Statistically Indistinguishable, Operationally Distinct: A Formal Barrier for Tabular Foundation Models

# A Formal Barrier for Tabular Foundation Models
Source: [https://arxiv.org/html/2606.29091](https://arxiv.org/html/2606.29091)
## Statistically Indistinguishable, Operationally Distinct: A Formal Barrier for Tabular Foundation Models

###### Abstract

Tabular foundation models cannot reason about data produced by running systems without access to the rules that govern them\. We make this statement falsifiable\. The*Operational Turing Test*\(OTT\) constructs pairs of legal and rule\-violating database states whose11\- and22\-way column\-value marginals match to a total variation of<0\.02<0\.02; Le Cam’s lemma then bounds any values\-only classifier at≥0\.49\\geq 0\.49Bayes error\. Three values\-only baselines \(XGBoost, TabICL, TabPFN\) hit the bound exactly \(accuracy0\.500\.50, pre\-registered two one\-sided tests \(TOST\)p<0\.002p<0\.002\), raw row\-level access does not help, exposing relational value consistency closes most of the gap, and only a classifier fed by seven executable rule\-derived audits reaches1\.001\.00classification accuracy\. In three matched100100\-state frontier large\-language\-model \(LLM\) runs, models given the schema, trigger source, rule tables, and state files classify at most2/502/50legal states as LEGAL; GPT\-5\.5 accepts0/500/50legal states even with higher reasoning effort and a Structured Query Language \(SQL\) executor\. The access\-ladder pattern also appears on a second schema with structurally distinct rule families \(banking ledger: cross\-row balance, cumulative aggregate\)\. The barrier is identifiability, not capacity: scale, data, and richer features cannot cross it without operational grounding\.111Code and data:[github\.com/SAP\-samples/operational\-turing\-test](https://github.com/SAP-samples/operational-turing-test)\.

tabular foundation models, operational grounding, impossibility result, benchmark

\\icmlshowauthorstrue

storedvaluesjoinsgroupsrulesauditsfulloracleConceptual ladderctrlRDBSQLoracle\.50\.751\.00\.50\.891\.001\.00AccuracyEmpirical evidenceFigure 1:Access ladder and empirical validation\.Left: conceptual access levels\. Right: representative evidence; the dashed line is chance\. Leakage controls stay at chance; relational baselines \(HistGB/RDB\-PFN,Wanget al\.,[2026](https://arxiv.org/html/2606.29091#bib.bib16)\) reach0\.890\.89but miss derivation; SQL audits derived from schema and code match the oracle\.## 1Introduction

Tabular foundation models have made rapid progress on benchmarks of single, self\-contained tables\. Production tables are different: application code writes rows, declarative constraints restrict values, procedural triggers enforce transitions, and business rules decide which states are legal\. The training data available to models is therefore a projection of a running system: stored values remain, but much of the operational logic and procedure that generated them is left behind\.

This decoupling is severe in enterprise systems\. Large schemas expose thousands of tables with technical identifiers whose semantics live outside the data definition language \(DDL\); column names such asBUKRS,MATNR, orVBAK\-ERDATare typical enough that automated column\-name expansion is now studied as a pre\-condition for working with such tables\(Zhanget al\.,[2023](https://arxiv.org/html/2606.29091#bib.bib18)\)\. Recent cross\-table\(Kimet al\.,[2024](https://arxiv.org/html/2606.29091#bib.bib11)\), relational\(Feyet al\.,[2024](https://arxiv.org/html/2606.29091#bib.bib9); Robinsonet al\.,[2024](https://arxiv.org/html/2606.29091#bib.bib10); Wanget al\.,[2025](https://arxiv.org/html/2606.29091#bib.bib12)\), and database\-native\(Wehrsteinet al\.,[2025](https://arxiv.org/html/2606.29091#bib.bib13)\)foundation models make the relational layer ingestible\. The operational layer above it is less developed: value domains and referential integrity in schema text, plus procedural rules in triggers, validation scripts, and application code\. This paper makes the resulting indistinguishability barrier falsifiable and tests whether source artifacts in a frontier LLM prompt close it\.

#### Reading the ladder\.

[Figure1](https://arxiv.org/html/2606.29091#S0.F1)is not a leaderboard over model classes\. The gray bar is a leakage\-control sanity check: values\-only models and raw\-row variants should remain at chance when matched states preserve observable value statistics\. Relational features add joins, key coverage, and group counts; rule\-derived audits instead recompute legality predicates such as stored totals from line items, discounts, and taxes\.

#### The Operational Turing Test\.

We treat “operational context” concretely as the set of rules that decide whether a database state is legal: value\-domain constraints, value\-transformation logic, relational value consistency \(referential integrity\), and value\-state\-transition constraints\. The*Operational Turing Test*\(OTT\) generalizes this idea to tests where statistical observations are insufficient without operational rules\(Klein and Hoffart,[2026](https://arxiv.org/html/2606.29091#bib.bib15)\); here we instantiate it as a binary classification task on pairs of \(legal, illegal\) states where the rule\-violating corruption preserves11\- and22\-way column\-value marginals to within total variation distance \(TV\)τ=0\.02\\tau=0\.02\. Le Cam’s lemma gives a Bayes error bound of12−τ2≥0\.49\\tfrac\{1\}\{2\}\-\\tfrac\{\\tau\}\{2\}\\geq 0\.49for any classifier whose input is restricted to such statistics \([Proposition1](https://arxiv.org/html/2606.29091#Thmproposition1)\)\. Values\-only baselines from two broad architectural families, gradient\-boosted trees and transformers, all reach accuracy statistically equivalent to chance under a pre\-registered two one\-sided tests \(TOST\) procedure for equivalence222The TOST equivalence marginδ=0\.02\\delta=0\.02and seed assignment were registered before evaluation\.\(Lakens,[2017](https://arxiv.org/html/2606.29091#bib.bib3),α=0\.05\\alpha=0\.05\); seven executable rule\-derived audits close the gap to1\.001\.00classification accuracy\.

#### Findings\.

1. 1\.Operational grounding isinformation\-theoretically necessaryunder marginal matching \([Proposition1](https://arxiv.org/html/2606.29091#Thmproposition1)\)\.
2. 2\.The barrier isarchitecture\-, scale\-, and representation\-independent: three baselines and raw rows all hit the Le Cam bound \([Section4](https://arxiv.org/html/2606.29091#S4)\)\.
3. 3\.Exposing relational value consistency closes most of the gap butcannot recover value\-transformation logic\([Table1](https://arxiv.org/html/2606.29091#S4.T1)\)\.
4. 4\.Frontier reasoning models with full source artifacts in\-promptfail the test\([Section5](https://arxiv.org/html/2606.29091#S5)\)\.

## 2The Operational Turing Test

#### Setting\.

Real\-world tables do not stand alone; they are rows written by a running system, and the rules governing that system come in two kinds\.*Declarative rules*\(types, value\-domain constraints, and relational value consistency such as referential integrity\) are written into the schema text\.*Procedural rules*\(value\-state\-transition constraints, value\-transformation logic, and per\-aggregate cardinality bounds\) live in trigger and application code\. We write the union of both as a rule setΠ\\Pi\. A dataset stripped ofΠ\\Piretains the values but loses much of the operational logic and procedure that produced them\.

Writeϕk​\(S\)\\phi\_\{k\}\(S\)for the vector of allkk\-way column\-value marginals of database stateSS, and call a classifier*values\-only*if its input isϕk​\(S\)\\phi\_\{k\}\(S\)for some finitekk\(so it has no access to queries that readΠ\\Pi\)\. LetPlegalP\_\{\\text\{legal\}\}andPillegalP\_\{\\text\{illegal\}\}be the distributions over states from a legal data\-generating process and from a corruption that violates a single rule ofΠ\\Piwhile preserving values elsewhere\.

###### Proposition 1\(Necessity of operational grounding\)\.

If‖ϕk​\(Plegal\)−ϕk​\(Pillegal\)‖TV≤τ\\\|\\phi\_\{k\}\(P\_\{\\text\{legal\}\}\)\-\\phi\_\{k\}\(P\_\{\\text\{illegal\}\}\)\\\|\_\{\\mathrm\{TV\}\}\\leq\\tau, then any values\-only classifier has Bayes error≥12−τ2\\geq\\tfrac\{1\}\{2\}\-\\tfrac\{\\tau\}\{2\}\.

This is Le Cam’s lemma\(Le Cam,[1973](https://arxiv.org/html/2606.29091#bib.bib1); Tsybakov,[2009](https://arxiv.org/html/2606.29091#bib.bib2)\): two distributions withinτ\\tauin total variation cannot be distinguished better than12−τ2\\tfrac\{1\}\{2\}\-\\tfrac\{\\tau\}\{2\}Bayes error\. Our construction enforcesτ<0\.02\\tau<0\.02\([Section3](https://arxiv.org/html/2606.29091#S3)\), giving≥0\.49\\geq 0\.49\. The bound is an*existence/impossibility*result\. The failure is identifiability\-based, not capacity\-based, so larger models, more data, and richer features cannot escape it; we verify the last empirically with row\-level access \([Section4](https://arxiv.org/html/2606.29091#S4)\)\. We do not claim every tabular foundation model fails on every task, only that where this condition holds, rule\-guided queries are necessary\.

## 3Construction

#### Schema\.

We instantiate the test on a three\-table order\-to\-cash schema \(customers,orders,order\_items\), the structural core of a standard enterprise sales process\. The schema is deliberately minimal for transparency; the full schema definition together with the trigger and application\-code rules is in[SectionsA\.1](https://arxiv.org/html/2606.29091#A1.SS1),[A\.2](https://arxiv.org/html/2606.29091#A1.SS2)and[A\.3](https://arxiv.org/html/2606.29091#A1.SS3), and the construction generalises to any schema whose rules can be stated as executable code\. Real\-world linked business\-table corpora at scale are already available\(Kleinet al\.,[2024](https://arxiv.org/html/2606.29091#bib.bib8)\)\.

#### Rules and corruptions\.

Four families of operational rules govern legal states; only some live in the schema text\. For each we give location, instance, and a single\-rule corruption that preserves every11\- and22\-way column\-value marginal toτ<0\.02\\tau<0\.02:

- \(i\)*Relational value consistency*\(declarative, schema\)\.orders\.customer\_idmust occur incustomers\.id\.fk\_breakreplaces∼5%\{\\sim\}5\\%of values with unseen IDs\. Surrogate key symbols are excluded fromϕk\\phi\_\{k\}to make the values\-only view invariant to arbitrary ID renamings; checking whether a child key occurs in the parent table is instead an executable relational audit, soTV=0\\mathrm\{TV\}=0for the values\-only view\.
- \(ii\)*Cardinality consistency*\(mixed; per\-rowquantity\>0\>0in schema, per\-aggregate bounds in app code\)\.≤20\\leq 20items per order,≤3\\leq 3open orders per customer\.cardinality\_breakrelocates items between same\-customer orders, leavingquantityandunit\_priceuntouched; order totals are recomputed to remain consistent with the relocated items, so the value\-transformation logic continues to hold\.
- \(iii\)*Value\-transformation logic*\(procedural, app code\)\.line\_total=qty⋅unit\_price⋅\(1−discount​\(tier,qty\)\)\\texttt\{line\\\_total\}=\\texttt\{qty\}\\cdot\\texttt\{unit\\\_price\}\\cdot\(1\-\\texttt\{discount\}\(\\texttt\{tier\},\\texttt\{qty\}\)\)andorder\.total=\(∑line\_total\)⋅\(1\+tax​\(country\)\)\\texttt\{order\.total\}=\(\\sum\\texttt\{line\\\_total\}\)\\cdot\(1\+\\texttt\{tax\}\(\\texttt\{country\}\)\)\.derivation\_breakadds small offsets toorders\.totalthat cancel out across orders \(∼0\.1%\{\\sim\}0\.1\\%of column mean, summing to zero\), so the column histogram is essentially unchanged \(TV≈0\.001\\mathrm\{TV\}\\approx 0\.001–0\.0030\.003\) but the totals no longer match the formula\.
- \(iv\)*Value\-state transition*\(procedural, trigger code;[SectionA\.2](https://arxiv.org/html/2606.29091#A1.SS2)\)\.\(prev\_status,status\)\(\\texttt\{prev\\\_status\},\\texttt\{status\}\)must lie in a four\-element allowed set \(e\.g\.pending→\\toshipped\)\.transition\_breakswapsstatusbetween onedeliveredand one initialpendingorder; the11\-way marginal ofstatusis preserved exactly\.

All four corruptions pass a permutation\-null check \(p=1\.000p=1\.000\); the corruption strategies are summarized in[SectionA\.4](https://arxiv.org/html/2606.29091#A1.SS4)\.

#### Features\.

The*values\-only*feature vector is a3535\-dimensional summary of column\-level statistics: mean, standard deviation, quartiles, entropy, mode frequency, and two pre\-specified cross\-column correlations\. By design it excludes any group\-size statistic, verified invariant under permutation oforder\_id\(max difference=0=0\)\. The*operationally\-grounded*classifier augments this vector with the scalar outputs of seven executable rule\-derived audits \(listed in full in[SectionA\.5](https://arxiv.org/html/2606.29091#A1.SS5)\): orphan\-FK counts \(two\), cardinality\-violation counts \(two\), maximum absolute residual of the line\-total and order\-total value transformations \(two\), and illegal\-transition count\. For value\-transformation logic, the audit does not read a hidden violation label: it recomputes expected line and order totals from quantities, prices, discounts, and taxes, then compares them with the stored totals\. Each audit is a single SQL query against the schema together with the trigger or application code; a model without access toΠ\\Picannot construct it\.

#### Values\-only sanity baselines and scale\.

We test three values\-only baselines across two broad architectures: gradient\-boosted trees, represented by XGBoost\(Chen and Guestrin,[2016](https://arxiv.org/html/2606.29091#bib.bib4)\), and transformer\-based tabular models, represented by TabICL\(Quet al\.,[2025](https://arxiv.org/html/2606.29091#bib.bib6)\)and TabPFN v1\(Hollmannet al\.,[2023](https://arxiv.org/html/2606.29091#bib.bib5)\)\. These baselines check for leakage, finite\-sample artifacts, and representation effects within the values\-only regime; under[Proposition1](https://arxiv.org/html/2606.29091#Thmproposition1)they are not expected to solve the task\. Improvements within that regime \(TabPFN’s Nature release\(Hollmannet al\.,[2025a](https://arxiv.org/html/2606.29091#bib.bib20)\), TabPFN\-2\.5\(Hollmannet al\.,[2025b](https://arxiv.org/html/2606.29091#bib.bib21)\)\) cannot escape it; we use v1 because the failure mode is information\-theoretic, not capacity\-bound\. An operationally\-grounded XGBoost uses the same3535\-dim vector augmented with the outputs of seven executable audits; an oracle executes the rules directly and serves as an upper bound\. Training:1,0001\{,\}000labeled \(legal, illegal\) pairs per seed; testing:500500held\-out pairs;55seeds;200200customers per state\.

## 4Results

Findings\.•Architecture\-independent failure: XGBoost, TabICL, and TabPFN all at chance under TOST \(p<0\.002p<0\.002\)\.•Representation\-independent failure: row\-level access also at0\.500\.50on all four violations\.•Relational value consistency is insufficient: tree and PFN models with relational features miss value\-transformation logic at recall≤0\.02\\leq 0\.02\.•Executable rule\-derived audits close the gap: operationally\-grounded and oracle reach1\.001\.00\.•LLMs given the source artifacts: matched100100\-state runs predict at most2/502/50legal states as LEGAL\.

#### Chance across architectures\.

All three values\-only models are statistically equivalent to chance within±2\\pm 2pp under a pre\-registered TOST equivalence test \(Lakens,[2017](https://arxiv.org/html/2606.29091#bib.bib3),α=0\.05\\alpha=0\.05\): XGBoost0\.5014\\mathbf\{0\.5014\}\(p=0\.0018p=0\.0018\), TabICL0\.5006\\mathbf\{0\.5006\}, TabPFN0\.5012\\mathbf\{0\.5012\}\(bothp<10−4p<10^\{\-4\}\); see[Figure1](https://arxiv.org/html/2606.29091#S0.F1)\. The operationally\-grounded XGBoost reaches1\.00\\mathbf\{1\.00\}and the oracle1\.001\.00\. Per\-violation recalls for the values\-only models are consistent with random guessing, and the errors of the two architecturally most distant baselines \(XGBoost, TabICL\) are essentially uncorrelated \(Pearsonφ=−0\.076\\varphi=\-0\.076\), ruling out a shared exploited signal\. TabICL further outputsP​\(legal\)=0\.5001±0\.0029P\(\\text\{legal\}\)=0\.5001\\pm 0\.0029on*every*test instance: maximal epistemic uncertainty\(Hüllermeier and Waegeman,[2021](https://arxiv.org/html/2606.29091#bib.bib7); Meloet al\.,[2026](https://arxiv.org/html/2606.29091#bib.bib17)\)in response to an information\-theoretic void, rather than guessing\.

#### Scale and representation do not help\.

Values\-only accuracy isflat at0\.50\\mathbf\{0\.50\}from5050to5,0005\{,\}000training pairs \(the operationally\-grounded model saturates near1\.001\.00from just5050\), consistent with[Proposition1](https://arxiv.org/html/2606.29091#Thmproposition1)being information\-theoretic, not statistical\. Raw row\-level access fares no better: TabICL onordersrows \(per\-row predictions, majority vote\) reaches0\.50\\mathbf\{0\.50\}on all four violations, including the within\-rowtransition\_break\. Without rule context to direct attention, raw rows provide the data but not the query\.

#### Relational value consistency helps but does not close the gap\.

A tree with relational features \(cross\-table joins, FK coverage, per\-group degrees, and the within\-row\(prev\_status,status\)\(\\texttt\{prev\\\_status\},\\texttt\{status\}\)value pair\) reaches0\.89\\mathbf\{0\.89\}\(HistGB,33seeds\), recovering FK, cardinality, and value\-state transitions at recall1\.001\.00but missing value\-transformation logic entirely \([Table1](https://arxiv.org/html/2606.29091#S4.T1)\)\. Value\-state transition is informative here: although the legal transition set is encoded only in trigger code, an illegal pair never appears in the legal training states, so a single occurrence in a test state is enough for a tree to flag once the\(prev\_status,status\)\(\\texttt\{prev\\\_status\},\\texttt\{status\}\)pair is exposed as a feature column\. The3535\-dim values\-only vector excludes that pair, which is why the gap between values\-only and relational is mostly the addition of within\-table two\-column value\-pair features, not anything cross\-table\. A relational PFN\(Wanget al\.,[2026](https://arxiv.org/html/2606.29091#bib.bib16)\)reproduces the same pattern\. What no relational tier recovers is*value\-transformation logic*: tax and discount formulas cannot be reconstructed from connectivity\. Probabilistic relational models\(Hilprechtet al\.,[2020](https://arxiv.org/html/2606.29091#bib.bib14)\)capture statistical structure but not the executable formulas that produced it; that residual gap is closed only by reading the rule code\.

Table 1:Per\-violation recall across the access ladder\.Relational features perfectly recover FK, cardinality, and value\-state\-transition violations, but*neither*relational baseline recovers value\-transformation logic\. Executable rule\-derived audits close the remaining gap\.
#### Alternative explanations ruled out\.

*Weak classifier?*Three architectures across distinct inductive biases fail identically\.*Aggregate features unfair?*Row\-level access also at0\.500\.50on all four violations\.*Just need relational structure?*Tree and PFN models with full relational features still miss value\-transformation logic \(recall≤0\.02\\leq 0\.02\)\.*Training artifact?*Flat scaling over two orders of magnitude\.*Feature leakage?*Values\-only vector invariant toorder\_idpermutation\.*Near\-zero mutual information exploited stochastically?*The observed feature\-label mutual information sits at the bottom of a label\-shuffled null distribution \(z=−1\.86z=\-1\.86, pooledp=0\.999p=0\.999\), so even the trace amount that exists is no larger than chance\.

## 5LLMs With the Rule Source in the Prompt

A natural objection is that frontier reasoning models, given the schema and rule code, can read and execute the rules\. We tested this directly, and it does not hold here\. Kimi\-K2\.6\(Moonshot AI Team,[2026](https://arxiv.org/html/2606.29091#bib.bib23)\)and GPT\-5\.5\(OpenAI,[2026](https://arxiv.org/html/2606.29091#bib.bib24)\)each received the schema, trigger source, rule tables, and state files in one prompt\. In[Table2](https://arxiv.org/html/2606.29091#S5.T2), all rows use the same100100\-state evaluation set \(5050legal,5050illegal\), making the key diagnostic comparable: how often a truly legal state is classified as LEGAL\.

Table 2:Frontier reasoning models with full source artifacts\.Overall accuracy is secondary because the dominant failure mode is asymmetric: models often detect illegal states while rejecting legal ones\. The diagnostic count is therefore LEGAL predictions on truly legal states\. Kimi\-K2\.6 produced EMPTY responses on14/10014/100states, including8/508/50legal states\.False positives concentrate on a small set of violation types\. GPT\-5\.5 at high reasoning effort marks every legal state astransition\_break; Kimi\-K2\.6 accepts only2/502/50legal states and otherwise emits a violation label or EMPTY response\. This is not a claim that LLMs are useless in an operational harness\. Rather, LLMs*on their own*, even with source artifacts in context, do not reliably compile those artifacts into the finite checks that decide legality\.

The follow\-ups rule out simple resource explanations\. Kimi\-K2\.6 has an additional output\-cap failure mode \(14/10014/100EMPTY responses, including88legal states\), but among non\-empty legal responses it still accepts only2/422/42legal states; a higher\-budget diagnostic accepts only1/251/25\. GPT\-5\.5 has no EMPTY responses; at high reasoning effort it labels every illegal state correctly, with41/5041/50correct violation types, yet still classifies0/500/50legal states as LEGAL\. In the SQL\-executor variant, the model can run queries it writes, but the audit is still specified ad hoc by the model rather than compiled from the rules\. It often queries relevant tables and columns, but the generated checks are partial or mis\-specified: the model misstates the legality predicate \(for example the initial\-state convention forprev\_status\) and misses value\-transformation checks \(0/170/17\)\. The failure is therefore specification, not arithmetic or SQL execution\. A harness that compiles schema, trigger code, and rule tables into deterministic audits is exactly the operational grounding hypothesis; those audits over the same artifacts reach1\.001\.00\.

## 6Discussion & Conclusion

Operational grounding is required in the setting studied here\. For data produced by a running system, there exist operationally realistic instances on which no model without executable rule logic can do better than random chance, whether it sees aggregate features or raw rows\. The failure is identifiability\-based: scaling cannot resolve it, and the binding constraint is the absence of executable logic, not the choice of representation\. Single\-table benchmarks like TabArena\(Ericksonet al\.,[2025](https://arxiv.org/html/2606.29091#bib.bib22)\)miss this failure mode; relational benchmarks \(RelBench,Robinsonet al\.,[2024](https://arxiv.org/html/2606.29091#bib.bib10)\) expose part of it; only operational benchmarks expose all of it\. Progress therefore means treating declarative and procedural rules as first\-class inputs: not as retrieved text, but as logic the model can evaluate\(Meta FAIR CodeGen Team,[2025](https://arxiv.org/html/2606.29091#bib.bib19)\)\. For deployed agents, the relevant capability is not only table prediction but operational verification: knowing which rule must be evaluated before a state can be trusted\.

#### Limitations\.

The construction uses synthetic database states so that legality, corruption type, and marginal matching are controlled; the banking replication \(values\-only0\.500\.50, executable audits1\.001\.00\) shows the pattern beyond the order\-to\-cash schema, but full real\-world generalization remains open\. The TV thresholdτ=0\.02\\tau=0\.02and TOST marginδ=0\.02\\delta=0\.02are pragmatic choices rather than constants of nature\. The LLM pilot covers two frontier models at one snapshot, so it should be read as a stress test of current prompt\-based operational reasoning, not as a permanent claim about those model families\. Finally, the executable rule\-derived audits are an oracle for missing access: their success does not claim that any deployed system already exposes complete, executable operational rules to a model\.

## References

- T\. Chen and C\. Guestrin \(2016\)XGBoost: a scalable tree boosting system\.InProceedings of the 22nd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining,pp\. 785–794\.Cited by:[§3](https://arxiv.org/html/2606.29091#S3.SS0.SSS0.Px4.p1.5)\.
- N\. Erickson, L\. Purucker, A\. Tschalzev, D\. Holzmüller, P\. Mutalik Desai, D\. Salinas, and F\. Hutter \(2025\)TabArena: a living benchmark for machine learning on tabular data\.InAdvances in Neural Information Processing Systems \(NeurIPS\) Datasets and Benchmarks Track,Cited by:[§6](https://arxiv.org/html/2606.29091#S6.p1.1)\.
- M\. Fey, W\. Hu, K\. Huang, J\. E\. Lenssen, R\. Ranjan, J\. Robinson, R\. Ying, J\. You, and J\. Leskovec \(2024\)Position: relational deep learning – graph representation learning on relational databases\.InProceedings of the 41st International Conference on Machine Learning \(ICML\),pp\. 13592–13607\.Cited by:[§1](https://arxiv.org/html/2606.29091#S1.p2.1)\.
- B\. Hilprecht, A\. Schmidt, M\. Kulessa, A\. Molina, K\. Kersting, and C\. Binnig \(2020\)DeepDB: learn from data, not from queries\!\.Proceedings of the VLDB Endowment13\(7\),pp\. 992–1005\.Cited by:[§4](https://arxiv.org/html/2606.29091#S4.SS0.SSS0.Px3.p1.6)\.
- N\. Hollmann, S\. Müller, K\. Eggensperger, and F\. Hutter \(2023\)TabPFN: a transformer that solves small tabular classification problems in a second\.InInternational Conference on Learning Representations \(ICLR\),Cited by:[§3](https://arxiv.org/html/2606.29091#S3.SS0.SSS0.Px4.p1.5)\.
- N\. Hollmann, S\. Müller, K\. Eggensperger, and F\. Hutter \(2025a\)Accurate predictions on small data with a tabular foundation model\.Nature\.External Links:[Document](https://dx.doi.org/10.1038/s41586-024-08343-z)Cited by:[§3](https://arxiv.org/html/2606.29091#S3.SS0.SSS0.Px4.p1.5)\.
- N\. Hollmann, S\. Müller, F\. Hutter, L\. Purucker, A\. Krishnakumar, M\. Körfer, S\. B\. Hoo, and R\. T\. Schirrmeister \(2025b\)TabPFN\-2\.5: advancing the state of the art in tabular foundation models\.arXiv preprint arXiv:2511\.08667\.Cited by:[§3](https://arxiv.org/html/2606.29091#S3.SS0.SSS0.Px4.p1.5)\.
- E\. Hüllermeier and W\. Waegeman \(2021\)Aleatoric and epistemic uncertainty in machine learning: an introduction to concepts and methods\.Machine Learning110\(3\),pp\. 457–506\.Cited by:[§4](https://arxiv.org/html/2606.29091#S4.SS0.SSS0.Px1.p1.11)\.
- M\. J\. Kim, L\. Grinsztajn, and G\. Varoquaux \(2024\)CARTE: pretraining and transfer for tabular learning\.InInternational Conference on Machine Learning \(ICML\),Cited by:[§1](https://arxiv.org/html/2606.29091#S1.p2.1)\.
- T\. Klein, C\. Biehl, M\. Costa, A\. Sres, J\. Kolk, and J\. Hoffart \(2024\)SALT: sales autocompletion linked business tables dataset\.InNeurIPS 2024 Third Table Representation Learning Workshop,External Links:[Link](https://openreview.net/forum?id=UZbELpkWIr)Cited by:[§3](https://arxiv.org/html/2606.29091#S3.SS0.SSS0.Px1.p1.1)\.
- T\. Klein and J\. Hoffart \(2026\)Position: foundation models for tabular data within systemic contexts need grounding\.External Links:2505\.19825,[Link](https://arxiv.org/abs/2505.19825)Cited by:[§1](https://arxiv.org/html/2606.29091#S1.SS0.SSS0.Px2.p1.6)\.
- D\. Lakens \(2017\)Equivalence tests: a practical primer for t\-tests, correlations, and meta\-analyses\.Social Psychological and Personality Science8\(4\),pp\. 355–362\.Cited by:[§1](https://arxiv.org/html/2606.29091#S1.SS0.SSS0.Px2.p1.6),[§4](https://arxiv.org/html/2606.29091#S4.SS0.SSS0.Px1.p1.11)\.
- L\. Le Cam \(1973\)Convergence of estimates under dimensionality restrictions\.The Annals of Statistics1\(1\),pp\. 38–53\.Cited by:[§2](https://arxiv.org/html/2606.29091#S2.SS0.SSS0.Px1.p3.4)\.
- S\. Melo, G\. Varoquaux, and M\. Le Morvan \(2026\)Epistemic uncertainty quantification to improve decisions from black\-box models\.InInternational Conference on Learning Representations \(ICLR\),Cited by:[§4](https://arxiv.org/html/2606.29091#S4.SS0.SSS0.Px1.p1.11)\.
- Meta FAIR CodeGen Team \(2025\)CWM: an open\-weights LLM for research on code generation with world models\.External Links:2510\.02387Cited by:[§6](https://arxiv.org/html/2606.29091#S6.p1.1)\.
- Moonshot AI Team \(2026\)Kimi K2\.6: advancing open\-source coding and agentic intelligence\.Note:[https://www\.kimi\.com/blog/kimi\-k2\-6](https://www.kimi.com/blog/kimi-k2-6)Technical blog postCited by:[§5](https://arxiv.org/html/2606.29091#S5.p1.3)\.
- OpenAI \(2026\)Introducing GPT\-5\.5\.Note:[https://openai\.com/index/introducing\-gpt\-5\-5/](https://openai.com/index/introducing-gpt-5-5/)Model announcementCited by:[§5](https://arxiv.org/html/2606.29091#S5.p1.3)\.
- J\. Qu, D\. Holzmüller, G\. Varoquaux, and M\. Le Morvan \(2025\)TabICL: a tabular foundation model for in\-context learning on large data\.InInternational Conference on Machine Learning \(ICML\),Cited by:[§3](https://arxiv.org/html/2606.29091#S3.SS0.SSS0.Px4.p1.5)\.
- J\. Robinson, R\. Ranjan, W\. Hu, K\. Huang, J\. Han, A\. Dobles, M\. Fey, J\. E\. Lenssen, Y\. Yuan, Z\. Zhang, X\. He, and J\. Leskovec \(2024\)RelBench: a benchmark for deep learning on relational databases\.External Links:2407\.20060Cited by:[§1](https://arxiv.org/html/2606.29091#S1.p2.1),[§6](https://arxiv.org/html/2606.29091#S6.p1.1)\.
- A\. B\. Tsybakov \(2009\)Introduction to nonparametric estimation\.Springer Series in Statistics,Springer\.Cited by:[§2](https://arxiv.org/html/2606.29091#S2.SS0.SSS0.Px1.p3.4)\.
- Y\. Wang, X\. Wang, Q\. Gan, M\. Wang, Q\. Yang, D\. Wipf, and M\. Zhang \(2025\)Griffin: towards a graph\-centric relational database foundation model\.InInternational Conference on Machine Learning \(ICML\),Cited by:[§1](https://arxiv.org/html/2606.29091#S1.p2.1)\.
- Y\. Wang, J\. You, C\. Shi, and M\. Zhang \(2026\)Relational in\-context learning via synthetic pre\-training with structural prior\.arXiv preprint arXiv:2603\.03805\.Cited by:[Figure 1](https://arxiv.org/html/2606.29091#S0.F1),[Figure 1](https://arxiv.org/html/2606.29091#S0.F1.2.1.1),[§4](https://arxiv.org/html/2606.29091#S4.SS0.SSS0.Px3.p1.6)\.
- J\. Wehrstein, C\. Binnig, F\. Özcan, S\. Vasudevan, Y\. Gan, and Y\. Wang \(2025\)Towards foundation database models\.InConference on Innovative Data Systems Research \(CIDR\),Cited by:[§1](https://arxiv.org/html/2606.29091#S1.p2.1)\.
- J\. Zhang, Z\. Shen, B\. Srinivasan, S\. Wang, H\. Rangwala, and G\. Karypis \(2023\)NameGuess: column name expansion for tabular data\.InProceedings of the 2023 Conference on Empirical Methods in Natural Language Processing \(EMNLP\),pp\. 13276–13290\.Cited by:[§1](https://arxiv.org/html/2606.29091#S1.p2.1)\.

## Appendix ASchema and Example Data

This appendix exhibits the schema definition, complementary rule code, executable rule setΠ\\Pi, and corruption strategies\. The construction is fully reproducible; code is released at[github\.com/SAP\-samples/operational\-turing\-test](https://github.com/SAP-samples/operational-turing-test)\.[Figure2](https://arxiv.org/html/2606.29091#A1.F2)visualizes the relational structure and the operational rules layered on top of it\.

customersPKidcountrytiersignup\_date
ordersPKidFKcustomer\_idstatusprev\_statusorder\_datetotal
order\_itemsPKidFKorder\_idproduct\_idquantityunit\_priceline\_total1 : N1 : N

Figure 2:Database schema\.Three tables linked by foreign keys \(FK→\\toPK\)\. Arrows point from each FK column directly to the PK column it references:orders\.customer\_id→\\tocustomers\.idandorder\_items\.order\_id→\\toorders\.id, each a one\-to\-many relation\. The four operational\-rule families layered on top of this structure \(referential integrity, cardinality, derivation, transition\) are detailed in the appendix; only the first is fully declared in the schema text, the others live partially or entirely in trigger and application code\.### A\.1Schema

The three\-table order\-to\-cash schema\. The schema declares only the declarative part ofΠ\\Pi: foreign keys \(rule family i\), value\-domainCHECKs, and the per\-rowquantity \> 0bound \(part of family ii\)\. The remaining rules live in trigger and application code \(next subsection\): the per\-customer open\-order limit \(the rest of family ii\), the line\- and order\-total value\-transformation formulas \(family iii\), and the legal value\-state\-transition pairs \(family iv\)\. Theprev\_statusandtotalcolumns appear without anyCHECKconstraining their joint or derived values; both invariants are enforced procedurally\.

CREATETABLEcustomers\(

idINTEGERPRIMARYKEY,

countryVARCHAR\(2\),

tierVARCHAR\(10\)CHECK\(tierIN\(’bronze’,’silver’,’gold’\)\),

signup\_dateDATE

\);

CREATETABLEorders\(

idINTEGERPRIMARYKEY,

customer\_idINTEGERREFERENCEScustomers\(id\),

statusVARCHAR\(20\)

CHECK\(statusIN\(’pending’,’shipped’,’delivered’,’cancelled’\)\),

prev\_statusVARCHAR\(20\),

order\_dateDATE,

totalNUMERIC\(10,2\)

\);

CREATETABLEorder\_items\(

idINTEGERPRIMARYKEY,

order\_idINTEGERREFERENCESorders\(id\),

product\_idINTEGER,

quantityINTEGERCHECK\(quantity\>0\),

unit\_priceNUMERIC\(10,2\),

line\_totalNUMERIC\(10,2\)

\);

The schema declares column types, primary/foreign keys, and value\-domain CHECKs, but is silent on which\(prev\_status,status\)\(\\texttt\{prev\\\_status\},\\texttt\{status\}\)pairs are legal, on the per\-customer open\-order limit, and on howline\_totalandtotalare derived\. A model given the schema text alone cannot construct an audit query for any of those rules\.

### A\.2Procedural Rule \(Trigger Code\)

The legal value\-state\-transition set is enforced by a trigger function rather than a CHECK constraint, consistent with how multi\-row temporal rules are typically expressed in enterprise systems\. The transition rule is therefore visible only to a model with access to the trigger source:

CREATEORREPLACEFUNCTIONcheck\_status\_transition\(\)

RETURNSTRIGGERAS$$

DECLARE

allowedCONSTANTTEXT\[\]\[\]:=ARRAY\[

\[’pending’,’shipped’\],

\[’shipped’,’delivered’\],

\[’pending’,’cancelled’\],

\[’pending’,’pending’\]

\];

BEGIN

IFNOT\(ARRAY\[NEW\.prev\_status,NEW\.status\]=ANY\(allowed\)\)

THEN

RAISEEXCEPTION’illegaltransition%\-\>%’,

NEW\.prev\_status,NEW\.status;

ENDIF;

RETURNNEW;

END;

$$LANGUAGEplpgsql;

CREATETRIGGERorders\_status\_transition

BEFOREINSERTORUPDATEONorders

FOREACHROWEXECUTEFUNCTIONcheck\_status\_transition\(\);

The same pattern \(some rules in the schema, others in trigger or application code\) holds for the per\-customer cardinality bound and thediscount/taxvalue\-transformation formulas, which we omit here for brevity but treat identically: they enter the operational rule setΠ\\Pialongside the schema\-level constraints\.

### A\.3Operational Rules \(Π\\Pi\)

Together, the schema constraints and the trigger/application code above encode four families of operational rules\. Their intersection partitions the database state spaceΩ\\Omegainto legal \(⋂iπi\\bigcap\_\{i\}\\pi\_\{i\}\) and illegal regions:

1. 1\.Relational value consistency\(in schema\)\. Everyorders\.customer\_idoccurs incustomers\.id; everyorder\_items\.order\_idoccurs inorders\.id\.
2. 2\.Cardinality consistency\(mixed\)\. Every order has between11and2020line items; every customer has at most33open orders, where*open*≡\\equivstatus∈\{\\in\\\{pending,shipped\}\\\}\. The per\-customer bound is enforced in application code, not in the schema text\.
3. 3\.Value\-transformation logic\(in application code\)\.line\_total=qty⋅unit\_price⋅\(1−discount​\(tier,qty\)\)\\texttt\{line\\\_total\}=\\texttt\{qty\}\\cdot\\texttt\{unit\\\_price\}\\cdot\(1\-\\texttt\{discount\}\(\\texttt\{tier\},\\texttt\{qty\}\)\), andorder\.total=\(∑line\_total\)⋅\(1\+tax​\(country\)\)\\texttt\{order\.total\}=\\big\(\\sum\\texttt\{line\\\_total\}\\big\)\\cdot\(1\+\\texttt\{tax\}\(\\texttt\{country\}\)\)\. Thediscountandtaxfunctions are deterministic table lookups \(e\.g\.,discount\(gold,≥\\geq1\)=0\.100\.10;tax\(DE\)=0\.190\.19\)\.
4. 4\.Value\-state transition\(in trigger code; see[SectionA\.2](https://arxiv.org/html/2606.29091#A1.SS2)\)\. The pair\(prev\_status,status\)\(\\texttt\{prev\\\_status\},\\texttt\{status\}\)lies in the allowed transition set, with\(pending,pending\)\(\\texttt\{pending\},\\texttt\{pending\}\)as the initial state\.

### A\.4Corruption Strategies

Each corruption modifies a legal database state to violate exactly one rule while preserving the measured11\- and22\-way column\-value marginals to withinτ<0\.02\\tau<0\.02\.fk\_breakreplaces some parent keys with non\-existing identifiers\.cardinality\_breakredistributes line items within a customer so a group\-size bound is violated while row values are preserved\.derivation\_breakadds paired zero\-sum perturbations to stored totals, leaving histograms essentially unchanged but breaking the discount/tax value\-transformation formula\.transition\_breakswaps status values so11\-way status counts are preserved while\(prev\_status,status\)\(\\texttt\{prev\\\_status\},\\texttt\{status\}\)pairs leave the trigger\-defined allowed set\.

### A\.5The Seven Executable Audits

The operationally\-grounded classifier in[Section4](https://arxiv.org/html/2606.29091#S4)uses the scalar outputs of seven executable rule\-derived audits computed directly from the schema and the trigger / application code above\. Each is a one\-line audit query:

1. 1\.n\_orphan\_fk\_orders: count ofordersrows withcustomer\_id∉\\notincustomers\.id\.
2. 2\.n\_orphan\_fk\_items: count oforder\_itemsrows withorder\_id∉\\notinorders\.id\.
3. 3\.n\_orders\_over\_item\_limit: count of orders with more than2020line items\.
4. 4\.n\_cust\_over\_open\_limit: count of customers with more than33open orders\.
5. 5\.max\_abs\_lt\_residual:maxi⁡\|line\_totali−qtyi⋅unit\_pricei⋅\(1−discount​\(tier,qty\)\)\|\\max\_\{i\}\|\\texttt\{line\\\_total\}\_\{i\}\-\\texttt\{qty\}\_\{i\}\\cdot\\texttt\{unit\\\_price\}\_\{i\}\\cdot\(1\-\\texttt\{discount\}\(\\texttt\{tier\},\\texttt\{qty\}\)\)\|\.
6. 6\.max\_abs\_order\_residual:maxo⁡\|order\.totalo−\(∑line\_total\)⋅\(1\+tax​\(country\)\)\|\\max\_\{o\}\|\\texttt\{order\.total\}\_\{o\}\-\(\\sum\\texttt\{line\\\_total\}\)\\cdot\(1\+\\texttt\{tax\}\(\\texttt\{country\}\)\)\|\.
7. 7\.n\_illegal\_transitions: count of\(prev\_status,status\)\(\\texttt\{prev\\\_status\},\\texttt\{status\}\)pairs not in the allowed set\.

Each value is a single SQL query against the database\. A model with access to both schema and rule code can derive them; a model without that access cannot\. This is what we mean by “operational grounding\.”