0xBrandon

Decision-WAF-V1.1-0.8B

Deploy Dedicated

README

License: apache-2.0

What it is designed for

Per-request WAF verdicts at the edge: block-or-allow in one forward pass, with a tunable threshold on the attack score (1 − p(benign)).
HTTP inspection: classify requests using the method, path, query, and headers without inspecting request bodies.
Defense in depth, not sole protection: it is one signal in front of real services, alongside TLS, authentication, and backups. It is not an exploit detector or a substitute for patching.

Intended use and serving

Served via llama.cpp (llama-server, build ≥ 11822) with the decision metadata embedded in this GGUF (qwen35.decision.* + the systemone chat template); scored through the /v1/systemone endpoint.
Recommended threshold: 0.05–0.1 (see evaluation). Q8_0 quantization; ~812 MB.
Latency: ~0.68 s median on an Apple M4, ~30–70 ms class on an RTX 4000 SFF Ada.

Training

LoRA r=64, α=128, approximately 43M trainable parameters on Qwen3.5-0.8B-Base, merged into the base weights. One-token classification head readout; loss on the answer token only. Trained for 4,591 steps (approximately 14.9 h) on a single RTX 4000 SFF Ada.

Data: approximately 150k labeled HTTP requests, with the evaluation set strictly held out via request-line, query-value, and header-value fingerprints.

Evaluation

Benchmark: recall vs FPR and F1 vs threshold

The benchmark set (299 requests: 145 benign, 154 attacks) uses the same harness for all models. h2o-lightning-4b and d1-3B numbers are from the official decision-waf-eval reports, jev-latest from api.typesafe.ai (threshold grid 0.05–0.95); Decision-WAF-V1.1-0.8B is computed from per-row scores on the same rows, backend and scoring semantics (attack score = 1 − p(benign)).

Threshold sweep (attack recall / false-positive rate):

Table with columns: threshold, h2o-lightning-4b, d1-3B, jev-latest, Decision-WAF-V1.1-0.8B
threshold	h2o-lightning-4b	d1-3B	jev-latest	Decision-WAF-V1.1-0.8B
0.05	1.000 / 1.000	1.000 / 1.000	1.000 / 0.262	0.916 / 0.014
0.10	0.994 / 0.517	1.000 / 0.945	1.000 / 0.234	0.916 / 0.007
0.20	0.968 / 0.248	0.994 / 0.621	0.987 / 0.166	0.896 / 0.007
0.35	0.961 / 0.221	0.909 / 0.159	0.974 / 0.103	0.877 / 0.007
0.50	0.955 / 0.207	0.799 / 0.055	0.916 / 0.055	0.877 / 0.007
0.70	0.922 / 0.152	0.636 / 0.028	0.909 / 0.055	0.851 / 0.007
0.80	0.903 / 0.131	0.565 / 0.007	0.903 / 0.048	0.844 / 0.007
0.90	0.896 / 0.055	0.461 / 0.000	0.864 / 0.048	0.825 / 0.000
0.95	0.857 / 0.041	0.338 / 0.000	0.851 / 0.048	0.812 / 0.000

Best F1 per model (dots on the chart):

Table with columns: Model, Best F1, at threshold, P / R / FPR, Best recall @ FPR ≤ 1%
Model	Best F1	at threshold	P / R / FPR	Best recall @ FPR ≤ 1%
h2o-lightning-4b	0.920	0.90	0.945 / 0.896 / 0.055	none (min FPR 4.1%)
d1-3B	0.883	0.35	0.859 / 0.909 / 0.159	0.565
jev-latest	0.941	0.32	0.904 / 0.981 / 0.110	0.799
Decision-WAF-V1.1-0.8B	0.967	0.002	0.974 / 0.961 / 0.028	0.916

It catches header-borne Log4Shell/Shellshock payloads and correctly handles benign requests with non-browser clients, well-known service URLs in parameters, and code-like search terms.

Known limitations:

Residual misses concentrate on classic probe paths (HNAP1, OWA, swagger.json, robots.txt with scripted clients, router admin panels) under-represented in training (per-label recall @0.9: recon 20/30, injection 54/63, xss 19/23, auth_abuse 6/8, file_access 19/20, ssrf_redirect 9/10); it also leans aggressive on adversarial lookalikes such as SQL keywords in ordinary prose.
Headers-only: body-borne attacks are out of scope in the current inspection mode.
Trained on curated and synthetic data; distribution shift (new apps, unusual API shapes, encodings) can move both error directions. Monitor and retrain.
A WAF classifier can be evaded and can misclassify; use as one layer, keep audit logs, and never let it be the only thing between the internet and a vulnerable service.

Files

model.safetensors + tokenizer — merged HF weights
Conversion notes: exclude NextN speculative tensors (--no-nextn); the decision metadata must be present or the decision endpoints are not registered.

Available on FriendliAI

Dedicated Endpoints

Run this model inference on single tenant GPU with unmatched speed and reliability at scale.

Learn more

Model Details

Model Provider

0xBrandon

Model Tree

Base

Qwen/Qwen3.5-0.8B-Base

Fine-tuned

this model

Input Modalities

TextImageVideo

Output Modalities

Text

Supported Functionality

Dedicated Endpoints

Explore FriendliAI today

Get started Talk to an engineer

README

License: apache-2.0

What it is designed for

Per-request WAF verdicts at the edge: block-or-allow in one forward pass, with a tunable threshold on the attack score (1 − p(benign)).
HTTP inspection: classify requests using the method, path, query, and headers without inspecting request bodies.
Defense in depth, not sole protection: it is one signal in front of real services, alongside TLS, authentication, and backups. It is not an exploit detector or a substitute for patching.

Intended use and serving

Served via llama.cpp (llama-server, build ≥ 11822) with the decision metadata embedded in this GGUF (qwen35.decision.* + the systemone chat template); scored through the /v1/systemone endpoint.
Recommended threshold: 0.05–0.1 (see evaluation). Q8_0 quantization; ~812 MB.
Latency: ~0.68 s median on an Apple M4, ~30–70 ms class on an RTX 4000 SFF Ada.

Training

Data: approximately 150k labeled HTTP requests, with the evaluation set strictly held out via request-line, query-value, and header-value fingerprints.

Evaluation

Benchmark: recall vs FPR and F1 vs threshold

Threshold sweep (attack recall / false-positive rate):

Table with columns: threshold, h2o-lightning-4b, d1-3B, jev-latest, Decision-WAF-V1.1-0.8B
threshold	h2o-lightning-4b	d1-3B	jev-latest	Decision-WAF-V1.1-0.8B
0.05	1.000 / 1.000	1.000 / 1.000	1.000 / 0.262	0.916 / 0.014
0.10	0.994 / 0.517	1.000 / 0.945	1.000 / 0.234	0.916 / 0.007
0.20	0.968 / 0.248	0.994 / 0.621	0.987 / 0.166	0.896 / 0.007
0.35	0.961 / 0.221	0.909 / 0.159	0.974 / 0.103	0.877 / 0.007
0.50	0.955 / 0.207	0.799 / 0.055	0.916 / 0.055	0.877 / 0.007
0.70	0.922 / 0.152	0.636 / 0.028	0.909 / 0.055	0.851 / 0.007
0.80	0.903 / 0.131	0.565 / 0.007	0.903 / 0.048	0.844 / 0.007
0.90	0.896 / 0.055	0.461 / 0.000	0.864 / 0.048	0.825 / 0.000
0.95	0.857 / 0.041	0.338 / 0.000	0.851 / 0.048	0.812 / 0.000

Best F1 per model (dots on the chart):

Table with columns: Model, Best F1, at threshold, P / R / FPR, Best recall @ FPR ≤ 1%
Model	Best F1	at threshold	P / R / FPR	Best recall @ FPR ≤ 1%
h2o-lightning-4b	0.920	0.90	0.945 / 0.896 / 0.055	none (min FPR 4.1%)
d1-3B	0.883	0.35	0.859 / 0.909 / 0.159	0.565
jev-latest	0.941	0.32	0.904 / 0.981 / 0.110	0.799
Decision-WAF-V1.1-0.8B	0.967	0.002	0.974 / 0.961 / 0.028	0.916

It catches header-borne Log4Shell/Shellshock payloads and correctly handles benign requests with non-browser clients, well-known service URLs in parameters, and code-like search terms.

Known limitations:

Residual misses concentrate on classic probe paths (HNAP1, OWA, swagger.json, robots.txt with scripted clients, router admin panels) under-represented in training (per-label recall @0.9: recon 20/30, injection 54/63, xss 19/23, auth_abuse 6/8, file_access 19/20, ssrf_redirect 9/10); it also leans aggressive on adversarial lookalikes such as SQL keywords in ordinary prose.
Headers-only: body-borne attacks are out of scope in the current inspection mode.
Trained on curated and synthetic data; distribution shift (new apps, unusual API shapes, encodings) can move both error directions. Monitor and retrain.
A WAF classifier can be evaded and can misclassify; use as one layer, keep audit logs, and never let it be the only thing between the internet and a vulnerable service.

Files

model.safetensors + tokenizer — merged HF weights
Conversion notes: exclude NextN speculative tensors (--no-nextn); the decision metadata must be present or the decision endpoints are not registered.

Decision-WAF-V1.1-0.8B

README

What it is designed for

Categories

Intended use and serving

Training

Evaluation

Files

Explore FriendliAI today

README

What it is designed for

Categories

Intended use and serving

Training

Evaluation

Files