card: CPU support

README.md

@@ -27,7 +27,9 @@ IntraSpanNet names what produced a flow from its first five packets: a security
 
 **DOI:** [10.5281/zenodo.23643146](https://zenodo.org/records/23643146)
 
-**Code and training guide:** [github.com/lupingQAQ/IntraSpanNet](https://github.com/lupingQAQ/IntraSpanNet) — [docs/TRAINING.md](https://github.com/lupingQAQ/IntraSpanNet/blob/main/docs/TRAINING.md)
+**Code and training guide:** [github.com/lupingQAQ/IntraSpanNet](https://github.com/lupingQAQ/IntraSpanNet) — [docs/TRAINING.md](https://github.com/lupingQAQ/IntraSpanNet/blob/main/docs/TRAINING.md)
+
+**Install:** `pip install intraspannet` runs on CPU; `pip install "intraspannet[gpu]"` adds the Triton kernel. Same weights either way.
 
 ## Model details
 
@@ -87,7 +89,7 @@ The test split is a flow-level half of the validation set, not a session-level h
 
 - `stunnel` has zero recall in the acceptance demo (0/30).
 - Flow-level test split; session-level generalization is not measured.
-- CPU inference is not supported. The GDN backbone uses Triton kernels and requires CUDA.
+- CPU inference uses a plain PyTorch port of the GDN block: correct, but about two seconds per flow per arm, so it is for inspection rather than a live probe. `pip install "intraspannet[gpu]"` enables the Triton path.
 - The model was trained on lab traffic. Production performance with different software versions, proxies, or NAT is unknown.
 - The malicious head is a secondary output and is not calibrated for production alerting.