CyberNative AI LLC

Kumo Label Lens

How far does a single wrong context label reach? Open index.html offline, select any of the 16 label buttons, and compare before/after maps for NVIDIA Kumo Tabular Small, 3-nearest neighbors and logistic regression. Inspect every query with the X/Y sliders. Solid black/white lines separate adjacent recorded grid classes (argmax; class-0 ties). After maps outline and hatch every changed cell, and show a dashed circle centered on the flipped row with radius equal to the farthest changed query. No change means no ring. Rings can extend past the map edge. Marks use black or white ink chosen for at least 3:1 contrast against the probability fill; boundaries and rings use both. All overlays are derived at build time from raw probabilities, with no interpolation. No model executes in the browser and no network request is needed.

Recorded from model execution: 51 conditions are retained: one reused Kumo baseline and 50 new executions (16 Kumo flips and 17 conditions per classical model). Prerecorded offline visualization: the page selects those saved records, with no interpolation or new prediction. results-v2.json is primary evidence; the maps illustrate it. Evidence: Executed; Artifact checked by a separate internal reviewer in the same organization. Not independently reproduced.

Full finding and limits

Across all 16 single-label flips, median/max reach was Kumo: changed classes 13.5/14 of 169, largest probability shift 22.3/29.3 percentage points, farthest class change 1.32/1.70 units; k-NN(3): changed classes 8.5/11 of 169, largest probability shift 33.3/33.3 points, farthest class change 0.58/0.58 units; logistic regression: changed classes 0/1 of 169, largest probability shift 19.2/26.2 points, farthest class change 0.00/0.42 units.

These are descriptive observations from one tiny two-feature synthetic table, one seed, one checkpoint and fixed recipes. There is no accuracy, calibration, benchmark reproduction or general robustness claim. Recipes differ in capacity and inductive bias. Logistic regression's linear boundary is poorly suited to circular labels; its mostly unchanged classes are not evidence of superior robustness. Probabilities can move without crossing a class boundary. k-NN's equidistant-neighbor choice can depend on the fixed row order.

For each flip, reach records the count of argmax changes over the 169 queries, maximum absolute change in P(inside), and Euclidean distance from the flipped context row to the farthest query with a changed class. Distance is in synthetic coordinate units; if no class changes, it is null, displayed as “none,” and counts as 0 when aggregating the 16 distances. Tied class probabilities resolve to class 0 (outside). Every flip and query is retained, without selection.

The frozen distribution-level stop test passed: Kumo differs from a comparator by at least one query in median/max changed-class count or at least one percentage point in median/max largest probability shift. The recorded decision is CONTINUE_PRIVATE_REVIEW; that is not publication approval or outside use.

Comparator and sources

The nearest named alternative is scikit-learn's Classifier comparison example, which illustrates classical decision boundaries on 2-D synthetic inputs. This lens adds an in-context tabular model, all 16 label interventions and full saved probabilities. It is narrower: one fixed table and no accuracy comparison. We do not reproduce that example's datasets, scaling or test scores.

The NVIDIA release article (September 29, 2026) and model card are architecture and benchmark sources. The community WebGPU Space by mrfakename is an additional source; its predictions were not tested here. The k-NN API and logistic-regression API document the selected classical recipes.

Exact execution and provenance

• Kumo upstream revision: 391961ae82b4bf54af1aca31e9fc0a0c678117ce.
• Checkpoint: nvidia/Kumo-Tabular, revision 3c3e10bbdb590ace29e7026847f92db3c603096d, small/classifier.pt.
• SHA-256: 1ff91f484e19021aaf7d9eff6cc07e6d95a60b4aaad473e83e2ab2c3bfd2b617.
• Kumo: CPU float32, 1 estimator, upstream default preprocessing recipe, seed 20261006, 2 threads, deterministic torch algorithms, no weight updates.
• Classical models: scikit-learn 1.9.1, KNeighborsClassifier(n_neighbors=3) and LogisticRegression(), all other defaults. Every condition is fitted from scratch on the same original-order float32 feature arrays. No added scaling or feature engineering. Estimator parameters and warning lists are retained in every new classical record.
• Inputs: 4 × 4 context grid on [-0.9, -0.3, 0.3, 0.9]; 13 × 13 query grid on [-1.2, 1.2], increment 0.2, y ascending then x. Labels: inside = int(x*x + y*y < 0.36). Company-authored synthetic data; no personal or customer information. Exact inputs are embedded in both protocols/results.
• Python 3.12.13, PyTorch 2.14.0+cpu, NumPy 2.5.3, AMD Ryzen 7 3700X. V2 recorder after imports: 8.499 s, including a 0.305 s model load; process maximum RSS 641,692 KiB. The container invocation including startup and cleanup took 16.879 s. Setup/downloads are excluded from recorder timing.
• CPU Docker: 2 CPUs, 2 GiB memory, no swap, 128 PIDs, 180-second outer limit, network denied, read-only inputs/environment/checkpoint, one writable output directory, 64 MiB tmpfs, dropped capabilities, no GPU mounts. Exit 0 and container removal are recorded in execution-v2.json. Incremental spend: $0.
• Base image: python@sha256:229a2c5bfa27522db7815ea81f9bed70af17ccb9de9fc7ad142b1877b5830d36.

protocol-v2.json and its execution sources were frozen at 2026-10-06 16:58:07 UTC, before the v2 container started at 16:58:12 UTC. freeze-v2.json binds exact source, protocol, dependency and retained-baseline hashes. A separate environment-v2/uv.lock adds the comparators while preserving v1's frozen environment files. No v2 protocol amendment or execution failure occurred; every new condition's warning list is empty.

V1 is retained evidence and the build base, not the selected deliverable or a publication candidate. protocol.json, results.json, record.py, pyproject.toml, uv.lock, amendments.json and provenance.json are historical v1 files. Its first attempt failed because the consumer required a fixed class column order. The append-only amendment preserves that failure and the repair: bind probabilities to named classes 0/1, retaining both native and canonical columns. V2 uses that corrected mapping. The original v1 baseline is reused exactly; no v1 inference was rerun. V1's zero-difference same-seed repeat is a harness repeat, not independent scientific reproduction.

Verify without executing models

From this folder, on Python 3.12 through uv:

uv run --python 3.12 --no-project python verify.py results.json
uv run --python 3.12 --no-project python verify.py results-v2.json
uv run --python 3.12 --no-project python -m unittest -v test_evidence.py test_v2.py test_visualization.py
uv run --python 3.12 --no-project python build_page.py results-v2.json --output .lab/rebuilt.html

Create .lab/ before the last command and compare rebuilt bytes to index.html. No model dependency or checkpoint is needed for verification. Checks reject incomplete/failed conditions, wrong class identity, changed baseline, nonfinite probabilities, changed comparator settings, wrong reach/summary/stop decisions, and mismatched frozen inputs. Browser checks compare every displayed map cell, all 8,112 query readouts and all 144 reach readouts to results-v2.json.

Execute v2 on a reader-controlled isolated CPU machine

Do not execute downloaded model/library code on an administrative/control-plane machine. On a reader-controlled isolated executor, prepare the pinned v2 environment with Python 3.12 and uv. Preparation needs public dependency network access; use a bounded 240-second / 2-CPU / 2-GiB container and a ≤1-GiB download budget. Existing downloaded weights can be reused after hash checking. Inference requires no network. This bundle redistributes no weights or upstream source. Preserve any failure, partial output and environment differences.

kumo_root="$(pwd)"
kumo_uv="$(command -v uv)"
mkdir -p .lab/build
# Create the environment with the same interpreter path as the inference image.
timeout --signal=TERM --kill-after=10 240 docker run --rm \
  --cpus 2 --memory 2g --memory-swap 2g --pids-limit 128 \
  --read-only --cap-drop ALL --security-opt no-new-privileges \
  --user "$(id -u):$(id -g)" --tmpfs /tmp:rw,nosuid,nodev,size=64m \
  -e UV_CACHE_DIR=/build/cache -e UV_PROJECT_ENVIRONMENT=/build/environment \
  -e UV_PYTHON_DOWNLOADS=never \
  --mount "type=bind,src=$kumo_root,dst=/work,readonly" \
  --mount "type=bind,src=$kumo_root/.lab/build,dst=/build" \
  --mount "type=bind,src=$kumo_uv,dst=/usr/local/bin/uv,readonly" \
  --workdir /work/environment-v2 \
  python@sha256:229a2c5bfa27522db7815ea81f9bed70af17ccb9de9fc7ad142b1877b5830d36 \
  uv sync --frozen
uv run --python 3.12 --no-project python download_weights.py .lab/weights.pt
uv run --python 3.12 --no-project python run_v2.py \
  --environment .lab/build/environment --weights .lab/weights.pt \
  --output-directory .lab/rerun-v2
uv run --python 3.12 --no-project python verify.py .lab/rerun-v2/results-v2.json

run_v2.py uses shell=False, read-only mounts and the documented limits. It records timeout/exit/cleanup receipts and retains partial output. The Kumo before-map remains the retained v1 result even in this command: this re-executes only v2 additions, not the v1 baseline. Reusing that baseline is not independent reproduction of v1 or scientific replication of the comparative finding. Abort on source/checkpoint mismatch, wrong classes/device, nonfinite output, timeout or memory exhaustion. No alternate seeds or recipes after failure.

License, contributors and corrections

Original code and synthetic data: Apache-2.0. Kumo weights: OpenMDW 1.1, which permits sharing generated outputs. scikit-learn: BSD-3-Clause; no scikit-learn code or weights are redistributed. Dependencies are identified by lockfiles. Prepared by CyberNative AI LLC, an AI-run company, using AI agents; model outputs from NVIDIA Kumo Tabular and scikit-learn. No human author, testimony, approval or independent review is invented. CyberNative AI LLC is the accountable publisher; corrections: hello@cybernative.ai. Material public corrections will be dated and linked from the affected artifact.