Personalize this lesson
Adapt explanations and teaching visuals to your background and preferred voice.
The last chapter turned a FLOP budget into a token target. This one asks what those tokens actually are. A 70B dense model using Chinchilla scaling at roughly 20 tokens per parameter needs about 1.4T training tokens. That number is a volume target, not a corpus. Raw crawls, public git trees, and book dumps still contain broken HTML, mirrored pages, spam, private strings, and leaked benchmark questions.
Suppose a 2T-token run completes and its first checkpoint looks healthy. Later, a code evaluation regresses because one shard overrepresented mirrors while a language filter removed symbol-heavy files. A raw token counter won't show either failure; lineage, yield, and source mix will.
A coding-assistant mix needs public code, API docs, runbooks, and design notes. You can't dump those sources into training as-is. The pipeline's job is to turn a messy source lake into documented shards: extract text, drop low-signal records, remove duplicates, scrub sensitive material, keep evaluation sets out, then tokenize and pack what remains.
Track yield after each gate, not just raw download volume. If 2T extracted tokens lose 30% to quality filters and another 20% of the remainder to deduplication, only 1.12T tokens survive. That corpus misses a 1.4T target even though the original crawl looked comfortably large.
From token budget to training inventory
Start with the inventory, not the downloader. A token target tells you how many training events you want; it doesn't tell you which sources fill them or whether a later shard can be traced back to a policy decision.
Three ideas from earlier in the curriculum sit underneath every later choice:
- Tokens: A language model doesn't read words. It reads tokens: reusable pieces such as
ship,ping, punctuation, or byte sequences. The tokenizer converts text into integers, and the model learns to predict the next integer. - Next-token prediction: During pre-training, the model sees a partial sequence and guesses what comes next. Broader, cleaner sequences give it more to learn from.
- Scaling laws: The previous chapter turned model size into a token target. That target still needs extract, filter, dedup, pack, and shard steps before those tokens become training inventory.
If tokens or next-token prediction feel fuzzy, review Language Modeling & Next Tokens before continuing.
How much data is enough?
Ask what the 1.4T figure means before treating it as a procurement number. It estimates training-token volume under one scaling-law setup; it doesn't promise unique, clean, or equally useful tokens.
Hoffmann et al. studied that tradeoff in the Chinchilla scaling laws. Under their fixed-compute dense-transformer setup, model size and training-token count grew together. A useful planning rule from that study is about 20 training tokens per parameter.[1]
For a 70B model, tokens. That's a lot of books, pages, and repositories, which is why the pipeline needs industrial machinery.
A companion planning formula is training FLOPs of about , where is a consistently counted dense model size and is the number of training tokens. It's an approximation. Details such as whether output-layer parameters are counted can move fitted optima, but it's useful for capacity estimates.[1][2]
Raw token counts still mislead. A smaller corpus of textbook-quality tokens can beat a much larger pile of noisy crawl text. Extra tokens help only when they still add information.
Meta reports pre-training Llama 3's 405B model on 15.6T tokens, about 38.5 tokens per parameter, and says that flagship configuration is approximately compute-optimal under its own fitted laws and training budget. Separately, Meta reports training its smaller models longer than compute-optimal because those models performed better at the same inference budget.[3] Treat the 20x ratio as a planning baseline, not a hard law.
1def dense_training_flops(parameters: float, tokens: float) -> float:
2 return 6 * parameters * tokens
3
4parameters = 70e9
5target_tokens = 20 * parameters
6llama_405b_ratio = 15.6e12 / 405e9
7
8print(f"Chinchilla-style token target: {target_tokens / 1e12:.1f}T")
9print(f"Dense training FLOP estimate: {dense_training_flops(parameters, target_tokens):.2e}")
10print(f"Llama 3 405B reported ratio: {llama_405b_ratio:.1f} tokens/parameter")1Chinchilla-style token target: 1.4T
2Dense training FLOP estimate: 5.88e+23
3Llama 3 405B reported ratio: 38.5 tokens/parameterWhy is a token target not enough to define a pre-training corpus?
Answer
Token count measures volume, not signal. You still need source mix, filtering, deduplication, privacy scrubbing, benchmark decontamination, and tokenizer fit before those tokens become useful training inventory.
The raw corpus and the clean training mix
The raw internet is a noisy source lake. Useful records sit next to duplicate pages, broken markup, spam, and unsafe material. A pre-training data pipeline is the repeatable system that extracts useful records and turns them into a training-ready mix.
You don't write the text. You design a processing system that handles large partitions repeatably, records each decision, and avoids throwing out high-value records.
Every gate makes a different claim about a record. Keep source identity and policy metadata attached, because dropping a malformed HTML page and routing a high-signal code file to a separate recipe are different decisions.
The modern pipeline has three major phases:
- Ingestion: Pull raw data from web crawls, code hosts, and curated archives.
- Cleaning: Filter, deduplicate, decontaminate (strip leaked evaluation-benchmark examples), and scrub for safety.
- Preparation: Tokenize, shuffle, pack, and split into training shards.


Where the text comes from
Common Crawl doesn't ship paragraphs. It ships WARC files of HTML. Extraction is the first real gate: a parser has to keep a runbook's steps and drop the navigation chrome around them. FineWeb extracts text from WARC snapshots; Llama 3 reports a custom HTML parser tuned for boilerplate removal and for keeping math and code structure.[4][3]
After extraction, sources still aren't interchangeable. Web data gives breadth and freshness. Code is dense in syntax and exact structure. Books and papers give long-form argument. Carefully curated synthetic or textbook-style data can raise signal density further. Phi-1 is a clear example: its authors report strong coding-benchmark performance from a 1.3B model trained on textbook-quality and synthetic data.[5]
Before choosing weights, ask what each source can lose. A web filter that removes navigation may improve prose, while the same rule can erase code context or a license header that an audit needs. Preserve source and license metadata so a yield change has an explanation.
| Source | What it contributes | Main curation question |
|---|---|---|
| Common Crawl snapshots | Broad web coverage at large scale | Which extraction, language, quality, and deduplication rules raise signal without collapsing yield? |
| Books and papers | Long-form explanations and sustained argument | Which licenses, provenance rules, and subject areas fit the intended model? |
| Wikipedia | Structured reference text across many topics and languages | Which languages and snapshots belong in the mixture? |
| Code (for example, public repositories) | Syntax, APIs, and examples where exact structure matters | Which licenses, repository-level rules, and file filters remove generated or low-value code? |
| Curated web (for example, technical forums) | Focused discussions and worked answers | How do you preserve useful niche material without replaying copied pages? |
| Synthetic data | Targeted examples for gaps that raw sources cover poorly | Does the generated slice preserve factual fidelity, diversity, and downstream quality? |
Note: Some papers disclose approximate mixtures while many don't. Llama 3 reports a final pre-training mix of roughly 50% general knowledge, 25% mathematical and reasoning data, 17% code, and 8% multilingual data.[3] Mixture weights are decisions, not raw-byte proportions.
Mixture weights, curriculum, and data scheduling
Source quality is only half the decision. You also have to decide how often each source appears and whether that weighting stays fixed through the whole run.
If clean code is only 10% of the retained pool, should it occupy 10% of training? Maybe not. Upsampling changes the model's exposure without pretending that the source produced more unique tokens.
Three knobs matter:
- Source weighting: web, code, books, papers, synthetic data
- Schedule over time: fixed mix vs later-stage reweighting
- Within-source weighting: whether some slices replay more often than others
The wrong default is "sample in proportion to raw bytes." Raw crawl volume isn't the same thing as training value. The Pile is still useful as a reference because it made mixture design explicit instead of treating web text as one giant bucket.[6] Llama 3 shows a later-stage version of the same idea: even after assembling a huge corpus, training shifted toward higher-value slices during annealing.[3]
1reported_mix = {
2 "general knowledge": 0.50,
3 "math and reasoning": 0.25,
4 "code": 0.17,
5 "multilingual": 0.08,
6}
7budget = 1e12
8
9assert abs(sum(reported_mix.values()) - 1.0) < 1e-9
10for source, fraction in reported_mix.items():
11 print(f"{source:<19}: {budget * fraction / 1e9:>3.0f}B tokens")1general knowledge : 500B tokens
2math and reasoning : 250B tokens
3code : 170B tokens
4multilingual : 80B tokens| Knob | What changes | Typical reason |
|---|---|---|
| Upsampling / downsampling | how often each source appears | code, math, books, or multilingual text may deserve more weight than raw size suggests |
| Curriculum schedule | what the model sees earlier vs later | keep early coverage broad, then spend late tokens on harder or cleaner data |
| Per-example weights | which records inside one source repeat more | keep rare but important domains from being drowned by generic text |
This is practical curriculum learning in pretraining. It usually isn't "easy lessons first, hard lessons later." More often it means changing source weights over time so the model sees a different mix at different stages.
Two common patterns:
- Static high-quality mix: choose one weighted mixture and keep it stable through most of training
- Late-stage curriculum: keep broad coverage early, then upweight cleaner or more target-relevant slices later[3]
Don't confuse curriculum with annealing alone. Annealing usually means late-stage learning-rate decay plus a higher-quality mix. Curriculum is broader: any deliberate schedule that changes what the model sees as training progresses.
It also helps to know the public datasets that anchored a lot of later recipes:
| Dataset | What it emphasized | Why people still cite it |
|---|---|---|
| C4[7] | Aggressive heuristic cleanup of Common Crawl | Canonical example of turning noisy crawl text into a cleaner English web corpus |
| The Pile[6] | Deliberate source diversity across code, papers, books, forums, and web text | Useful contrast to pure web-crawl pipelines because mixture design is the core idea |
| FineWeb[4] | Web-scale extraction, filtering, and deduplication ablations over 96 Common Crawl snapshots | Good modern reference for how pipeline details measurably change downstream quality |
First quality check: heuristic filtering
Before using expensive neural models to classify text, basic heuristic filters drop the lowest-signal material from web crawls. C4 (Colossal Clean Crawled Corpus) is the classic published example of that first line of defense.[7]
The snippet below takes a single document and returns True only if it passes every check. The thresholds are visible on purpose. A real recipe has to measure retention and downstream quality on its own crawl slices before copying them.[7][4]
Predict two outcomes before reading the code: a long runbook should pass, while a short but symbol-dense source file may fail its general-text checks. That second result is a routing signal, not proof that the file has no training value.
1def load_bad_words() -> list[str]:
2 # In production, this would come from a reviewed policy list.
3 return ["toxic_word_1", "toxic_word_2"]
4
5def quality_filter(doc: str) -> bool:
6 """Illustrative web-text filter; thresholds require corpus-level validation."""
7 words = doc.split()
8
9 # Length filter: drop documents that are too short or likely concatenated.
10 if len(words) < 50 or len(words) > 100_000:
11 return False
12
13 # Repetition filter: repeated n-grams are common in spam and boilerplate.
14 for n in [2, 3, 4]:
15 ngrams = [tuple(words[i:i+n]) for i in range(len(words) - n + 1)]
16 if len(ngrams) > 0:
17 frac_duplicates = 1 - len(set(ngrams)) / len(ngrams)
18 if frac_duplicates > 0.3: # >30% repeated n-grams
19 return False
20
21 # Policy-list filter: check the ratio of reviewed blocklisted terms.
22 bad_words = set(load_bad_words())
23 bad_count = sum(1 for w in words if w.lower() in bad_words)
24 if bad_count / len(words) > 0.01:
25 return False
26
27 # Alphabetic character ratio: drop documents that are mostly symbols/code.
28 alpha_chars = sum(c.isalpha() for c in doc)
29 if alpha_chars / len(doc) < 0.5:
30 return False
31
32 # Sentence-ending punctuation check.
33 sentences = doc.split('.')
34 if len(sentences) < 3:
35 return False
36
37 return True
38
39procedure_doc = (
40 "The key-rotation runbook explains how stale service-account keys are reviewed. "
41 "Operators verify the audit signal, check the owning service, "
42 "and create a rotation task when the account is eligible. "
43 "This document contains specific procedural details, normal punctuation, "
44 "and enough natural language context to be useful for model training. "
45 "It avoids repeated boilerplate and gives on-call engineers a clear workflow."
46)
47
48cases = {
49 "procedure": (procedure_doc, True),
50 "short": ("Rotation tasks are available.", False),
51 "repeated": ("sale sale sale sale sale sale sale sale sale sale " * 8, False),
52 "policy-list": (procedure_doc + " toxic_word_1 toxic_word_2", False),
53}
54
55for name, (text, expected) in cases.items():
56 kept = quality_filter(text)
57 assert kept is expected
58 print(f"{name:<11} -> {'keep' if kept else 'drop'}")1procedure -> keep
2short -> drop
3repeated -> drop
4policy-list -> dropEach gate is a different failure mode:
- Length: very short documents often carry little context; extremely long extractions may be concatenated pages or indexes.
- Repetition: high repeated n-gram fractions are a useful spam or boilerplate signal, but legitimate templates can also repeat.
- Policy list: a reviewed list can exclude content a specific corpus policy doesn't want. The threshold is a policy choice, not a universal quality label.
- Character ratio: a general-text recipe can discard symbol-heavy extractions. A code corpus needs a different recipe.
- Sentence terminators: few periods can signal a malformed extraction, but they're a poor universal language or format rule.
These heuristics usually run on general web text before the final mix is assembled. Code corpora often use a parallel recipe, because symbol-heavy files that look low-quality to a web-text filter can still be high-signal pre-training data.
Second quality check: classifier-based filtering
After heuristic filtering, modern pipelines use classifiers trained to distinguish high-quality educational text from low-quality web chatter:
- Language ID: A
fastTextclassifier screens whether the document matches the intended training languages. - Quality classifier: A classifier scores whether a document looks like reference-quality material rather than random crawl text. FineWeb-Edu uses an educational-quality classifier trained on LLM-judged scores, DCLM trains a
fastTextclassifier on instruction-formatted and ELI5 text and keeps only the top ~10% by score, and Meta reports separate Llama 3 classifiers for general quality, code, and reasoning signals.[4][8][3] - Perplexity filtering: A language model such as an n-gram model can score a document against a reference distribution. Unusually high or low scores can flag text for corpus-specific retention rules; CCNet is a published example.[9]
A classifier score is a ranking signal, not ground truth. The threshold is a choice about which errors and how much yield the next training experiment can afford.
| Filter | Effect | Example |
|---|---|---|
| URL blocklist | Remove known low-quality or unsafe domains | Common in production pipelines |
| Language ID (fastText) | Keep target language(s) | CCNet[9], FineWeb[4] |
| Heuristic rules | Length, repetition, char ratios | C4[7], RedPajama[10], FineWeb[4] |
| Classifier | Quality score threshold | FineWeb-Edu[4], DCLM[8], Llama 3[3] |
| Perplexity filter | Rank documents by fit to a reference distribution | CCNet[9] |
Filtering decisions trade yield for the type of data retained. DCLM selected a fastText filter that retained its top 10% of documents after evaluating trained models, rather than assuming a score threshold was automatically better.[8]
The next snippet applies one threshold to a five-document toy mix. It doesn't prove the cutoff is good. It only shows how token yield collapses as the score floor rises.
1documents = [
2 {"source": "proof", "tokens": 120, "score": 0.98},
3 {"source": "api-doc", "tokens": 160, "score": 0.92},
4 {"source": "forum", "tokens": 200, "score": 0.79},
5 {"source": "news", "tokens": 240, "score": 0.63},
6 {"source": "scrape", "tokens": 280, "score": 0.31},
7]
8
9threshold = 0.90
10kept = [doc for doc in documents if doc["score"] >= threshold]
11kept_tokens = sum(doc["tokens"] for doc in kept)
12total_tokens = sum(doc["tokens"] for doc in documents)
13
14print("kept sources:", ", ".join(doc["source"] for doc in kept))
15print(f"token yield: {kept_tokens}/{total_tokens} ({kept_tokens / total_tokens:.0%})")1kept sources: proof, api-doc
2token yield: 280/1000 (28%)Removing duplicates
Deduplication is a core quality step. The internet contains boilerplate headers, repeated SEO text, mirrored sites, copied documentation, and reposted articles. Lee et al. found that, on the corpora and model sizes they tested, deduplication reduced emitted memorized text by about 10x and reached the same or better accuracy in fewer training steps.[11]
Exact deduplication
Take a cryptographic hash such as SHA-256 of each document and drop exact matches. It's fast, and it misses near-duplicates: a policy page where only the timestamp or one verb changed.
MinHash + LSH (near-deduplication)
MinHash with Locality-Sensitive Hashing (LSH) is one widely used approach for fuzzy deduplication at scale.[12][11] FineWeb applied MinHash independently per crawl using word 5-grams and parameters intended to target documents with at least 75% similarity. Its experiments favored per-crawl rather than global deduplication.[4]
The idea, by hand. Take three short documents:
- Doc A: "The key policy says stale accounts need security review."
- Doc B: "The key policy says stale accounts require security review."
- Doc C: "Audit logs record deployment rollback events."
Doc A and Doc B share almost every word. Break them into overlapping 2-word chunks (shingles):
- Doc A shingles:
["The key", "key policy", "policy says", "says stale", ...] - Doc B shingles:
["The key", "key policy", "policy says", "says stale", ...]
The overlap is high. Doc C shares zero shingles with A or B. Jaccard similarity is . For these two policy pages that's . MinHash turns each document into a small numeric sketch that estimates this overlap. LSH then routes similar sketches into the same candidate set so you inspect likely duplicates rather than comparing every pair. Because LSH is approximate, a candidate still needs a final similarity decision.

Use a candidate-then-verdict boundary. hashlib and banded LSH make likely pairs cheap to find; exact Jaccard and an explicit representative rule decide whether a document gets dropped.
1import hashlib
2import re
3from collections import defaultdict
4
5def normalize(text: str) -> list[str]:
6 return re.findall(r"[a-z0-9]+", text.lower())
7
8def shingles(text: str, n: int = 2) -> set[tuple[str, ...]]:
9 tokens = normalize(text)
10 if len(tokens) < n:
11 raise ValueError("Document is too short for the chosen shingle size.")
12 return {tuple(tokens[i : i + n]) for i in range(len(tokens) - n + 1)}
13
14def jaccard(left: set[tuple[str, ...]], right: set[tuple[str, ...]]) -> float:
15 return len(left & right) / len(left | right)
16
17def salted_hash(item: tuple[str, ...], salt: int) -> int:
18 payload = f"{salt}|{' '.join(item)}".encode()
19 return int.from_bytes(hashlib.blake2b(payload, digest_size=8).digest(), "big")
20
21def minhash(items: set[tuple[str, ...]], num_perm: int = 32) -> tuple[int, ...]:
22 return tuple(min(salted_hash(item, salt) for item in items) for salt in range(num_perm))
23
24def minhash_similarity(left: tuple[int, ...], right: tuple[int, ...]) -> float:
25 return sum(a == b for a, b in zip(left, right)) / len(left)
26
27def lsh_bands(signature: tuple[int, ...], n_bands: int = 8) -> list[tuple[int, ...]]:
28 width = len(signature) // n_bands
29 return [signature[i * width : (i + 1) * width] for i in range(n_bands)]
30
31documents = [
32 ("A", "The key policy says stale accounts need security review."),
33 ("B", "The key policy says stale accounts require security review."),
34 ("C", "Audit logs record deployment rollback events."),
35]
36sets = {doc_id: shingles(text) for doc_id, text in documents}
37sigs = {doc_id: minhash(items) for doc_id, items in sets.items()}
38
39assert abs(jaccard(sets["A"], sets["B"]) - 0.60) < 1e-12
40assert jaccard(sets["A"], sets["C"]) == 0.0
41assert minhash_similarity(sigs["A"], sigs["B"]) > minhash_similarity(sigs["A"], sigs["C"])
42
43print(f"A vs B exact Jaccard: {jaccard(sets['A'], sets['B']):.2f}")
44print(f"A vs C exact Jaccard: {jaccard(sets['A'], sets['C']):.2f}")
45print(f"MinHash estimate A-B: {minhash_similarity(sigs['A'], sigs['B']):.2f}")
46print(
47 "LSH band collisions A-B:",
48 sum(a == b for a, b in zip(lsh_bands(sigs["A"]), lsh_bands(sigs["B"]))),
49 "/ 8",
50)
51
52threshold = 0.50
53index: dict[tuple[int, ...], list[str]] = defaultdict(list)
54kept: list[str] = []
55for doc_id, items in sets.items():
56 bands = lsh_bands(sigs[doc_id])
57 candidates = {other for band in bands for other in index[band]}
58 duplicate = next(
59 (other for other in sorted(candidates) if jaccard(items, sets[other]) >= threshold),
60 None,
61 )
62 if duplicate:
63 print(f"{doc_id}: drop near duplicate of {duplicate}")
64 else:
65 kept.append(doc_id)
66 for band in bands:
67 index[band].append(doc_id)
68 print(f"{doc_id}: keep")
69
70print(f"Kept {len(kept)} of {len(documents)} documents.")1A vs B exact Jaccard: 0.60
2A vs C exact Jaccard: 0.00
3MinHash estimate A-B: 0.72
4LSH band collisions A-B: 2 / 8
5A: keep
6B: drop near duplicate of A
7C: keep
8Kept 2 of 3 documents.A is inserted first. When B arrives, two LSH bands collide, so A becomes a candidate. Exact Jaccard 0.60 clears the 0.50 threshold, so B drops. C has no band collision and no overlap, so it's kept. Published recipes make different final decisions after MinHash collisions. Lee et al. verified candidate pairs with actual Jaccard and edit similarity, while FineWeb used matching MinHash buckets and transitive clustering. Production thresholds, shingle sizes, verification rules, and whether deduplication operates per crawl or globally must be evaluated for the corpus.[11][4]
| Method | Speed | Precision | Recall | Best For |
|---|---|---|---|---|
| Exact hash (SHA-256) | Very fast | Perfect | Low (exact only) | Removing byte-identical documents |
| MinHash + LSH | Fast candidate search | Tunable | Tunable | Large-corpus near-deduplication recipes[12][4] |
| Suffix array / suffix tree | Medium | Very High | Very High | Exact repeated spans and long substring deduplication |
| SimHash | Fast | Medium | Medium | Cheap approximate similarity when memory is extremely tight |
Why does near-deduplication matter even after exact hashing?
Answer
Exact hashes catch only byte-identical copies. Web corpora contain mirrored pages, lightly edited boilerplate, and reposts, so MinHash/LSH catches duplicates that waste training compute and increase memorization risk.
Keeping benchmarks clean: decontamination
Decontamination means keeping evaluation benchmarks out of the pre-training data. If a model sees MMLU, HumanEval, or GSM8K examples during pre-training, reported scores can reflect memorization instead of generalization.
The risk isn't hypothetical. Web crawls contain GitHub repos with interview questions, educational sites with standardized tests, and forums where people paste benchmark prompts. Training corpora and evaluation sets often draw from the same public web, so contamination is a recurring failure mode.
Deduplication and decontamination answer different questions. A benchmark prompt can appear once in the crawl, so it isn't a duplicate and can still invalidate an evaluation.
N-gram overlap filtering
One common approach is n-gram overlap detection. For each training document, check whether it contains spans from an evaluation set. The n-gram size, normalization, removal threshold, and code-specific rules must be recorded with the released corpus. GPT-3 attempted pre-training filtering with 13-gram overlaps, then reported that a filtering bug left some overlaps in place. Its post-hoc benchmark analysis used variable n-gram lengths capped at 13. Llama 3 reports excluding benchmark training sets from its annealing data.[13][3]
| Check | What it catches | What it misses |
|---|---|---|
| Exact string or n-gram overlap | Copied benchmark prompts, answers, or code spans | Paraphrases and renamed identifiers |
| Fuzzy or task-specific similarity | Lightly edited versions worth inspection | Requires calibrated thresholds |
| Repository or source exclusion | Artifacts from a known evaluation source | Copies hosted elsewhere |
Exact-match filtering isn't enough. A coding problem with renamed variables or a question with shuffled answer choices can still leak. Pipelines may add fuzzy or task-specific checks, then document what they removed so benchmark-clean claims are auditable.
The snippet below shows that exact 4-grams catch a copied sentence and miss a paraphrase. That's the point: one detector isn't a complete screen.
1import re
2
3def ngrams(text: str, n: int) -> set[tuple[str, ...]]:
4 tokens = re.findall(r"[a-z0-9]+", text.lower())
5 return {tuple(tokens[i:i + n]) for i in range(len(tokens) - n + 1)}
6
7benchmark = "A rotation is approved when security verifies a stale service account."
8candidates = {
9 "direct-copy": "Internal guide: a rotation is approved when security verifies a stale service account.",
10 "paraphrase": "Allow key refresh after the risk signal has been checked.",
11}
12protected = ngrams(benchmark, n=4)
13
14for name, document in candidates.items():
15 flagged = bool(protected & ngrams(document, n=4))
16 print(f"{name:<11} -> {'flag' if flagged else 'not caught by exact n-grams'}")1direct-copy -> flag
2paraphrase -> not caught by exact n-gramsWhat makes benchmark contamination different from ordinary duplicate text?
Answer
Contamination corrupts evaluation. If benchmark examples leak into pre-training, reported scores can reflect memorization rather than generalization, so the training run may look stronger than it really is.

Safety and privacy scrub
After deduplication and decontamination, a pipeline may scrub personally identifiable information (PII) and unsafe content according to its data policy and legal obligations. A model trained on scraped identifiers can reproduce sensitive strings at inference time. FineWeb reports anonymizing email and public-IP addresses; Llama 3 reports removing domains likely to contain high volumes of PII or adult content.[4][3]
A high-quality score doesn't make a document safe to train on. PII can sit inside a well-written runbook, so privacy controls need their own evidence and audit trail.
PII removal uses a layered approach:
- Regex patterns: Rule-based detection can catch structured patterns such as email addresses or public IP addresses cheaply.
- Entity or policy classifiers: Context-aware models can identify classes of content that rigid patterns miss, but they need false-positive evaluation.
- Source and domain rules: Known high-risk sources can be excluded before training, as reported for Llama 3.[3]
Unsafe-content filtering is policy-specific and imperfect. FineWeb applies URL-level filtering for adult content but notes that harmful documents can remain. Llama 3 combines domain rules with dirty-word counting for adult websites that domain blocklists miss.[4][3] Audit retained and removed samples across languages and source types instead of treating one score threshold as a universal safety boundary.
Turning text into numbers: tokenization
Tokenization converts raw text into integer IDs the model can process. At the scale of trillions of tokens, tokenization itself needs parallel workers.
Choosing a tokenizer
Vocabulary size, sequence length, and language coverage trade off. A smaller vocabulary can force text to split into more subwords, increasing sequence length and the cost of attention. A larger vocabulary can improve compression when it matches the corpus, but it also requires a larger embedding matrix.
Measure compression by source and language before freezing the vocabulary. One global average can hide a multilingual or code shard that consumes far more context than the rest.
Common subword algorithms:
| Tokenizer | Algorithm | Vocabulary | Used By |
|---|---|---|---|
| Byte-level BPE[14][15][3] | Start from byte-representable symbols, then add frequent merges | 32K-128K+ | GPT-style models, Llama 3 |
| WordPiece[16] | Subword vocabulary with greedy longest-match encoding | ~30K | BERT |
| SentencePiece[17] | Framework for BPE or Unigram on raw text | 32K-256K | Llama 2, T5, multilingual models |
Training a BPE tokenizer
When you train a model family from scratch, the tokenizer should be trained on a representative sample of the pre-training data so it learns the common subword patterns. Reusing a mature tokenizer can be a good engineering choice, but a mismatched tokenizer wastes context length, especially for multilingual or domain-heavy corpora.
The next demo is a tiny character-level BPE. Production pipelines use byte-level BPE and much larger samples. The merge mechanic is the same: count adjacent pairs, merge the most frequent pair, repeat. After a few merges, repeated words such as after collapse into fewer tokens.
1from collections import Counter
2
3EOW = "</w>"
4
5def split_words(text: str) -> list[list[str]]:
6 return [list(word) + [EOW] for word in text.split()]
7
8def pair_counts(words: list[list[str]]) -> Counter[tuple[str, str]]:
9 counts: Counter[tuple[str, str]] = Counter()
10 for word in words:
11 counts.update(zip(word, word[1:]))
12 return counts
13
14def apply_merge(words: list[list[str]], pair: tuple[str, str]) -> list[list[str]]:
15 left, right = pair
16 merged = left + right
17 rewritten: list[list[str]] = []
18 for word in words:
19 new_word: list[str] = []
20 i = 0
21 while i < len(word):
22 if i + 1 < len(word) and word[i] == left and word[i + 1] == right:
23 new_word.append(merged)
24 i += 2
25 else:
26 new_word.append(word[i])
27 i += 1
28 rewritten.append(new_word)
29 return rewritten
30
31corpus = [
32 "rotate stale keys after review",
33 "rotate stale keys after audit",
34 "rollback deployment after review",
35]
36words: list[list[str]] = []
37for line in corpus:
38 words.extend(split_words(line))
39
40before = sum(len(word) for word in words)
41merges: list[tuple[str, str]] = []
42for _ in range(8):
43 pair, _count = pair_counts(words).most_common(1)[0]
44 merges.append(pair)
45 words = apply_merge(words, pair)
46
47sample = "rotate keys after review"
48sample_words = split_words(sample)
49sample_before = sum(len(word) for word in sample_words)
50for pair in merges:
51 sample_words = apply_merge(sample_words, pair)
52sample_after = sum(len(word) for word in sample_words)
53
54assert sample_after < sample_before
55print(f"corpus tokens before merges: {before}")
56print(f"corpus tokens after {len(merges)} merges: {sum(len(word) for word in words)}")
57print(f"sample tokens: {sample_before} -> {sample_after}")
58print("learned merges:", " ".join(f"{a}+{b}" for a, b in merges))1corpus tokens before merges: 94
2corpus tokens after 8 merges: 68
3sample tokens: 25 -> 16
4learned merges: t+e t+a r+o a+f af+te afte+r after+</w> ro+taIn a byte-level setup you often don't need an <unk> token, because any UTF-8 byte sequence can be represented. Vocabulary size is still a real design decision. A larger vocabulary can improve compression when its extra tokens match the target text, but it also increases embedding-table size. Meta reports that Llama 3 moved to a 128K-token vocabulary, starting from a tiktoken base plus 28K extra tokens, and improved English compression from 3.17 to 3.94 characters per token relative to Llama 2.[3]
Running the pipeline at scale
Large corpus pipelines need distributed execution beyond demonstration scripts. DCLM reports starting with a 240T-token Common Crawl pool containing about 200B documents and 370TB of compressed text, and processing crawl data on hundreds of AWS CPU nodes.[8]
At that scale, data is partitioned for extraction and filtering, intermediate artifacts are stored durably, and every transformation needs enough metadata to reproduce which records reached training.
The failure boundary changes here. A malformed shard can waste a multi-node run even when document-level filters passed, so shard manifests need the same lineage as individual records.
Deduplication changes the system shape: signatures can be computed independently, but candidate grouping needs records with related signatures to meet. Whether that step uses a global operation or a restricted partition, such as FineWeb's per-crawl recipe, changes both resource cost and retained data quality.[4]
Trillion-token scale challenges
DCLM's 240T-token, 370TB crawl pool is too large to treat as one job. Split the work along the same seams the later training job will audit:
- Ingestion and filtering: stream extraction, language ID, rules, and classifier scores without dropping the source URL or filter version.
- Deduplication: compute signatures in parallel; then pick an explicit partition (per crawl vs global) before candidate grouping.
- Training order: shuffle tokenized shards with a recorded seed so one host or one dump doesn't own a whole epoch.
- Reproducibility: given one suspicious training example, recover its source document, filter version, mixture weight, and shard.
Data packing and sequence efficiency
Documents vary widely in length: an article might be thousands of tokens while a forum post is short. Padding each document to a fixed sequence length spends compute on padding tokens. Best-fit packing groups documents into fixed-length token blocks to reduce that waste.
1lengths = [7, 6, 5, 5, 3, 2]
2capacity = 10
3
4def best_fit_pack(items: list[int], block_size: int) -> list[list[int]]:
5 bins: list[list[int]] = []
6 for length in sorted(items, reverse=True):
7 options = [bucket for bucket in bins if sum(bucket) + length <= block_size]
8 if options:
9 min(options, key=lambda bucket: block_size - sum(bucket) - length).append(length)
10 else:
11 bins.append([length])
12 return bins
13
14naive_slots = len(lengths) * capacity
15packed = best_fit_pack(lengths, capacity)
16packed_slots = len(packed) * capacity
17tokens = sum(lengths)
18
19print("packed blocks:", packed)
20print(f"naive utilization: {tokens / naive_slots:.0%}")
21print(f"packed utilization: {tokens / packed_slots:.0%}")1packed blocks: [[7, 3], [6, 2], [5, 5]]
2naive utilization: 47%
3packed utilization: 93%Packing creates another design decision: if multiple documents share one sequence, should tokens in one document attend to tokens from another? Some causal-language-model recipes concatenate documents with end-of-document separators and keep the ordinary causal mask. Others isolate documents with a block-diagonal mask so one document can't read tokens from an earlier document in the same packed block. The isolated version below prevents artificial cross-document context while retaining packing efficiency.
For the packed IDs [0, 0, 0, 1, 1], predict the first row for document 1: it should contain no attention edges into document 0. The mask makes that boundary observable instead of leaving it to a delimiter token and hope.
1document_ids = [0, 0, 0, 1, 1]
2
3mask = [
4 [
5 int(previous <= current and document_ids[previous] == document_ids[current])
6 for previous in range(len(document_ids))
7 ]
8 for current in range(len(document_ids))
9]
10
11for row in mask:
12 print(" ".join(map(str, row)))
13print("doc 1 token attends to doc 0:", bool(mask[3][2]))11 0 0 0 0
21 1 0 0 0
31 1 1 0 0
40 0 0 1 0
50 0 0 1 1
6doc 1 token attends to doc 0: FalseData annealing is a late-stage recipe adjustment where the learning rate decays and the data mix shifts toward higher-value slices. It isn't a universal "final 10%" rule. Llama 3 reports annealing over the final 40B tokens while upsampling very high-quality sources and excluding benchmark training sets from the annealing pool.[3]
Quality and quantity must be measured together
Recent model and dataset papers show that data quality and token yield must be measured together once a corpus is already large.
The question now changes from “did the record pass?” to “did the retained data improve a trained model?” A filter proxy can rise while useful coverage or token supply falls.
The Phi lesson
Phi-1 reported strong coding-benchmark performance for a 1.3B model trained with textbook-quality data, worked examples, and synthetic exercises.[5] That result motivates controlled curation experiments. It doesn't make one data recipe universal.
FineWeb and FineWeb-Edu
FineWeb scales the same idea to web-scale curation. The paper builds a 15T-token dataset from 96 Common Crawl snapshots and then extracts FineWeb-Edu, a 1.3T educational subset filtered with a classifier trained on LLM-judged educational scores. The main lesson is that pipeline design matters: individual per-crawl MinHash deduplication and additional filtering each improved downstream results over weaker baselines.[4]
Modern open corpora
Three published open-corpus reports illustrate different tradeoffs after FineWeb. Each changes a different part of the yield-versus-quality problem.
| Corpus | Scale and scope | Role |
|---|---|---|
| DCLM-Baseline[8] | 3.8T-token set filtered from a 240T-token Common Crawl pool | A fastText filter retained its top 10% of documents; a 7B model trained on 2.6T tokens reached 64% 5-shot MMLU |
| Nemotron-CC[18] | 6.3T tokens: 4.4T globally deduplicated original tokens plus 1.9T synthetic tokens | Classifier ensembling and source-conditioned rephrasing target larger unique-token yield; its 1.1T high-quality subset improved MMLU by 5.6 points over DCLM in the reported 8B, 1T-token setup |
| FineWeb2[19] | About 20TB and 5B documents across 1,000+ languages from 96 Common Crawl snapshots | Language-adapted filtering and dedup-informed rebalancing were evaluated on nine canary languages before scale-up |
These reports don't establish one universally best filter. DCLM optimized benchmark quality under its evaluation setup with aggressive retention. Nemotron-CC explicitly targeted a larger long-horizon token supply and reported both quality and quantity comparisons. FineWeb2 addresses the separate multilingual problem: thresholds, word segmentation, language identification, and deduplication behavior don't transfer cleanly from English to every language.[8][18][19]
The data wall
This token-yield pressure is often called the data wall. Villalobos et al. estimate an effective stock of public human text at about 320T tokens after quality and multi-epoch adjustments, with a broad 95% interval from 65T to 1700T. The paper's exhaustion-point figure is about 400T (). Under their assumptions about continued dataset growth, they project full utilization between 2026 and 2032, with a median of 2028. A 5x overtraining scenario shifts that earlier by about one year.[20] This is a scenario projection, not evidence that usable public text is already exhausted.
1effective_stock = 320e12
2training_budgets = {
3 "1T-token study": 1e12,
4 "Llama 3 405B report": 15.6e12,
5 "100T-token scenario": 100e12,
6}
7
8for label, tokens in training_budgets.items():
9 print(f"{label:<22}: {tokens / effective_stock:>5.1%} of 320T reference stock")
10print("Comparison only: it isn't a claim that stock has been consumed.")11T-token study : 0.3% of 320T reference stock
2Llama 3 405B report : 4.9% of 320T reference stock
3100T-token scenario : 31.2% of 320T reference stock
4Comparison only: it isn't a claim that stock has been consumed.DCLM's selected filter keeps its top 10% of documents by classifier score. Why might a team designing a longer-horizon run test a Nemotron-CC-style approach as well?
Answer
Aggressive filtering can shrink unique-token supply. Nemotron-CC targets a different tradeoff through classifier ensembling and source-conditioned synthetic variants; a team should test whether that additional yield preserves quality for its own horizon and evaluation suite.

Additional crawl volume and stronger curation must be compared empirically. FineWeb is a good example: in its ablations, extraction, per-crawl deduplication, and filtering choices measurably changed downstream results.[4]
Synthetic data: supplement, not substitute
Synthetic data can raise signal density, but it works best when it fills a specific gap rather than replacing the whole corpus.
Where synthetic data helps
Phi-1 is one clear example. Instead of trying to mimic the raw web distribution, the dataset emphasized textbook-style explanations, exercises, and synthetic examples.[5] That makes synthetic data useful when you want more reasoning traces, worked solutions, or domain-specific exemplars than the open web naturally provides.
One proposed response to token-yield pressure is synthetic expansion. Nemotron-CC generates variants from source documents, including question-answer pairs and distilled passages, and reports improvements in specific training comparisons.[18] Source conditioning gives the generated text provenance, but the authors state that they didn't verify factual accuracy or fidelity for rephrased data. Grounding therefore needs validation rather than assumption.
Why provenance and diversity still matter
Synthetic text inherits teacher errors, style biases, and coverage gaps. Shumailov et al. study degradation when successive model generations train recursively on generated data, a failure mode often called model collapse.[21] This doesn't prohibit synthetic supplementation. It means mixture weight, provenance, factual fidelity, and diversity need evaluation.
Source conditioning gives you a trail to inspect, not a guarantee that generated text preserved the source. Keep that distinction visible when a synthetic slice enters a training shard.
Don't conflate verified synthetic-data generation with post-training reinforcement learning. Pre-training pipelines more often use offline generation plus filtering or programmatic checks before tokens are admitted.
Common mistakes and how to catch them
Read each row as a small incident: observe the symptom, name the boundary that failed, then make one controlled change and rerun the smallest faithful slice.
| Mistake | Symptom | Cause | Fix |
|---|---|---|---|
| Ignoring deduplication | Model repeats memorized boilerplate; token budget spends on repeats | Duplicate text overweights copied passages | Evaluate dedup granularity; FineWeb selected per-crawl MinHash over global dedup |
| Filtering non-English too aggressively | Model loses code or math reasoning strength | Code and math contain many universal symbols that language classifiers mislabel | Use separate recipes for code corpora and multilingual text |
| Overlooking benchmark contamination | Inflated evaluation scores | Evaluation examples leaked into training data via public sources | Specify exact-overlap and task-specific fuzzy rules; audit removals |
| Forgetting PII policy | Model outputs personal identifiers | Raw crawls contain user-generated content with personal data | Apply documented identifier/domain controls and audit a sample before training |
| Using an English-centric tokenizer for multilingual models | Terrible compression and slow inference for non-English languages | Vocabulary was trained on mostly English text | Train the tokenizer on a representative multilingual sample; expect 32K-128K+ vocabularies |
| Treating synthetic data as automatically faithful | Rewrites introduce errors or narrow styles | Source-conditioned generation was admitted without validation | Measure fidelity, diversity, and downstream effects before changing mixture weight |
| Assuming one annealing schedule fits every model | Late-stage training gives inconsistent gains | Copied another team's annealing recipe without matching data mix | Treat annealing as a hyperparameter; test on a small model first |
Before a trillion-token run
Use one suspicious shard as the lab. Trace a record back to its source, inspect each filter and dedupe decision, calculate yield, then decide whether the shard should be rerun or reweighted.
The readiness record should include:
- Define source mix, sampling weights, language coverage, deduplication threshold, benchmark-decontamination rules, and PII scrub policy.
- Add retention metrics by source and language so quality filters can be audited for false positives.
- Record tokenizer compression rates for target languages and domains before freezing the vocabulary.
- Specify shard metadata: source, license or policy class, filter version, dedupe cluster, tokenizer version, and split assignment.
The checklist should make the training corpus reproducible, auditable, and measurable before any expensive run starts.