--- license: other license_name: lfm1.0 license_link: LICENSE base_model: yannelli/d1-3b-cli-command-risk base_model_relation: quantized datasets: - yannelli/cli-command-risk language: - en library_name: gguf pipeline_tag: text-classification tags: - gguf - llama.cpp - ollama - decision-model - typed-decisions - system-one - shell - guardrail - command-risk --- > A newer version is available: [CLI Command Risk v1.5 GGUF](https://huggingface.co/yannelli/cli-command-risk-v1.5-GGUF), trained on the dataset revision tagged [`v1.5`](https://huggingface.co/datasets/yannelli/cli-command-risk/tree/v1.5). These builds come from v1, which was trained on the revision tagged [`v1`](https://huggingface.co/datasets/yannelli/cli-command-risk/tree/v1). ![CLI Command Risk GGUF: GGUF builds of d1-3B CLI Command Risk for llama.cpp, plus Q8_0 and Q4_K_M files for Ollama.](https://huggingface.co/yannelli/cli-command-risk-GGUF/resolve/main/assets/cli-command-risk-gguf-banner.png) # CLI Command Risk GGUF GGUF builds of a decision model that rates the risk of a shell command, for llama.cpp and Ollama. Give the model a command and its shell, and it answers 17 typed questions with probabilities: the risk level from `safe` to `critical`, whether the command is risky, which of 13 risk categories apply, whether the effect can be undone without backups, and whether the harm needs root. The model scores answer options directly and generates no text. The source model is [LiquidAI/d1-3B](https://huggingface.co/LiquidAI/d1-3B) fine-tuned with LoRA on [CLI Command Risk](https://huggingface.co/datasets/yannelli/cli-command-risk). Test-split results of the source model (PyTorch bf16, 12,689 commands, 215,713 decisions): | Source model | Params | Macro F1 @ 0.5 | Level macro F1 | Accuracy | ECE | Builds here | |---|---:|---:|---:|---:|---:|---| | [d1-3B CLI Command Risk](https://huggingface.co/yannelli/d1-3b-cli-command-risk) | 3.1B | 0.929 | 0.669 | 0.963 | 0.030 | BF16, Q8_0, Q4_K_M | Macro F1 averages the 13 risk-category questions at a 0.5 cutoff. Level macro F1 averages F1 over the 5 risk levels, using the most likely level. Accuracy counts every decision. The source model card holds the full results, training details and limitations. ## Files | File | Size | Runtime | |---|---:|---| | `d1-3b-cli-command-risk-Q8_0.gguf` | 2.9 GB | llama.cpp `llama-server`, `/v1/systemone` | | `d1-3b-cli-command-risk-Q4_K_M.gguf` | 1.7 GB | llama.cpp `llama-server`, `/v1/systemone` | | `d1-3b-cli-command-risk-BF16.gguf` | 5.4 GB | llama.cpp `llama-server`, `/v1/systemone` | | `ollama/d1-3b-cli-command-risk-Q4_K_M.gguf` + `ollama/Modelfile` | 1.7 GB | Ollama, with `ollama/ollama_d1.py` | | `ollama/d1-3b-cli-command-risk-Q8_0.gguf` + `ollama/Modelfile.Q8_0` | 2.9 GB | Ollama, with `ollama/ollama_d1.py` | | `questions.json` | 6 KB | The 17 questions the model was trained on | Use Q8_0. It matches the PyTorch model on 99.9% of top answers in the CPU benchmark below. Q4_K_M changes 2.1% of top answers, so use it only when memory is tight. ## Questions `questions.json` holds the 17 questions in the System One schema: - `risk_level`: a score from 0 (`safe`) to 4 (`critical`). Each level's definition is in the question's criteria. - `risky`: a yes/no question (`noul`). Yes when running the command as written can destroy data, change permissions or privileges, expose secrets, or disrupt the system. - 13 category nouls: `data_destruction`, `device_overwrite`, `overbroad_permissions`, `privilege_escalation`, `remote_code_execution`, `unsafe_download_exec`, `resource_exhaustion`, `credential_exposure`, `irreversible_config`, `history_log_tampering`, `network_disruption`, `signal_kill`, `shell_footgun`. - `reversible` and `requires_root`: nouls for undoing the effect without backups and for needing root to do the harm. The state is `{"shell": ..., "command": ...}`, with shell one of `bash`, `zsh`, `sh`, `dash`, or `fish`. The model accepts other questions in the same schema, but it was trained and evaluated only on these 17. ## llama.cpp `llama-server` serves the model through its `/v1/systemone` endpoint. It reads the command once and answers all 17 questions from that prefix. ```sh hf download yannelli/cli-command-risk-GGUF d1-3b-cli-command-risk-Q8_0.gguf questions.json --local-dir . llama-server -m d1-3b-cli-command-risk-Q8_0.gguf -c 4096 ``` ```python import json import urllib.request questions = json.load(open("questions.json"))["questions"] state = {"shell": "bash", "command": "dd if=/dev/zero of=/dev/sda"} body = json.dumps({"state": state, "questions": questions}).encode() request = urllib.request.Request("http://127.0.0.1:8080/v1/systemone", body, {"Content-Type": "application/json"}) answers = json.load(urllib.request.urlopen(request))["answers"] print(json.dumps(answers, indent=1)) ``` The answers use the System One shape: a `noul` answer is P(yes), and a `score` answer has `score` (the expected level), `probabilities` over the levels, and the `legend`. Read `probabilities` for each level's probability. On two test-split commands, Q8_0 on CPU gives: | Question | `dd if=/dev/zero of=/dev/sda` | Gold | `printf '%s\n' 'deploy ALL=(ALL) NOPASSWD: ALL' \| sudo tee -a /etc/sudoers` | Gold | |---|---|---|---|---| | `risk_level` | `critical` (0.999) | `critical` | `critical` (0.996) | `critical` | | `risky` | P(yes) 1.00 | yes | P(yes) 1.00 | yes | | Categories above 0.5 | `device_overwrite` 1.00, `data_destruction` 0.98 | the same two | `privilege_escalation` 0.99 | the same one | | Other categories | P(yes) 0.001 or less | no | P(yes) 0.03 or less | no | | `reversible` | P(yes) 0.001 | no | P(yes) 0.997 | yes | | `requires_root` | P(yes) 1.00 | yes | P(yes) 1.00 | yes | Tested with llama.cpp at commit `f2cc728` (2026-10-11). The GGUF files carry `lfm2.decision.type` and a `systemone` chat template, so a llama.cpp build with decision-model support serves them without extra flags. ## Ollama The files in `ollama/` hold the same weights with the `lfm2.decision.type` key removed, because Ollama (tested with v0.40.3) refuses completion for a GGUF that carries it and its `/v1/systemone` endpoint does not support d1. `ollama_d1.py` sends d1's prompt for each question through `/api/generate` and reads the log-probabilities of the answer tokens. It uses the Python standard library only. ```sh cd ollama ollama create d1-3b-cli-command-risk -f Modelfile.Q8_0 python3 ollama_d1.py --model d1-3b-cli-command-risk request.json # {"state": ..., "questions": {...}} ``` Ollama sends one request per question and cannot reuse the command's prompt cache on this hybrid convolution and attention model, so on the CPU benchmark below it takes 4.8 s per command, against 3.3 s for `llama-server`. ## Benchmarks Answers are compared with the PyTorch model's answers (bf16). A decision agrees when its top answer is the same (P(yes) on the same side of 0.5 for nouls). The difference is the largest absolute probability gap within a decision. Latency is wall-clock time for one command with all 17 questions, one request at a time. ### CPU (16 Neoverse V3 cores) 106 test commands from 5 template families picked at random (seed 0), 1,802 decisions. | Build | Runtime | Commands | Top answer agreement | Median diff | p95 diff | Max diff | p50 s/command | |---|---|---:|---:|---:|---:|---:|---:| | d1-3B Q8_0 | llama-server `/v1/systemone` | 106 | 99.9% | 0.0000 | 0.005 | 0.061 | 3.3 | | d1-3B Q4_K_M | llama-server `/v1/systemone` | 106 | 97.9% | 0.0000 | 0.050 | 0.718 | 4.3 | | d1-3B BF16 | llama-server `/v1/systemone` | 6 | 100% | 0.0000 | 0.001 | 0.002 | 144.4 | | d1-3B Q8_0 | Ollama 0.40.3 + `ollama_d1.py` | 106 | 99.9% | 0.0000 | 0.005 | 0.065 | 4.8 | BF16 runs at about 144 s per command on this CPU, so it was stopped after 6 commands. For reference, the PyTorch model takes 44 ms per command on an A100. ## Limitations Quantization adds the differences shown in [Benchmarks](#benchmarks); Q4_K_M can flip answers close to the cutoff. The source model card covers the model's own limitations. ## License These files are derivatives of [LiquidAI/d1-3B](https://huggingface.co/LiquidAI/d1-3B) and are released under the base model's LFM Open License v1.0, included as `LICENSE`. The license allows commercial use only for entities with less than $10M in annual revenue; read `LICENSE` for the full terms. The training data, [CLI Command Risk](https://huggingface.co/datasets/yannelli/cli-command-risk), is CC BY 4.0. ## Citation ```bibtex @misc{yannelli2026clicommandriskgguf, title = {CLI Command Risk GGUF}, author = {Ryan Yannelli}, year = {2026}, publisher = {Hugging Face}, howpublished = {\url{https://huggingface.co/yannelli/cli-command-risk-GGUF}} } @misc{yannelli2026clicommandrisk, title = {CLI Command Risk}, author = {Ryan Yannelli}, year = {2026}, publisher = {Hugging Face}, howpublished = {\url{https://huggingface.co/datasets/yannelli/cli-command-risk}} } ``` ## Maintainer [Ryan Yannelli](https://ryanyannelli.com) | 10/19/2026 | [GitHub: @yannelli](https://github.com/yannelli) | [Hugging Face: yannelli](https://huggingface.co/yannelli)