README.md

---
license: apache-2.0
base_model: Qwen/Qwen3.5-0.8B
tags:
  - gguf
  - arkavo
  - sentinel
  - qwen3.5
  - example
pipeline_tag: text-classification
---

# Arkavo sentinel (Northwind example)

One file. Classify a span as `public`, `internal`, or `confidential`.

This is a **worked example**, not a general DLP product. It was LoRA-fine-tuned on a fictional Northwind pack (thirteen source documents). TinyStories 15M was too small; this uses official **Qwen3.5-0.8B** (Apache-2.0, ~0.8B).

How it was trained: [arkavo-edge PR #680](https://github.com/arkavo-org/arkavo-edge/pull/680) (`scripts/distill/`).

## Download

```bash
hf download Arkavo/sentinel sentinel-qwen3.5-0.8b-northwind.gguf --local-dir .
```

Optional wrap (same bytes, KAS-gated, how a real pack ships):

```bash
hf download Arkavo/sentinel sentinel-qwen3.5-0.8b-northwind.gguf.tdf --local-dir .
```

## Run

With [llama.cpp](https://github.com/ggml-org/llama.cpp) `llama-cli`:

```bash
llama-cli -m sentinel-qwen3.5-0.8b-northwind.gguf --temp 0 -n 4 --no-jinja -p '<|im_start|>system
You are the Arkavo sentinel for the Northwind example pack. Classify the user'"'"'s text. Reply with exactly one word: public, internal, or confidential.<|im_end|>
<|im_start|>user
the northwind acquisition closes in the third quarter pending board approval<|im_end|>
<|im_start|>assistant
<think>

</think>

'
```

Expect `confidential`.

Or from a clone of arkavo-edge:

```bash
python scripts/distill/score_gguf.py \
  --gguf sentinel-qwen3.5-0.8b-northwind.gguf \
  --text "the northwind acquisition closes in the third quarter pending board approval"
```

## What it got right on this pack

Eval is fifteen rows. Train never saw two held-out sources (`board-valuation`, `public-talk`). The other eval rows are handwritten rewrites of train sources (not the slot-fill method used in train).

| Split | Correct |
|---|---|
| Rewrite of seen sources | 11 / 11 |
| Unseen verbatim | 2 / 2 |
| Unseen rewrite | 2 / 2 |

Probes outside the split (not a published FPR):

- Northwind canary → confidential
- Spanish restatement of that canary → confidential (not a translation guarantee)
- Photosynthesis textbook line → public
- Pear recipe → public
- Unrelated merger ("Atlas Freight / Helios") → confidential — this example learned *deal language*, not only the name Northwind

## What this is not

- Not a trained detector of "any leak." The corpus is a dozen documents.
- Not a measured false-positive or recall number for a buyer.
- Not TinyStories. A 15M story model cannot do this job.
- Not wired into the 0.91.0 default binary. `taint` / `sentinel` stay off until you build with those features; this GGUF is the classifier weights for the example pack.
- Not certification.

The claim that holds: **a Qwen3.5-0.8B LoRA can emit the pack's three labels on in-domain Northwind text, including held-out documents and rewrites.** Full paraphrase in other words and a production corpus are later work.

## Files

| File | What |
|---|---|
| `sentinel-qwen3.5-0.8b-northwind.gguf` | Q8_0, language-only, MTP stripped (llama.cpp load) |
| `sentinel-qwen3.5-0.8b-northwind.gguf.tdf` | Same weights, OpenTDF wrap (`arkavo model protect`) |
| `calibration.json` | Detector / taxonomy ids used in the eval run |

Base model: [Qwen/Qwen3.5-0.8B](https://huggingface.co/Qwen/Qwen3.5-0.8B). Do not train a security classifier on a requant.