TFMs: model weights and behavioural fingerprints for dataset inference on tabular foundation models

Companion artefacts for the paper

Dataset inference for data provenance and privacy auditing in tabular foundation models Dariush Wahdany*¹, Jesse C. Cresswell*², Naiqing Guan², Atiyeh Ashari Ghomi², Franziska Boenisch¹, Adam Dziedzic¹ ¹ CISPA Helmholtz Center for Information Security · ² Layer 6 AI · * equal contribution

Code: https://github.com/layer6ai-labs/tfm-di

Tabular foundation models (TFMs) are trained on large collections of real tabular datasets and served through black-box APIs. The paper introduces the first dataset inference (DI) method for TFMs: it probes a model with input manipulations, measures how its predictions react, reduces each (manipulation, measurement) curve to a handful of scalars, and trains an auditor on the resulting per-dataset fingerprint to decide whether a suspect dataset was part of the model's pre-training corpus. Every number is reported against a blind baseline, the same pipeline run on a TFM that never saw the datasets (TabPFN-2.5 trained on synthetic data only), so distribution shift between members and non-members is not mistaken for memorisation.

This repository holds the two kinds of artefacts needed to reproduce or extend that study:

1. Model weights we trained ourselves: TabDPT re-trained with different seeds and on row-level member splits, and a family of NanoTabPFN models of varying training-set size, architecture size, and training data (synthetic vs. real T4).
2. Behavioural fingerprint tables (signals/<model>/<pool>/datasets.parquet): the extracted signals for every target model and every blind, so the audits in the paper can be re-run on CPU in minutes without any GPU extraction.

Access

The repository is gated. Request access on the repository page, then authenticate once:

hf auth login

from huggingface_hub import hf_hub_download, snapshot_download
import pandas as pd

# a weight file
ckpt = hf_hub_download("SprintML/tfms", "nanotabpfn/classifier.pt")

# a fingerprint table
df = pd.read_parquet(hf_hub_download("SprintML/tfms", "signals/tabdpt/binary_all_tabdpt/datasets.parquet"))
df["true_label"].value_counts()   # 1 = member of the target model's pre-training corpus

Model weights

NanoTabPFN family (nanotabpfn/)

Small TabPFN-style in-context learners trained with TFM-Playground (vendored as tfm_playground/ in the code repository). Every <name>.pt has a sibling <name>.arch.json with the architecture and training hyper-parameters, which the loader in di/datasets/nanotabpfn_wrapper.py reads automatically. All models: 80 epochs, batch 50, lr 1e-4, up to 10 classes, seed 2402.

file	layers	embed	heads	MLP	params	training tables	role in the paper
classifier.pt	6	192	6	768	3.7 M	50,000 synthetic	baseline NanoTabPFN (Tables 1, 2, 10, 11)
data25k.pt	6	192	6	768	3.7 M	25,000 synthetic	data-size ablation (Table 10)
data10k.pt	6	192	6	768	3.7 M	10,000 synthetic	data-size ablation (Table 10)
data5k.pt	6	192	6	768	3.7 M	5,000 synthetic	data-size ablation (Table 10)
arch_medium.pt	8	384	8	1536	19.5 M	50,000 synthetic	architecture ablation (Table 11)
arch_large.pt	12	768	12	3072	115.8 M	50,000 synthetic	architecture ablation (Table 11)
real_t4_default.pt	6	192	6	768	3.7 M	9,323 real T4 tables	real-data model (Table 4)
real_t4_100k_default.pt	6	192	6	768	3.7 M	100,000 real T4 tables	real-data model, larger corpus (not in the paper's tables)

Synthetic training tables come from the TFM-Playground prior dump 50x3_3_100k_classification (100,000 tables of 50 rows × 3 features; the first 50,000 are the training stream, the remaining 50,000 the held-out non-members used in signals/nanotabpfn/nanotabpfn_all). classifier.arch.json carries reconstructed metadata for the pre-existing baseline model; the other seven were trained by train_nanotabpfn_variant.py. Not uploaded: the 2,000-, 1,000-, 500- and 100-table models of Table 10 and the two synthetic-T4 models (Gaussian copula, shuffled) of Table 4.

The two real-data models were trained on tables sampled from the T4 corpus (50 rows × 3 features per table, tables with at least 150 rows, at most 10 target classes). Their *.manifest.json lists every T4 table id, target column and feature columns that were used, which is the membership ground truth for those models: real_t4_default draws 9,323 tables from a single T4 chunk, real_t4_100k_default 100,000 tables across 94 chunks.

TabDPT re-trainings (tabdpt/, split{1,2,3}/)

TabDPT re-trained from scratch with the public TabDPT-training code.

file	what it is
tabdpt/seed{42,123,456}/model.safetensors	the full TabDPT recipe and corpus, only the random seed changed. Used to test whether fingerprints transfer across seeds.
tabdpt/split{1,2,3}/model.safetensors	TabDPT trained on a row-level 50/50 split of every dataset in its pre-training corpus (split seed 1, 2, 3): each model saw one half of the rows of every member dataset and never the other half. Weights only.
split{1,2,3}/latest.ckpt	the corresponding full training checkpoints written by train.py (model, optimiser and scheduler state; load with torch.load(..., weights_only=False)).
split{1,2,3}/member_splits.json.zst	zstd-compressed JSON {"member_split_seed": s, "splits": {dataset_id: {"member_indices", "non_member_indices", "total_rows"}}}; indices refer to the original OpenML row order.

The split models support row-level in/out experiments only; there is no dataset-level hold-out among them.

Behavioural fingerprint tables (signals/)

One parquet file per (model, dataset pool). Each row is one probed table (one target column of one dataset). Columns are

• metadata: dataset_id, dataset_name, true_label (1 = member of the target model's pre-training corpus, 0 = non-member), task_type, n_pool, n_features, success, elapsed_s (plus dataset_id_str where ids are strings; the audits treat n_pool/n_features/n_classes and elapsed_s as metadata, never as signals);
• signals: hundreds of scalar columns named <manipulation>_<measurement>_<reduction>, e.g. tserum_loss_early, ctx_accuracy_slope, mislbl_kl2clean_auc, base_entropy. The manipulation, measurement and reduction vocabularies are Tables 5–7 of the paper and di/grid/ in the code;
• the two binary_realtabpfn25 tables also carry nested aggregate columns: _metadata_features (summary statistics of the table), _curves (the per-manipulation-level values the scalars were reduced from) and _metadata (compute time, context and query sizes). Their per-row payload columns (_row_signals, _row_labels) were removed on 2026-10-15; the scalar columns the audits read are unchanged and the published cells reproduce bit-for-bit from the current files.

tabpfn25/<pool> is always the blind table for the target <model>/<pool>: the identical extraction run on TabPFN-2.5, aligned row-for-row by dataset_id. The blind checkpoint is the synthetic-only tabpfn-v2.5-classifier-v2.5_default-2.ckpt / tabpfn-v2.5-regressor-v2.5_default.ckpt, with one exception: tabpfn25/nanotabpfn_all was run with tabpfn-v2.5-classifier-v2.5_default.ckpt, the real-data-finetuned default; it is still blind to the synthetic prior tables of that pool.

target model	pool	rows	members / non-members	pool definition
tabdpt	binary_all_tabdpt	224	117 / 107	OpenML datasets: TabDPT's pre-training corpus vs. OpenML-CC18 + CTR23 benchmarks it did not use; 160 classification + 64 regression tasks. The April 2026 extraction (1,091 columns) that the paper's external TabDPT row reads
realtabpfn25	binary_realtabpfn25	70	19 / 51	the OpenML datasets among Real-TabPFN-2.5's real fine-tuning data (its Kaggle datasets are not covered) vs. TabArena datasets it did not use; 55 classification + 15 regression
sap-rpt-oss	binary_t4_all	20,104	16,183 / 3,921	T4 tables, native task types (8,907 classification, 11,197 regression). SAP-RPT-1-OSS was pre-trained on every T4 table with more than 150 rows, which defines membership
sap-rpt-oss	binary_t4_regression_forcecls	4,594	3,717 / 877	the T4 regression tables that have a column with 2–10 distinct values, re-targeted to a random such column
sap-rpt-oss	binary_t4_regression_hybrid	11,193	9,134 / 2,059	all T4 regression tables: the forcecls draw where possible, otherwise the column with the fewest distinct values
sap-rpt-oss	binary_t4_regression_bin10	11,197	9,138 / 2,059	all T4 regression tables with the continuous target quantile-binned into 10 classes
sap-rpt-oss	binary_t4_regression_binswap	11,193	9,134 / 2,059	hybrid with the task-shuffle manipulation's swapped-in target column binned as well
nanotabpfn	nanotabpfn_all	100,000	50,000 / 50,000	the synthetic prior tables: classifier.pt's 50,000 training tables vs. the 50,000 held-out tables of the same prior. The April 2026 extraction that the paper's external NanoTabPFN row reads (stratified subsample of 20,000)
nanotabpfn	nanotabpfn_matched20k	20,000	10,000 / 10,000	stratified subset of nanotabpfn_all for which the blind also has a row (target/blind matched pair)

signals/sap-rpt-oss/sap_fullgrid_signals_sap-rpt-oss.json is an earlier, JSON-format full-grid extraction on a small set of T4 classification tables, kept for provenance.

signals/tabdpt/grid_results/mia_grid_results_{default,seed42,seed123,seed456,tabpfn25}_2026071*.json are the five grid result files behind the paper's internal-audit TabDPT row (Table 2): the TabDPT default weights, the three re-trained seeds and the TabPFN-2.5 blind, 224 OpenML datasets each, one flat record of scalar signals per dataset (successful_results) plus the skipped datasets with their reason (failed_results). The audit code reads them from the $AUDIT_REPO root under these file names; cluster paths in the skip messages were replaced by <repo>.

Which files the paper used

Since 2026-10-15 main holds exactly the signal tables behind the paper's Tables 1 and 2, under their canonical paths:

• external rows (Table 1): tabdpt/binary_all_tabdpt + tabpfn25/binary_all_tabdpt and nanotabpfn/nanotabpfn_all + tabpfn25/nanotabpfn_all (the April 2026 extraction, 1,091 and 751 columns), sap-rpt-oss/binary_t4_all + binary_t4_regression_hybrid and realtabpfn25/binary_realtabpfn25, each with its tabpfn25/ blind;
• internal rows (Table 2): sap-rpt-oss/binary_t4_all + binary_t4_regression_forcecls, nanotabpfn/nanotabpfn_matched20k, realtabpfn25/binary_realtabpfn25, each with its blind, and tabdpt/grid_results/*.json.

Earlier revisions and the two older branches carry superseded material: a July 2026 re-extraction of the TabDPT and NanoTabPFN pools with the 62 blind-degenerate seed_*/logit_*/temp_* columns dropped (it yields a different external TabDPT number and has no NanoTabPFN blind), a TabFM blind the paper does not use, and large per-row samples.parquet files. Do not use them for reproduction; they will be removed from the history.

# everything behind Tables 1 and 2
snapshot_download("SprintML/tfms", allow_patterns=["signals/*/*/datasets.parquet", "signals/tabdpt/grid_results/*.json"])

The code repository's exports/ file names map onto these paths as follows.

exports/ name in the code	path here
sap_binary_t4_all_datasets_corrected.parquet	signals/sap-rpt-oss/binary_t4_all/datasets.parquet
sap_t4_regression_{forcecls,hybrid,bin10,binswap}.parquet	signals/sap-rpt-oss/binary_t4_regression_{forcecls,hybrid,bin10,binswap}/datasets.parquet
tabpfn25_binary_t4_all_datasets_corrected.parquet, tabpfn25_t4_regression_*.parquet	signals/tabpfn25/binary_t4_all/…, signals/tabpfn25/binary_t4_regression_*/…
nanotabpfn_matched20k.parquet / tabpfn25_nano_matched20k.parquet	signals/nanotabpfn/nanotabpfn_matched20k/… / signals/tabpfn25/nanotabpfn_matched20k/…
mia_grid_results_{default,seed42,seed123,seed456,tabpfn25}_2026071*.json (repo root)	signals/tabdpt/grid_results/
realtabpfn25_binary_realtabpfn25.parquet / tabpfn25_binary_realtabpfn25.parquet	signals/realtabpfn25/binary_realtabpfn25/… / signals/tabpfn25/binary_realtabpfn25/…

Not in this repository: the OpenML / T4 source tables themselves (fetch them from OpenML and from mlfoundations/t4-full).

Intended use and limitations

These artefacts exist to audit tabular foundation models for training-data membership and to study what makes such audits succeed. The fingerprint tables are per-table derived statistics of model behaviour; they contain no feature values and no target values of the probed datasets. The T4-based manifests list table identifiers and column names of T4 tables, which is why the repository stays gated like T4 itself.

The NanoTabPFN models are research-scale (3.7 M to 116 M parameters) and are not meant as predictors. The TabDPT split models deliberately saw only half of each dataset's rows and should not be used as general-purpose TabDPT checkpoints.

Licenses

• NanoTabPFN weights and the signals/nanotabpfn/*, signals/tabdpt/* and signals/sap-rpt-oss/* fingerprint tables: Apache License 2.0, like the code and TFM-Playground.
• The signals/tabpfn25/* and signals/realtabpfn25/* tables are statistics of outputs of TabPFN-2.5 checkpoints, which Prior Labs distributes under the TabPFN-2.5 License v1.1 (non-commercial). Use them for non-commercial research only; they are not covered by the Apache-2.0 statement above.
• TabDPT re-trainings and split checkpoints: derived with the TabDPT-training code and subject to its license.
• The real-T4 manifests reference tables of the T4 corpus; its terms apply to the underlying data.

Citation

@article{wahdany2026dataset,
  title   = {Dataset Inference for Data Provenance and Privacy Auditing in Tabular Foundation Models},
  author  = {Wahdany, Dariush and Cresswell, Jesse C. and Guan, Naiqing and Ashari Ghomi, Atiyeh and Boenisch, Franziska and Dziedzic, Adam},
  year    = {2026}
}