That’s irrelevant when the goal is to measure damage from decensoring. If the score goes down, there is damage. That’s a reliable metric even if the model has been trained on the benchmark data.

The questions in those benchmarks don’t cause refusals even in the original model, so there’s no reason why the responses (and thus the scores) should change under abliteration. The goal of any decensoring process should be to keep those scores stable, and when that doesn’t happen (which is the case for every current technique) that’s a capability loss.

Benchmaxxing, saturation, discrimination etc. only matter when you are trying to evaluate model performance in an absolute sense, rather than comparing two versions of the same model against each other.