tabcustody 0.1.0__tar.gz

tabcustody-0.1.0/.github/workflows/ci.yml

@@ -0,0 +1,52 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+jobs:
+  quality:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: astral-sh/setup-uv@v10.2.0
+      - run: uv sync --locked
+      - run: uv run ruff check .
+      - run: uv run ruff format --check .
+      - run: uv run mypy
+
+  tests:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        python: ["3.11", "3.12", "3.13"]
+    steps:
+      - uses: actions/checkout@v7
+      - uses: astral-sh/setup-uv@v10.2.0
+        with:
+          python-version: ${{ matrix.python }}
+      - run: uv sync --locked
+      - run: uv run pytest
+
+  installed-package:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: astral-sh/setup-uv@v10.2.0
+        with:
+          python-version: "3.13"
+      - run: uv build
+      - name: Install the wheel in a fresh environment
+        run: |
+          uv venv "$RUNNER_TEMP/env"
+          uv pip install --python "$RUNNER_TEMP/env" "tabcustody @ file://$(ls "$PWD"/dist/*.whl)" scikit-learn
+      - name: Run the README quick start as written
+        working-directory: ${{ runner.temp }}
+        run: "$RUNNER_TEMP/env/bin/python $GITHUB_WORKSPACE/ci/run_readme.py $GITHUB_WORKSPACE/README.md"
+      - name: The command exits 1 on a file with training data and 0 on a clean one
+        run: |
+          set +e
+          "$RUNNER_TEMP/env/bin/tabcustody" scan tests/fixtures/tabicl.pkl; test $? -eq 1 || exit 1
+          "$RUNNER_TEMP/env/bin/tabcustody" scan tests/fixtures/xgboost.pkl; test $? -eq 0 || exit 1

tabcustody-0.1.0/.github/workflows/release.yml

@@ -0,0 +1,40 @@
+name: Release
+
+on:
+  push:
+    tags: ["v*"]
+
+jobs:
+  pypi:
+    runs-on: ubuntu-latest
+    environment:
+      name: pypi
+      url: https://pypi.org/project/tabcustody/
+    permissions:
+      id-token: write
+    steps:
+      - uses: actions/checkout@v7
+      - uses: astral-sh/setup-uv@v10.2.0
+      - run: uv build
+      - run: uv publish --trusted-publishing always
+
+  github-release:
+    needs: pypi
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+      - name: Write the notes from the commits since the previous tag
+        run: |
+          previous=$(git describe --tags --abbrev=0 "$GITHUB_REF_NAME^" 2>/dev/null || git rev-list --max-parents=0 HEAD)
+          {
+            git log --no-merges --format='- %s' "$previous..$GITHUB_REF_NAME"
+            echo
+            echo "**Full Changelog**: https://github.com/$GITHUB_REPOSITORY/compare/$previous...$GITHUB_REF_NAME"
+          } > notes.md
+      - run: gh release create "$GITHUB_REF_NAME" --title "${GITHUB_REF_NAME#v}" --notes-file notes.md --verify-tag
+        env:
+          GH_TOKEN: ${{ github.token }}

tabcustody-0.1.0/.gitignore

@@ -0,0 +1,23 @@
+# planning artifacts (local only)
+ai/
+
+# python
+__pycache__/
+*.py[cod]
+*.egg-info/
+.venv/
+dist/
+.pytest_cache/
+.ruff_cache/
+
+# agent instructions (local only)
+CLAUDE.md
+
+# ephemeral viz pages
+.tmp/
+
+# reference files too large to version (integration suite)
+tests/fixtures/large/
+
+# macOS
+.DS_Store

tabcustody-0.1.0/.python-version

@@ -0,0 +1 @@
+3.12

tabcustody-0.1.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Rachid Jeffali
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

tabcustody-0.1.0/PKG-INFO

@@ -0,0 +1,174 @@
+Metadata-Version: 2.5
+Name: tabcustody
+Version: 0.1.0
+Summary: With in-context tabular models (TabPFN, TabICL, TabDPT), the saved model file is your training data. tabcustody detects it.
+Project-URL: Homepage, https://github.com/jrachid/tabcustody
+Project-URL: Repository, https://github.com/jrachid/tabcustody
+Project-URL: Issues, https://github.com/jrachid/tabcustody/issues
+Author: Rachid Jeffali
+License-Expression: MIT
+License-File: LICENSE
+Keywords: data-leakage,gdpr,in-context-learning,mlops,pickle,privacy,tabdpt,tabicl,tabpfn,tabular-foundation-models
+Classifier: Development Status :: 2 - Pre-Alpha
+Classifier: Intended Audience :: Developers
+Classifier: Intended Audience :: Science/Research
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Topic :: Scientific/Engineering :: Artificial Intelligence
+Classifier: Topic :: Security
+Classifier: Typing :: Typed
+Requires-Python: >=3.11
+Requires-Dist: numpy>=1.24
+Description-Content-Type: text/markdown
+
+# tabcustody
+
+> With in-context tabular models, the model file **is** your training data. tabcustody proves it on your files, then lets you deploy, erase and trace without exposing that data.
+
+**Status: pre-alpha.** Version 0.1 ships the scanner: it tells whether a model file carries its training data, without running the file. Separating, erasing and tracing come next.
+
+## Quick start
+
+```bash
+pip install tabcustody
+tabcustody scan model.pkl other.joblib fitted.tabpfn_fit
+```
+
+The command reads pickle files, joblib files (plain or compressed with zlib, gzip, bz2 or xz) and zip archives of them such as TabPFN's `.tabpfn_fit`. It exits with 1 when a file carries training data, 2 when a file cannot be read, 0 otherwise, so it can gate a CI job; `--json` prints one report per file.
+
+From Python, with scikit-learn installed:
+
+```python
+import pickle
+
+from sklearn.datasets import make_classification
+from sklearn.neighbors import KNeighborsClassifier
+
+from tabcustody import scan_file
+
+X, y = make_classification(n_samples=200, n_features=4, random_state=0)
+with open("model.pkl", "wb") as file:
+    pickle.dump(KNeighborsClassifier().fit(X, y), file)
+
+report = scan_file("model.pkl")
+print(report.to_text())
+assert report.carries_training_data
+```
+
+```
+model.pkl (pickle)
+  training table  _fit_X  200 rows x 4 columns
+    why: the 1-D array _y has one entry per row
+    why: _fit_X is a name libraries use for training rows
+    fix: An instance-based model keeps training rows by design: keep this file as confidential as the data it was fitted on.
+```
+
+On a TabPFN archive the report names the rows of every ensemble member, and on a TabICL file it names the save option that leaves them out:
+
+```
+fitted.tabpfn_fit (zip)
+  training table  executor_state.joblib:ensemble_members[*].X_train  300 rows x 10 or 4 columns  (8 alike)
+    why: the 1-D array executor_state.joblib:ensemble_members[*].y_train has one entry per row
+    why: X_train is a name libraries use for training rows
+    fix: TabPFN keeps the rows in its default fit mode. Releases that include PriorLabs/TabPFN pull request 1323 drop them once the caches are built when the model is fitted with fit_mode='fit_with_cache'; otherwise keep this file as confidential as the data it was fitted on.
+```
+
+The scanner never unpickles the file the usual way: only NumPy arrays and plain containers are rebuilt, every other class becomes an inert placeholder, and no library the file names is imported. The report gives paths, shapes and evidence, never a value of the table.
+
+## The problem, measured
+
+A classic model such as XGBoost learns rules from its training data, then forgets the data: the saved file holds split thresholds, nothing else. The new tabular foundation models — TabPFN, TabICL, TabDPT — work differently. They predict by reading the training table again at every prediction, the way a language model reads its prompt. So a fitted model keeps the table, and saving the model saves the table.
+
+The same 300 synthetic customers, each model fitted then saved with `pickle`, and only the saved file inspected afterwards:
+
+| Model | Saved file | Incomes found verbatim | Incomes rebuilt from the file alone |
+|---|---|---|---|
+| XGBoost 3.4.1 (control) | 0.1 MB | 0 / 300 | 0 / 300 |
+| TabICL 2.2.0 | < 0.1 MB | 300 / 300 | 300 / 300 |
+| TabPFN v2 (tabpfn 9.0.0) | 29.2 MB | 300 / 300 | 300 / 300 |
+| TabPFN v3.5, the default weights (tabpfn 9.0.0) | 876.3 MB | 300 / 300 | 300 / 300 |
+| TabDPT 1.3.1 | 252.5 MB | 11 / 300 | 300 / 300 |
+
+Measured on 28 September 2026 by [`comparisons/leak.py`](comparisons/leak.py), which anyone can rerun with the pinned versions of [`comparisons/pyproject.toml`](comparisons/pyproject.toml).
+
+TabDPT is the instructive row. It stores the table standardised — an income of 38,693.02 becomes -0.058 — so searching the file for known values finds almost nothing, and a manual check concludes the file is clean. But the scaler that standardised the table is saved in the same file, and calling it in reverse rebuilds every income to the cent.
+
+Nothing here is a bug in these libraries: keeping the table is how in-context learning works. The risk is in the habits around model files. Teams have treated them as harmless build artefacts for a decade — committed to Git, copied to buckets, sent to vendors — and with these models each of those copies is a copy of the customer table.
+
+## What the libraries' own saves keep
+
+The table above uses `pickle`. Each library's own save function tells the same story by default, and one of them offers a way out:
+
+| Save | Incomes found verbatim | Largest prediction gap after reload |
+|---|---|---|
+| TabPFN v2 `save_fit_state` (tabpfn 9.0.0) | 300 / 300 | n/a |
+| TabICL 2.2.0 `save(save_training_data=True)`, `kv_cache=False` | 300 / 300 | 0 |
+| TabICL 2.2.0 `save(save_training_data=False)`, `kv_cache=True` | 4 / 300 | 0 |
+
+Measured by [`comparisons/builtin_saves.py`](comparisons/builtin_saves.py).
+
+TabICL's documentation presents `save_training_data=False` as giving "better data privacy": the file keeps the model's cached key-value projections of the table instead of the table, and predictions after reload are unchanged. It works only if the model was fitted with `kv_cache=True`, it is off by default, 4 incomes still appear verbatim, and whether the table can be rebuilt from the cache has not been measured here. TabPFN's `.tabpfn_fit` archive leaves out the foundation model's weights but keeps the table, and TabDPT offers no option to drop it. TabPFN is about to follow TabICL: [pull request 1323](https://github.com/PriorLabs/TabPFN/pull/1323), merged on 28 September 2026 for memory reasons and not yet released, drops each ensemble member's table once its cache is built in `fit_mode="fit_with_cache"`. Measured on TabPFN's main branch at commit `dbba40314b`, with TabPFN v2 weights: the default mode keeps 300 of 300 incomes in the `.tabpfn_fit` archive, `fit_with_cache` keeps 4, and predictions after reload are unchanged in both.
+
+## What existing tools see
+
+The closest prior work is [SACRO-ML](https://github.com/AI-SDC/SACRO-ML), which checks models leaving trusted research environments. Its instance-based attack detects models that store their training rows — SVMs and k-nearest-neighbours, the classic cases — by comparing the stored instances with the training data you give it. On its own ground it works, and on anything else it reports no risk:
+
+| Model | SACRO-ML 2.0.1 verdict | Rows it matched |
+|---|---|---|
+| KNeighborsClassifier (scikit-learn 1.9.1) | leakage confirmed | 300 / 300 |
+| TabICL 2.2.0 | not instance-based, no data leakage risk | 0 / 300 |
+
+Same 300 customers as above, measured by [`comparisons/sacroml_check.py`](comparisons/sacroml_check.py). The TabICL file it clears is one from which every income is rebuilt.
+
+Other tools look at model files for a different reason, or skip them:
+
+- **Pickle security scanners** — [fickling](https://github.com/trailofbits/fickling), [picklescan](https://github.com/mmaitre314/picklescan), [modelscan](https://github.com/protectai/modelscan), the [Hugging Face pickle scan](https://huggingface.co/docs/hub/security-pickle) — look for code that runs when the file loads. Arrays are data, so they are not their concern.
+- **Model auditors** — [ModelAudit](https://github.com/promptfoo/modelaudit) also searches weights for embedded credentials such as API keys, not for rows of a dataset.
+- **Cloud data-loss prevention** — [Amazon Macie](https://docs.aws.amazon.com/macie/latest/user/discovery-supported-storage.html) classifies pickle and NumPy files as objects it cannot analyse, so personal data inside them goes unreported.
+
+tabcustody discovers the table without being handed the training data, covers the in-context tabular models, and tells when values stored behind a scaler can be rebuilt, as with TabDPT.
+
+## Guarantees and the tests that prove them
+
+| Guarantee | Test |
+|---|---|
+| Reading a file runs none of its code, joblib object arrays included | `test_safety.py::test_a_pickle_that_runs_a_command_on_load_runs_nothing`, `test_formats.py::test_an_object_array_inside_a_joblib_file_is_read_without_running_it` |
+| Scanning imports no model library | `test_safety.py::test_scanning_imports_neither_torch_nor_xgboost` |
+| The training table of TabICL, TabPFN v2, TabPFN v3.5 and TabDPT is found | `test_detection.py::test_the_training_table_of_each_in_context_model_is_found` (TabPFN and TabDPT files are too large to version: marked `integration`), `test_formats.py::test_a_tabpfn_fit_archive_is_scanned_member_by_member` |
+| Instance-based models (k-nearest-neighbours, SVM) are reported | `test_detection.py::test_instance_based_models_are_reported_like_sacroml_does` |
+| No finding on XGBoost, LightGBM, logistic regression, random forest, gradient boosting, a 100×100 MLP or a QuantileTransformer pipeline | `test_detection.py::test_classic_models_report_no_table`, `::test_a_square_weight_matrix_next_to_its_bias_is_not_a_table`, `::test_a_quantile_grid_beside_its_levels_is_not_a_table` |
+| A table kept as a pandas DataFrame, pickled by pandas 2 or 3, is found and rebuilt in its column order | `test_detection.py::test_a_table_kept_as_a_pandas_dataframe_is_found`, `::test_a_dataframe_is_rebuilt_column_by_column_in_its_own_order` |
+| A table stored standardised is declared reversible, and reversing gives the exact rows | `test_reversal.py::test_a_standardised_table_is_rebuilt_from_the_scaler_saved_beside_it`, `::test_a_scaled_pipeline_table_is_rebuilt_from_the_scaler_step` |
+| A scaler that does not feed the table is never credited | `test_reversal.py::test_a_scaler_nested_inside_another_transformer_is_not_credited`, `::test_a_table_stored_as_is_is_not_said_to_be_reversible` |
+| The report never prints a value of the table | `test_report.py::test_the_report_never_prints_a_value_of_the_table` |
+| joblib files, compressed or not, read like pickles | `test_formats.py::test_a_joblib_file_is_scanned_like_a_pickle`, `::test_compressed_joblib_files_are_read` |
+| The command exits 1 on a file that carries training data | `test_cli.py::test_the_command_exits_non_zero_when_a_table_is_found` |
+
+## Limits
+
+- **A table is recognised by its target.** The scanner looks for a 2-D numeric array beside a 1-D array with one entry per row. Rows kept without a target, or tables under 20 rows (`--min-rows`), are not reported.
+- **A one-column table stored in sorted order** is taken for a lookup grid, such as QuantileTransformer's quantiles, and not reported.
+- **Only numeric columns are read.** Text and category columns of a DataFrame stay in the file but are not part of the reported shape.
+- **Reversal covers scikit-learn's StandardScaler, MinMaxScaler and RobustScaler**, when the scaler sits beside the table or is the pipeline step right before it. Tables behind other transforms are still reported; they are not called reversible.
+- **Formats.** Not read: lz4-compressed joblib, safetensors, ONNX, `torch.save` archives. PyTorch tensors inside a pickle stay opaque placeholders.
+- **Memory.** The whole object tree is loaded: scanning the 836 MB TabPFN v3.5 pickle peaks at about the size of the file.
+
+## What comes next
+
+1. **Detect** — shipped in 0.1.
+2. **Separate.** Save the model without its table, and supply the table at prediction time from a place you control.
+3. **Erase.** Find a person's rows, remove them, refit, and keep a record that proves it — an erasure request under GDPR article 17 becomes a routine operation with these models, where classic models would need retraining.
+4. **Trace and verify.** Know which exact table was in place for any past prediction, and check that production predicts like development.
+
+Each step ships on its own, with its guarantees backed by named tests.
+
+## What tabcustody does not claim
+
+- **Leakage through predictions.** Whether an attacker can infer training rows from a model's answers is a research question, studied in [arXiv 2606.26021](https://arxiv.org/abs/2606.26021) and [arXiv 2606.31474](https://arxiv.org/abs/2606.31474). tabcustody is about the far plainer leak above: the rows are in the file.
+- **That users are already reporting this.** As of 28 September 2026 no public issue describes it. These models are young; tabcustody is built ahead of the moment teams put them in production at scale.
+- **Models not in the table.** TabPFN 2.5, 2.6 and 3, and AutoGluon's Mitra, are not measured yet. They join the table when `comparisons/leak.py` has run on them.
+
+## License
+
+MIT

tabcustody-0.1.0/README.md

@@ -0,0 +1,150 @@
+# tabcustody
+
+> With in-context tabular models, the model file **is** your training data. tabcustody proves it on your files, then lets you deploy, erase and trace without exposing that data.
+
+**Status: pre-alpha.** Version 0.1 ships the scanner: it tells whether a model file carries its training data, without running the file. Separating, erasing and tracing come next.
+
+## Quick start
+
+```bash
+pip install tabcustody
+tabcustody scan model.pkl other.joblib fitted.tabpfn_fit
+```
+
+The command reads pickle files, joblib files (plain or compressed with zlib, gzip, bz2 or xz) and zip archives of them such as TabPFN's `.tabpfn_fit`. It exits with 1 when a file carries training data, 2 when a file cannot be read, 0 otherwise, so it can gate a CI job; `--json` prints one report per file.
+
+From Python, with scikit-learn installed:
+
+```python
+import pickle
+
+from sklearn.datasets import make_classification
+from sklearn.neighbors import KNeighborsClassifier
+
+from tabcustody import scan_file
+
+X, y = make_classification(n_samples=200, n_features=4, random_state=0)
+with open("model.pkl", "wb") as file:
+    pickle.dump(KNeighborsClassifier().fit(X, y), file)
+
+report = scan_file("model.pkl")
+print(report.to_text())
+assert report.carries_training_data
+```
+
+```
+model.pkl (pickle)
+  training table  _fit_X  200 rows x 4 columns
+    why: the 1-D array _y has one entry per row
+    why: _fit_X is a name libraries use for training rows
+    fix: An instance-based model keeps training rows by design: keep this file as confidential as the data it was fitted on.
+```
+
+On a TabPFN archive the report names the rows of every ensemble member, and on a TabICL file it names the save option that leaves them out:
+
+```
+fitted.tabpfn_fit (zip)
+  training table  executor_state.joblib:ensemble_members[*].X_train  300 rows x 10 or 4 columns  (8 alike)
+    why: the 1-D array executor_state.joblib:ensemble_members[*].y_train has one entry per row
+    why: X_train is a name libraries use for training rows
+    fix: TabPFN keeps the rows in its default fit mode. Releases that include PriorLabs/TabPFN pull request 1323 drop them once the caches are built when the model is fitted with fit_mode='fit_with_cache'; otherwise keep this file as confidential as the data it was fitted on.
+```
+
+The scanner never unpickles the file the usual way: only NumPy arrays and plain containers are rebuilt, every other class becomes an inert placeholder, and no library the file names is imported. The report gives paths, shapes and evidence, never a value of the table.
+
+## The problem, measured
+
+A classic model such as XGBoost learns rules from its training data, then forgets the data: the saved file holds split thresholds, nothing else. The new tabular foundation models — TabPFN, TabICL, TabDPT — work differently. They predict by reading the training table again at every prediction, the way a language model reads its prompt. So a fitted model keeps the table, and saving the model saves the table.
+
+The same 300 synthetic customers, each model fitted then saved with `pickle`, and only the saved file inspected afterwards:
+
+| Model | Saved file | Incomes found verbatim | Incomes rebuilt from the file alone |
+|---|---|---|---|
+| XGBoost 3.4.1 (control) | 0.1 MB | 0 / 300 | 0 / 300 |
+| TabICL 2.2.0 | < 0.1 MB | 300 / 300 | 300 / 300 |
+| TabPFN v2 (tabpfn 9.0.0) | 29.2 MB | 300 / 300 | 300 / 300 |
+| TabPFN v3.5, the default weights (tabpfn 9.0.0) | 876.3 MB | 300 / 300 | 300 / 300 |
+| TabDPT 1.3.1 | 252.5 MB | 11 / 300 | 300 / 300 |
+
+Measured on 28 September 2026 by [`comparisons/leak.py`](comparisons/leak.py), which anyone can rerun with the pinned versions of [`comparisons/pyproject.toml`](comparisons/pyproject.toml).
+
+TabDPT is the instructive row. It stores the table standardised — an income of 38,693.02 becomes -0.058 — so searching the file for known values finds almost nothing, and a manual check concludes the file is clean. But the scaler that standardised the table is saved in the same file, and calling it in reverse rebuilds every income to the cent.
+
+Nothing here is a bug in these libraries: keeping the table is how in-context learning works. The risk is in the habits around model files. Teams have treated them as harmless build artefacts for a decade — committed to Git, copied to buckets, sent to vendors — and with these models each of those copies is a copy of the customer table.
+
+## What the libraries' own saves keep
+
+The table above uses `pickle`. Each library's own save function tells the same story by default, and one of them offers a way out:
+
+| Save | Incomes found verbatim | Largest prediction gap after reload |
+|---|---|---|
+| TabPFN v2 `save_fit_state` (tabpfn 9.0.0) | 300 / 300 | n/a |
+| TabICL 2.2.0 `save(save_training_data=True)`, `kv_cache=False` | 300 / 300 | 0 |
+| TabICL 2.2.0 `save(save_training_data=False)`, `kv_cache=True` | 4 / 300 | 0 |
+
+Measured by [`comparisons/builtin_saves.py`](comparisons/builtin_saves.py).
+
+TabICL's documentation presents `save_training_data=False` as giving "better data privacy": the file keeps the model's cached key-value projections of the table instead of the table, and predictions after reload are unchanged. It works only if the model was fitted with `kv_cache=True`, it is off by default, 4 incomes still appear verbatim, and whether the table can be rebuilt from the cache has not been measured here. TabPFN's `.tabpfn_fit` archive leaves out the foundation model's weights but keeps the table, and TabDPT offers no option to drop it. TabPFN is about to follow TabICL: [pull request 1323](https://github.com/PriorLabs/TabPFN/pull/1323), merged on 28 September 2026 for memory reasons and not yet released, drops each ensemble member's table once its cache is built in `fit_mode="fit_with_cache"`. Measured on TabPFN's main branch at commit `dbba40314b`, with TabPFN v2 weights: the default mode keeps 300 of 300 incomes in the `.tabpfn_fit` archive, `fit_with_cache` keeps 4, and predictions after reload are unchanged in both.
+
+## What existing tools see
+
+The closest prior work is [SACRO-ML](https://github.com/AI-SDC/SACRO-ML), which checks models leaving trusted research environments. Its instance-based attack detects models that store their training rows — SVMs and k-nearest-neighbours, the classic cases — by comparing the stored instances with the training data you give it. On its own ground it works, and on anything else it reports no risk:
+
+| Model | SACRO-ML 2.0.1 verdict | Rows it matched |
+|---|---|---|
+| KNeighborsClassifier (scikit-learn 1.9.1) | leakage confirmed | 300 / 300 |
+| TabICL 2.2.0 | not instance-based, no data leakage risk | 0 / 300 |
+
+Same 300 customers as above, measured by [`comparisons/sacroml_check.py`](comparisons/sacroml_check.py). The TabICL file it clears is one from which every income is rebuilt.
+
+Other tools look at model files for a different reason, or skip them:
+
+- **Pickle security scanners** — [fickling](https://github.com/trailofbits/fickling), [picklescan](https://github.com/mmaitre314/picklescan), [modelscan](https://github.com/protectai/modelscan), the [Hugging Face pickle scan](https://huggingface.co/docs/hub/security-pickle) — look for code that runs when the file loads. Arrays are data, so they are not their concern.
+- **Model auditors** — [ModelAudit](https://github.com/promptfoo/modelaudit) also searches weights for embedded credentials such as API keys, not for rows of a dataset.
+- **Cloud data-loss prevention** — [Amazon Macie](https://docs.aws.amazon.com/macie/latest/user/discovery-supported-storage.html) classifies pickle and NumPy files as objects it cannot analyse, so personal data inside them goes unreported.
+
+tabcustody discovers the table without being handed the training data, covers the in-context tabular models, and tells when values stored behind a scaler can be rebuilt, as with TabDPT.
+
+## Guarantees and the tests that prove them
+
+| Guarantee | Test |
+|---|---|
+| Reading a file runs none of its code, joblib object arrays included | `test_safety.py::test_a_pickle_that_runs_a_command_on_load_runs_nothing`, `test_formats.py::test_an_object_array_inside_a_joblib_file_is_read_without_running_it` |
+| Scanning imports no model library | `test_safety.py::test_scanning_imports_neither_torch_nor_xgboost` |
+| The training table of TabICL, TabPFN v2, TabPFN v3.5 and TabDPT is found | `test_detection.py::test_the_training_table_of_each_in_context_model_is_found` (TabPFN and TabDPT files are too large to version: marked `integration`), `test_formats.py::test_a_tabpfn_fit_archive_is_scanned_member_by_member` |
+| Instance-based models (k-nearest-neighbours, SVM) are reported | `test_detection.py::test_instance_based_models_are_reported_like_sacroml_does` |
+| No finding on XGBoost, LightGBM, logistic regression, random forest, gradient boosting, a 100×100 MLP or a QuantileTransformer pipeline | `test_detection.py::test_classic_models_report_no_table`, `::test_a_square_weight_matrix_next_to_its_bias_is_not_a_table`, `::test_a_quantile_grid_beside_its_levels_is_not_a_table` |
+| A table kept as a pandas DataFrame, pickled by pandas 2 or 3, is found and rebuilt in its column order | `test_detection.py::test_a_table_kept_as_a_pandas_dataframe_is_found`, `::test_a_dataframe_is_rebuilt_column_by_column_in_its_own_order` |
+| A table stored standardised is declared reversible, and reversing gives the exact rows | `test_reversal.py::test_a_standardised_table_is_rebuilt_from_the_scaler_saved_beside_it`, `::test_a_scaled_pipeline_table_is_rebuilt_from_the_scaler_step` |
+| A scaler that does not feed the table is never credited | `test_reversal.py::test_a_scaler_nested_inside_another_transformer_is_not_credited`, `::test_a_table_stored_as_is_is_not_said_to_be_reversible` |
+| The report never prints a value of the table | `test_report.py::test_the_report_never_prints_a_value_of_the_table` |
+| joblib files, compressed or not, read like pickles | `test_formats.py::test_a_joblib_file_is_scanned_like_a_pickle`, `::test_compressed_joblib_files_are_read` |
+| The command exits 1 on a file that carries training data | `test_cli.py::test_the_command_exits_non_zero_when_a_table_is_found` |
+
+## Limits
+
+- **A table is recognised by its target.** The scanner looks for a 2-D numeric array beside a 1-D array with one entry per row. Rows kept without a target, or tables under 20 rows (`--min-rows`), are not reported.
+- **A one-column table stored in sorted order** is taken for a lookup grid, such as QuantileTransformer's quantiles, and not reported.
+- **Only numeric columns are read.** Text and category columns of a DataFrame stay in the file but are not part of the reported shape.
+- **Reversal covers scikit-learn's StandardScaler, MinMaxScaler and RobustScaler**, when the scaler sits beside the table or is the pipeline step right before it. Tables behind other transforms are still reported; they are not called reversible.
+- **Formats.** Not read: lz4-compressed joblib, safetensors, ONNX, `torch.save` archives. PyTorch tensors inside a pickle stay opaque placeholders.
+- **Memory.** The whole object tree is loaded: scanning the 836 MB TabPFN v3.5 pickle peaks at about the size of the file.
+
+## What comes next
+
+1. **Detect** — shipped in 0.1.
+2. **Separate.** Save the model without its table, and supply the table at prediction time from a place you control.
+3. **Erase.** Find a person's rows, remove them, refit, and keep a record that proves it — an erasure request under GDPR article 17 becomes a routine operation with these models, where classic models would need retraining.
+4. **Trace and verify.** Know which exact table was in place for any past prediction, and check that production predicts like development.
+
+Each step ships on its own, with its guarantees backed by named tests.
+
+## What tabcustody does not claim
+
+- **Leakage through predictions.** Whether an attacker can infer training rows from a model's answers is a research question, studied in [arXiv 2606.26021](https://arxiv.org/abs/2606.26021) and [arXiv 2606.31474](https://arxiv.org/abs/2606.31474). tabcustody is about the far plainer leak above: the rows are in the file.
+- **That users are already reporting this.** As of 28 September 2026 no public issue describes it. These models are young; tabcustody is built ahead of the moment teams put them in production at scale.
+- **Models not in the table.** TabPFN 2.5, 2.6 and 3, and AutoGluon's Mitra, are not measured yet. They join the table when `comparisons/leak.py` has run on them.
+
+## License
+
+MIT

tabcustody-0.1.0/ci/run_readme.py

@@ -0,0 +1,12 @@
+"""Runs the first Python block of the README exactly as written, so the quick start cannot drift from the package."""
+
+import re
+import sys
+from pathlib import Path
+
+readme = Path(sys.argv[1]).read_text()
+block = re.search(r"```python\n(.*?)```", readme, re.DOTALL)
+if block is None:
+    sys.exit("no Python block in the README")
+exec(compile(block.group(1), "README.md", "exec"), {"__name__": "__main__"})
+print("the README quick start ran as written")

tabcustody-0.1.0/comparisons/builtin_saves.py

@@ -0,0 +1,45 @@
+"""Measures what each library's own save function keeps: TabPFN's `.tabpfn_fit` archive and TabICL's `save()` with and without its option.
+
+Run with `uv run python builtin_saves.py`; the output is the README's built-in saves table."""
+
+import pickle
+import tempfile
+import warnings
+import zipfile
+from importlib.metadata import version
+from pathlib import Path
+
+import numpy as np
+
+from leak import ROWS, customers, tabpfn_v2_model, target, verbatim
+
+warnings.filterwarnings("ignore")
+
+workdir = Path(tempfile.mkdtemp())
+
+
+def tabpfn_fit_archive() -> tuple[str, str, str]:
+    path = workdir / "model.tabpfn_fit"
+    tabpfn_v2_model().save_fit_state(path)
+    with zipfile.ZipFile(path) as archive:
+        blob = b"".join(archive.read(name) for name in archive.namelist())
+    return f"TabPFN v2 `save_fit_state` (tabpfn {version('tabpfn')})", f"{verbatim(blob)} / {ROWS}", "n/a"
+
+
+def tabicl_save(kv_cache: bool, keep_data: bool) -> tuple[str, str, str]:
+    from tabicl import TabICLClassifier
+
+    model = TabICLClassifier(device="cpu", kv_cache=kv_cache).fit(customers, target)
+    reference = model.predict_proba(customers)
+    path = workdir / f"tabicl-{kv_cache}-{keep_data}.pkl"
+    model.save(path, save_training_data=keep_data)
+    reloaded = pickle.loads(path.read_bytes())
+    gap = np.max(np.abs(reloaded.predict_proba(customers) - reference))
+    label = f"TabICL {version('tabicl')} `save(save_training_data={keep_data})`, `kv_cache={kv_cache}`"
+    return label, f"{verbatim(path.read_bytes())} / {ROWS}", f"{gap:.0e}"
+
+
+print("| Save | Incomes found verbatim | Largest prediction gap after reload |")
+print("|---|---|---|")
+for row in (tabpfn_fit_archive(), tabicl_save(kv_cache=False, keep_data=True), tabicl_save(kv_cache=True, keep_data=False)):
+    print("| " + " | ".join(row) + " |")

tabcustody-0.1.0/comparisons/leak.py

@@ -0,0 +1,108 @@
+"""Measures, from a pickled model alone, how many of its 300 training incomes are readable or rebuildable.
+
+Run with `uv run python leak.py [xgboost tabicl tabpfn-v2 tabpfn tabdpt]`; the output is the README table."""
+
+import pickle
+import struct
+import subprocess
+import sys
+import warnings
+from importlib.metadata import version
+
+import numpy as np
+import pandas as pd
+
+warnings.filterwarnings("ignore")
+
+ROWS = 300
+rng = np.random.default_rng(0)
+customers = pd.DataFrame(
+    {
+        "age": rng.integers(20, 70, ROWS),
+        "income": rng.normal(40000, 12000, ROWS).round(2),
+        "debt": rng.normal(8000, 3000, ROWS).round(2),
+    }
+)
+target = (customers["debt"] / customers["income"] > 0.2).astype(int)
+incomes = customers["income"].to_numpy()
+
+
+def verbatim(blob: bytes) -> int:
+    return sum(blob.count(struct.pack("<d", v)) + blob.count(struct.pack("<f", v)) > 0 for v in incomes)
+
+
+def rebuilt(restored) -> int | None:
+    """Rebuilds incomes from the unpickled object only, never from the original frame."""
+    for attr in ("X_train", "X_", "_X_train"):
+        stored = getattr(restored, attr, None)
+        if stored is None:
+            continue
+        stored = np.asarray(stored, dtype=float)
+        scaler = getattr(restored, "scaler", None)
+        if scaler is not None and hasattr(scaler, "inverse_transform"):
+            stored = scaler.inverse_transform(stored)
+        return int(np.isclose(stored[:, 1], incomes, atol=0.005).sum())
+    return None
+
+
+def report(name: str, model) -> None:
+    blob = pickle.dumps(model)
+    restored = pickle.loads(blob)
+    found = verbatim(blob)
+    recovered = rebuilt(restored)
+    recovered = found if recovered is None else max(found, recovered)
+    print(f"| {name} | {len(blob) / 1e6:.1f} MB | {found} / {ROWS} | {recovered} / {ROWS} |")
+
+
+def xgboost_model():
+    import xgboost
+
+    return xgboost.XGBClassifier(n_estimators=50, max_depth=3).fit(customers, target)
+
+
+def tabicl_model():
+    from tabicl import TabICLClassifier
+
+    return TabICLClassifier(device="cpu").fit(customers, target)
+
+
+def tabpfn_v2_model():
+    from tabpfn import TabPFNClassifier
+    from tabpfn.constants import ModelVersion
+
+    return TabPFNClassifier.create_default_for_version(ModelVersion.V2, device="cpu").fit(customers, target)
+
+
+def tabdpt_model():
+    from tabdpt import TabDPTClassifier
+
+    model = TabDPTClassifier(device="cpu")
+    model.fit(customers.to_numpy(float), target.to_numpy())
+    return model
+
+
+def tabpfn_latest_model():
+    from tabpfn import TabPFNClassifier
+
+    return TabPFNClassifier(device="cpu").fit(customers, target)
+
+
+MODELS = {
+    "xgboost": (f"XGBoost {version('xgboost')} (control)", xgboost_model),
+    "tabicl": (f"TabICL {version('tabicl')}", tabicl_model),
+    "tabpfn-v2": (f"TabPFN v2 (tabpfn {version('tabpfn')})", tabpfn_v2_model),
+    "tabpfn": (f"TabPFN v3.5, the default weights (tabpfn {version('tabpfn')})", tabpfn_latest_model),
+    "tabdpt": (f"TabDPT {version('tabdpt')}", tabdpt_model),
+}
+
+if __name__ == "__main__":
+    if len(sys.argv) == 2:
+        label, build = MODELS[sys.argv[1]]
+        report(label, build())
+        sys.exit()
+    print("versions:", ", ".join(f"{p} {version(p)}" for p in ("xgboost", "tabicl", "tabpfn", "tabdpt", "torch")))
+    print("| Model | Saved file | Incomes found verbatim | Incomes rebuilt from the file alone |")
+    print("|---|---|---|---|")
+    # One process per model: on macOS, fitting XGBoost and a PyTorch model in the same process segfaults.
+    for key in sys.argv[1:] or list(MODELS):
+        subprocess.run([sys.executable, __file__, key], check=True)