kt-audit
Before you trust an AUC, audit the evaluation.
kt-audit is a small, opinionated audit tool for knowledge-tracing (KT) experiments. It does not train models. It checks whether the evaluation setup behind a reported AUC is trustworthy.
Status: alpha (0.1.0). The scope is intentionally narrow; see docs/charter.md for the scope and non-goals.
Why
KT papers and libraries report AUC, but the evaluation protocol is often under-specified:
- Are train events strictly before validation/test events for each user?
- Does the same item appear in train and test?
- When an item has multiple knowledge components (KCs), are some KCs train-only and others test-only?
- Do the reported metrics match a recomputation from the released predictions?
kt-audit turns those questions into a machine-readable report you can attach to a paper artifact, a PR, or a model release.
Install
Not on PyPI yet. From source:
git clone https://github.com/summeriver13/kt-audit
cd kt-audit
uv sync
uv run kt-audit --help
Or with pip:
pip install -e .
Requires Python 3.10+.
Quickstart
uv run kt-audit run examples/leaky.csv --out /tmp/kt-audit-report
Output:
verdict: fail
findings: 6 error, 2 warn
report: /tmp/kt-audit-report/report.md
The command writes:
report.json— stable, machine-readable.report.md— human-readable, with examples and limitations.
Exit codes: 0 pass/warn, 1 fail, 2 input/config error.
What it checks
| Check | Catches | Default |
|---|---|---|
temporal_split |
train timestamps after validation/test; users across splits | error / warn |
multi_kc |
same item with train-only and test-only KCs | error |
alignment |
missing/duplicate/out-of-range predictions; constant predictions; reported AUC mismatch | error / warn |
Each finding has a severity, a count, and up to three examples.
Input
One row per interaction or prediction. CSV or JSONL.
| Column | Required | Notes |
|---|---|---|
user_id |
yes | non-null |
timestamp |
yes | ISO8601 or numeric; comparable within a user |
split |
yes | train / valid / test |
kc_ids |
yes | pipe-separated KCs or JSON array |
item_id |
no | needed for multi-KC check |
y_true |
no | 0/1; required with y_pred |
y_pred |
no | [0,1]; omit to skip metric checks |
fold |
no | checks run per fold |
sequence_id, position |
no | reserved for sequence checks |
See docs/data-contract.md for the full contract.
Python API
from kt_audit import AuditConfig, audit_path
report = audit_path("events.csv", AuditConfig(reported_auc=0.80))
print(report.verdict)
for finding in report.findings:
print(finding.severity, finding.check, finding.count)
Design constraints
- Runtime dependencies:
numpy,pandas,scikit-learn. - CLI uses
argparse; config uses JSON. - Each check is a pure function over a prepared
DataFrame. - Synthetic examples only; no dataset is bundled.
- Findings are heuristics, not causal proof.
Development
uv sync --extra dev
uv run ruff check .
uv run ruff format --check .
uv run basedpyright
uv run pytest --cov=kt_audit --cov-report=term-missing
bash scripts/wheel-smoke.sh
Release
See docs/release.md. TestPyPI and PyPI publish through GitHub Actions trusted publishing.
Roadmap
- v0.2: pyKT adapter, bootstrap AUC intervals, HTML report.
- v0.3: duplicate interactions, cold-start, sequence truncation, label leakage.
AI disclosure
AI tools are used in development. The maintainer reviews every check definition, test, and release. Findings generated by the tool are deterministic and do not call an LLM.
Contributing
See CONTRIBUTING.md. The v0.1 scope is frozen to the three checks above.
License
MIT. See LICENSE.
Metadata
Release files for kt-audit 0.1.0
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | Provenance | Actions |
|---|---|---|---|---|
| kt_audit-0.1.0.tar.gz | 22.5 kB | Without provenance | Details for kt_audit-0.1.0.tar.gz |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Actions Reset |
|---|---|---|---|---|
| kt_audit-0.1.0-py3-none-any.whl | Python 3 | none | any | Details for kt_audit-0.1.0-py3-none-any.whl |
Total release size: 39.2 kB
Release files / kt_audit-0.1.0.tar.gz
| Download URL | kt_audit-0.1.0.tar.gz |
|---|---|
| Size | 22.5 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
1b9ebbf01b2b858b3f63f2d72a847620ded3b8d60ea6292c2a89c23eb7c333ba
|
|
BLAKE2b-256 checksum How to use checksums |
c8761dd3b26f66d21887af14aa4681f8a0bec8347843aed0cc63df3fc72dc0e9
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
uv/0.13.4 {"installer":{"name":"uv","version":"0.13.4","subcommand":["publish"]},"python":null,"implementation":{"name":null,"version":null},"distro":{"name":"Ubuntu","version":"24.04","id":"noble","libc":null},"system":{"name":null,"release":null},"cpu":null,"openssl_version":null,"setuptools_version":null,"rustc_version":null,"ci":true}
|
Release files / kt_audit-0.1.0-py3-none-any.whl
| Download URL | kt_audit-0.1.0-py3-none-any.whl |
|---|---|
| Size | 16.7 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
3958f2b1d7e996493a0a0b4c48ac91a5289e74427fa2b8803bc28f524e6a6207
|
|
BLAKE2b-256 checksum How to use checksums |
6ac16c9ae6c9e7554fd214ecfdd21796cf40f34391190962841a00a574445331
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
uv/0.13.4 {"installer":{"name":"uv","version":"0.13.4","subcommand":["publish"]},"python":null,"implementation":{"name":null,"version":null},"distro":{"name":"Ubuntu","version":"24.04","id":"noble","libc":null},"system":{"name":null,"release":null},"cpu":null,"openssl_version":null,"setuptools_version":null,"rustc_version":null,"ci":true}
|
Security for kt-audit 0.1.0
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
No provenance found
None of the files in this release were uploaded with provenance metadata.
A note on package security
PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.
To learn more about protecting yourself from malicious actors, visit our package security documentation.