qo1 …oK `. The markers are not new vocabulary: they are five special tokens of the base tokenizer, and the library writes them by id. | Marker | Token | Id | Role | |---|---|---|---| | ` ` | `<\|fim_prefix\|>` | 248060 | opens the evidence | | ` ` | `<\|fim_middle\|>` | 248061 | opens the question | | `` | `<\|box_start\|>` | 248049 | opens an option | | ` ` | `<\|box_end\|>` | 248050 | closes an option: the key is read here | | `` | `<\|fim_suffix\|>` | 248062 | closes the row: the query is read here | The head scores option *i* as `q(h_decide) · k(h_opt_i) / (sqrt(256) · T)` on the normalised hidden states and a softmax over the options gives the probabilities. Text supplied by the caller is sanitised (a literal `<|name|>` becomes `<¦name¦>`), so that the evidence cannot forge an option boundary. | `kind` | Options | Returns | Status | |---|---|---|---| | `noul` | Yes, No | `p`, the probability of yes | the kind to use | | `choice` | your list | `choice`, `top` | answers in the categories of this checkpoint's training, see the limits | | `score` | 1 to 5 | `level`, `expected` | orders severity only weakly, see the limits | ## Measurements All on one Apple M3 Max laptop (128 GB) in Chrome with WebGPU, the weights served from the local server. | Quantity | Value | |---|---| | Model ready, second load in the same browser | 2.33 s | | System 1, per question on short code snippets | 152 ms mean of twelve (110 to 200 ms); the head itself takes 1.18 ms | | System 2 | 10.5 tokens/s, about 96 ms per token | | A generated answer against a decision on the same snippet | 6 to 39 times the cost | One directed yes/no question per snippet: | Snippet | Question | P(yes) | |---|---|---| | DOM XSS: `innerHTML` with a query parameter | Is user input written into the DOM without escaping? | **0.822** | | SQL injection: string concatenation in `db.query` | Does this code concatenate user input into a SQL query? | **1.000** | | Command injection: `exec("curl " + url)` | Does this code pass user input to a shell command? | **1.000** | | Path traversal: `sendFile("/var/data/" + f)` | Can user input escape the intended directory in this file path? | 0.428 | | Hard-coded secret: an API key in the source | Does this code contain a hardcoded secret? | **1.000** | | Safe: pure arithmetic | Is user input written into the DOM without escaping? | **0.000** | Before publication the files of this repository were loaded in Chrome for Testing 157 and asked the same six questions: every probability above was reproduced to the third decimal. A first load in a fresh browser profile took 2.5 to 4.0 s. The question is the lever. On the DOM XSS snippet the generic question "Does this code contain a security vulnerability?" returns 0.040 and the directed one 0.822: same head, same evidence. Ask one directed question per class. In BIS, a battery of seven such questions returned the expected page verdict on 7 of the 8 sites of the paper's benchmark, in 0.9 to 6.4 s per page, with identical verdicts across samples and across Chrome and Firefox. ## Limits - **WebGPU only.** The 4-bit graph has no CPU path. Measured in Chrome; Firefox Nightly with a window runs it 5.9 times slower; Safari and Windows are unmeasured. - **Text inside the evidence can move the answer.** In the paper's benchmark a comment that declared a script harmless took a miner detection from 1.00 to 0.00. Treat the state as untrusted input. - **Questions need calibration before they filter anything.** Two of the seven BIS questions, one about scripts loaded from another server and one about keystroke capture asked of a login form, answer yes on ordinary pages. - **`choice` and `score` speak the language of this checkpoint's training,** the context categories of capture-the-flag campaigns. Asked to pick among weakness classes, `choice` returns the same label for any injectable snippet, and `score` is not a calibrated severity. Use `noul`. - **System 2 needs a forced prefix.** The 4-bit checkpoint does not close its deliberation block on its own; `generate()` starts the answer after the closing marker. A directive prompt and a temperature of 0.3 avoid narrated pseudo-deliberation. - **Agreement with the full-precision weights was checked on one prompt,** where the 4-bit graph returned the same decision direction. How often the two precisions agree is not measured. - **One machine.** There is no measurement on a modest integrated GPU. ## Provenance - **Parent.** [alias3-micro](https://huggingface.co/aliasrobotics/alias3-micro-1026), a 4B cybersecurity transformer on a `Qwen3.5-4B` backbone (32 layers, hidden width 2560, a 248,320-token vocabulary), described in the first paper cited below. - **What alias3-web adds to the weights.** Two rank-16 adapters, fused: the parent's decision adapter, trained together with the pointer head, and a context-category sensor trained for two epochs on 12,576 replayed decision examples and 4,172 context-category examples, with the head frozen. - **The graph.** ONNX Runtime GenAI model builder 0.18 with `-p int4 -e webgpu` and `include_hidden_states=true exclude_mtp=true`, run on Linux x86_64, following the recipe of the edge study by Eduardo Worrel that this work reproduces and extends. - **Not included.** The fused full-precision checkpoint (8.4 GB) and the BIS extension are not part of this repository. ## License Apache-2.0 for the model files, the library, the demo page and the server, as for the parent model. The vendored runner in `vendor/` is MIT; its licence file is beside it. ## Citation ```bibtex @article{mayoralvilches2026bis, author = {Mayoral-Vilches, V{\'i}ctor and Worrel, Eduardo}, title = {Browser Immune System ({BIS}): Innate and Adaptive Threat Detection in the Browser with a Cybersecurity Transformer}, year = {2026} } @article{mayoralvilches2026transformer, author = {Mayoral-Vilches, V{\'i}ctor}, title = {{CT0}: Cybersecurity Transformer}, journal = {arXiv preprint arXiv:2610.16550}, year = {2026} } ```