NanoSOC Gemstone 4B is a compact, text-only security operations model tuned for structured event triage on the T3 Gemstone O1 / AM67A class of edge hardware. It consumes normalized events from tools such as Zeek, Suricata or Wazuh and returns strict JSON with a decision, evidence, MITRE ATT&CK attribution and a human-reviewable next step.

This is the experimental / memory-tight variant. The recommended runtime context on a 4 GB board is 512 tokens.

Hardware honesty: the GGUF builds were validated with llama.cpp on the build host. Physical T3 Gemstone latency and peak-RAM validation is still required. The board's 4 TOPS TIDL accelerators are not claimed to accelerate this LLM.

Frozen evaluation

The selected checkpoint was chosen only on a separate 400-record development set and then evaluated once on a frozen 1,000-record detection holdout with zero prompt overlap with training.

Metric	Result
Valid JSON	100.00%
Decision accuracy	87.50%
MITRE exact match	87.50%
Detection recall	99.00%
Precision	61.68%
F1	76.01%
Specificity	84.62%
False-positive rate	15.38%

Full aggregate evidence is in reports/frozen-score.json; frozen prompts and raw log contents are not redistributed.

Files

NanoSOC-Gemstone-4B-Q4_0.gguf — 2.37 GiB — 9395fc16160241dd2c57243074ebffc57ed3668e51cc10d9818786d03bf27aa7
NanoSOC-Gemstone-4B-Q4_K_M.gguf — 2.52 GiB — 6e5e06d30a70ca8b8a5f70cf8e9ebacd569589440e4dff7443aa54db74563f6c

Q4_0 is the primary Gemstone package because it has predictable ARM NEON support and a tighter memory footprint. Q4_K_M is supplied for host-side quality comparison and boards with sufficient free RAM.

Host benchmark

Peak RSS observed in the short Q4_0 host benchmark: 4502.9 MiB. This is not an AM67A performance claim.

qwen35 4B Q4_0: 153.92 tokens/s
qwen35 4B Q4_0: 9.29 tokens/s

Output contract

json

{
  "guven": "...",
  "kanit": ["..."],
  "karar": "supheli",
  "mitre_attack": ["T0000"],
  "olay_tipi": "...",
  "onerilen_adim": "..."
}

karar is constrained to supheli or yetersiz_kanit. The included JSON Schema can enforce this at generation time.

Run with llama.cpp

bash

git clone https://github.com/ggml-org/llama.cpp
cmake -S llama.cpp -B llama.cpp/build -DCMAKE_BUILD_TYPE=Release -DGGML_NATIVE=ON
cmake --build llama.cpp/build --target llama-cli -j 4

./deploy/run-gemstone.sh \
  NanoSOC-Gemstone-4B-Q4_0.gguf \
  ./llama.cpp/build/bin/llama-cli

For T3 Gemstone itself, run deploy/build-on-gemstone.sh on the board first.

Intended use

Offline triage of already-normalized SOC events
Alert prioritization and evidence summarization
MITRE ATT&CK suggestion with mandatory analyst review
Edge deployments where events should remain local

Not intended for

Raw packet/PCAP inspection
Autonomous blocking, deletion, quarantine or remediation
Replacing an IDS/IPS, SIEM correlation engine or human analyst
Treating model confidence as calibrated probability

Training and provenance

Base model: Qwen/Qwen3.5-4B
Method: 4-bit NF4 QLoRA, rank 16
Training mix: 9,129 structured SOC examples; 5,872 insufficient-evidence and 3,257 suspicious decisions
Frozen holdout excluded from training and checkpoint selection
Vision encoder removed; these are text-only GGUF packages

License and source notice

The Qwen3.5 base is Apache-2.0. The NanoSOC training mixture contains multiple source/provenance categories, including sources governed by their own terms. Therefore this repository is conservatively tagged license: other; review NOTICE.md and upstream source terms before commercial redistribution.

Turkish / Türkçe

Bu model ham PCAP okumaz; Zeek, Suricata veya Wazuh gibi sensörlerden gelen yapılandırılmış JSON olaylarını analiz eder. Üretilen aksiyonlar otomatik uygulanmamalı, analist onayından geçmelidir. 4 GB Gemstone kartında 4B sürümü için önerilen bağlam 512 tokendır.

Citation

bibtex

@software{nanosoc_gemstone_4b,
  author = {GoktugD},
  title = {NanoSOC Gemstone 4B},
  year = {2026},
  url = {https://huggingface.co/GoktugD/NanoSOC-Gemstone-4B-GGUF}
}