhao, Lingpeng Kong, and Wei Bi. Gsm-plus: A comprehensive benchmark for evaluating the robustness of llms as mathematical problem solvers. arXiv preprint arXiv:2402.19255, 2024b.

[2] Hugh Zhang, Jeff Da, Dean Lee, Vaughn Robinson, Catherine Wu, Will Song, Tiffany Zhao, Pranav Raja, Dylan Slack, Qin Lyu, et al. A careful examination of large language model performance on grade school arithmetic. arXiv preprint arXiv:2405.00332, 2024.

[3] Xiang Li, Yunshi Lan, and Chao Yang. Treeeval: Benchmark-free evaluation of large language models through tree planning. arXiv preprint arXiv:2402.13125, 2024c.

[4] Wenhong Zhu, Hongkun Hao, Zhiwei He, Yunze Song, Yumeng Zhang, Hanxu Hu, Yiran Wei, Rui Wang, and Hongyuan Lu. Clean-eval: Clean evaluation on contaminated large language models. arXiv preprint arXiv:2311.09154, 2023.

[5] Yihong Dong, Xue Jiang, Huanyu Liu, Zhi Jin, Bin Gu, Mengfei Yang, and Ge Li. Generalization or memorization: Data contamination and trustworthy evaluation for large language models. In Lun-Wei Ku, Andre Martins, and Vivek Srikumar (eds.), Findings of the Association for Computational Linguistics ACL 2024, pp. 12039–12050, Bangkok, Thailand and virtual meeting, August 2024. Association for Computational Linguistics. doi: 10.18653/v1/2024.findings-acl.716. URL https://aclanthology.org/2024.findings-acl.716.

Thank you sincerely for your thorough reading of our work and detailed suggestions for improvements. We are glad that you agree that we have a good motivation and benchmark against very recent models.

We would like to address your concerns in the following.

Weakness one:

1. a. As shown in Table 1 of the paper, all methods perform significantly worse on the mildly contaminated model compared to the moderately and heavily contaminated models, indicating that pollution detection is more challenging in the mild contamination scenario. In this challenging task, our proposed LNE strategy outperforms other methods by 5 percentage points in both F1 score and AUC. However, in the moderate and heavy contamination scenarios, where the task is simpler, our method performs only 1 percentage point worse than Min-k. This results in overall superior performance of our strategy.

   b. Since the contamination detection strategy needs to be integrated with our subsequent contamination mitigation evaluation strategy, and the contamination level of the current model is unknown when applying the contamination mitigation evaluation strategy, it requires a contamination detection method that performs well overall to ensure better performance in the task of contamination mitigation evaluation. We have added this experiment, as shown in the table below, and the results demonstrate that using LNE leads to improved performance in the contamination mitigation evaluation task compared to Min-k.

   Strategy	Mild Cont.	Moderate Cont.	Heavy Cont.	Average
   PPL-Blocking	0.3 (0.044)	0.28 (0.037)	0.274 (0.047)	0.284 (0.042)
   MINK-Blocking	0.323 (0.058)	0.274 (0.051)	0.27 (0.043)	0.29 (0.052)
   LNE-Blocking	0.297 (0.035)	0.282 (0.032)	0.271 (0.045)	0.283 (0.037)

   c. Our motivation is to treat contamination detection as a foundational task, with the primary focus on solving the contamination mitigation evaluation task. As a result, we just selected a more effective contamination detection strategy without conducting further performance exploration.

2. a. We apologize for any confusion caused. The bold numbers in Table 2 indicate the best-performing contamination mitigation strategy for each contamination level. A smaller value indicates better contamination mitigation evaluation strategy, closer to the performance of the uncontaminated model after applying the contamination mitigation strategy to contaminated model.

   b. As shown in Table 2, TED on CodeGen with mild contamination outperforms LNE-Blocking by only 4 percentage points. However, for moderate and heavy contamination, LNE-Blocking demonstrates superior performance, leading to better overall performance. Additionally, we have underlined significantly better strategies. For example, LNE-Blocking outperforms TED by nearly 10 percentage points on CodeLlama with moderate and heavy contamination, as well as on Llama3.1 with heavy contamination.