NetGraphFM-1M

NetGraphFM-1M is a small graph model built for networking work.

The model has 1,028,755 parameters and was trained on network states built from topology, routing, traffic and flow-level performance data.

The main goal was to see whether a very small graph encoder could learn useful representations of network structure and behaviour instead of being trained around only one supervised task.

What the model learns

Training uses three objectives:

1. flow delay, jitter and packet-drop prediction
2. masked node-state reconstruction
3. topology reconstruction

The encoder combines local edge-aware message passing with sparse global attention.

It also uses:

• random-walk structural features
• Laplacian positional features
• grouped-query attention
• QK normalization
• learned global graph tokens
• RMSNorm
• SwiGLU feed-forward blocks

The idea is to make the representation useful even after the original networking prediction heads are removed.

GFMBenchmark 2026

I tested the frozen encoder on GFMBenchmark 2026 using the Exp1 unseen-dataset few-shot transfer setting.

The currently completed overlapping datasets are:

BZR, Chameleon and Wikipedia

Setting	Accuracy	Micro-F1	Macro-F1
1-shot	33.87	33.87	27.19
5-shot	36.28	36.28	31.11

The raw evaluation files are included in the evaluation/ directory.

Accuracy comparison

This compares NetGraphFM-1M against graph foundation models reported in GFMBenchmark 2026 over the datasets that overlap with the completed evaluation run.

Macro-F1 comparison

Macro-F1 is included alongside accuracy because some graph datasets are not perfectly balanced.

1-shot transfer

The 1-shot setting gives the downstream classifier one labelled example per class.

This is useful for checking whether the frozen representation contains enough structure to adapt with very little labelled data.

5-shot transfer

The 5-shot setting gives the downstream classifier five labelled examples per class.

The change between 1-shot and 5-shot gives a rough idea of how easily the representation can be adapted with a small amount of labelled data.

Benchmark summary

The GFMBenchmark results should be read as a transfer experiment.

NetGraphFM was not pretrained on GFMBenchmark's official pretraining collection.

For this evaluation, the NetGraphFM encoder is frozen, each benchmark graph is converted into label-free structural inputs, and a small downstream classifier is trained using the benchmark's few-shot examples.

That makes this mainly a test of how much general graph information survived in a model that was originally trained for networking.

Architecture

NetGraphFM uses a hybrid local-global graph architecture.

Network graph
    │
    ├── Node features
    ├── Edge features
    ├── Random-walk structural encoding
    └── Laplacian positional encoding
            │
            ▼
     Node representations
            │
            ▼
  Edge-aware local message passing
            │
            ▼
   Sparse global graph attention
            │
            ├── Grouped-query attention
            ├── QK normalization
            ├── Global graph tokens
            ├── RMSNorm
            └── SwiGLU
            │
            ▼
      Graph representations
            │
     ┌──────┼───────────────┐
     ▼      ▼               ▼
 Flow KPI  Masked state   Topology
prediction reconstruction reconstruction

Current model size:

Item	Value
Parameters	1,028,755
Hidden size	128
Layers	4
Query heads	4
KV heads	2
Global graph tokens	4
Node feature width	12
Edge feature width	4

Training objectives

The total objective combines three losses:

$$L=L_{\text{flow}}+0.15L_{\text{masked-state}}+0.10L_{\text{topology}}L\; =\; L\_\{\backslash text\{flow\}\}\; +\; 0.15L\_\{\backslash text\{masked-state\}\}\; +\; 0.10L\_\{\backslash text\{topology\}\}$$

Flow prediction

The flow head predicts:

• delay
• jitter
• packet drops

The prediction targets are represented in log space during training.

Masked-state reconstruction

A percentage of the node state is hidden during training.

The model has to reconstruct that state from the surrounding network and the rest of the graph.

Topology reconstruction

The model also learns whether pairs of nodes should be connected.

This gives the encoder a structural objective that is separate from the flow prediction task.

Training data

The first release was trained using BNN-UPC network modelling data.

The compact training setup used network traces based on:

• Abilene
• NOBEL-Germany
• GEANT

Abilene and NOBEL-Germany derived states were used for training and validation.

GEANT was kept as an unseen topology for testing.

The graph representation contains:

• topology
• routing
• traffic state
• source-destination paths
• link information
• node state
• flow-level information

Measured prediction targets are not intentionally exposed as direct input features for the same prediction task.

Potential uses

Network performance modelling

The original training objective makes NetGraphFM a starting point for predicting:

• delay
• jitter
• packet loss
• congestion
• network state changes

Network digital twins

The model can sit beside a network simulator or digital-twin system and provide a learned representation of the current network state.

Possible uses include:

• comparing different network states
• forecasting network behaviour
• ranking candidate changes
• feeding graph embeddings into a larger simulation system

Observability

Node and graph embeddings can be used as features for:

• anomaly detection
• incident grouping
• dependency analysis
• network-state comparison
• root-cause ranking

For a real deployment, I would fine-tune the model on telemetry and incident data from the target environment rather than using the base checkpoint directly.

Routing and traffic engineering

A downstream head can be trained for:

• path scoring
• route comparison
• routing-policy experiments
• traffic engineering
• congestion-aware path selection

Missing telemetry

Masked-state pretraining makes the model useful for experiments where part of the network state is unavailable.

Possible examples include:

• missing counters
• incomplete telemetry
• dropped monitoring signals
• partial topology information
• graph-state reconstruction

Network anomaly detection

The encoder can be fine-tuned to distinguish ordinary network states from unusual ones.

Examples include:

• abnormal traffic shifts
• congestion events
• unexpected path behaviour
• link degradation
• topology changes
• unusual latency patterns
• packet-loss spikes

Incident and root-cause analysis

The graph embeddings can be combined with incident labels or observability events to train downstream models for root-cause ranking.

A larger version could represent:

• routers
• hosts
• services
• containers
• pods
• external endpoints
• network links
• dependencies

inside the same graph.

Capacity planning

Network-state embeddings could be used as inputs to models that estimate whether a topology has enough capacity for a future traffic pattern.

Small graph-model research

At roughly one million parameters, the model is cheap to retrain and useful for:

• architecture ablations
• graph scaling experiments
• distillation
• sparse attention research
• structural positional encoding experiments
• few-shot graph transfer
• topology generalization
• domain-specific graph pretraining

Generic graph transfer

The GFMBenchmark experiment suggests that some of the learned representation transfers outside the original networking domain.

That part is still exploratory.

If generic graph classification is the main goal, a graph foundation model pretrained from the beginning on a broad collection of graph domains would be a more natural starting point.

Limits

This is an experimental research model.

It is not a network simulator.

It should not make production routing, security, reliability or availability decisions by itself.

The first release was trained on a relatively small collection of network topologies.

Performance should be measured on the target network before using it for any operational workflow.

The model also does not directly understand:

• raw packet captures
• natural-language incident reports
• raw application logs
• packet payloads
• arbitrary monitoring formats

Those inputs need to be converted into graph features or handled by another encoder.

The GFMBenchmark adapter is also an external transfer setup.

NetGraphFM was not pretrained on the benchmark's official graph pretraining collection.

The benchmark results shown here currently cover the datasets that completed successfully in the evaluation run rather than the entire GFMBenchmark suite.

Files

• model.pt — trained PyTorch checkpoint
• normalizer.pt — network feature normalization statistics
• config.json — main architecture settings
• evaluation/gfmbenchmark2026_results.json — raw benchmark output
• evaluation/gfmbenchmark2026_results.csv — benchmark table
• assets/01_accuracy_leaderboard.png — accuracy comparison
• assets/02_macro_f1_leaderboard.png — Macro-F1 comparison
• assets/03_dataset_comparison_1shot.png — 1-shot comparison
• assets/04_dataset_comparison_5shot.png — 5-shot comparison
• assets/05_release_card.png — benchmark summary
• assets/06_release_card.png — main release image
• training/summary.json — training summary when available

Loading

import torch

checkpoint = torch.load(
    "model.pt",
    map_location="cpu",
    weights_only=False,
)

state_dict = checkpoint["model"]

print(checkpoint.get("config", {}))

This repository contains a custom PyTorch checkpoint rather than a registered Transformers architecture.

The state dictionary should be loaded into the NetGraphFM PyTorch class used for training.

Current status

This is the first NetGraphFM release.

The main thing I am interested in is whether a very small graph model trained specifically on networking can learn representations that transfer between network topologies and remain useful after the original networking prediction heads are removed.

The GFMBenchmark experiment is an early indication that at least some of that representation transfers beyond the original training domain.