{"id":"be17b65a-870a-4ac6-a294-8cc1f8b9ffb7","arxiv_id":"2412.15255","paper_version":2,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":0,"one_line_summary":"Training a teacher on benchmark test data and distilling through an unrelated dataset lets a 2-layer BERT reach near-state-of-the-art GPQA accuracy, revealing a benchmark vulnerability.","lead":"This paper shows that knowledge distillation can quietly transfer memorized benchmark answers into a new model, letting a tiny two-layer BERT score 75% on GPQA without actually learning to reason. It introduces \"Data Laundering\" as a cautionary demonstration that current benchmarks can be gamed through seemingly normal training steps.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"GPQA result lacks answer-order permutation control; Appendix C random-input scores (~49-50%) indicate a large option-position prior, so 73.94% may not demonstrate covert transfer of benchmark-specific knowledge.","rationale":"The reader's weakest assumption concerned access to the test set. That is a legitimate scope boundary, but the paper itself acknowledges it in Section 5.5 by noting that private benchmarks can prevent intentional misuse, so it does not undermine the central demonstration for public benchmarks. The more load-bearing concern is internal: the headline result may be confounded by an answer-position prior rather than actual transfer of test-item knowledge. Appendix C's randomized-text experiments are the key evidence. Accuracy of 48.99% with fully random questions and answers, and 50.00% with identical answer choices, cannot arise from learning the content of GPQA questions; it strongly suggests the model learns a fixed or majority answer position that happens to align with GPQA's label distribution. The paper does not report the position distribution, a fixed-choice baseline, or an answer-shuffled evaluation. Without these, the 73.94% result in Table 1 is ambiguous: it could reflect genuine laundering of benchmark answers, or it could reflect a much simpler exploitation of the benchmark's fixed option order. The proposed permutation test settles this directly. If the effect survives shuffling, the paper's central claim is robust and the remaining veracity concerns are minor; if it collapses, the contribution is substantially weaker. I therefore recommend keeping the CONDITIONAL verdict, but the condition should be this permutation control rather than only code verification and single-run statistics. I partially agree with the reader because the test-set access assumption is a real scope limitation, but it is not the primary threat to the central claim.","tokens_in":13515,"tokens_out":11902,"duration_ms":121529,"concrete_test":"Re-evaluate the KD(1) BERT student on GPQA under three conditions: (a) the original option order, (b) a random permutation of the four answer choices per question with a fixed seed, and (c) a majority-position baseline such as always predicting option A. Also report the correct-answer position distribution for GPQA Diamond. If shuffled accuracy drops below roughly 35% or falls to the majority-position baseline, the 73.94% headline is largely an option-order artifact; if shuffled accuracy remains above 60%, content-level knowledge transfer is confirmed.","verdict_should_be":"CONDITIONAL","load_bearing_attack":"The central demonstration rests on Table 1's 73.94% GPQA accuracy for the distilled 2-layer BERT. For that number to support 'knowledge laundering,' the student must be answering by content rather than by a positional heuristic. Appendix C (Figure 5) undercuts this interpretation: with question and answer text replaced by random characters, accuracy is 48.99%; with all answer choices identical strings, 50.00%. Both are far above the 25% random baseline and are hard to explain by content transfer, since the student never saw real text during distillation. A straightforward explanation is that GPQA's released answer ordering is imbalanced and the student learns a majority-position prior from the teacher's logits. The paper reports no always-pick-A baseline, no permutation test, and no label-distribution analysis for GPQA. If this prior contributes substantially to Table 1's 73.94%, the result is an artifact of the benchmark's fixed option ordering rather than laundered test knowledge. The method would still be a benchmark-gaming technique, but it would not support the paper's specific claim of covert transfer of benchmark-specific knowledge through distillation, and it would not generalize to evaluations that randomize option order.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper introduces \"Data Laundering,\" a three-stage process (placement, layering, integration) in which a teacher model is first trained on benchmark test data, then distilled into a student model via an intermediate dataset such as MedMCQA or RACE, and finally evaluated on the original benchmark. The central empirical claim is that a 2-layer BERT student can reach 73.94% on GPQA Diamond and 62.31% on MMLU-Redux, approaching OpenAI o1's 77.30% and far exceeding the student's random baseline, with the implication that benchmark-specific knowledge can be covertly transferred through a seemingly legitimate distillation pipeline. The paper includes experiments on loss functions, alpha mixing, iterative distillation, training data size, and artificially degraded intermediate datasets. The authors frame the work as a cautionary tale about evaluation vulnerability and suggest private benchmarks and transparent teacher training as mitigations.","tokens_in":13712,"tokens_out":4116,"duration_ms":37083,"significance":"If the central claim is supported, the paper demonstrates a practically important vulnerability: knowledge distillation can propagate test-set contamination through an intermediate training step, producing models that achieve high benchmark scores without genuine reasoning, and this can occur unintentionally when the teacher's training data is opaque. The authors provide code, specify student-side hyperparameters in Appendix B, and include a useful control experiment in Appendix C (randomized intermediate datasets). However, as detailed in the major comments, the interpretation of the headline result is not yet established because the paper does not control for answer-order position priors, and the comparison to untouched state-of-the-art models is rhetorically misleading. With additional controls and a more careful framing, the paper could still serve as a valuable warning about benchmark integrity.","major_comments":[{"comment":"The headline result of 73.94% on GPQA is not currently evidence of covert transfer of benchmark-specific knowledge, because the paper does not report an answer-order permutation control. Appendix C shows that the same 2-layer BERT distillation setup, with both questions and answers replaced by random characters, still achieves 48.99% accuracy on GPQA, far above the 25% random baseline. Since the student never saw real GPQA text in this condition, a large fraction of the observed accuracy can be explained by a learned option-position prior derived from the teacher's logits, not by content knowledge. The authors should report an always-pick-A baseline, analyze the label/answer-position distribution of GPQA, and run an evaluation with randomly permuted answer orders to separate position prior from content transfer. Without these controls, the claim that the method 'launders' test-set knowledge is not supported; at most, the paper demonstrates a benchmark-gaming technique based on fixed option ordering.","section":"Section 5.1, Table 1"},{"comment":"The teacher training setup is ambiguous. Contaminated models are labeled as trained on 'GPQA/MMLU-Redux,' but the paper does not specify whether the teacher is trained jointly on both benchmarks, independently per benchmark, or with a mixed objective, nor does it state the teacher training hyperparameters. Since the same teacher model (e.g., model (1)) is used to produce the GPQA and MMLU-Redux columns, the reader cannot determine whether the MMLU-Redux result reflects a teacher trained on MMLU-Redux test data in the same configuration. Please clarify the teacher training data composition and provide teacher-side hyperparameters (learning rate, epochs, batch size) in Appendix B for reproducibility.","section":"Section 4.1, Table 1"},{"comment":"The comparison to OpenAI o1, Claude 3.5 Sonnet, GPT-4o, and LLaMA3-70B is unfair and should be reframed or removed. Those models were not trained on GPQA test data, while the laundered student was distilled from a teacher that was. The claim of 'near state-of-the-art' performance is therefore an artifact of the attack setup, not a meaningful competitive result. The paper should either drop this comparison or explicitly label it as a vulnerability demonstration against an unprivileged baseline, avoiding the implication that the method achieves legitimate SOTA-level capability.","section":"Section 5.1, Section 5.5"},{"comment":"All secondary results (loss-function comparison, alpha sweeps, iterative distillation, and data-size curves) are based on single runs, as stated in Section 5. Claims such as 'MSE loss consistently outperforms KLD' and 'the most favorable trade-off ... occurs in the range α=0.5–0.7' are therefore not statistically supported. The authors should either run multiple seeds for these experiments or soften the claims to qualitative observations. This does not affect the paper's main vulnerability message if the headline result survives the permutation control, but it limits the reliability of the design recommendations.","section":"Section 5, Figures 2-4"}],"minor_comments":[{"comment":"In the second paragraph, 'reliance' is misspelled as 'reliance' in the phrase 'as the relience on automated evaluation metrics increases'.","section":"Section 1"},{"comment":"The discussion contains a typo: 'constatnt knowledge leakage' should be 'constant knowledge leakage'.","section":"Section 5.2"},{"comment":"The phrase 'trained prohibitively on test data' is unclear; it likely means 'trained on data that is prohibited' or 'trained in a prohibited manner on test data.' Please rephrase for precision.","section":"Section 3.1"},{"comment":"The caption for Figure 5 lists four modifications, but the text describes the fourth condition as 'identical questions with identical answers' with 28.65% accuracy; please make the mapping between the caption bullet points and the reported numbers explicit and consistent.","section":"Appendix C, Figure 5"},{"comment":"The sentence 'One potential way to prevent the unintended use ... is to ensure the teacher model is trained on known dataset like LLM360' contains a grammatical issue ('a known dataset'); please revise.","section":"Section 5.5"}],"recommendation":"major_revision","confidential_remarks":"The paper addresses a timely and important topic, but the central claim is currently over-stated. The Appendix C randomized-data results suggest that the 73.94% GPQA figure may be substantially driven by option-position priors rather than laundered content knowledge. This is a fixable issue with additional control experiments, but it is load-bearing for the paper's main interpretation. I also note a fit concern: the manuscript reads more like a security/benchmark-integrity cautionary note than a methodological advance; that is acceptable for a workshop or an applied journal, but the authors should temper the 'near state-of-the-art' framing to avoid sensationalism."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"You should read this one: it makes a concrete, testable claim about evaluation integrity, and its own appendix contains the control that complicates the headline. The paper shows that a teacher trained on GPQA test data transfers enough through distillation on an unrelated intermediate dataset (MedMCQA) to push a 2-layer BERT from ~26% to 73.94% on GPQA. The three-phase framing (placement, layering, integration) is a useful package, and the threat model includes the accidental case — a researcher using an opaque teacher could inflate scores without meaning to. That is fair and worth taking seriously.\n\nWhat is genuinely good: the main result is averaged over three runs with standard deviations, hyperparameters are in Appendix B, the iterative distillation and data-size sweeps are sensible, and the paper openly says most secondary results are single runs. The Appendix C experiments, destroying the intermediate dataset's content, are the right instinct for isolating what actually transfers.\n\nNow the soft spot, and it is the load-bearing one. Appendix C reports 48.99% accuracy when questions and answers are replaced with random characters, and 50.00% when all answer choices are identical strings — both far above the 25% chance floor. At alpha=1.0, hard labels are ignored, so the only signal reaching the student is the teacher's logits on garbage inputs. The paper attributes the result to \"structural patterns,\" but the simpler explanation is a positional prior: the GPQA-trained teacher learned that some answer positions are more likely correct, and the student inherits that bias. The paper never reports an always-pick-A baseline, an answer-order permutation, or GPQA's label-position distribution. Without those, the headline 73.94% is an unknown mix of content transfer and position prior — Appendix C makes it plausible that roughly half the gain is positional. That undercuts the \"near SOTA\" comparison to o1 and means the laundered model would partially collapse under randomized evaluation.\n\nThe core vulnerability claim survives, though. The student only gets the prior because the teacher trained on test data, and the distillation step launders it, so the paper still demonstrates a real benchmark-gaming path; it just overstates what specific knowledge is transferred. The fix is straightforward: permutation control, label-position analysis, and a decomposition of the gains. Secondary issues are minor: most experiments are single-run, the training setup for the six contaminated models is underspecified, the SOTA baselines come from different evaluation protocols, and the code repo is unverified. Related work is solid on contamination and benchmark gaming; it skips the model-extraction and privacy literature, where teacher-logit leakage is well documented — connecting there would strengthen the paper.\n\nFor anyone building or using public benchmarks, this is worth a read and a serious referee. The revision request should center on the positional-prior control.","headline":"Worth engaging, but the headline GPQA number is partly a positional-prior artifact the paper never controls for; Appendix C's own randomized-input results show it.","tokens_in":14209,"tokens_out":6237,"would_cite":true,"duration_ms":57613,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Distillation can launder benchmark answers into a 74% GPQA score","keywords":["data contamination","knowledge distillation","benchmark manipulation","GPQA","MMLU-Redux","evaluation integrity","benchmark leakage","model evaluation"],"falsifier":"Train a teacher on the GPQA training split rather than the test split, distill it through MedMCQA into a 2-layer BERT, and evaluate on the GPQA test. If the student still scores near 74%, the boost is not caused by test-set contamination; if it drops to random level, the laundering explanation is supported.","tokens_in":13320,"feed_emoji":"🧼","tokens_out":5573,"duration_ms":45600,"temperature":0.7,"pith_summary":"This paper demonstrates that knowledge distillation, a standard technique for compressing models, can be subverted to transfer answers from a benchmark's test set into a student model without the student ever seeing the test data. The authors train a teacher on the GPQA test set, then distill it into a 2-layer BERT using the unrelated MedMCQA dataset as an intermediate step. The student reaches 73.94% accuracy on GPQA, close to the 77.30% of a top general-purpose reasoning model, despite having no genuine reasoning capability. The finding implies that public benchmark scores can be inflated through legitimate-looking training pipelines, intentionally or accidentally.","feed_headline":"Distillation can launder benchmark answers into a 74% GPQA score","feed_subtitle":"A 2-layer BERT with no reasoning ability beats models many times its size once the teacher memorizes test answers.","key_machinery":"The central object is the three-phase Data Laundering pipeline built on logit-based knowledge distillation. The loss mixes hard labels from an intermediate dataset with the teacher's soft logits, $L_{\\text{student}} = (1-\\alpha)L_{\\text{hard}} + \\alpha L_{\\text{soft}}$, and the paper shows that MSE on the logits transfers test-set knowledge more effectively than KL divergence. The distillation step is what converts the teacher's memorized test answers into a student that performs well on the benchmark while having no direct contact with the test set.","core_discovery":"The central claim is that benchmark-specific knowledge can be covertly transferred through knowledge distillation in a three-phase process the authors call Data Laundering: placement (train a teacher on the target benchmark's test set), layering (distill the teacher into a student through an innocuous intermediate dataset, mixing hard labels and the teacher's soft logits), and integration (evaluate on the benchmark). The evidence is that a 2-layer BERT distilled this way through MedMCQA reaches 73.94% on GPQA, compared to 25.76% when trained normally on the same intermediate data without a contaminated teacher. The transfer is robust: it persists across loss functions, alpha values, dataset sizes down to 500 samples, and even when the intermediate data's questions and answers are replaced with random characters, indicating that the format alone carries the leaked signal.","pith_inferences":["The same logit-based laundering likely transfers to generation tasks or open-ended benchmarks, because the signature lives in the teacher's output distribution rather than in memorized text.","The iterative-distillation result implies that one contaminated model can poison a lineage of descendants, so a single leaked benchmark can quietly skew model comparisons for several generations.","A concrete detection test would compare a student's agreement with its teacher on benchmark questions against agreement on held-out control questions; anomalous agreement would flag laundering.","If this technique spreads, benchmark averages across many models could become systematically inflated over time, eroding the meaning of 'state of the art' even for honestly trained models."],"forward_implications":["A small model can be made to look like a much larger one on a leaderboard without gaining any real capability, so reported benchmark scores become untrustworthy.","Standard contamination checks that look for n-gram overlap or memorized text will not catch this leak, since the student never sees the test questions.","Researchers who distill from a teacher with opaque training data can inflate their scores without intending to, making provenance checks on teachers a necessary safeguard.","Private benchmarks with hidden answers become a practical defense, since the teacher in this attack needs the actual test labels.","Even meaningless intermediate training data transfers the benchmark signal, so sanitizing the intermediate corpus does not stop the leak."],"supporting_citations":[{"why":"Supplies the knowledge-distillation loss that carries the teacher's soft-label information to the student.","marker":"Hinton et al., 2015"},{"why":"Defines the GPQA benchmark, the test set used to contaminate the teacher and the target of evaluation.","marker":"Rein et al., 2024"},{"why":"Provides MedMCQA, the intermediate dataset in the layering phase.","marker":"Pal et al., 2022"},{"why":"Provides RACE, the alternative intermediate dataset used to study domain alignment effects.","marker":"Lai et al., 2017"},{"why":"Defines MMLU-Redux, the second target benchmark showing the method generalizes beyond GPQA.","marker":"Gema et al., 2025"},{"why":"Shows that rephrasing can bypass decontamination filters, motivating the claim that subtle leakage routes avoid detection.","marker":"Yang et al., 2023"}],"fun_headline_variants":["Fake benchmark scores by laundering answers via distillation","Hidden trick: distillation leaks benchmark answers into AI","2-layer BERT hits 74% GPQA by distilling test answers","Data laundering inflates AI benchmarks without reasoning","Contaminated distillation: a covert way to cheat benchmarks"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The demonstration assumes the attacker (or unwitting researcher) has access to the full test set of a public benchmark such as GPQA in order to train the teacher; the attack does not apply to private benchmarks whose test answers are withheld.","fun_headline_variants_meta":{"raw":{"variants":["Fake benchmark scores by laundering answers via distillation","Hidden trick: distillation leaks benchmark answers into AI","2-layer BERT hits 74% GPQA by distilling test answers","Data laundering inflates AI benchmarks without reasoning","Contaminated distillation: a covert way to cheat benchmarks"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.00024,"raw_usage":{"total_tokens":1491,"prompt_tokens":894,"completion_tokens":597,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":510,"completion_tokens_details":{"reasoning_tokens":520}},"tokens_in":510,"tokens_out":597,"duration_ms":5649,"temperature":1.0,"reasoning_tokens":520,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-11T15:04:37.069263+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Train a teacher on the GPQA training split rather than the test split, distill it through MedMCQA into a 2-layer BERT, and evaluate on the GPQA test. If the student still scores near 74%, the boost is not caused by test-set contamination; if it drops to random level, the laundering explanation is supported.","supporting_citations":[{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Defines MMLU-Redux, the second target benchmark showing the method generalizes beyond GPQA."}],"review_version":1}