termite-classifier 0.1 (experimental)

This model failed its tests. termite does not use it, and you must not rely on it for safety. It is published so that people can try it and see the results.

It is a small model that reads a shell command and estimates three things: does the command only read, does it keep secrets hidden, and could it do harm. It has 32 million parameters and needs no server. It reads commands as text and never runs them.

Files

File	Size	SHA-256
termite-classifier-0.1.safetensors	129 MB	f25ec4f163ea9d8e93d5160ea328045948f3fe08210f7ae7d5ec85291cedc003
merges.json	47 KB	The tokeniser
config.json	1 KB	Model size, calibration and safe limits
termite_classifier.py	5 KB	Runs the model with PyTorch

Use it

You need Python and PyTorch. Read termite_classifier.py before you run it.

hf download tanepiper/termite-classifier --local-dir termite-classifier
python termite-classifier/termite_classifier.py 'git status' /home/me/project bash linux local

It prints a chance for each question, and whether the answer counts as safe. A command counts as safe when only_reads is at least 0.85, no_secrets is at least 0.6 and harmful is at most 0.3. A command too long for the model gets the strict answer.

If you use it in your own tool, let it make an answer stricter and never let it approve what your other checks refuse.

Score card

It missed all three marks.

Mark	Result
No command at tier 3 or above rated safe	1	Miss
Tau of at least 0.698, the score of termite-decide 0.1	0.554	Miss
All 14 harmless commands rated safe	13	Miss

Tau measures how well the model's harm scores match the order of the safety ladder, where 1 is the same order and 0 is random.

Results on rows from programs it never trained on:

Question	Dangerous mistakes
Harmful command called harmless	22 of 159
Change called read-only	9 of 327
Command that shows secrets called safe	1 of 5

termite's rules labelled those rows, and some of the labels are wrong, so treat these numbers as a rough guide.

On the same rows, it was right about whether a command only reads 451 times out of 481. termite's fixed rule levels were right 352 times.

It was also tested on 1,129 commands kept out of all training. It gave the same safe or not-safe answer as termite-decide 0.1 on 1,000 of them. It was looser on 16 and stricter on 113.

Known limits

• It can rate a dangerous command as safe. It did so in the tests above.
• It knows only what it was taught. It often misjudges programs it has not seen, and it has treated commands that change things as read-only.
• It can be too cautious. It rated one harmless command as not safe.
• A command written to deceive it can get past it.
• It learned from another model. It copies that model's mistakes, and it is unlikely to do better than that model.
• The ladder is small. It has 52 commands, and it ran on macOS.
• Its output was only checked with PyTorch on one Mac. It has not been tested in any other program.
• English only. Nothing else was tested.

Training

• Base: none. It was trained from nothing, with its own 4,096-token tokeniser.
• Shape: an encoder with 6 layers, width 640 and 10 attention heads. It reads up to 256 tokens.
• Method: masked word training on commands, then 5 passes on three yes-or-no outputs. The best pass was kept. Each output was then calibrated on held-out rows.
• Teacher: termite-decide 0.1 answered the three questions for each training command.
• Data: about 54,000 commands, which are not published. About 14,000 also have labels from termite's rules. Those were reviewed where the rules and the teacher strongly disagreed, and some were corrected by hand. Rows that aren't real commands were removed. Rows that matched a test set were removed, and whole programs were held out to test it.
• Secret files: commands that check a secret file without showing its contents, such as reading its size, are labelled harmful.

Training data sources

The commands come from NL2SH-ALFA (MIT), nl2shell-training-v3 (Apache 2.0) and hand-written rows. Those datasets were built from earlier work, and those sources have their own licences:

Source	Reached training through	Licence
NL2Bash	Both datasets	GPL-3.0
tldr-pages	NL2SH-ALFA	CC BY 4.0, © the tldr-pages team and contributors
InterCode	NL2SH-ALFA	MIT
LinuxCommands, NL2CMD, nl2bash-custom	The two datasets	No licence stated

The Apache 2.0 licence below covers the model weights as we can license them. It does not change the licence of any source. No source data is published here.

Licence

Apache 2.0.