🤖 machine learning

Statistically Indistinguishable, Operationally Distinct: A Formal Barrier for Tabular Foundation Models

This paper establishes a formal barrier for tabular foundation models by demonstrating that even with advanced reasoning capabilities, they cannot distinguish between legal and rule-violating database states if they lack access to the operational rules governing the data, as evidenced by their failure to pass the "Operational Turing Test" where only rule-derived audits achieve perfect accuracy.

Original authors: Tassilo Klein, Johannes Hoffart

Published 2026-06-30

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Tassilo Klein, Johannes Hoffart

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

The Big Idea: The "Magic Ledger" Problem

Imagine you have a bank ledger. It's a giant spreadsheet showing who has how much money, what transactions happened, and who owns what.

Now, imagine you give a super-smart AI (a "Tabular Foundation Model") a copy of this spreadsheet. You ask the AI: "Is this page of the ledger legal, or has someone tampered with it?"

The paper argues that the AI will fail. Even if the AI is the smartest in the world, if it only looks at the numbers on the page, it cannot tell the difference between a real page and a fake one that has been carefully altered to look real.

The paper calls this the "Operational Turing Test." It proves that without knowing the rules the bank uses to write the ledger, the AI is mathematically blind to certain types of cheating.

The Analogy: The "Perfectly Forged Receipt"

To understand why the AI fails, let's look at how the researchers created the "fake" data.

Imagine a receipt for a coffee shop.

Real Receipt: You buy 2 coffees at $5 each. You get a 10% discount. The total is $9.00.
Fake Receipt (The Corruption): Someone changes the math. They say you bought 2 coffees, but the total is $9.05. To hide this, they slightly lower the price of every other coffee sold in the shop that day by a tiny fraction of a penny.

The Result:

The Numbers Look the Same: If you look at the "Average Price" or "Total Revenue" for the whole day, the fake receipt is statistically identical to the real one. The "1-way" and "2-way" numbers (like averages and pairs of numbers) match perfectly.
The Logic is Broken: The math on this specific receipt is wrong. $5 +$ 5 minus 10% should be $9.00, not $9.05.

The AI's Dilemma:
The AI is like a detective who only sees the final numbers on the receipt. It sees the average price and the total revenue. Since the fake receipt matches the real statistics perfectly, the AI has no way to know it's a forgery. It has to guess, and it guesses correctly only 50% of the time (like flipping a coin).

The "Access Ladder": How High Can the AI Climb?

The researchers tested the AI at different levels of "access," like climbing a ladder:

Level 1: The "Blind" AI (Values-Only)
- What it sees: Just a list of numbers (averages, counts, standard deviations).
- Result: It fails completely. It can't tell the difference between real and fake. It guesses 50/50.
- Analogy: Trying to solve a puzzle by looking only at the colors of the pieces, not the picture they form.
Level 2: The "Relational" AI (Seeing the Connections)
- What it sees: It can see how tables connect (e.g., "This order belongs to Customer X"). It checks if the customer exists and if the order count makes sense.
- Result: It gets better at spotting some errors (like if a customer doesn't exist), but it still fails at spotting the math errors (the "Value-Transformation" logic).
- Analogy: The AI can see that the customer is real, but it still can't do the math to know if the discount was applied correctly.
Level 3: The "Rule-Reading" AI (The Oracle)
- What it sees: It doesn't just see the numbers; it sees the source code and the rules (e.g., "Total = Price × Quantity × (1 - Discount)"). It runs a check to re-calculate the math itself.
- Result: It gets 100% accuracy. It instantly spots the fake receipt because it can re-run the math and see the error.
- Analogy: This is the detective who has the original recipe book. They can taste the soup and say, "This is wrong because you used salt instead of sugar," even if the color looks right.

The Shocking Finding: Even "Super-Brains" Fail

The researchers took the most advanced AI models available (like GPT-5.5 and Kimi-K2.6) and gave them everything:

The spreadsheet data.
The database structure (schema).
The actual code that writes the rules.
The trigger scripts.

The Result: Even with all this information, the AI models still failed.

They couldn't reliably tell a legal state from an illegal one.
They often rejected perfectly legal states as "fake."
They couldn't write the correct SQL query to check the math, even when they had the rules in front of them.

Why? The paper suggests the problem isn't that the AI isn't "smart" enough or needs more data. The problem is identifiability. If the data looks statistically identical to the real thing (because the forger was clever), no amount of "reasoning" can fix it unless the AI is explicitly programmed to run the specific rule-checks.

The Conclusion: You Need the "Rulebook"

The paper concludes that for AI to work on real-world business data (like banking or sales), it cannot just "read" the data. It must be grounded in the operational rules.

Current AI: Looks at the numbers and guesses. (Fails).
Future AI: Needs to be connected to the actual code that defines the rules so it can execute a check. (Succeeds).

In short: You can't teach an AI to be a good auditor just by showing it a million spreadsheets. You have to give it the calculator and the rulebook so it can do the math itself. Without that, it's just guessing.

Technical Summary: Statistically Indistinguishable, Operationally Distinct

Problem Statement
The paper addresses a fundamental limitation in tabular foundation models: their inability to reason about data produced by running enterprise systems without access to the operational rules governing that data. While these models excel on single, self-contained tables, production tables are projections of complex systems where application code writes rows, declarative constraints restrict values, and procedural triggers enforce transitions. Consequently, the training data available to models often lacks the operational logic (rules, triggers, code) that generated the values. The authors posit that without access to this "operational grounding," models face a formal barrier where legal and illegal database states are statistically indistinguishable based on value distributions alone.

Methodology: The Operational Turing Test (OTT)
To make this barrier falsifiable, the authors construct the Operational Turing Test (OTT), a binary classification task distinguishing between "legal" and "rule-violating" database states.

Construction: The test utilizes a three-table order-to-cash schema (customers, orders, order items). It generates pairs of states where the "illegal" state violates a specific rule but preserves the 1-way and 2-way column-value marginals to within a total variation (TV) distance of $\tau < 0.02$ .
Corruption Types: Four families of operational rules are tested:
1. Relational Value Consistency: Breaking foreign key constraints (e.g., replacing IDs with unseen values).
2. Cardinality Consistency: Violating aggregate bounds (e.g., item counts per order) while preserving individual row values.
3. Value-Transformation Logic: Violating procedural formulas (e.g., $total = \sum line\_items \times (1 + tax)$ ) by adding offsets that cancel out across the column, leaving the histogram unchanged.
4. Value-State Transitions: Violating state transition rules (e.g., pending $\to$ shipped) while preserving the marginal distribution of status values.
Theoretical Bound: The authors invoke Le Cam's lemma to establish a theoretical lower bound on the Bayes error for any "values-only" classifier (one restricted to column-value marginals). If the TV distance between legal and illegal distributions is $\le \tau$ , the error is bounded by $\frac{1}{2} - \frac{\tau}{2}$ . With $\tau < 0.02$ , the minimum error is $\ge 0.49$ , meaning accuracy cannot exceed $\approx 0.50$ (chance).

Experimental Setup
The study evaluates models across an "access ladder" to determine what information is required to cross the barrier:

Values-Only Baselines: Models fed only the 35-dimensional summary of column statistics (mean, std, quartiles, etc.). Architectures include XGBoost, TabICL, and TabPFN.
Row-Level Access: Models given raw row data without rule context.
Relational Access: Models given features including joins, foreign key coverage, and group counts.
Operational Grounding: Models augmented with the scalar outputs of seven executable rule-derived audits (e.g., recomputing totals from line items to check consistency).
Frontier LLMs: Large Language Models (GPT-5.5, Kimi-K2.6) provided with the full schema, trigger source code, rule tables, and state files in the prompt, tested with and without SQL execution capabilities.

Key Results

Values-Only Failure: All values-only baselines (XGBoost, TabICL, TabPFN) achieved accuracy statistically equivalent to chance ( $\approx 0.50$ ). Pre-registered two one-sided tests (TOST) confirmed they failed to distinguish legal from illegal states ( $p < 0.002$ ). This holds even with increased training data (up to 5,000 pairs) and raw row-level access.
Relational Insufficiency: Relational models (HistGB, RDB-PFN) improved significantly, reaching 0.89 accuracy. They successfully detected foreign key breaks, cardinality violations, and state transition errors. However, they failed completely on value-transformation logic (recall $\le 0.02$ ), as connectivity alone cannot reconstruct executable formulas like tax or discount calculations.
Operational Grounding Success: A classifier augmented with the seven executable rule-derived audits achieved 1.00 accuracy, closing the gap entirely. This confirms that the barrier is not a lack of model capacity but a lack of access to the executable logic.
LLM Limitations: Frontier LLMs provided with full source artifacts (schema, code, rules) in the prompt failed the test. GPT-5.5 classified 0/50 legal states as LEGAL, and Kimi-K2.6 classified only 2/50. Even with high reasoning effort and SQL execution, LLMs could not reliably compile the source artifacts into deterministic legality checks, often misstating predicates or missing transformation checks.

Significance and Claims
The paper claims that the inability of tabular foundation models to reason about system-generated data without operational rules is an identifiability problem, not a capacity problem.

Formal Barrier: The authors establish that where statistical marginals are matched to a high degree of precision, no model lacking access to the governing rules can perform better than random chance.
Independence: This barrier is independent of model architecture, scale, or feature richness. Scaling laws cannot overcome the absence of operational grounding.
Implication for Progress: The authors argue that progress in tabular foundation models requires treating declarative and procedural rules as first-class inputs—logic the model can evaluate—rather than merely retrieved text. Current benchmarks (like TabArena) miss this failure mode; only operational benchmarks that test against the "access ladder" reveal the true limitations of current models.

The paper concludes that for data produced by running systems, operational verification (knowing which rule must be evaluated) is a prerequisite for trust, and current foundation models, even with full context, lack the mechanism to reliably perform this verification without explicit, executable rule derivation.