A lab tested four common preparation steps two ways: the leaky way, run on all rows before cross-validation, and the correct way, run inside each fold. It first put 30 percent of the rows away untouched as a final check, and repeated everything with 100 different random splits. The numbers below are averages over those 100 runs.
Selecting 20 of 5,000 columns on pure random noise, with 70 building rows and a logistic regression model: the leaky estimate promised 93 percent accuracy (0.927), the correct estimate said 0.495, and the untouched rows gave 0.498, a coin flip. With 5,000 random columns and 70 rows, some columns match the label by luck, and the leaky step picked exactly those, partly because they agreed with the future test rows. Target encoding a random customer id on noise promised 0.792 and delivered 0.501.
Two steps on 569 real breast tumour records gave a different picture. Copying rare malignant rows before the split promised an F1 score (a 0 to 1 score for finding a rare class) of 0.996 and delivered 0.876, because copies of the same row landed on both sides of the split. Scaling barely leaked at all: 0.962 leaky, 0.962 correct, 0.963 on untouched rows. The pattern: steps that read the label leaked the most, copying came next, and scaling leaked almost nothing.