hifazat-edge — the offline brain behind Safe Pakistan

Hey 👋 I'm Noman. This is the small model inside Safe Pakistan (Hifazat = حفاظت = "protection"), our open-source scam shield for Pakistani SMS and WhatsApp users.

Why this model exists

Most scam detectors assume stable internet and English. Pakistan has neither luxury everywhere. So we trained a tiny model that runs locally, offline, on cheap hardware — because a grandmother on a 2G connection in rural Punjab deserves the same protection as a developer in Lahore.

hifazat-edge is Layer 1 of our inference cascade, not a standalone product:

• L0 — sender-reputation prior (never a bypass, only a prior)
• L1 — this model (fast, free, local)
• L2 — gated cloud escalation (Qwen-Max) for borderline confidence only
• L3 — deterministic rules floor that still answers when every AI layer is down

The specs

• Base model: Qwen/Qwen2.5-1.5B-Instruct
• Fine-tuning: LoRA via Unsloth, single Tesla T4 (yes, really — one GPU, one student budget)
• Format: Q4_K_M GGUF, served through Ollama (OpenAI-compatible /v1 endpoint)
• Languages: English, Roman Urdu, Urdu (Nastaliq input)
• Speed: ~2.3s on CPU, sub-second on GPU
• Inference params: temperature 0.1, max_tokens 220, format: json

Output schema

One message in, one strict JSON out: {"verdict":"scam|suspicious|safe","score":0-100,"confidence":0-100,"type":"","redFlags":[],"explanation_en":"","explanation_roman_ur":"","explanation_urdu":""}

The trilingual explanations matter as much as the verdict — a warning nobody can read protects nobody.

Training data (the honest version)

• Real scam typologies reconstructed from NCCIA advisories, SBP fraud alerts and community reports (BISP 8171 fraud, EasyPaisa/JazzCash smishing, CNIC/OTP harvesting). No private user SMS, ever.
• ~1,500 synthetic samples from a Colab permutation pipeline (sender prefixes × PKR amounts × malicious links).
• A deliberately adversarial "suspicious" class: legit messages with exactly one social-engineering tactic injected, to teach the boundary instead of the extremes.
• Roman Urdu templates refined with Kimi, because generic LLMs write Roman Urdu like a robot reading a dictionary.

Numbers we'll defend

155-message blind hold-out, 3 runs:

• Full cascade: 74.8–77.4% vs 46.5% single-model baseline
• Offline-only floor (L1+L3, no cloud): 58.7–61.9% Eval harness ships in the repo (eval-holdout.js). Ranges, not point claims — that's our Honesty Doctrine.

Limitations (we say these out loud)

• It is a classifier, not a wall. ~1 in 4 scams can still slip at L1; the family-alert layer and L3 exist because we know this.
• Nastaliq screenshot OCR is still weak (Phase 2).
• L3's English coverage is deliberately conservative to avoid crying wolf on real bank SMS.
• Live-call detection is not here yet.

Run it

ollama run hf.co/Noman33/hifazat-edge

Where the whole system lives

App, backend, cascade, evals: https://github.com/cyberNoman/Safe-Pakistan PRs, issues and Roman Urdu samples very welcome. If this model stops even one fake BISP message from emptying one pensioner's account — it did its job. 🇵