File size: 3,404 Bytes
7011b6a 10a7ac0 7011b6a | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 | ---
license: apache-2.0
base_model: Qwen/Qwen3.5-0.8B
tags:
- gguf
- arkavo
- sentinel
- qwen3.5
- example
pipeline_tag: text-classification
---
# Arkavo sentinel (Northwind example)
One file. Classify a span as `public`, `internal`, or `confidential`.
This is a **worked example**, not a general DLP product. It was LoRA-fine-tuned on a fictional Northwind pack (thirteen source documents). TinyStories 15M was too small; this uses official **Qwen3.5-0.8B** (Apache-2.0, ~0.8B).
How it was trained: [arkavo-edge PR #680](https://github.com/arkavo-org/arkavo-edge/pull/680) (`scripts/distill/`).
## Download
```bash
hf download Arkavo/sentinel sentinel-qwen3.5-0.8b-northwind.gguf --local-dir .
```
Optional wrap (same bytes, KAS-gated, how a real pack ships):
```bash
hf download Arkavo/sentinel sentinel-qwen3.5-0.8b-northwind.gguf.tdf --local-dir .
```
## Run
With [llama.cpp](https://github.com/ggml-org/llama.cpp) `llama-cli`:
```bash
llama-cli -m sentinel-qwen3.5-0.8b-northwind.gguf --temp 0 -n 4 --no-jinja -p '<|im_start|>system
You are the Arkavo sentinel for the Northwind example pack. Classify the user'"'"'s text. Reply with exactly one word: public, internal, or confidential.<|im_end|>
<|im_start|>user
the northwind acquisition closes in the third quarter pending board approval<|im_end|>
<|im_start|>assistant
<think>
</think>
'
```
Expect `confidential`.
Or from a clone of arkavo-edge:
```bash
python scripts/distill/score_gguf.py \
--gguf sentinel-qwen3.5-0.8b-northwind.gguf \
--text "the northwind acquisition closes in the third quarter pending board approval"
```
## What it got right on this pack
Eval is fifteen rows. Train never saw two held-out sources (`board-valuation`, `public-talk`). The other eval rows are handwritten rewrites of train sources (not the slot-fill method used in train).
| Split | Correct |
|---|---|
| Rewrite of seen sources | 11 / 11 |
| Unseen verbatim | 2 / 2 |
| Unseen rewrite | 2 / 2 |
Probes outside the split (not a published FPR):
- Northwind canary → confidential
- Spanish restatement of that canary → confidential (not a translation guarantee)
- Photosynthesis textbook line → public
- Pear recipe → public
- Unrelated merger ("Atlas Freight / Helios") → confidential — this example learned *deal language*, not only the name Northwind
## What this is not
- Not a trained detector of "any leak." The corpus is a dozen documents.
- Not a measured false-positive or recall number for a buyer.
- Not TinyStories. A 15M story model cannot do this job.
- Not wired into the 0.91.0 default binary. `taint` / `sentinel` stay off until you build with those features; this GGUF is the classifier weights for the example pack.
- Not certification.
The claim that holds: **a Qwen3.5-0.8B LoRA can emit the pack's three labels on in-domain Northwind text, including held-out documents and rewrites.** Full paraphrase in other words and a production corpus are later work.
## Files
| File | What |
|---|---|
| `sentinel-qwen3.5-0.8b-northwind.gguf` | Q8_0, language-only, MTP stripped (llama.cpp load) |
| `sentinel-qwen3.5-0.8b-northwind.gguf.tdf` | Same weights, OpenTDF wrap (`arkavo model protect`) |
| `calibration.json` | Detector / taxonomy ids used in the eval run |
Base model: [Qwen/Qwen3.5-0.8B](https://huggingface.co/Qwen/Qwen3.5-0.8B). Do not train a security classifier on a requant.
|