NanoSOC Gemstone 2B is a compact, text-only security operations model tuned for structured event triage on the T3 Gemstone O1 / AM67A class of edge hardware. It consumes normalized events from tools such as Zeek, Suricata or Wazuh and returns strict JSON with a decision, evidence, MITRE ATT&CK attribution and a human-reviewable next step.

This is the recommended variant. The recommended runtime context on a 4 GB board is 1024 tokens.

Hardware honesty: the GGUF builds were validated with llama.cpp on the build host. Physical T3 Gemstone latency and peak-RAM validation is still required. The board's 4 TOPS TIDL accelerators are not claimed to accelerate this LLM.

Frozen evaluation

The selected checkpoint was chosen only on a separate 400-record development set and then evaluated once on a frozen 1,000-record detection holdout with zero prompt overlap with training.

Metric	Result
Valid JSON	100.00%
Decision accuracy	88.70%
MITRE exact match	88.70%
Detection recall	60.50%
Precision	78.06%
F1	68.17%
Specificity	95.75%
False-positive rate	4.25%

Full aggregate evidence is in reports/frozen-score.json; frozen prompts and raw log contents are not redistributed.

Files

NanoSOC-Gemstone-2B-Q4_0.gguf — 1.12 GiB — a0d66afd9e33ad500d3f981150082b194b6edfbd39e8d9e7f8576a125375cbd2
NanoSOC-Gemstone-2B-Q4_K_M.gguf — 1.19 GiB — 393c47f3302a73fd8c3e8fed5edd2a68b2e4fa600d7e024ed172679b7111766f

Q4_0 is the primary Gemstone package because it has predictable ARM NEON support and a tighter memory footprint. Q4_K_M is supplied for host-side quality comparison and boards with sufficient free RAM.

Host benchmark

Peak RSS observed in the short Q4_0 host benchmark: 2001.0 MiB. This is not an AM67A performance claim.

qwen35 2B Q4_0: 376.77 tokens/s
qwen35 2B Q4_0: 20.65 tokens/s

Output contract

json

{
  "guven": "...",
  "kanit": ["..."],
  "karar": "supheli",
  "mitre_attack": ["T0000"],
  "olay_tipi": "...",
  "onerilen_adim": "..."
}

karar is constrained to supheli or yetersiz_kanit. The included JSON Schema can enforce this at generation time.

Run with llama.cpp

bash

git clone https://github.com/ggml-org/llama.cpp
cmake -S llama.cpp -B llama.cpp/build -DCMAKE_BUILD_TYPE=Release -DGGML_NATIVE=ON
cmake --build llama.cpp/build --target llama-cli -j 4

./deploy/run-gemstone.sh \
  NanoSOC-Gemstone-2B-Q4_0.gguf \
  ./llama.cpp/build/bin/llama-cli

For T3 Gemstone itself, run deploy/build-on-gemstone.sh on the board first.

Intended use

Offline triage of already-normalized SOC events
Alert prioritization and evidence summarization
MITRE ATT&CK suggestion with mandatory analyst review
Edge deployments where events should remain local

Not intended for

Raw packet/PCAP inspection
Autonomous blocking, deletion, quarantine or remediation
Replacing an IDS/IPS, SIEM correlation engine or human analyst
Treating model confidence as calibrated probability

Training and provenance

Base model: Qwen/Qwen3.5-2B
Method: 4-bit NF4 QLoRA, rank 16
Training mix: 9,129 structured SOC examples; 5,872 insufficient-evidence and 3,257 suspicious decisions
Frozen holdout excluded from training and checkpoint selection
Vision encoder removed; these are text-only GGUF packages

License and source notice

The Qwen3.5 base is Apache-2.0. The NanoSOC training mixture contains multiple source/provenance categories, including sources governed by their own terms. Therefore this repository is conservatively tagged license: other; review NOTICE.md and upstream source terms before commercial redistribution.

Turkish / Türkçe

Bu model ham PCAP okumaz; Zeek, Suricata veya Wazuh gibi sensörlerden gelen yapılandırılmış JSON olaylarını analiz eder. Üretilen aksiyonlar otomatik uygulanmamalı, analist onayından geçmelidir. 4 GB Gemstone kartında 2B sürümü için önerilen bağlam 1024 tokendır.

Citation

bibtex

@software{nanosoc_gemstone_2b,
  author = {GoktugD},
  title = {NanoSOC Gemstone 2B},
  year = {2026},
  url = {https://huggingface.co/GoktugD/NanoSOC-Gemstone-2B-GGUF}
}