Data leakage in machine learning means building a model with information it would not have at prediction time. It inflates test scores, so a model looks safe to ship when it is not. It also often signals that data boundaries in the pipeline are unclear, which is a governance problem.
What leakage is
The scikit-learn documentation describes data leakage as using information unavailable at prediction time to build a model, which inflates performance estimates and leads to poor results on new data. The most common cause is fitting preprocessing on the whole dataset before splitting. A normalization step should compute its mean from the training subset only.
The documented example
The scikit-learn guide shows feature selection on 10,000 random features with random binary targets. Selecting the top 25 features on all the data before splitting gave 0.76 test accuracy, far above the 0.5 expected from chance. Splitting first and fitting the selector only on the training data gave 0.5. There was no signal in the data, and the leaky process manufactured one.
The recommended fix is to split first and never call fit or fit_transform on test data. Using a Pipeline makes each step fit only on the right training data and works with cross validation.
Why security and governance teams should care
- False confidence. A model that scores well because of leakage may fail on real traffic, including in fraud, abuse or malware detection where a miss is costly.
- Hidden sensitive inputs. Leakage often comes from a column that should never have been a feature, such as an identifier or a field populated after the outcome. Finding it exposes a data boundary that nobody enforced.
- Mixed environments. If training and evaluation data share a store without separation, a poisoned or tampered record can reach both.
- Evidence quality. If you cite model performance to an auditor or customer, leakage makes that number wrong.
Leakage patterns beyond preprocessing
- Time leakage: training on data from after the event you predict.
- Group leakage: the same customer or device appears in both train and test sets.
- Duplicate leakage: copied rows land on both sides of the split.
- Target leakage: a feature derived from the label or recorded after it.
A review checklist
- Is the split done before any fitting step, and is that enforced by a pipeline object?
- Are splits by time or by group where the problem needs it?
- Were duplicates removed before splitting?
- Does any feature depend on information created after the prediction moment?
- Is the final test set touched only once?
Record the answers in the model's lineage notes, as described in what to record for ML data lineage.
Where Safeguard fits
Safeguard does not evaluate models. It scans dependencies and code, applies policies and gates on pull requests, and automates compliance evidence, which helps you keep the review above on record. Free scan: https://gold.safeguard.sh/scan.
Quick check
What is the simplest fix for preprocessing leakage?
Split first, fit preprocessing only on training data, and wrap the steps in a pipeline so this is enforced.
Why does leakage matter beyond accuracy?
It can overstate a model's safety and reveal data boundaries that were not enforced.
Sources
Last reviewed: 19 October 2026.
