anckursingh/aegis-nano

AegisNano — 6.3M-param SLM for Behavioral Anomaly Detection

The smallest model in the SLM World Registry.

AegisNano is a 6.3-million-parameter transformer trained via knowledge distillation from Llama 3.1 70B to distinguish human behavior from autonomous agent (bot) behavior by analyzing behavioral telemetry sequences.

At just 6.5 MB in INT8 quantized form, it runs on microcontrollers, Raspberry Pis, phones, and browsers.

What It Detects

Threat Model	Description
Slow-Burn Agent	Bots mimicking loyal users over days/weeks before committing fraud
Agent Hijacking	Prompt injection or session hijacking of legitimate AI assistants
Synthetic Biometric	GAN-generated mouse/touch/swipe patterns

Also supports transfer learning for financial fraud detection (Vesta/PaySim) and spyware detection (Pegasus/Predator IoCs).

Architecture

AegisNano Transformer
├── 6 layers, 8 attention heads
├── Hidden dim: 256, FF dim: 1024
├── Rotary Position Embeddings (RoPE)
├── Vocabulary: 1024 tokens (event types + delta-time bins + jitter bins)
├── Max sequence length: 512 tokens
└── Total parameters: 6.3M

Training: Knowledge distillation from Llama 3.1 70B teacher (via Ollama) with combined loss:

• Cross-entropy (hard labels)
• KL divergence (soft labels, temperature 3.0)
• MSE (feature embedding alignment)

Quick Start

import onnxruntime as ort
import numpy as np

# Load the INT8 quantized model (6.5 MB)
session = ort.InferenceSession("model_int8.onnx")

# Tokenize your behavioral sequence (event IDs, delta bins, jitter bins)
input_ids = np.array([[/* your 512 token sequence */]], dtype=np.int64)
attention_mask = np.ones_like(input_ids)

# Run inference
outputs = session.run(None, {
    "input_ids": input_ids,
    "attention_mask": attention_mask
})

# Binary classification
is_bot = outputs[0][0][1] > 0.5
confidence = max(outputs[0][0])
print(f"Bot probability: {outputs[0][0][1]:.4f}")
print(f"Classification: {'BOT' if is_bot else 'HUMAN'} (confidence: {confidence:.4f})")

Performance

Blind Test (1,000 unseen examples)

Metric	Score
F1 Score	0.9262
AUC-ROC	0.9129
Accuracy	87.80%
Precision	94.44%
Recall	90.86%
Generalization Gap	7.38% (under 10% target)

5-Fold Cross-Validation (3,164 examples)

Metric	Mean ± Std	CV
F1 Score	0.9124 ± 0.0108	1.19%
Accuracy	87.45% ± 1.54%	—
Precision	94.83% ± 0.96%	—
AUC-ROC	0.9347 ± 0.0145	—

Hardware Compatibility

Platform	Compatible	RAM (INT8)
Raspberry Pi 5	✅	7 MB
Mobile Phone	✅	7 MB
Consumer GPU (8 GB)	✅	7 MB
CPU Only	✅	7 MB
Apple Silicon	✅	7 MB
Microcontroller	✅ (ONNX)	~10 MB

Files

File	Size	Description
student_distilled_best.pt	25 MB	PyTorch FP32 checkpoint
model_int8.onnx	6.5 MB	ONNX INT8 quantized (deployment)

Deployment

# Export to edge formats
python examples/export_optimized_onnx.py

# Start real-time API
uvicorn src.deployment.fraud_api:app --host 0.0.0.0 --port 8000

# Batch scoring
python examples/detect_anomalies.py --input data/telemetry.jsonl

Citation

@software{aegis-nano-2026,
  author = {Aegis-Edge Team},
  title = {AegisNano: A 6.3M-Parameter SLM for Behavioral Anomaly Detection},
  year = {2026},
  url = {https://huggingface.co/anckursingh/aegis-nano},
}

License

MIT — free for research and commercial use.

Links

• Source Code: github.com/anckursingh/anamoly-detection-slm
• SLM World Registry: taskSLM.github.io/registry