ATLAS

Can you trust this model's test score? ATLAS finds train/test leakage with deterministic checks, lets NVIDIA Nemotron propose a fix, and re-checks it in a sealed sandbox.

Comment

Inspiration

Data leakage has been found in 294 published papers across 17 scientific fields (Kapoor & Narayanan, Patterns, 2023). A model can score well on test data it has quietly already seen: the same person in training and testing, or a preprocessing step fit on all the data before the split. The person who wrote the evaluation usually can't see it. I wanted a tool that checks an evaluation the way a careful reviewer would, shows the evidence, and lets an AI help fix it without ever letting the AI decide whether the fix worked.

What it does

You give ATLAS a small scikit-learn classification project and the claim it makes (for example, "the activity classifier works on people absent from training").

  • Deterministic checks decide. ATLAS runs the project's own evaluation in an isolated Docker container (no network, non-root, read-only filesystem), records which rows each preprocessing and model step learned from, and runs fixed checks: group overlap between training and testing, out-of-fold fitting, prediction alignment, and recomputed metrics. Outcomes are only VIOLATION_FOUND, NO_VIOLATION_FOUND, INCONCLUSIVE or NOT_SUPPORTED, never "valid". A clean result means the listed checks passed within the coverage shown, not that the science is true.
  • The AI proposes, untrusted. If a check fails, NVIDIA Nemotron 3 Super (via Nebius Token Factory) reads the project and proposes a revised evaluation.
  • A human approves the exact code by typing the start of its code hash. The revision runs sealed in Docker and the same checks judge it again.
  • You don't have to trust the screen. Every recorded hash is recomputed before display; the demo lets you change one byte of a copy and watch ATLAS withhold the result. Each verified case downloads as an audit report.

How I built it

  • Python 3.11, scikit-learn, Pydantic, Docker, Streamlit, with a Neon Postgres budget ledger for the hosted demo.
  • Nemotron through Token Factory's OpenAI-compatible API, inside hard bounds: at most 6 requests per run, each reserved against a budget cap before it is sent; exact JSON validation of every reply (one action, no extra fields, no repair); a free pre-run GET /models check that the model, prices and context length match configuration.
  • Agentic engineering workflow: I designed the architecture, invariants and task cards and directed AI coding agents to implement them: Claude Code built, Codex ran independent adversarial reviews at every gate (including fault injection on the hosted spend controls), and Gemini reviewed every public claim against the records. 2,100+ automated tests, and every release passed review before publishing.

Results

  • Live run 6: the original evaluation was VIOLATION_FOUND; Nemotron proposed a fix; I approved it; it ran in Docker; the trusted evaluator judged it NO_VIOLATION_FOUND, with four checks moving FAIL → PASS. 5 requests, 0 schema failures, about $0.019 (estimate, not billing).
  • Real data (UCI HAR smartphone sensors): a deliberately flawed evaluation is caught (21 people on both sides of the split in all 5 folds); a clean control passes.
  • ATLAS vs. the model alone (predeclared, 4 development projects, not held-out): ATLAS found all 8 assessable violations with no false alarms. Nemotron alone made 19 of 20 detections on the same 8 (19 of 23 overall), with 2 false alarms and 3 of 12 replies unusable. The flawed projects' files describe their flaws in text the model could read, so this is a small, favourable test for the model. What ATLAS adds is evidence you can re-run and fixes verified by execution.

Challenges

I ran the live agent eight times and recorded every failure as measured. Schema failures were the main obstacle: they occurred in 5 of the 8 runs and ended 4. Each fix was small and reviewed: storing raw replies so failures could be diagnosed, corrective turns built only from the schema, showing the model its own sanitized errors. I never loosened the evaluator to get a pass. On the real-data case, Nemotron proposed the correct repair four times across runs 7 and 8, but returned the code double-escaped every time. ATLAS doesn't repair model output, so it rejected all four, and I stopped there rather than tune prompts until a run happened to succeed.

What I learned

  • Let the model propose and let deterministic code decide.
  • A rising metric is not success: in run 6 the honest score went down (0.681 → 0.675) after the leaks were removed.
  • Show the model its own errors; two candidates failed identically until the traceback reached it.
  • Independent review catches real defects: Codex found reporting and gating bugs that tests alone missed.

What's next

Held-out cases written outside the builder's view, an evaluator-only holdout label store, native tool calling for the model, and testing beyond one Windows machine. The hosted demo stays up through judging (until Dec 15, 2026).

Built With

Share this project:

Updates

Submission history