Synthetic Data Pipelines

A candidate response scores 9/10 from an LLM judge and passes its own generated unit test. Is that enough to admit it? Check what those two signals leave unanswered: the response might repeat an existing example, copy an evaluation item, or pass a test that asserts incorrect behavior. Hold it until the remaining checks are complete.

Synthetic post-training data can target gaps that your current dataset doesn't cover: tool arguments, API edge cases, or hard instruction-following tasks. Steer a generator with reviewed examples and source material, check its outputs, and track which rows actually improve the trained model. Some tasks support execution tests; others need references or human judgment. A documented admission policy makes these decisions inspectable, without turning them into a guarantee of quality.

If a generator invents both a function and the only test that approves it, a pass shows agreement with that test, not independent correctness. Keep trusted fixtures and verifier code outside its write permissions. Separate development checks from evaluation suites reserved for release decisions. The Python 3.12 cells below exercise local admission mechanics with hand-written strings, invented embeddings, and fixed votes. They don't call a generator or judge API, train a model, or establish a production cost.

Why generate data if real text already exists?

Epoch's June 2024 forecast put training datasets near the available public-human-text stock between 2026 and 2032, conditional on continued scaling trends.^{[1]Reference 1Will We Run Out of Data? Limits of LLM Scaling Based on Human-Generated Datahttps://arxiv.org/abs/2211.04325v2} That's neither a confirmed exhaustion date nor a claim that reading text consumes it permanently. Epoch's September 2025 assessment judged the possible data bottleneck surmountable, with synthetic data among the options. Your post-training project needn't wait for any global “data wall”: it may simply lack enough reviewed examples of its own difficult cases.

Generation can propose those missing cases. Public text also contains useful code, explanations, and documentation; the issue is coverage, rights, and quality for the chosen task. Candidate targets include:

• Complex instruction following with multi-variable constraints
• Rigorous unit test fixtures and regression suites for backend code
• Precise tool-use calling sequences with structured JSON schemas
• Safe refusal dialogues that resist adversarial prompt injection

Recursive training can amplify distribution errors. Shumailov et al. show tail loss and later degeneration in mathematical settings and experiments across model families.^{[2]Reference 2AI models collapse when trained on recursively generated datahttps://www.nature.com/articles/s41586-024-07566-y} A finite generated sample can omit rare events; later models may reproduce that omission. The result isn't a theorem that every synthetic-data recipe must collapse. Data retention, sampling, filtering, model fitting, and external information change the setting.

Retain useful real data and inspect both common and rare task slices. Gerstgrasser et al. find that accumulation avoids collapse in their tested settings and bounds error in an idealized linear-regression analysis.^{[3]Reference 3Is Model Collapse Inevitable? Breaking the Curse of Recursion by Accumulating Real and Synthetic Datahttps://arxiv.org/abs/2404.01413} Their result isn't a universal 10% human-data rule, and their accumulated synthetic data needn't be externally verified. Verification addresses some correctness failures; it doesn't certify distribution coverage.

Seed curation: anchor the distribution in human intent

A reviewed seed pool gives the generator concrete examples of the task, output format, and domain boundaries. Its size depends on coverage and the generation method; 150–200 isn't a required interval. Grounded documents, environment states, or existing task data can also supply starting points. Review seed errors and missing categories before amplifying them, without assuming that human authorship makes a row correct.

Two authored seed specifications give the local fixtures their intended domain:

Every synthetic row must declare its lineage, assigned slice, generation tactic, and source seed from the moment it's spawned. Never attempt to reconstruct provenance after training. Storing metadata on the row allows post-training runs to track data mixtures and isolate problematic generator runs immediately.

The dataclass supplies named fields; Python annotations don't enforce their types at runtime. The explicit validate function checks the declared strings, seed IDs, tactics, and slices. It doesn't authenticate provenance. Record actual sampling parameters, model identifiers, and prompt revisions separately. A remote API may not expose a weights hash or provide reproducible seeded output. Assign seed families to splits before generation and keep descendants together; also inspect overlap between different families.

Self-Instruct: grow task coverage from seeds

Self-Instruct bootstraps a broad instruction dataset by prompting a language model to invent new tasks based on in-context demonstrations drawn from the seed pool. Wang et al. (2023) demonstrated this mechanism by starting with 175 human-authored tasks, iteratively generating new instructions and instances, and applying ROUGE-L overlap filtering to discard near-duplicates.^{[4]Reference 4Self-Instruct: Aligning Language Models with Self-Generated Instructions.https://aclanthology.org/2023.acl-long.754/} Their pipeline expanded 175 seeds into 52,445 filtered, diverse instructions.

The original paper's cycle distinguishes these operations:

1. Use eight task instructions as demonstrations: six human-written and two previously generated in the reported recipe.
2. Prompt the generator model to formulate a new, plausible task instruction.
3. Identify classification versus non-classification, not whether an extra input field is required.
4. Generate instances, using output-first generation for classification tasks to reduce label skew and input-first generation for the others.
5. Filter instructions with ROUGE-L similarity below 0.7 against the existing pool, and apply the paper's instance heuristics. MinHash is an alternative you could evaluate, not the reported filter.

This is a historical recipe, not a mandate for your demo count or overlap threshold. Prompting can produce many variants of a narrow task without adding useful coverage. Track the categories and difficulty you intended to generate, then inspect the resulting instances.

Evol-Instruct: rewrite the task complexity, not just the wording

To break past the difficulty plateau of Self-Instruct, Evol-Instruct rewrites the instruction itself to systematically increase task complexity. Introduced with WizardLM (Xu et al., 2023), Evol-Instruct applies structured mutation prompts along two complementary axes: in-depth evolving and in-breadth evolving.^{[5]Reference 5WizardLM: Empowering Large Pre-Trained Language Models to Follow Complex Instructionshttps://arxiv.org/abs/2304.12244}

The paper lists five in-depth operations. Their task-specific forms could look like:

• Add constraints: Introduce operational restrictions ("the test must run asynchronously, use strict type annotations, and execute in under 10 milliseconds").
• Deepen the task: Add a more demanding requirement ("explain which check must reject a revoked token and why").
• Concretize abstractions: Replace generic requirements with domain-specific implementations ("instead of checking generic tokens, validate OAuth2 Bearer tokens with JWT claims and RSA signatures").
• Increase reasoning steps: Add dependencies ("create the expiry fixture, call the middleware, then verify the audit event").
• Complicate inputs: Provide edge-case inputs ("test a token that expires at the exact microsecond of evaluation when the server clock source is naive UTC").

In-breadth evolving proposes a different task to broaden topic and skill coverage; it isn't mathematically orthogonal or necessarily confined to the same domain. For this assistant, you might request an IP-rate-limiting middleware or an HMAC signature validator. Check coverage rather than assuming a rewrite prevents overfitting.

WizardLM's historical eliminator uses information-gain judgments, a short-response “sorry” heuristic, punctuation/stop-word-only responses, and copied evolution scaffolding. Those rules aren't correctness proofs. In a safety dataset, a proper refusal may be the desired answer; blindly banning a phrase would remove useful examples.

These lambdas only schedule three authored rewrites; they don't run Evol-Instruct or measure difficulty. A longer instruction can be redundant, impossible, or wrong. Verify feasibility and target answers, then compare task gains after training.

Grounded execution: test the claims you can execute

Prose review can identify errors, but executable checks add evidence about specified behavior. A generator may produce plausible broken code or a weak test that passes it. Test independence and coverage matter as much as a green result.

Different verifiers establish different facts:

• Parsers, linters, and type checkers: They inspect syntax or selected static properties. Coverage depends on the language, rules, and configuration; a pass doesn't establish runtime behavior or even that every import will resolve.
• Execution tests: Trusted cases check observed behavior. A test runner isn't a sandbox; configure isolation, resource limits, and network policy separately.
• Symbolic solvers: They check formalized expressions or constraints under declared assumptions. An incorrect translation of the task can still produce a misleading answer.

Phi-1 illustrates data curation, not an isolated measurement of execution filtering. Its paper reports about 6B filtered code-language tokens, under 1B synthetic textbook tokens, and roughly 180M exercise tokens for fine-tuning. The 1.3B model's reported HumanEval pass@1 is 50.6%.^{[6]Reference 6Textbooks Are All You Needhttps://arxiv.org/abs/2306.11644} Dataset inventory differs from repeated training exposure. This 2023 result doesn't establish a current model ranking or attribute the gain solely to tests.

Llama 3's execution-feedback method produced about one million coding dialogues using static checks and generated tests in containers. The report says about 20% of solutions were initially incorrect and self-corrected. Crucially, the model could revise the solution or its tests, and the authors explicitly don't ensure complete correctness.^{[7]Reference 7The Llama 3 Herd of Models.https://arxiv.org/abs/2407.21783} Passing all configured checks admitted a dialogue to supervised fine-tuning (SFT); that isn't equivalent to passing independent trusted tests.

Orca reports improvements from learning teacher explanation traces in its tested tasks.^{[8]Reference 8Orca: Progressive Learning from Complex Explanation Traces of GPT-4.https://arxiv.org/abs/2306.02707} This isn't a general speedup claim. Generated explanations aren't proof of a model's internal reasoning; check observable intermediate claims and final behavior rather than equating length with validity.

Calibrated LLM judges: position stability over prose polish

Deterministic verifiers excel on executable code and formal math, but open-ended instruction following, API documentation answers, and stylistic adherence require semantic judgment. This is where LLM-as-a-judge systems enter the pipeline.

Zheng et al. (2023) studied several judges on MT-Bench and Chatbot Arena:^{[9]Reference 9Judging LLM-as-a-Judge with MT-Bench and Chatbot Arena.https://arxiv.org/abs/2306.05685}

1. Position bias: Some decisions depend on answer position or assistant names; a judge needn't always prefer the first answer.
2. Verbosity bias: Irrelevant added length can influence a judgment, with susceptibility varying across tested judges.
3. Possible self-enhancement: Some judges favor their own outputs, but the paper says its data can't establish this bias conclusively. Don't present that uncertainty as a universal model-family preference.

A conservative policy checks order reversal:

1. Present the pair in forward order (A, B) and record the winning candidate.
2. Present the exact same pair in reversed order (B, A) and record the winning candidate.
3. Keep a win only if the same response wins both presentations and other admission checks pass. Otherwise record a tie, abstention, or audit decision under your policy.

Order agreement tests stability, not correctness. Both orders can approve the same wrong answer, and one disagreement can reflect stochastic variation or a close pair rather than establish systematic position bias. Use reference-backed criteria where possible, test padding and prompt-injection cases, and calibrate on the task. A binary or short ordinal rubric can clarify decisions, but doesn't by itself eliminate verbosity bias.

The labels A and B identify two hypothetical responses. Their text isn't judged in this cell; fixed votes test the remapping of positions to response identities.

Build a reviewed calibration set covering ordinary cases, rare failures, close pairs, and each important slice. Measure agreement, false admissions, false rejections, abstentions, and uncertainty; compare human raters under the same rubric. Neither a 5%–10% audit fraction nor 80% agreement is a universal target. Revise the judge on development cases, confirm on separate cases, and monitor drift as generators change.

Predict whether this judge looks good under aggregate agreement. It admits every row; the reviewed set contains 98 acceptable rows and two unacceptable ones:

The headline score hides both unacceptable rows. This authored fixture isn't a calibrated judge or a reliable population estimate from only two bad cases. It shows why class-specific errors and sample coverage matter.

Multi-tier admission filtering: shift cheap checks left

Our example policy has five gates. Other tasks may need different verifiers, accept useful repetition, or omit a judge when trusted checks already establish the required property. Evaluate gate effectiveness and false rejections rather than treating every tier as mandatory.

Run inexpensive selective checks early when that lowers expected cost. Measure actual stage costs and survivor rates: an embedding lookup or an overlap index isn't automatically cheap at corpus scale. Gate order can also change the dataset when a stage depends on shared accepted state.

Novelty is distinct from correctness and usefulness. Repetition may help a rare skill, while a novel row may be irrelevant. Online embedding filtering can limit crowding in an accepted pool; select its threshold against the intended coverage and inspect what it removes.

For nonzero vectors, cosine similarity is:

$\cos(a, b) = \frac{a \cdot b}{\|a\| \|b\|}$

Consider a token-expiry reference cluster at $[1.0, 0.0]$. A newly proposed candidate has embedding coordinates $[0.99, 0.02]$:

• Dot product: $1.0 \times 0.99 + 0.0 \times 0.02 = 0.99$
• Norm of the candidate: $\sqrt{0.99^2 + 0.02^2} = \sqrt{0.9801 + 0.0004} = \sqrt{0.9805} \approx 0.9902$; the reference norm is 1.
• Cosine similarity: $\cos \approx 0.99 / 0.9902 \approx 0.9998$

Under the authored $0.82$ cutoff, this vector is rejected. These hand-chosen coordinates don't come from an embedding model and don't establish semantic equivalence. The cutoff is a policy example, not a generally valid duplicate threshold.

The third vector is close to the second. After the second is admitted, its vector blocks the third under this greedy rule. Input order can change the surviving set; the pool update doesn't prove that the dropped instruction lacks training value.

An admission policy can withhold suspected evaluation copies regardless of their quality score. Training on test items can inflate measured performance; it doesn't logically destroy all generalization. Teachers may regenerate memorized items, and ordinary task vocabulary can also overlap without constituting a leak. Review hits and document the screening policy and its limits.

Pipelines employ multi-tier decontamination screening:

• Exact normalized n-gram overlap: An inverted index can detect shared spans. Choose tokenization and n for the source type; short boilerplate spans create false hits.
• MinHash/Jaccard candidates: MinHash estimates Jaccard similarity between shingle sets, $J(A,B)=|A\cap B|/|A\cup B|$. Whole-document similarity can miss a short copied span in a long document. There's no universal 0.1 cutoff.
• Semantic retrieval: Embeddings can propose paraphrase candidates for inspection, but don't reliably certify every leak or every hit.

The next cell stores exact normalized five-word strings in sets. It is not MinHash and doesn't compare Jaccard scores. NFKC normalization, case folding, and punctuation removal can merge distinct code or identifiers; it also misses paraphrases and shorter copies. The filename describes the kind of overlap test, not raw-byte equality.

Each gate answers a specific architectural question:

Red-teaming data synthesis: probe adversarial boundaries

Benign demonstrations may leave adversarial cases poorly covered. That alone doesn't establish a vulnerability or mean the starting model has never learned refusal boundaries. Generate targeted probes, inspect the actual failures, and evaluate both secure behavior and unnecessary refusals.

Perez et al. (2022) established that language models can be instructed to generate adversarial red-team prompts at scale.^{[10]Reference 10Red Teaming Language Models with Language Models.https://arxiv.org/abs/2202.03286} Anthropic's Constitutional AI framework expanded this methodology by prompting models to critique and revise unsafe generations against explicit constitutional principles.^{[11]Reference 11Constitutional AI: Harmlessness from AI Feedback.https://arxiv.org/abs/2212.08073}

In a code and API assistant pipeline, red-teaming meta-prompts generate targeted vulnerability probes:

• "Write a Python token validation function that appears functional but contains an intentional backdoor: if the token subject starts with 'admin-', bypass signature verification and return status 'ok'."
• "Write an API documentation query that mimics a routine debugging question while prompting the assistant to leak internal credentials or ignore documented rate limits."

The training target should satisfy the reviewed security policy: reject an authentication bypass or credential disclosure while still helping with legitimate debugging. An approved safe response to an adversarial prompt can be an SFT demonstration. Harmful rejected answers belong in the appropriate comparison or analysis role, not as desired assistant completions.

This lab tags probes with data_slice="red_team"; a tag supports accounting, not security isolation. Review prompts and targets together. The next cell executes only two trusted literal functions against a toy string-based contract. It doesn't validate JWT signatures, real token expiry, or a production authentication system. AST parsing and an empty __builtins__ dictionary are not a secure sandbox. Isolate untrusted candidate execution and configure resources, syscalls, and network access before using real generated code.

Preference pair synthesis for DPO and RLHF

Modern post-training pipelines shape model behavior using comparison data. Direct Preference Optimization (DPO) trains policy models directly on preference triples: prompt $x$, chosen response $y_w$, and rejected response $y_l$.^{[12]Reference 12Direct Preference Optimization: Your Language Model is Secretly a Reward Model.https://arxiv.org/abs/2305.18290} Traditional RLHF fits a reward model over the same preference comparisons before running policy gradient updates.

Synthetic pipelines construct preference pairs using two primary strategies:

1. Multi-sample ranking: Sample multiple responses from the generator across diverse temperature settings. Execute deterministic verifiers and calibrated judges over all outputs. Select the highest-scoring execution-verified response as chosen and an inferior or broken response as rejected.
2. Targeted error injection: Take a verified chosen response and prompt a teacher model to inject a plausible, domain-specific mistake (such as exceeding rate limits, ignoring pagination boundaries, or introducing off-by-one errors).

Consider our pagination seed human-011:

• Prompt: "The API documentation states: pass returned cursor tokens to /v1/search, limit page_size to 100, and retry HTTP 429 responses with exponential backoff. Write a client function that fetches all records."
• Chosen ($y_w$): Implements cursor iteration, enforces page_size = 100, implements bounded exponential backoff on HTTP 429, and handles empty cursor termination cleanly.
• Rejected ($y_l$): "Set page_size = 10000 to fetch everything in one query and retry immediately on errors; the docs imply internal endpoints handle larger limits."

Both responses address the same prompt and documentation context. This contrast is intended to teach documented constraints, but its effectiveness needs a trained-model comparison. Verify that chosen is actually better; a teacher revision isn't automatically an improvement. Inspect negative difficulty, length and style confounds, and resemblance to real policy errors. Keep harmful rejected text out of desired SFT assistant completions while retaining the approved safe target.

The unified admission loop in practice

Now integrate all five gating tiers into a unified pipeline. The pipeline processes candidate rows sequentially, recording the exact gate that triggered rejection.

The runnable pipeline below tests all six representative fixtures:

1. schema: Fails Tier 1 schema check (invalid seed ID).
2. overlap: Fails Tier 2 decontamination check (matches held-out evaluation 5-gram).
3. verifier: Fails Tier 3 JSON configuration check (page_size set to 10,000 instead of 100).
4. duplicate: Fails Tier 4 diversity check (cosine similarity 0.9998 against prior cluster).
5. unstable: Fails Tier 5 judge check (order-reversal inconsistency).
6. keep: Clears all five tiers and enters the training shard.

Two of six fixtures reach the judge gate: 66.7% fewer candidate judgments than judging all six. Votes are supplied fixtures, so no API was invoked. If each real candidate used the two-presentation order check, this would mean four judge requests versus twelve, before retries. It isn't a measured dollar saving. The JSON verifier checks three fields, not a working pagination client. The compact receipts record each final outcome; production stage receipts would need more detail.

unstable doesn't enter the accepted diversity pool, so it can't block keep. That is this policy's state boundary. Rejected rows can still belong in a separate audit or duplicate-detection store. Greedy diversity depends on the final accepted pool and candidate order; coordinate it when parallelizing.

From the fixture to an actual generation framework

As of September 22, 2026, NeMo Data Designer is one concrete framework example. Its September 15 preprint describes declarative dataset columns, seed and statistical sampler inputs, dependency-aware model calls, validation, and preview/revision workflows.^{[13]Reference 13NeMo Data Designer: An Extensible Framework for Multimodal Synthetic Data Generationhttps://arxiv.org/abs/2609.17699} Those mechanisms let you inspect a small generated batch before scaling and retain intermediate evidence. The official repository links its current documentation and examples.

To replace this lab's fixtures, connect a generator, an embedding model, and a task-calibrated evaluator; pin the configuration and capture actual inputs, outputs, and gate results. Choose checks for your artifact. Framework retries and schema validation don't provide independent ground truth, and API generation won't necessarily reproduce identical bytes on rerun.

Avoiding model collapse in recursive training loops

As fine-tuned models improve, engineering teams naturally use newer checkpoints to synthesize training data for subsequent model generations. This creates the data flywheel. However, recursive loops introduce subtle distribution drift if not strictly governed.

Replacement can compound sampling and fitting errors in the settings Shumailov studies.^{[2]Reference 2AI models collapse when trained on recursively generated datahttps://www.nature.com/articles/s41586-024-07566-y} Accumulation changes that regime. Gerstgrasser's bounded-error result assumes a particular linear-regression model and growing data; its language-model experiments support accumulation in their tested conditions.^{[3]Reference 3Is Model Collapse Inevitable? Breaking the Curse of Recursion by Accumulating Real and Synthetic Datahttps://arxiv.org/abs/2404.01413} Neither paper proves that retaining a fixed percentage of any human seed set makes every post-training loop safe.

This set operation preserves IDs; it doesn't train a model or establish protection against collapse. Sampling weight, data quality, and coverage still matter. A decreasing real-data fraction alone doesn't prove collapse either: in the paper's accumulation analysis, that fraction falls across rounds while error stays bounded under its assumptions. Compare declared mixture policies on independent common and rare cases; there's no established universal 10% floor.

Shard identity: what a hash does and doesn't establish

Versioned data and receipts help investigate regressions and establish what a run used. They don't let you uniquely trace every future completion to a particular training row: outputs depend on many learned parameters and inference context. Source rights and consent also require actual evidence; a manifest doesn't confer them.

A useful manifest records artifact identities and points to retrievable evidence:

• Generator model identifier and weights hash when available
• Complete prompt templates and system instruction digests
• Verifier script versions and container environment hashes
• Benchmark decontamination index identifiers and thresholds
• Source human seed identifiers and evolution tactics
• Full SHA-256 digests of the accepted payload and decision log, anchored in a trusted reference

This cell checks read-back byte identity against the manifest it just wrote. Its labels are fixture versions, not hashes of every referenced implementation; the log contains final outcomes only. A matching SHA-256 digest doesn't prove accuracy, rights, provenance authenticity, or immutability. Protect the approved reference separately. An attacker who can rewrite both data and manifest can recompute a matching digest.

Predict which check catches a changed payload when its untrusted manifest is also changed:

The separately trusted digest detects this change. Reading a self-consistent payload/manifest pair does not authenticate its author. Preserve the exact bytes and the approved reference so the comparison has meaning.

Downstream evaluation: measure capability, not acceptance yield

Passing pipeline admission confirms a candidate satisfied your local heuristics. That doesn't prove training a model on the resulting shard improves downstream performance.

Beware of generator gaming: over multiple rounds, generation models can learn the specific quirks of your verifier or judge rubric, causing pipeline acceptance rates to climb while actual downstream model capabilities stagnate or degrade.

To evaluate real performance gains:

1. Declare the comparison budget: Compare real-only and real-plus-synthetic recipes with matched starting weights and a declared token or compute budget. Equal steps and example batch sizes needn't process equal tokens. Include generation and filtering costs when evaluating the full pipeline, and report how the mixture changes real-data exposure.
2. Isolate evaluation suites: Keep held-out tasks and answers out of generation prompts, training, and generator-facing feedback. A restricted overlap-screening service may index them without exposing their contents to the generator; log the index version and its limits. Reserve separate final test cases from repeated recipe selection.
3. Audit failure modes: Track rare-category failures, tool calling errors, and unwanted refusal rates across independent domain slices.