Leo Betthauser, Yingqi Liu, Uday Shah, Jishang Wei, Sainyam Galhotra, Liang Gou, Vedant Dharnidharka, Hao Yang
Many log-analysis tasks involve choosing among known options, such as detecting anomalous sessions or identifying attack techniques, and benefit from calibrated probabilities. We present Lev-3B, an open 3B-parameter decision model built on Granite-4.1-3B-Base with a shared pointer readout, and study its training recipe. The recipe has two key parts. First, training follows a curriculum: the model learns bounded natural-language decisions, using no log data, before it sees any logs. Second, the log stage mixes the target tasks with general log data spanning 35 auxiliary tasks unrelated to either evaluation task. We evaluate one shared checkpoint on sources seen in training and on sources excluded from training, calibration and model selection. The two-stage recipe transfers substantially better than training on log data alone. Adding general log data improves performance on excluded sources. At a fraction of their serving cost, Lev-3B outperforms prompted frontier models on anomaly detection, including on an excluded logging system, but trails them on attack-technique classification. Its probabilities are well calibrated on familiar sources, but on the excluded logging system it confidently misses anomalies. We release the checkpoint, recipe, data manifests, and prediction-level artifacts.
Tabular data discovery aims to identify the tables relevant to a natural-language question from a large collection of heterogeneous data. Existing systems typically assume that a question is answered by a single table and rely on retrieval pipelines constructed through substantial offline preprocessing. These assumptions become restrictive when relevant information is distributed across multiple tables. In this paper, we present Octopus, a lightweight agentic framework for multi-table data discovery. Octopus follows a thin-harness design that combines lightweight offline semantic guidance with adaptive access to raw tabular data. At query time, an LLM agent dynamically orchestrates semantic column search, structured tabular operations, and general-purpose execution to locate and verify relevant tables based on intermediate observations. We further introduce a benchmark that explicitly evaluates multi-table data discovery, covering both settings where multiple tables independently answer a question and settings where multiple tables must be joined. Experimental results across four independent-discovery datasets and two join-based datasets show that Octopus achieves the highest macro-F1 on all six datasets. It also substantially reduces offline preprocessing overhead relative to Pneuma and online latency and API cost relative to Claude Code. When coupled with the same NL2SQL agent, Octopus yields substantially higher downstream question-answering F1 than Claude Code, showing that improved table discovery provides more complete evidence for downstream analytics. Code is available at https://github.com/wenzhilics/octopus.