Arkavo sentinel (Northwind example)

One file. Classify a span as public, internal, or confidential.

This is a worked example, not a general DLP product. It was LoRA-fine-tuned on a fictional Northwind pack (thirteen source documents). TinyStories 15M was too small; this uses official Qwen3.5-0.8B (Apache-2.0, ~0.8B).

How it was trained: arkavo-edge PR #680 (scripts/distill/).

Download

hf download Arkavo/sentinel sentinel-qwen3.5-0.8b-northwind.gguf --local-dir .

Optional wrap (same bytes, KAS-gated, how a real pack ships):

hf download Arkavo/sentinel sentinel-qwen3.5-0.8b-northwind.gguf.tdf --local-dir .

Run

With llama.cpp llama-cli:

llama-cli -m sentinel-qwen3.5-0.8b-northwind.gguf --temp 0 -n 4 --no-jinja -p '<|im_start|>system
You are the Arkavo sentinel for the Northwind example pack. Classify the user'"'"'s text. Reply with exactly one word: public, internal, or confidential.<|im_end|>
<|im_start|>user
the northwind acquisition closes in the third quarter pending board approval<|im_end|>
<|im_start|>assistant
<think>

</think>

'

Expect confidential.

Or from a clone of arkavo-edge:

python scripts/distill/score_gguf.py \
  --gguf sentinel-qwen3.5-0.8b-northwind.gguf \
  --text "the northwind acquisition closes in the third quarter pending board approval"

What it got right on this pack

Eval is fifteen rows. Train never saw two held-out sources (board-valuation, public-talk). The other eval rows are handwritten rewrites of train sources (not the slot-fill method used in train).

Split	Correct
Rewrite of seen sources	11 / 11
Unseen verbatim	2 / 2
Unseen rewrite	2 / 2

Probes outside the split (not a published FPR):

• Northwind canary → confidential
• Spanish restatement of that canary → confidential (not a translation guarantee)
• Photosynthesis textbook line → public
• Pear recipe → public
• Unrelated merger ("Atlas Freight / Helios") → confidential — this example learned deal language, not only the name Northwind

What this is not

• Not a trained detector of "any leak." The corpus is a dozen documents.
• Not a measured false-positive or recall number for a buyer.
• Not TinyStories. A 15M story model cannot do this job.
• Not wired into the 0.91.0 default binary. taint / sentinel stay off until you build with those features; this GGUF is the classifier weights for the example pack.
• Not certification.

The claim that holds: a Qwen3.5-0.8B LoRA can emit the pack's three labels on in-domain Northwind text, including held-out documents and rewrites. Full paraphrase in other words and a production corpus are later work.

Files

File	What
sentinel-qwen3.5-0.8b-northwind.gguf	Q8_0, language-only, MTP stripped (llama.cpp load)
sentinel-qwen3.5-0.8b-northwind.gguf.tdf	Same weights, OpenTDF wrap (arkavo model protect)
calibration.json	Detector / taxonomy ids used in the eval run

Base model: Qwen/Qwen3.5-0.8B. Do not train a security classifier on a requant.