The Arithmetic Boundary

A great deal of statistical work now happens by pasting a spreadsheet into a chat window and asking a question in plain language. The workflow is fast, free and entirely undocumented. Nobody has published what it is reliable for.

The convenient assumption in our industry is that language models improvise numbers. We designed this study expecting to confirm that, and the data rejected it twice. What we found instead is more useful: the workflow is reliable inside a boundary that can be measured, and unreliable outside it in a way the reader cannot see.

That reframes the practical question. It is not whether to trust a language model with arithmetic. It is how to decide, before you act on an answer, which side of the boundary you are on.

We reproduced the consumer workflow exactly. A raw CSV was pasted into a single chat turn with a statistical question in plain language. All tools were disallowed, no code execution was available, and the working directory carried no context, so each answer had to come from the pasted text alone.

The design covered five public datasets, three models across two price tiers, five question shapes (correlation, subgroup mean, two-sample test, regression slope and highest-mean category) at sizes from 50 to 2,000 rows. In total 240 attempts produced 179 responses and 105 scorable numeric answers.

Models never saw the published datasets. Each was given a seeded random subsample whose true statistics differ from any figure that could be looked up. On one dataset the correlation is 0.772 at 50 rows and 0.640 at 200 rows, against roughly 0.676 for the published full set. That single decision is what makes Section 3 possible, and the exact subsamples are published.

Ground truth was computed independently, and three statistics were re-derived by hand-written formulas and matched to twelve decimal places.

Two further arms were added after the main sweep. One regenerated the entire study on data created for this paper, which no model has seen. One repeated single questions five times each to separate a stable error from a noisy one.

The first question is whether any of this is arithmetic at all. A model that had memorised a famous dataset could return the right correlation without computing anything, and the whole exercise would be measuring recall.

It is not recall, and the evidence is direct. Several responses showed their intermediate working, which allows the claim to be checked rather than argued. On one 50-row regression the model reported a sum of squared deviations of 33,915,193. The true value for that subsample is 33,915,192.5: fifty squared deviations, each near 700,000, correct to eight significant figures. That quantity exists for no other dataset in the world.

Two designed tests agree. Because our subsamples differ from the published figures, a model answering from memory would drift toward the published value; across 45 cases where the two differ by more than 2%, only 6 answers did, well below chance. And when the public datasets were removed entirely and the study regenerated on newly created data, performance in the usable band was flat across all three conditions at 85.9%, 84.6% and 88.9%.

Whatever else is true about next-token prediction, the errors in this study are not caused by retrieval. They are the errors of a system doing real arithmetic under a constraint.

That constraint is size, and it produces a step rather than a slope. Restricting to frontier models, which is the case that matters in practice:

The size of the paste is only half of the rule. The other half is what you asked for, and it is the part that makes this usable rather than merely interesting.

The main study collected nothing between 350 and 500 rows, so we ran a further arm at 400 and 450 rows on the two datasets large enough to supply them, across three question shapes. Twenty of a planned 24 observations are in at the time of writing.

The result did not confirm the prediction we recorded before running it, which was that regression would degrade first inside the gap. It did not degrade at all: regression slopes were correct at both 400 and 450 rows, including one answer of 0.2879 against a true 0.287858. Group averages were correct in all eight observations, confirming the control and with it the two-dimensional rule in Table 1.

What failed instead was one specific pairing, and it failed consistently. On one dataset the correlation was wrong in all four attempts at 400 and 450 rows. Our first explanation was that this variable is an ordinal rating rather than a continuous measure, which the study elsewhere shows the models handle loosely. That explanation is wrong: at 50 rows the same model computes the same correlation exactly, returning 0.2859 against a true 0.2859.

Tracing that one pairing across every size available gives the most instructive single result in this study:

The dangerous band is the middle, not the top. At 50 rows the model computes and is exact. At 1,500 rows it recognises that it cannot compute, samples deliberately, says so, and lands close. Between 400 and 500 it does neither: it still attempts the full calculation, can no longer complete it, and does not yet know to tell you. Every answer in that band was confidently and consistently too high.

This traces a single variable pair across five sizes, with two observations at most sizes. It is an observation rather than an established rate, and it is reported because the shape of it is instructive, not because the numbers are precise. It does, however, mean the boundary should be treated as a zone rather than a threshold, and that the zone begins below 400 rather than at 500.

A separate arm of this study asked the same questions with no method named, to see what the model would choose unprompted. It produced an explanation for Section 4 that we were not looking for.

Asked for a correlation across 1,500 rows, one response opened:

"I can't tally all 1500 rows by hand reliably, so I hand-tabulated the pairs from two contiguous 240-row blocks."

Another sampled roughly 350 rows of 1,500 and checked that the direction held in each block. A third computed a regression slope on 202 rows out of 1,500 and reported the sampling error of its own subsample. All three instances occurred at 1,500 rows. Not one occurred at 500 rows or fewer.

This explains both halves of Table 1. Substituting a sample or a set of bins for the raw rows barely disturbs a group average, and destroys a regression slope. Accuracy does not decay at scale for a diffuse reason: past some point the model stops computing over the data you gave it and computes over a portion of it instead.

It disclosed this every time. The information was on the page. Whether a reader who wants a number reads the fourth paragraph of a caveats section is a separate question, and not one this study measured.

An error rate is manageable when errors announce themselves. These do not, and three separate results say so.

Confidence does not fall when accuracy does. Across 35 significance tests exactly one verdict was wrong, and that one reported p < 0.01. The single incorrect answer arrived more emphatic than the correct ones.

Asking again does not help at the frontier. We repeated questions five times each in independent sessions. Against a cheap model this works well: it was never unanimous and every one of its wrong answers would have been caught by a second attempt. Against a frontier model the spread was roughly 500× tighter. On a task with a known planted answer, five independent runs returned the same method, the same reasoning and the same number, all about 10% wrong. Three runs on a variant did it again, unanimously, 28% wrong.

Correct reasoning does not guarantee a usable answer. Given a dataset containing a genuine randomised experiment, the model found the experiment unprompted, identified the right test and control groups, ran the correct method and checked for confounding. Every step was right. The experiment it found was too small to carry the estimate, it did not say so, and it reported a range that did not contain the true value.

Nothing visible about that answer was wrong. The method was named, the diagnostics were run, the arithmetic was correct, and the stated range was narrow. A reader has no purchase on it at all.

We expected the opposite and recorded that expectation in writing before collecting the data. Sixty questions were asked in plain language with no method named, scored against a standard fixed and cryptographically hashed before a single answer was read.

The written prediction was that models would select well but explain themselves poorly. They selected well and explained themselves thoroughly, in every case. Some of the work exceeded what a practitioner would typically produce: one response ran two different tests, reported that they disagreed about significance, and identified the distributional assumption responsible for the disagreement.

The one consistent lapse is close calls. Four of the five missing caveats concern a ranking decided by a few percent, and twice the model observed that two groups were close and then declared the ranking reliable. Everywhere else it hedges generously. On a near-tie, which is exactly where a decision turns on the margin, it stops.

Taken together these results point somewhere more specific than "verify AI output."

A language model performs a bounded amount of genuine computation in a single pass. Inside that bound it is not approximately right, it is exactly right, and the practical response is to use it rather than duplicate it. Outside the bound it does not stop or fail loudly. It substitutes a cheaper estimate and continues, in the same register, with the same confidence.

So the decision comes before the analysis, and it can be made from facts you already have: how many rows there are, what kind of question is being asked, and what kind of variable is being asked about. All three are known before any work begins.

And it is not a decision a person can reasonably be expected to make. It is not one threshold. Group averages hold at 2,000 rows while one correlation fails from 400. The safe answer at 1,500 rows was safe because the model announced that it had sampled, and the unsafe answers at 450 were unsafe because it did not. A rule with that shape has to be held by the system doing the work, not carried in the head of the person asking the question.

This is the principle MCP Analytics is built on. Our data scientist evaluates the objective against the dataset before doing any work. Where the answer is reliably reachable by reasoning, you get it immediately and we confirm it against a full computation behind you. Where it is not, the analysis runs properly over the entire dataset. Either way the objective is kept, so the same question can be asked again next quarter of new data and produce a comparable number by the same method.

Clean data. All five datasets are public, tidy and complete. Real uploads carry missing values, mixed types and inconsistent categories. The boundary should be treated as an upper bound on where reliability ends, not a promise.

One vendor. These are one company's models at one moment through one interface. Nothing here is a claim about language models generally.

Small cells in places. The 48 of 48 result is well supported in aggregate. Individual size bands within it rest on six observations each, and the by-shape rates in Table 1 should be read as directions.

The gap is measured but thinly. The 400 and 450 row arm rests on 20 observations across two datasets, and one of its three question shapes carries a single observation at 450. It is enough to show that the boundary is a zone rather than a line, and not enough to place its edge precisely.

Our own errors. Three claims in the first draft of this work were wrong, including one where two analyses run on different subsets of rows were compared as though they were a like-for-like test. They were found by running the reproduction commands we were about to publish. The corrections are documented in the full technical version rather than quietly folded in.

The exact subsamples every model saw are published, so ground truth is checkable independently. The scoring scripts make no model calls at all: they read committed data and recompute. Anyone can therefore verify the arithmetic of this paper without an account, an API key or our cooperation.

That includes the size effect, which is fitted by a script that writes out the maximum-likelihood estimation by hand rather than importing a statistics package, specifically so that the figure this paper rests on can be re-derived on a laptop.

Each arm of the study states its design, its measures and its prediction in its own source file, written before that arm's data existed. One arm went on to fail the prediction it was built to test, and is reported as such.

1. Restaurant tipping records (244 observations). Bill totals, gratuities, party size, day and service period.
2. Abalone physical measurements (4,177 observations). Length, diameter, height, four weight measures and ring count.
3. Palmer penguins (344 observations). Species, island, bill and flipper dimensions, body mass, sex.
4. Red wine physicochemical properties (1,599 observations). Eleven chemical measures and an ordinal quality rating.
5. Automobile fuel economy (398 observations). Miles per gallon, cylinders, displacement, horsepower, weight, model year, origin.

All five are long-standing public teaching datasets. Their familiarity is the reason models were shown seeded subsamples rather than the published files, and the reason the study includes an arm on data generated specifically for this paper.