Data and Information Systems

Training data is the collection of examples from which a machine-learning model's parameters are fitted. Contamination is the presence of evaluation material (or near copies of it) in the training data, which makes evaluation scores overstate performance on unseen inputs. Provenance is the documented origin, licensing, collection method and processing history of a data set.

For modern language and multimodal models, the composition of the training corpus is among the most consequential design decisions and, for closed models, one of the least disclosed. Three problems recur in the literature. Quality: web-scale corpora contain duplicated, machine-generated, toxic and low-value text, so filtering choices change model behaviour. Validity of evaluation: if test items appear in training, benchmark scores measure memorisation as well as capability (see CAP-BENCH-001 AI Evaluation). Accountability: licensing, consent, privacy and copyright questions depend on knowing what was collected from where (see SAFE-IP-001 Copyright and Intellectual Property and SAFE-PRIV-001 Privacy and Data Protection in AI).

This article describes the technical mechanisms and the evidence. It does not state legal conclusions, which vary by jurisdiction and are covered in the governance volume.

Early supervised learning relied on curated, hand-labelled sets. As language modelling moved to self-supervised pretraining, corpora grew by crawling the web. The Common Crawl archive became a standard raw source, and filtered derivatives such as the Colossal Clean Crawled Corpus (C4) were documented after the fact: Dodge et al. (2021) audited C4 and reported that blocklist-based filtering removed a disproportionate share of text from and about minority individuals, that the corpus contained machine-generated text, and that it contained evaluation examples from other NLP benchmarks.

Gao et al. (2020) assembled the Pile, an English corpus of roughly 825 GiB combining 22 subsets, many from academic and professional sources, and reported that models trained on it outperformed those trained on raw Common Crawl and CC-100 on its components. Penedo et al. (2024) described FineWeb, about 15 trillion tokens from 96 Common Crawl snapshots, releasing the curation code and ablations of filtering choices; this was a rare detailed public account of web-corpus construction at frontier scale. Frontier developers typically describe their data only in general terms; where a model's data are not disclosed, this article treats them as undisclosed.

On documentation, Gebru et al. (2018) proposed "datasheets for datasets", standardised questions on a data set's motivation, composition, collection and recommended uses, modelled on electronics datasheets. On provenance at scale, Longpre et al. (2023) audited more than 1,800 text data sets and reported license omission above 70% and error rates above 50% on popular hosting sites.

#4.1 Corpus construction pipeline

A typical web-text pipeline has these stages, described in the construction papers cited above: (1) obtain raw crawl snapshots; (2) extract text from markup; (3) filter by language, heuristic quality rules and, in some pipelines, learned classifiers; (4) remove duplicates; (5) mix sources with sampling weights; (6) tokenise (see TECH-TOK-001 Tokenization and Embeddings). Each step encodes judgments that Dodge et al. (2021) and Penedo et al. (2024) show can change downstream behaviour.

#4.2 Deduplication

Lee et al. (2022) found that existing language-modelling data sets contain many near-duplicate examples and long repeated substrings; in their experiments, over 1% of unprompted text from models trained on such data was copied from the training set, deduplicated training reduced the frequency of memorised output roughly tenfold, and deduplication reduced train-test overlap that they report affecting more than 4% of standard validation sets. Deduplication can be exact (hash-based), suffix-array based for repeated substrings, or approximate (e.g., MinHash-style near-duplicate detection).

#4.3 Memorisation and extraction

Language models can reproduce training sequences. Carlini et al. (2021) extracted hundreds of verbatim sequences from GPT-2, including personal contact information, code and chat logs, some of which appeared in only one training document, and reported that larger models were more vulnerable. Memorisation is thus a property of the model-data pair, not only of duplicated text.

#4.4 Contamination

Following the definitions of Sainz et al. (2023), contamination occurs when a model is trained on the test data of a benchmark on which it is later evaluated. Magar and Schwartz (2022) separate two effects: memorisation of contaminated examples and exploitation of them to raise downstream scores. In their controlled BERT pretraining experiments, exploitation occurred in some settings and mere memorisation in others, depending on factors including the number of duplicates and model size.

Detection approaches fall into: (a) n-gram or string overlap between training and test text, which requires access to the training data; (b) black-box statistical tests, such as the exchangeability test of Oren et al. (2023), which compares the likelihood of a benchmark in its canonical order with shuffled orders and requires only likelihood access; (c) construction of benchmarks from material created after a model's training cutoff, as in LiveCodeBench, which continuously collects contest problems (Jain et al., 2024). Brown et al. (2020) reported a contamination analysis of the GPT-3 benchmarks as part of that model's technical report, noting overlap in some evaluations; this is an example of a developer disclosing the problem.

#4.5 Synthetic data and model collapse

As model-generated text enters web crawls, training on it is a growing concern. Shumailov et al. (2024) report that indiscriminate training on model-generated content causes "model collapse", in which the tails of the original data distribution disappear, demonstrated for language models, variational autoencoders and Gaussian mixtures. The result concerns recursive, indiscriminate training; whether and how much mixed real-and-synthetic data pipelines are affected in practice, and the effect of careful curation, is a separate question (see section 7).

• By source: web crawl, curated books and papers, code repositories, user-generated or licensed content, human-written demonstrations and preference labels (see TECH-ALIGN-001 Pretraining, Fine-Tuning and RLHF), synthetic data.
• By contamination type (Sainz et al., 2023; Magar & Schwartz, 2022): exact or near-exact test-set inclusion; inclusion of test inputs without labels; inclusion of derived or paraphrased material; indirect leakage through discussions of benchmark items online.
• By documentation level: undocumented, datasheet-documented (Gebru et al., 2018), or audited with provenance tracing (Longpre et al., 2023).
• By access: open corpora (Pile, C4, FineWeb) versus undisclosed proprietary corpora.

• Open corpora enabling replication: C4, the Pile and FineWeb are documented, public data sets used for open model training and for studying data effects (Dodge et al., 2021; Gao et al., 2020; Penedo et al., 2024).
• Privacy auditing: extraction attacks serve as an audit of what a trained model retains (Carlini et al., 2021).
• Evaluation hygiene: time-segmented benchmarks and black-box tests are used to qualify reported scores (Jain et al., 2024; Oren et al., 2023). Oren et al. audited five public models and reported little evidence of pervasive contamination in that audit; that result applies to the models and benchmarks tested.
• Governance practice: dataset documentation and training-data transparency are subjects of regulation; see GOV-LAW-001 AI Governance for the current legal position, which this article does not summarise.

Strengths of current practice. Deduplication has measurable benefits for memorisation and evaluation (Lee et al., 2022). Documentation templates are cheap and widely adopted as a norm.

Limitations. (1) Detection of contamination is imperfect: overlap checks need data access; black-box tests need likelihoods and have power limits (Oren et al. report tests on models as small as 1.4B parameters and test sets of about 1,000 examples; power depends on test-set size and on how the data were duplicated in training). (2) Sainz et al. (2023) argue the extent of the problem is hard to measure, so published scores for closed models can rarely be fully qualified. (3) Provenance metadata are frequently missing or wrong (Longpre et al., 2023). (4) Quality filters embed value judgments with disparate effects (Dodge et al., 2021).

Unresolved. The real-world impact of synthetic data on future model quality is contested between worst-case recursive results (Shumailov et al., 2024) and practice that mixes curated and synthetic data; this article does not assert a consensus. How much benchmark contamination changes rankings among frontier systems is not established in general.

As of 2026-10-15: the following are well documented in peer-reviewed or archival sources: duplicates and memorisation in web corpora (Lee et al., 2022; Carlini et al., 2021), documented quality and bias effects of filtering (Dodge et al., 2021), the prevalence of weak licensing metadata (Longpre et al., 2023), and statistical methods for black-box contamination testing (Oren et al., 2023). Frontier models' training corpora generally remain undisclosed. Statistics such as corpus sizes, licensing agreements and the share of synthetic data in current frontier training are fast-moving and are not tabulated here; see MODEL-001 and FACT-001.

Observed trends. Dataset documentation, time-segmented benchmarks, and licensing audits are increasingly used. Open pipelines (FineWeb) show that filtering recipes are an active research variable.

Forecast. The record below is a qualitative, testable expectation.

Medium and long term. The balance between scarce high-quality human text and abundant synthetic data is unresolved; this article makes no quantitative prediction about it.

• Foundational Concepts:
  • TECH-ML-001 Machine Learning: Generalisation and held-out evaluation, which contamination undermines.
• Related Methods & Technologies:
  • TECH-LLM-001 Large Language Models: The main consumers of web-scale corpora.
  • TECH-TOK-001 Tokenization and Embeddings: Corpus preprocessing end stage.
  • TECH-SCALE-001 Scaling Laws: Data quantity and quality in compute-optimal training.
  • TECH-ALIGN-001 Pretraining, Fine-Tuning and RLHF: Human-labelled and preference data.
• Evaluation and Governance:
  • CAP-BENCH-001 AI Evaluation: Benchmark validity.
  • SAFE-IP-001 Copyright and Intellectual Property: Rights questions arising from training data.
  • SAFE-PRIV-001 Privacy and Data Protection in AI: Memorisation and personal data.
  • GOV-LAW-001 AI Governance: Regulatory treatment of data documentation.