TabulaSage: An Open-Source Offline AI Analyzer That Keeps Your Data on Your Machine

Almost every "smart spreadsheet" tool on the market follows the same playbook: you upload your file to someone else's server, a closed-source model you can't inspect does the analysis, and you pay per API call. For customer exports, medical logs, or any file with even a hint of personally identifiable information (PII), that workflow is a non-starter.

That's exactly the pain point developer Zhiyilang set out to address, building TabulaSage for the Hacktoberfest 2026 Open Source AI Challenge — a data analyzer powered entirely by open-source AI, where your files never leave your machine.

What It Does

Point it at any CSV file, and TabulaSage will tell you three things in plain English: a profile of every column (type, missing rate, distribution, high-frequency categories); which rows look "off" — anomaly detection aimed at data entry errors and rare edge cases; and what's actually driving your target column — explained by an interpretable model, not a black box.

Usage is straightforward:

pip install -r requirements.txt
python tabulasage.py examples/sample_customers.csv --target churned

On a 15-row sample with one intentionally corrupted row, the output speaks for itself. The anomaly detection module (IsolationForest) immediately flagged row 9 as garbage data (age=999, income=15), while legitimate high-value customers were correctly left alone. More importantly, the interpretable model doesn't just tell you the prediction (100% test accuracy) — it tells you why. The strongest driver was age (importance 0.57), followed by monthly_spend. It explains the reason, not just the result.

Why Open-Source AI Is Central to the Entire Project

This is exactly what the challenge brief asked for — and it's the fundamental reason the project exists.

Your data always belongs to you — as an architectural fact, not a promise. There are zero network calls anywhere in the code path. You can verify this yourself by reading roughly 200 lines of Python. For anyone handling sensitive CSVs, "the core is open source" isn't ideology — it's the only way to get AI-powered insights while keeping data on your own hard drive.

Zero runtime cost. The "brain" is scikit-learn's IsolationForest and a shallow decision tree — open weights, auditable, and reproducible output. No per-call billing, no surprise charges as your files grow.

The brain is swappable. Because the intelligence layer is an open framework rather than a hosted endpoint, you can plug in a local open-weights LLM (like Gemma running via Ollama) for richer natural-language descriptions, or TabPFN for predictions — without sending data anywhere. No rewrite required.

The author puts it bluntly: closed-source API solutions are easier to demo but harder to trust. For a tool that touches real data, he'd rather be trusted.

Open Weights vs. Open Source: Gemma and TabPFN mentioned above are "open-weights" models — the trained parameters are publicly released and can be deployed locally, but the full training code or data may not be. scikit-learn's IsolationForest and decision tree are strictly "open source": the algorithm implementation and the process that produces the weights are both fully auditable. Both satisfy the core "data stays local" requirement, but open-weights models offer slightly less auditability depth than fully open-source traditional ML algorithms. TabulaSage uses the latter as its default engine for exactly this reason; local LLM integration is an optional enhancement layer with a different purpose.

Ollama is a tool that lets users run open-weights LLMs like Llama, Gemma, and Mistral on their local machine with a single command — no GPU cloud required, all inference runs locally. This aligns directly with TabulaSage's "data never leaves your machine" design philosophy.

How It Works (Fully Offline)

TabulaSage's engineering details reflect a design philosophy built around accountability:

• Parsing & Profiling: Python standard library plus NumPy, no network calls anywhere.
• Anomaly Detection: Runs IsolationForest on normalized numerical features and one-hot encoded categorical features. A row is only flagged when its anomaly score falls more than 2σ below the mean — a parameter-free threshold that avoids the "flags 40% of the data" pitfall the author encountered using contamination="auto" on small datasets.
• Interpretable Model: A depth-limited DecisionTreeClassifier that lets you read the exact rules behind every prediction. The author explicitly drops the --target column from the feature set — an early version reported a spurious 100% accuracy due to label leakage, a reminder that "interpretable" must be enforced in code, not assumed.
• Insight Generation: Deterministic templates convert statistics into sentences, no LLM required — but a local open-weights model can be plugged in at any time for more natural language output.

How IsolationForest Works: IsolationForest is an unsupervised anomaly detection algorithm based on random partition trees. The core idea: anomalous points are sparse and distinct in feature space, so they can be "isolated" with very few random splits; normal points require far more splits to isolate. The algorithm computes an average path length for each sample — shorter paths mean easier isolation and higher anomaly scores. TabulaSage uses a "mean ± 2σ" flagging threshold rather than scikit-learn's default contamination parameter, which assumes a preset proportion of anomalies in the dataset and tends to over-flag aggressively on small samples. This adaptive threshold keeps the algorithm stable even on CSVs with only a dozen rows.

Why Shallow Decision Trees Are Interpretable: A depth-limited DecisionTreeClassifier has a key advantage over deep models or ensembles: every prediction path can be traced back to a set of readable if-else conditions. This lets auditors or business users verify model logic without any AI background — making it a common choice for regulatory compliance scenarios, such as GDPR's "right to explanation" requirement.

What Building This Taught Me

Building TabulaSage reinforced a point the open-source AI community keeps making: the interesting engineering challenge isn't "calling a model" — it's "making a model accountable." That means normalizing features so units don't lie, choosing a threshold that doesn't cry wolf, and refusing to let labels leak into features. None of this is glamorous, but it's exactly why the author would rather run a debuggable open-source model than an inscrutable closed-source one.

This perspective is worth noting for AI tool development today. As more and more applications default to "upload, then analyze," TabulaSage offers a counterpoint: embed the intelligence in auditable local code, and make privacy an architectural property that can't be bypassed.

Label Leakage is a common machine learning pitfall: when the target column (label) appears directly or indirectly in the training features, the model learns a "shortcut" and shows artificially high accuracy on both training and test sets — but completely fails on real data. TabulaSage's first version made exactly this mistake — the target column churned wasn't removed from the feature matrix, so the model was "looking at the answers before solving the problem," inflating test accuracy to a false 100%. The fix is simple (remove --target from the feature list), but catching it requires vigilance about data flow. This case is a reminder that "interpretability" isn't just about choosing a transparent algorithm — it also means ensuring the input data itself is clean. Both must be enforced in code.

How to Try It

The code, sample data, and copy-paste-ready demo are all in the repository:

🔗 https://github.com/Zhiyilang/tabulasage

The project was built for the Hacktoberfest 2026 Open Source AI Challenge. The author welcomes feedback and PRs — especially from developers who have already connected TabulaSage to a local Gemma or TabPFN instance and want to share their implementation patterns.