Dataset Inference for Data Provenance and Privacy Auditing in Tabular Foundation Models

Dariush Wahdany; Jesse Cresswell; Naiqing Guan; Atiyeh Ashari Ghomi; Franziska Boenisch; Adam Dziedzic

cs.LGOct 16, 2026

Dataset Inference for Data Provenance and Privacy Auditing in Tabular Foundation Models

Authors: Dariush Wahdany, Jesse Cresswell, Naiqing Guan, Atiyeh Ashari Ghomi, Franziska Boenisch, Adam Dziedzic

Organizations: CISPA Helmholtz Center for Information Security · Layer 6 AI

Abstract

Tabular foundation models (TFMs) are increasingly deployed through black-box APIs and trained on large collections of real-world tabular datasets. As this training paradigm becomes more widely adopted, private or proprietary datasets may be incorporated into pre-training corpora, yet there are currently no dedicated methods for determining whether a given tabular dataset was used to train a TFM. As a solution, we introduce the first dataset inference method for TFMs, aiming to infer whether a suspect dataset was part of a model's pre-training data. We systematically analyze a broad collection of candidate signals that can be observed from a black-box TFM via input manipulation and find that individual signals provide only weak evidence of training data membership. However, by combining multiple complementary signals, we can infer dataset membership for several state-of-the-art TFMs trained on real tabular data, achieving up to 0.99 ROCAUC dependent on the TFM. We then study factors that influence dataset identification, including pre-training data composition, model capacity, and the use of real vs. synthetic data. Our results show that our dataset inference method is a practical auditing tool for detecting privacy leakage and the use of proprietary datasets in TFMs.

Figures & tables

Panel of Figure 1 — Figure 1: Prediction with TFMs.

Figure 2: Classical inference signals are weak predictors. Per-dataset avg. loss does not clearly separate members and non-members of SAP-RPT-1-OSS.

Panel of Figure 3 — Figure 3: Overview of our DI procedure . The auditor queries the black-box TFM API with both known datasets $\{\mathcal{D}_{\text{known}}\}$ and a suspect dataset $\mathcal{D}_{\text{sus}}$ under structured input manipulations, yielding fingerprint vectors $\{\bar{S}(\mathcal{D}_{\text{known}})\}$ and $\bar{S}(\mathcal{D}_{\text{sus}})$ . (a) External audit: All $\mathcal{D}_{\text{known}}$ are non-members. We fit an Isolation Forest on $\{\bar{S}(\mathcal{D}_{\text{known}})\}$ and score $\bar{S}(\mathcal{D}_{\text{sus}})$ as a candidate anomaly indicating membership. (b) Internal audit: $\{\mathcal{D}_{\text{known}}\}$ has a mix of member and non-members. We train a binary membership classifier $g_{\varphi}$ on $\{\bar{S}(\mathcal{D}_{\text{known}})\}$ , and predict the membership label of $\bar{S}(\mathcal{D}_{\text{sus}})$ .

Target TFM $f_{\theta}$	Classifier $g_{\varphi}$	Target TFM	Blind TFM	Excess
SAP-RPT-1-OSS	LR	0.972 $\pm$ 0.001	0.714 $\pm$ 0.005	$+$ 0.258 $\pm$ 0.005
	XGB	0.992 $\pm$ 0.001	0.697 $\pm$ 0.004	$+$ 0.295 $\pm$ 0.005
	TabPFN-2.5	0.994 $\pm$ 0.000	0.689 $\pm$ 0.005	$+$ 0.306 $\pm$ 0.005
TabDPT	LR	0.675 $\pm$ 0.036	0.686 $\pm$ 0.035	$-$ 0.011 $\pm$ 0.044
	XGB	0.722 $\pm$ 0.034	0.662 $\pm$ 0.037	$+$ 0.060 $\pm$ 0.036
	TabPFN-2.5	0.695 $\pm$ 0.035	0.611 $\pm$ 0.038	$+$ 0.084 $\pm$ 0.034

Table 2: Internal-audit DI AUC by classifier. For each target TFM and classifier, we report the test ROCAUC of dataset-membership prediction; the Blind TFM column reports the same pipeline run against fingerprints from TabPFN-2.5. Excess of target over blind quantifies the actual DI signal, accounting for distributional differences between

\mathcal{D}_{\text{sus}}

and

\{\mathcal{D}_{\text{known}}\}

Fingerprint Feature	Manipulation	Signal	Reduction	Target	Blind
TaskSwap_Wasserstein_Range	M10	S14	R9	0.8942	0.0000
TaskSwap_KLD_Range	M10	S12	R9	0.7583	0.0159
TaskSwap_KLD_Mean	M10	S12	R7	0.5271	0.1173
Retrieval_KLD_Mean	M19	S12	R7	0.3491	0.0046
TaskSwap_Wasserstein_Mean	M10	S14	R7	0.3368	0.0001
Retrieval_KLD_Std	M19	S12	R8	0.2926	0.0076

Table 3: Fingerprint Feature Contributions. Mean absolute SHAP value of the top 10 features from

\bar{S}(\mathcal{D})

, computed for the SAP-RPT-1-OSS target TFM and TabPFN-2.5 blind TFM, with the XGB classifier. Larger values indicate that the feature contributes more to membership classification. Identifiers for signals, manipulations, and reductions reference Tables 4 , 5 , and 6 in Appendix C .

Appendix figures & tables9 assets

Supplementary material from the paper’s appendix.

Appendix

Signal Name	Type	Formula	Description
S1: Correct class confidence	C	$p(y):=p(y\mid X^{i}_{\text{qy}};\mathcal{D}_{\text{ctx}})$	Likelihood assigned to the correct class
S2: Max confidence	C	$\max_{y}p(y)$	Highest likelihood assigned to any label
S3: Prediction margin	C	$p(y_{(1)})-p(y_{(2)})$	Difference of highest two class likelihoods
S4: Accuracy	C	$\mathds{1}(\hat{y}^{i}=y^{i}_{\text{qy}})$	Correctness of predicted class
S5: Cross entropy	C	$-\sum_{k=1}^{K}y^{i}_{\text{qy}}\log{p}_{k}(y)$	Cross entropy loss
S6: Absolute error	R	$\|\hat{y}^{i}-y^{i}_{\text{qy}}\|$	Absolute error loss

Appendix

Table 4: Output signals for dataset inference on TFMs. C - classification tasks; R - Regression tasks.

\hat{y}^{i}

denotes the point prediction

\argmax_{y}p(y)

for query row

i

Manipulation Name	Type	Description	Parameters
M1: No manipulation	CR	Only split rows of $\mathcal{D}_{\text{sus}}$ into disjoint sets $(X_{\text{ctx}},y_{\text{ctx}})$ and $(X_{\text{qy}},y_{\text{qy}})$	Splitting fraction (applies to all below)
M2: Query = Context	CR	Repeat the context inputs $X_{\text{ctx}}$ as $X_{\text{qy}}$	-
M3: Query only	CR	Provide only $X_{\text{qy}}$ , with $\mathcal{D}_{\text{ctx}}=\varnothing$	-
M4: Row sampling	CR	Subsample the rows of $\mathcal{D}_{\text{ctx}}$	Fraction of rows sampled
M5: Row shuffling	CR	Randomly permute the rows of $\mathcal{D}_{\text{ctx}}$	Permutation
M6: Feature sampling	CR	Subsample the columns of $X_{\text{ctx}}$	Fraction of columns sampled

Appendix

Table 5: Input manipulations for dataset inference on TFMs and their parameters. C - classification tasks; R - Regression tasks

Type	Reduction	Formula	Captures
Default	R1: No Reduction	Signal is used directly as feature	Predictive power of signal directly
Ordered	R2: Slope	Regression coef. on (log-spaced) intensity	Rate of signal change as manipulation intensity increases
	R3: AUC	Normalised trapezoidal integral	Average signal value across manipulation intensity range
	R4: Gain	Final value minus initial value	Total signal change between highest and lowest intensity
	R5: Early	Value at 25% intensity, normalised by max	Signal response at low-intensity manipulation
	R6: Late gain	Final value minus second-to-last	End-of-curve flattening or runaway signal

Appendix

Table 6: Reductions vary the parameters of a manipulation to create a sequence of signals that are then summarised into a scalar entry of

\bar{S}(\mathcal{D})

. The applicable family depends on the structure of the manipulation’s parameters: ordered along an intensity axis, unordered , or based on prediction stability .

Panel of Figure 7 — Figure 7: Single- and multi-feature dataset inference on TabDPT. The per-dataset average loss (Left) and correct-class confidence (Middle) computed for member and non-member datasets of TabDPT ( Ma et al., 2025 ) ( $n{=}224$ datasets) do not clearly separate member and non-member datasets, as in Figure 2 . (Right) The internal auditing method used as in Figure 5 with many TFM-specific features achieves higher ROCAUC.

Fingerprint Feature	Manipulation	Signal	Reduction	Target	Blind
RowSampling_KLDClean_LateGain	M4	S12	R6	0.2203	0.0559
FeatureNoise_KLD_Early	M8	S12	R5	0.1710	0.0074
TruthSerum_Confidence_Early	M15	S1	R5	0.1573	0.0359
RowDuplication_ChiSquared_Early	M14	S10	R5	0.1523	0.0077
FeatureSample_KLD_AUC	M6	S12	R3	0.1504	0.0747
FeatureSample_KLD_Slope	M6	S12	R2	0.1427	0.0885

Appendix

Table 7: Fingerprint Feature Contributions. Mean absolute SHAP value of the top 10 features from

\bar{S}(\mathcal{D})

, computed for the TabDPT target TFM and TabPFN-2.5 blind TFM, with the XGB classifier. Larger values indicate that the feature contributes more to membership classification. Identifiers for signals, manipulations, and reductions reference Tables 4 , 5 , and 6 in Appendix C .

Variant	L/E/H/M	Prior tables	Time/epoch	Compute
default	6/192/6/768	50 000	0.55 s	44 s
data25k	6/192/6/768	25 000	0.54 s	43 s
data10k	6/192/6/768	10 000	0.52 s	42 s
data5k	6/192/6/768	5 000	0.52 s	42 s
arch_medium	8/384/8/1536	50 000	1.34 s	1.8 min
arch_large	12/768/12/3072	50 000	5.35 s	7.1 min

Appendix

Table 8: NanoTabPFN training cost. Single-GPU (NVIDIA H100) training time for the default checkpoint and all ablation variants used in the paper. Architecture is given as L / E / H / M (layers, embedding dim, attention heads, MLP hidden dim). All variants are trained for 80 epochs of 25 steps each at batch size 50 with AdamW (

\eta=10^{-4}

$\|\mathcal{D}_{\text{train}}\|$	eval $n$	top-1 AUC	multivariate AUC
50,000	100,000	0.505	$0.501\pm 0.003$
25,000	50,000	0.511	$0.506\pm 0.004$
10,000	20,000	0.516	$0.514\pm 0.005$
5,000	10,000	0.531	$0.523\pm 0.009$
2,000	4,000	0.530	$0.516\pm 0.019$
1,000	2,000	0.536	$0.541\pm 0.037$

Appendix

Table 9: NanoTabPFN training corpus size ablation. Dataset inference results for nanoTabPFN models trained on different sized corpora of prior-synthetic tables. For each row, the number of training steps and batch size is held constant, meaning that when the corpus is smaller, the model is exposed to each dataset more times. DI is run on a held-out synthetic eval set with equal numbers of member and non-member tables. Top-1 is the best single-features AUC; multivariate is logistic regression on the top-50 features.

Variant	L/E/H/M	params	top-1 AUC	multivariate AUC
Small (default)	6/192/6/768	3.7M	0.505	$0.501\pm 0.003$
Medium	8/384/8/1536	19.5M	0.506	$0.505\pm 0.003$
Large	12/768/12/3072	115.8M	0.505	$0.503\pm 0.004$

Appendix

Table 10: NanoTabPFN architecture size ablation. All variants are trained on the same 50 000 synthetic prior tables; only the parameter count differs. “L/E/H/M” denotes layers, embedding dimension, attention heads, and feed-forward dimension. DI evaluation is run on the same held-out 50 000 member / 50 000 non-member split as in Table 9 .

Training corpus	members	non-mem.	top-1 ROCAUC	multivariate ROCAUC
Real T4	9,321	3,725	0.811	$0.923\pm 0.006$
Synthetic, Gaussian copula	8,867	2,437	0.871	$0.897\pm 0.008$

Appendix

Table 11: NanoTabPFN training-corpus ablation. DI results on two nanoTabPFN models with the default architecture, trained on the real T4 corpus and on a Gaussian-copula synthetic copy of T4.

Training Data Attribution

Training data attribution identifies which examples, sources, or groups shape a model’s predictions, capabilities, and failures.

See all 81 papers

Privacy Vulnerabilities of Attention Layers in Tabular Foundation Models and Protection of High-Risk Queries
Jun 24, 2026Tânia Carvalho, Maxime CordyTabular Foundation Models Membership Inference Attacks
SnT, University of Luxembourg · Luxembourg
Efficient Provably Private Classification with a Tabular Foundation Model
Oct 7, 2026Talal Alrawajfeh, Cristiana Diaconu, Ossi Räisä +5Privacy-Preserving ML Tabular Foundation Models
Department of Computer Science, University of Helsinki, Helsinki, Finland · Department of Engineering, University of Cambridge, Cambridge, United Kingdom · CISPA Helmholtz Center for Information Security, Saarbrücken, Germany +1
TabPATE: Differentially Private Tabular In-Context Learning Without Public Data
Jun 30, 2026Dariush Wahdany, Matthew Jagielski, Jesse C. Cresswell +2Tabular Foundation Models Differential Privacy
CISPA · Anthropic · Layer 6 AI

Jun 24, 2026J/K move · Enter open · S save

Privacy Vulnerabilities of Attention Layers in Tabular Foundation Models and Protection of High-Risk Queries

Tânia Carvalho, Maxime Cordy

SnT, University of Luxembourg · Luxembourg

Tabular Foundation Models Membership Inference Attacks Privacy-Preserving ML Attention Mechanisms Tabular ICL

Open paper AskPDF arXiv

Tabular foundation models are commonly assumed to present limited privacy concerns as they are often pre-trained on large collections of synthetic data. However, these models leverage in-context learning, where sensitive records may be provided directly at inference time as labelled context examples. In this paper, we demonstrate that predictions generated via the attention mechanism leak sufficient information to enable effective Membership Inference Attacks (MIAs). To highlight this vulnerability, we propose AMIA (Attention-based Membership Inference Attack), a shadow-model-free attack that exploits the concentration of transformer attention patterns. Our results show that attention mechanisms reveal strong membership signals, which exceed classical confidence-based attacks, achieving an average gain of 7.7%, specially in low false-positive regimes. To mitigate this risk, we introduce an inference-time defence inspired by

k

-anonymity principles. This approach reduces the uniqueness of context-key representations without introducing random noise or retraining the model. By targeting only high-risk queries identified through AMIA scores, the defence substantially reduces membership leakage of this attack by an average of 50% and 25% against confidence-based attacks, while preserving predictive utility with only 3.9% performance degradation. Beyond showing that context examples are vulnerable, we further demonstrate that fine-tuning introduces an additional source of privacy risk. In particular, samples whose prediction confidence increases after fine-tuning become more susceptible to MIAs, indicating that fine-tuning can amplify memorisation and expose sensitive training information through confidence shifts.

Abstract

Training Data Attribution

Explore similar work

Privacy Vulnerabilities of Attention Layers in Tabular Foundation Models and Protection of High-Risk Queries

Efficient Provably Private Classification with a Tabular Foundation Model

TabPATE: Differentially Private Tabular In-Context Learning Without Public Data