Contamination risk is the chance that test data leaks into a system’s training or tuning pipeline. When that happens, a benchmark no longer measures genuine generalization; it measures how well the model has already seen the answers. In cyber security, that can inflate the apparent quality of malware detectors, phishing filters, exploit classifiers, or AI assistants used for analysis.
The risk matters because security decisions rely on trustworthy evaluation. If samples, prompts, incident reports, or labels from a test set are reused during training, a model may look strong on paper but fail on fresh attacks. Attackers benefit from this kind of overfitting, while defenders may buy or deploy tools that are less capable than advertised. Good defenses include strict data separation, deduplication, provenance tracking, and hidden or rotated test sets with controlled access.