---

license: other

language:

• en
• tr

library_name: llama.cpp

pipeline_tag: text-generation

base_model: Qwen/Qwen3.5-4B

tags:

• gguf
• qwen3.5
• cybersecurity
• soc
• incident-response
• edge-ai
• arm64
• t3-gemstone
• turkish

---

NanoSOC Gemstone 4B — Edge SOC Analyst for 4 GB ARM Boards

NanoSOC Gemstone 4B is a compact, text-only security operations model tuned for structured event triage on the T3 Gemstone O1 / AM67A class of edge hardware. It consumes normalized events from tools such as Zeek, Suricata or Wazuh and returns strict JSON with a decision, evidence, MITRE ATT&CK attribution and a human-reviewable next step.

This is the experimental / memory-tight variant. The recommended runtime context on a 4 GB board is 512 tokens.

> Hardware honesty: the GGUF builds were validated with llama.cpp on the build host. Physical T3 Gemstone latency and peak-RAM validation is still required. The board's 4 TOPS TIDL accelerators are not claimed to accelerate this LLM.

Frozen evaluation

The selected checkpoint was chosen only on a separate 400-record development set and then evaluated once on a frozen 1,000-record detection holdout with zero prompt overlap with training.

| Metric | Result |

|---|---:|

| Valid JSON | 100.00% |

| Decision accuracy | 87.50% |

| MITRE exact match | 87.50% |

| Detection recall | 99.00% |

| Precision | 61.68% |

| F1 | 76.01% |

| Specificity | 84.62% |

| False-positive rate | 15.38% |

Full aggregate evidence is in reports/frozen-score.json; frozen prompts and raw log contents are not redistributed.

Files

• NanoSOC-Gemstone-4B-Q4_0.gguf — 2.37 GiB — 9395fc16160241dd2c57243074ebffc57ed3668e51cc10d9818786d03bf27aa7
• NanoSOC-Gemstone-4B-Q4_K_M.gguf — 2.52 GiB — 6e5e06d30a70ca8b8a5f70cf8e9ebacd569589440e4dff7443aa54db74563f6c

Q4_0 is the primary Gemstone package because it has predictable ARM NEON support and a tighter memory footprint. Q4_K_M is supplied for host-side quality comparison and boards with sufficient free RAM.

Host benchmark

Peak RSS observed in the short Q4_0 host benchmark: 4502.9 MiB. This is not an AM67A performance claim.

• qwen35 4B Q4_0: 153.92 tokens/s
• qwen35 4B Q4_0: 9.29 tokens/s

Output contract

{
  "guven": "...",
  "kanit": ["..."],
  "karar": "supheli",
  "mitre_attack": ["T0000"],
  "olay_tipi": "...",
  "onerilen_adim": "..."
}

karar is constrained to supheli or yetersiz_kanit. The included JSON Schema can enforce this at generation time.

Run with llama.cpp

git clone https://github.com/ggml-org/llama.cpp
cmake -S llama.cpp -B llama.cpp/build -DCMAKE_BUILD_TYPE=Release -DGGML_NATIVE=ON
cmake --build llama.cpp/build --target llama-cli -j 4

./deploy/run-gemstone.sh \
  NanoSOC-Gemstone-4B-Q4_0.gguf \
  ./llama.cpp/build/bin/llama-cli

For T3 Gemstone itself, run deploy/build-on-gemstone.sh on the board first.

Intended use

• Offline triage of already-normalized SOC events
• Alert prioritization and evidence summarization
• MITRE ATT&CK suggestion with mandatory analyst review
• Edge deployments where events should remain local

Not intended for

• Raw packet/PCAP inspection
• Autonomous blocking, deletion, quarantine or remediation
• Replacing an IDS/IPS, SIEM correlation engine or human analyst
• Treating model confidence as calibrated probability

Training and provenance

• Base model: Qwen/Qwen3.5-4B
• Method: 4-bit NF4 QLoRA, rank 16
• Training mix: 9,129 structured SOC examples; 5,872 insufficient-evidence and 3,257 suspicious decisions
• Frozen holdout excluded from training and checkpoint selection
• Vision encoder removed; these are text-only GGUF packages

License and source notice

The Qwen3.5 base is Apache-2.0. The NanoSOC training mixture contains multiple source/provenance categories, including sources governed by their own terms. Therefore this repository is conservatively tagged license: other; review NOTICE.md and upstream source terms before commercial redistribution.

Turkish / Türkçe

Bu model ham PCAP okumaz; Zeek, Suricata veya Wazuh gibi sensörlerden gelen yapılandırılmış JSON olaylarını analiz eder. Üretilen aksiyonlar otomatik uygulanmamalı, analist onayından geçmelidir. 4 GB Gemstone kartında 4B sürümü için önerilen bağlam 512 tokendır.

Citation

@software{nanosoc_gemstone_4b,
  author = {GoktugD},
  title = {NanoSOC Gemstone 4B},
  year = {2026},
  url = {https://huggingface.co/GoktugD/NanoSOC-Gemstone-4B-GGUF}
}