tabcustody

With in-context tabular models, the model file is your training data. tabcustody proves it on your files, then lets you deploy, erase and trace without exposing that data.

Status: pre-alpha. Version 0.1 ships the scanner: it tells whether a model file carries its training data, without running the file. Separating, erasing and tracing come next.

Quick start

pip install tabcustody
tabcustody scan model.pkl other.joblib fitted.tabpfn_fit

The command reads pickle files, joblib files (plain or compressed with zlib, gzip, bz2 or xz) and zip archives of them such as TabPFN's .tabpfn_fit. It exits with 1 when a file carries training data, 2 when a file cannot be read, 0 otherwise, so it can gate a CI job; --json prints one report per file.

From Python, with scikit-learn installed:

import pickle

from sklearn.datasets import make_classification
from sklearn.neighbors import KNeighborsClassifier

from tabcustody import scan_file

X, y = make_classification(n_samples=200, n_features=4, random_state=0)
with open("model.pkl", "wb") as file:
    pickle.dump(KNeighborsClassifier().fit(X, y), file)

report = scan_file("model.pkl")
print(report.to_text())
assert report.carries_training_data

model.pkl (pickle)
  training table  _fit_X  200 rows x 4 columns
    why: the 1-D array _y has one entry per row
    why: _fit_X is a name libraries use for training rows
    fix: An instance-based model keeps training rows by design: keep this file as confidential as the data it was fitted on.

On a TabPFN archive the report names the rows of every ensemble member, and on a TabICL file it names the save option that leaves them out:

fitted.tabpfn_fit (zip)
  training table  executor_state.joblib:ensemble_members[*].X_train  300 rows x 10 or 4 columns  (8 alike)
    why: the 1-D array executor_state.joblib:ensemble_members[*].y_train has one entry per row
    why: X_train is a name libraries use for training rows
    fix: TabPFN keeps the rows in its default fit mode. Releases that include PriorLabs/TabPFN pull request 1323 drop them once the caches are built when the model is fitted with fit_mode='fit_with_cache'; otherwise keep this file as confidential as the data it was fitted on.

The scanner never unpickles the file the usual way: only NumPy arrays and plain containers are rebuilt, every other class becomes an inert placeholder, and no library the file names is imported. The report gives paths, shapes and evidence, never a value of the table.

The problem, measured

A classic model such as XGBoost learns rules from its training data, then forgets the data: the saved file holds split thresholds, nothing else. The new tabular foundation models — TabPFN, TabICL, TabDPT — work differently. They predict by reading the training table again at every prediction, the way a language model reads its prompt. So a fitted model keeps the table, and saving the model saves the table.

The same 300 synthetic customers, each model fitted then saved with pickle, and only the saved file inspected afterwards:

Measured on 28 September 2026 by comparisons/leak.py, which anyone can rerun with the pinned versions of comparisons/pyproject.toml.

TabDPT is the instructive row. It stores the table standardised — an income of 38,693.02 becomes -0.058 — so searching the file for known values finds almost nothing, and a manual check concludes the file is clean. But the scaler that standardised the table is saved in the same file, and calling it in reverse rebuilds every income to the cent.

Nothing here is a bug in these libraries: keeping the table is how in-context learning works. The risk is in the habits around model files. Teams have treated them as harmless build artefacts for a decade — committed to Git, copied to buckets, sent to vendors — and with these models each of those copies is a copy of the customer table.

What the libraries' own saves keep

The table above uses pickle. Each library's own save function tells the same story by default, and one of them offers a way out:

Measured by comparisons/builtin_saves.py.

TabICL's documentation presents save_training_data=False as giving "better data privacy": the file keeps the model's cached key-value projections of the table instead of the table, and predictions after reload are unchanged. It works only if the model was fitted with kv_cache=True, it is off by default, 4 incomes still appear verbatim, and whether the table can be rebuilt from the cache has not been measured here. TabPFN's .tabpfn_fit archive leaves out the foundation model's weights but keeps the table, and TabDPT offers no option to drop it. TabPFN is about to follow TabICL: pull request 1323, merged on 28 September 2026 for memory reasons and not yet released, drops each ensemble member's table once its cache is built in fit_mode="fit_with_cache". Measured on TabPFN's main branch at commit dbba40314b, with TabPFN v2 weights: the default mode keeps 300 of 300 incomes in the .tabpfn_fit archive, fit_with_cache keeps 4, and predictions after reload are unchanged in both.

What existing tools see

The closest prior work is SACRO-ML, which checks models leaving trusted research environments. Its instance-based attack detects models that store their training rows — SVMs and k-nearest-neighbours, the classic cases — by comparing the stored instances with the training data you give it. On its own ground it works, and on anything else it reports no risk:

Same 300 customers as above, measured by comparisons/sacroml_check.py. The TabICL file it clears is one from which every income is rebuilt.

Other tools look at model files for a different reason, or skip them:

• Pickle security scanners — fickling, picklescan, modelscan, the Hugging Face pickle scan — look for code that runs when the file loads. Arrays are data, so they are not their concern.
• Model auditors — ModelAudit also searches weights for embedded credentials such as API keys, not for rows of a dataset.
• Cloud data-loss prevention — Amazon Macie classifies pickle and NumPy files as objects it cannot analyse, so personal data inside them goes unreported.

tabcustody discovers the table without being handed the training data, covers the in-context tabular models, and tells when values stored behind a scaler can be rebuilt, as with TabDPT.

Guarantees and the tests that prove them

Limits

• A table is recognised by its target. The scanner looks for a 2-D numeric array beside a 1-D array with one entry per row. Rows kept without a target, or tables under 20 rows (--min-rows), are not reported.
• A one-column table stored in sorted order is taken for a lookup grid, such as QuantileTransformer's quantiles, and not reported.
• Only numeric columns are read. Text and category columns of a DataFrame stay in the file but are not part of the reported shape.
• Reversal covers scikit-learn's StandardScaler, MinMaxScaler and RobustScaler, when the scaler sits beside the table or is the pipeline step right before it. Tables behind other transforms are still reported; they are not called reversible.
• Formats. Not read: lz4-compressed joblib, safetensors, ONNX, torch.save archives. PyTorch tensors inside a pickle stay opaque placeholders.
• Memory. The whole object tree is loaded: scanning the 836 MB TabPFN v3.5 pickle peaks at about the size of the file.

What comes next

1. Detect — shipped in 0.1.
2. Separate. Save the model without its table, and supply the table at prediction time from a place you control.
3. Erase. Find a person's rows, remove them, refit, and keep a record that proves it — an erasure request under GDPR article 17 becomes a routine operation with these models, where classic models would need retraining.
4. Trace and verify. Know which exact table was in place for any past prediction, and check that production predicts like development.

Each step ships on its own, with its guarantees backed by named tests.

What tabcustody does not claim

• Leakage through predictions. Whether an attacker can infer training rows from a model's answers is a research question, studied in arXiv 2606.26021 and arXiv 2606.31474. tabcustody is about the far plainer leak above: the rows are in the file.
• That users are already reporting this. As of 28 September 2026 no public issue describes it. These models are young; tabcustody is built ahead of the moment teams put them in production at scale.
• Models not in the table. TabPFN 2.5, 2.6 and 3, and AutoGluon's Mitra, are not measured yet. They join the table when comparisons/leak.py has run on them.

License

MIT