---

license: other

language:

• en
• tr

library_name: llama.cpp

pipeline_tag: text-generation

base_model: Qwen/Qwen3.5-2B

tags:

• gguf
• qwen3.5
• cybersecurity
• soc
• incident-response
• edge-ai
• arm64
• t3-gemstone
• turkish

---

NanoSOC Gemstone 2B — Edge SOC Analyst for 4 GB ARM Boards

NanoSOC Gemstone 2B is a compact, text-only security operations model tuned for structured event triage on the T3 Gemstone O1 / AM67A class of edge hardware. It consumes normalized events from tools such as Zeek, Suricata or Wazuh and returns strict JSON with a decision, evidence, MITRE ATT&CK attribution and a human-reviewable next step.

This is the recommended variant. The recommended runtime context on a 4 GB board is 1024 tokens.

> Hardware honesty: the GGUF builds were validated with llama.cpp on the build host. Physical T3 Gemstone latency and peak-RAM validation is still required. The board's 4 TOPS TIDL accelerators are not claimed to accelerate this LLM.

Frozen evaluation

The selected checkpoint was chosen only on a separate 400-record development set and then evaluated once on a frozen 1,000-record detection holdout with zero prompt overlap with training.

| Metric | Result |

|---|---:|

| Valid JSON | 100.00% |

| Decision accuracy | 88.70% |

| MITRE exact match | 88.70% |

| Detection recall | 60.50% |

| Precision | 78.06% |

| F1 | 68.17% |

| Specificity | 95.75% |

| False-positive rate | 4.25% |

Full aggregate evidence is in reports/frozen-score.json; frozen prompts and raw log contents are not redistributed.

Files

• NanoSOC-Gemstone-2B-Q4_0.gguf — 1.12 GiB — a0d66afd9e33ad500d3f981150082b194b6edfbd39e8d9e7f8576a125375cbd2
• NanoSOC-Gemstone-2B-Q4_K_M.gguf — 1.19 GiB — 393c47f3302a73fd8c3e8fed5edd2a68b2e4fa600d7e024ed172679b7111766f

Q4_0 is the primary Gemstone package because it has predictable ARM NEON support and a tighter memory footprint. Q4_K_M is supplied for host-side quality comparison and boards with sufficient free RAM.

Host benchmark

Peak RSS observed in the short Q4_0 host benchmark: 2001.0 MiB. This is not an AM67A performance claim.

• qwen35 2B Q4_0: 376.77 tokens/s
• qwen35 2B Q4_0: 20.65 tokens/s

Output contract

{
  "guven": "...",
  "kanit": ["..."],
  "karar": "supheli",
  "mitre_attack": ["T0000"],
  "olay_tipi": "...",
  "onerilen_adim": "..."
}

karar is constrained to supheli or yetersiz_kanit. The included JSON Schema can enforce this at generation time.

Run with llama.cpp

git clone https://github.com/ggml-org/llama.cpp
cmake -S llama.cpp -B llama.cpp/build -DCMAKE_BUILD_TYPE=Release -DGGML_NATIVE=ON
cmake --build llama.cpp/build --target llama-cli -j 4

./deploy/run-gemstone.sh \
  NanoSOC-Gemstone-2B-Q4_0.gguf \
  ./llama.cpp/build/bin/llama-cli

For T3 Gemstone itself, run deploy/build-on-gemstone.sh on the board first.

Intended use

• Offline triage of already-normalized SOC events
• Alert prioritization and evidence summarization
• MITRE ATT&CK suggestion with mandatory analyst review
• Edge deployments where events should remain local

Not intended for

• Raw packet/PCAP inspection
• Autonomous blocking, deletion, quarantine or remediation
• Replacing an IDS/IPS, SIEM correlation engine or human analyst
• Treating model confidence as calibrated probability

Training and provenance

• Base model: Qwen/Qwen3.5-2B
• Method: 4-bit NF4 QLoRA, rank 16
• Training mix: 9,129 structured SOC examples; 5,872 insufficient-evidence and 3,257 suspicious decisions
• Frozen holdout excluded from training and checkpoint selection
• Vision encoder removed; these are text-only GGUF packages

License and source notice

The Qwen3.5 base is Apache-2.0. The NanoSOC training mixture contains multiple source/provenance categories, including sources governed by their own terms. Therefore this repository is conservatively tagged license: other; review NOTICE.md and upstream source terms before commercial redistribution.

Turkish / Türkçe

Bu model ham PCAP okumaz; Zeek, Suricata veya Wazuh gibi sensörlerden gelen yapılandırılmış JSON olaylarını analiz eder. Üretilen aksiyonlar otomatik uygulanmamalı, analist onayından geçmelidir. 4 GB Gemstone kartında 2B sürümü için önerilen bağlam 1024 tokendır.

Citation

@software{nanosoc_gemstone_2b,
  author = {GoktugD},
  title = {NanoSOC Gemstone 2B},
  year = {2026},
  url = {https://huggingface.co/GoktugD/NanoSOC-Gemstone-2B-GGUF}
}