pmarquees/blot-mini

Blot Mini: XS, S and M

Built with Mill, the agentic research environment from Succinct Labs. Blot Mini finds API keys and developer-secret spans in text for downstream redaction. Agents authored and edited its neural weights directly, using development feedback and fork-and-flush rounds. There was no gradient training, optimizer fitting, pretrained detector initialization or teacher distillation.

Choose a size, like a model family with several download options. XS, S and M are distinct authored checkpoints with different network sizes and behavior. They are not quantizations of one common model: all three use FP32 coefficients, and no INT4/INT8 version is claimed. The default root download is now M, the frozen uuid2 candidate evaluated on November 6, 2026. XS and S remain available in this same repository with their original inference files unchanged.

Choose a variant

Variant	Role	Checkpoint	Parameters	Inference assets	Download location
Blot Mini XS	Smallest	r3a	257,751	1,044,930 bytes / 1.045 MB	variants/xs/
Blot Mini S	Middle size	precision-a-2026-11-04	2,283,666	9,166,928 bytes / 9.167 MB	variants/s/
Blot Mini M	Highest measured full-CredData F1; default	uuid2-2026-11-05	6,129,296	24,574,583 bytes / 24.575 MB	Repository root

Each variant includes its own Python frontend, frozen NumPy weights and Core ML FP32 package. The sizes above are measured uncompressed inference assets: model.py, weights.npz and bundle/. They exclude dependencies, documentation, examples, compiler caches and application packaging. They are not RAM measurements or the size of downloading the entire multi-variant repository. Every individual bundle is below the 30 MB research cap. A small compressed NPZ is not the deployed dense network size.

The networks have 5,153 input features and 50 / 443 / 1,189 hidden ReLU units for XS / S / M respectively. variants.json provides paths, identities, sizes, hashes and results for programmatic selection.

Same benchmark: all variants versus Gitleaks

Full pinned CredData: 11,030 files, 337 repositories, 15,188 positive annotated locations. The primary metric is detection of unique annotated line ranges, called labeled-location F1. It is not token accuracy or exact-span F1. All rows below use the same corpus revision and scoring rules.

Frozen system	Precision	Recall	Labeled-location F1	Conservative F1
Blot Mini XS — 1.045 MB	58.07%	43.35%	49.64%	42.27%
Blot Mini S — 9.167 MB	71.15%	44.07%	54.43%	50.87%
Blot Mini M — 24.575 MB	77.49%	56.67%	65.46%	61.77%
Stock Gitleaks 8.30.1	85.99%	45.58%	59.57%	58.96%

• XS trails Gitleaks by 9.93 percentage points F1, about 16.7% in relative terms. “Less than 10 points behind” does not mean “less than 10% lower.”
• S improves on XS by 4.79 points F1, while remaining 5.14 points below Gitleaks on this corpus.
• M improves on S by 11.03 points F1 and exceeds Gitleaks by 5.89 points F1. Its conservative F1 is 2.81 points higher than Gitleaks. Gitleaks remains more precise.

System	True positives	Known false positives	False negatives	Unannotated finding lines
XS	6,584	4,755	8,604	4,622
S	6,694	2,714	8,494	1,721
M	8,607	2,500	6,581	1,575
Gitleaks 8.30.1	6,922	1,128	8,266	244

Conservative F1 counts every finding line outside annotated ranges as a false positive. It is a pessimistic sensitivity view, not a claim that all unannotated findings are benign. For M, full labeled-value span coverage is 52.30%, versus 38.75% for S; detecting a labeled line does not guarantee complete redaction of its secret value.

What we can claim

M has the highest measured F1 in this frozen full-CredData comparison. This is a corpus-specific result. CredData informed model development and selection, so the full run is not a fresh independent holdout. It does not establish scanner replacement or superiority on new repositories.

The paired 95% repository-bootstrap interval for M minus Gitleaks F1 is [−16.91, +44.13] percentage points, which includes zero. Performance varies substantially by repository; the higher point estimate does not establish a reliable population-wide advantage. M minus S is +11.03 points, with interval [+4.96, +21.36]. Intervals use 2,000 paired repository resamples, seed 90272.

Gitleaks uses its frozen stock 8.30.1 predictions, rescored with the unchanged evaluator; the results reproduced exactly. The scanner binary was not rerun during M confirmation. The M run completed all 11,030 files with zero file errors on an 8-vCPU Mill sandbox, resuming 5,646 verified saved predictions and evaluating 5,384 missing files. The model, thresholds, features, decoder, data and scorer remained frozen. No active credential verification occurred.

See aggregate results and intervals, the full confirmation report, the scorer, selection protocol, and resume provenance. Raw benchmark text, secret values and per-case predictions are not included in this release.

Other historical evaluations

S also scored 63.95% F1 versus Gitleaks' 52.49% on a separate frozen, balanced sample of 2,000 GitHub issue candidates from distinct repositories. That custom sample uses localized span overlap, not CredData's line-range metric. It is evidence for S, not an M result. XS's historical ProwlBench detection F1 was 86.19% on a reused 24,603-snippet corpus; it is not comparable to the CredData percentages above.

The historical S card, S issue-sample evidence, and historical XS card retain those details and the earlier overlap-audit correction. Trained Blot, detect-secrets and TruffleHog were not rerun in the M confirmation. The old overlap-excluded CredData slice is descriptive, not a restored clean holdout.

How Mill made these models

This is a hybrid detector. A deterministic lexical frontend proposes spans and encodes character, shape and context features. A two-layer ReLU network scores those features using saved authored coefficients; a fixed threshold and overlap decoder select SECRET spans. The graph does not directly ingest strings.

1. XS: the first compact published checkpoint, built through three fork-and-flush rounds. Format and context conditions were encoded as weight-based conjunctions and inhibitory readout coefficients.
2. S: later direct-weight iterations added precision controls for benign URLs, paths, filenames, references and placeholders. Development labels informed the edits; the published S inference files are preserved byte for byte.
3. M: two additional fork-and-flush rounds on CredData. The first round compared independent precision, provider-recall and structural-recall branches. Fresh follow-up authors received the chosen precision parent and concise development-only lessons. A further authored UUID-format neuron won the predeclared selection gate. Only authored_weights() and its permitted prefix specification were editable; the rest of the model AST stayed unchanged from S.

M combines general source-reference inhibitors with a UUID-shaped-value detector requiring length and entropy features and suppressing explicit public/hash context. It does not look up benchmark literal values or paths. Benign UUIDs remain a real failure mode.

The selection split used 1,200 development files and 1,200 different selection files, restricted to files no larger than 128 KiB for iteration. Selection favored F1 while guarding conservative F1, recall and the 30 MB size cap. The final full run included large files too. These splits were separated by file, not repository, and the corpus was already reused. See the round-one trace summary and round-two summary.

No gradients does not mean no examples or no selection: feedback guided direct edits, and the authoring LLMs carry pretrained knowledge. We did not test an equivalent symbolic implementation or a matched-budget single-author control, so we do not claim that neural encoding or branching itself caused the improvement. Larger size alone is not established as the cause either.

Papers and research inspiration

Sparks of Weight-Space Programming: LLMs can natively read & write neural network weights — Rikiya Takehi, Jayden Teoh, Alex Zhang and Omar Khattab, MIT CSAIL; November 2, 2026. This article inspired direct reasoning about and authoring of weight arrays without gradient descent. Blot Mini is our adaptation to a narrow secret-detection task, not an official implementation or reproduction of all the article's experiments.

Fork-and-Flush: Escaping Idea Basins in Autoresearch Agents inspired the workflow of branching into fresh author contexts, evaluating proposals and continuing from the selected candidate. Our branch counts, tasks and evaluation protocol differ from the paper.

Download and run a variant

Download only the variant you want. For the M default, from a Hugging Face CLI installation:

hf download pmarquees/blot-mini --local-dir blot-mini-m \
  --include "model.py" "weights.npz" "requirements.txt" "bundle/*" "examples/*" "frozen.json"
cd blot-mini-m
python3.12 -m venv .venv
source .venv/bin/activate
python -m pip install -r requirements.txt
python model.py < examples/input.jsonl

For XS or S, select its directory instead:

hf download pmarquees/blot-mini --include "variants/xs/*" --local-dir blot-mini
cd blot-mini/variants/xs
# Create the environment and run model.py as above.
# Replace xs with s to select the 9 MB variant.

The repository is public. Inference runs on your machine after download and does not check whether credentials are live. Each input line is JSON with a text field; each output line is a list of {start, end, label} objects. Offsets count Unicode code points, with exclusive ends, not UTF-8 bytes or UTF-16 code units. Scores are not calibrated probabilities.

On macOS 15 or newer, python model.py --coreml uses the packaged Core ML graph. The graph uses iOS 18 / macOS 15 operations and accepts (128, 5153) extracted features. An Apple app still needs the frontend/decoder and appropriate offset conversion; these downloads are not a native iOS SDK or a Transformers AutoModel checkpoint.

The benchmark used 8,192-character windows with 512 overlap, mapped predictions back to original offsets and deduplicated spans. The simple CLI processes each input text directly; use that same windowing to reproduce long-document benchmark behavior. Keep each variant's own model.py, weights.npz and bundle/ together.

Packaging and verification

• XS and S: original inference-file hashes are preserved, with historical native/reference checks retained in each variant directory. Their historical validations are not new M checks.
• M: source and NumPy weights are byte-identical to the remotely benchmarked candidate. Its new Core ML package contains the same FP32 tensors and readout bias byte for byte, with the linear → ReLU → linear graph verified. Native Core ML runtime parity and physical-device behavior were not tested for M. The full benchmark ran through the sparse NumPy implementation.
• Packaging did not execute local inference or author new weights. See Core ML packaging verification and publication validation scope.

M identity	SHA-256
model.py	2615330be6c58c0193cea6b4ba36b30f5ec2cb360480b7e81bed0373068e40db
weights.npz	39c316308e20e70f9a30d136eb78073554018854fc59f830c2f32ebb323f0514

Each variant's frozen.json identifies its inference files. Root SHA256SUMS covers the release files except itself. M's build.py re-exports saved tensors without regenerating the authored weights; serialization metadata can still change. The original XS revision 371716a and S revision 2845fcd remain available. Publishing this family does not update the separate macOS test app.

Limitations and provenance

These are research checkpoints. They can miss secrets, flag benign text and produce incomplete boundaries. They do not scan Git history, reproduce every scanner rule or allowlist, verify credentials online or guarantee safe redaction. Real production prevalence and fully annotated independent traffic may produce very different precision and recall.

Development references included Gitleaks, detect-secrets, SecretBench, the supplied pattern workbook and Blot's synthetic generators. Neither Gitleaks nor detect-secrets is the inference engine or a distillation teacher.

Dataset provenance includes CredData, ProwlBench revision 06f6d2cdf6a64c6d77ffb95a8dfb7abf7913b885 (CC BY-NC 4.0), and the issue-report replication dataset (source receipt: CC BY 4.0). Dataset terms are separate from model publication. This card does not grant new model or dataset license rights. No raw benchmark texts, secret values, per-case predictions or author conversations are redistributed in this family update.