Non-obvious modes of train/test leakage in instruction-tuning evaluation

Train/test **leakage** means your eval set secretly overlaps with training, so the score looks better than the real ability. In instruction tuning the leaks are subtle, and exact-match dedup misses most of them. The first sneaky leak is paraphrased duplicates. A synthetic data pipeline might generate a training instruction that asks the same thing as an eval item, just reworded. The fix is embedding-based dedup: compare meaning, not characters, and drop pairs above a cosine threshold. The second is benchmark contamination. Famous tests like MMLU and GSM8K have leaked into pretraining corpora over the years. Both the base model and the fine-tuned model score high for the wrong reason, so your improvement number is meaningless. Prefer private held-out sets or benchmarks released after the pretraining cutoff. The third is judge overlap. If you generate training data with one model and then grade with the same model family, the judge favors its own style. Use a different family for judging. A fourth common one: augmenting first, then splitting. Variants of one example land on both sides. Always split before you augment.

**Leakage** in instruction-tuning eval is any path by which eval signal sneaks into training, inflating the measured gain. Exact-match dedup catches almost none of the dangerous modes. Four modes matter most. Paraphrased duplicates arise when synthetic pipelines reword the same task across splits. Benchmark contamination arises when public sets like MMLU or HumanEval already sit in pretraining. Judge-teacher overlap arises when the data generator and the LLM judge share a family. Split-after-augmentation arises when variants of one seed land on both sides. Each has a concrete fix. For paraphrases, run embedding dedup at cosine 0.85 or higher before training. For contamination, run n-gram overlap probes and prefer private or post-cutoff benchmarks. For the judge, pick a different model family than the teacher. For augmentation, split the seed set first, then augment each split in isolation. The meta-point separates seniors from juniors. Leakage is not one bug; it is a class of bugs at different scales: the example, the corpus, the evaluator, and the pipeline. A clean eval addresses all four, then re-reports the fine-tune delta on a decontaminated, held-out set with an independent judge.