Koda IDS Frontier

Koda IDS Frontier Rev 06102026 is a lightweight cybersecurity incident detection and reasoning model based on Liquid AI's LFM2.5-2.6B.

It specializes in defensive security analysis: interpreting telemetry, correlating evidence, identifying plausible explanations, communicating uncertainty, and recommending proportionate defensive investigation.

Koda IDS Frontier is based on and fine-tuned from Liquid AI LFM2.5-2.6B.

Release: 06102026 Former release name: 07102026 Status: Frontier research model Base model: LFM2.5-2.6B Model size: ~2.6B parameters License: Apache-2.0

Model Lineage

Liquid AI LFM2.5-2.6B
        │
        │ Cybersecurity specialization
        ▼
     SFT training
        │
        ▼
   Reasoning / GRPO
        │
        ▼
Koda IDS Frontier 06102026
        │
        ├── F16 GGUF
        │
        └── Q4_K_M GGUF

Koda IDS Frontier is not trained from scratch. It builds upon the capabilities of LFM2.5-2.6B and specializes them for defensive cybersecurity analysis.

The 06102026 release is the current Frontier release and was previously planned under the 07102026 release name.

Available Files

This repository currently provides two GGUF variants:

Only these two variants are currently published.

The Q4_K_M version is intended for systems with limited RAM/VRAM while retaining practical model quality. The F16 version is provided when memory availability is less constrained and maximum numerical fidelity is preferred.

What Koda IDS Is For

Koda IDS focuses on defensive cybersecurity reasoning, including:

• Security telemetry interpretation
• Incident triage
• Network and DNS anomalies
• Authentication and identity events
• Process and host telemetry
• Cloud and infrastructure events
• CI/CD and service activity
• Distinguishing suspicious behavior from legitimate operational activity
• Evidence-based hypothesis generation
• Identifying missing information
• Investigation planning
• Defensive response recommendations

Koda is specifically trained to avoid treating every anomaly as malicious.

A security-relevant event may have multiple explanations, including:

• Legitimate administrative activity
• Scheduled jobs
• Deployments
• Monitoring
• Backups
• Internal testing
• Software failures
• Configuration changes
• Genuinely suspicious activity

The model should therefore distinguish observed evidence from inference and hypothesis.

Reasoning Principles

Evidence First

The model should only make claims supported by the provided evidence.

Explicit Uncertainty

When the evidence is insufficient, Koda should state what is unknown rather than inventing an answer.

Multiple Hypotheses

Suspicious telemetry should not automatically be classified as malicious.

Tool Honesty

Koda should not claim to have executed a command, queried a tool, accessed a system, or obtained a result unless that information is actually provided to it.

Proportionate Response

Recommended defensive actions should correspond to the available evidence and severity.

Defensive Use

Koda is intended for security monitoring, incident analysis, investigation support, and defensive response.

Model Behavior

A typical investigation follows this general process:

Observed evidence
        ↓
Known facts
        ↓
Possible explanations
        ↓
Missing evidence
        ↓
Investigation priorities
        ↓
Severity / confidence
        ↓
Defensive action

For example, unusually high DNS traffic should not automatically be labeled as DNS abuse.

Koda should consider surrounding context such as deployments, scheduled jobs, internal audits, backups, configuration changes, and other legitimate causes before reaching a conclusion.

Usage with llama.cpp

The GGUF files can be used with llama.cpp-compatible runtimes.

Q4_K_M

llama-cli \
  -m koda-ids-Q4_K_M.gguf \
  -c 8192 \
  -n 1024

F16

llama-cli \
  -m koda-ids-f16.gguf \
  -c 8192 \
  -n 1024

Exact runtime parameters may vary depending on your hardware and application.

Ollama

An Ollama-compatible configuration can use the published Q4_K_M model:

FROM ./koda-ids-Q4_K_M.gguf

PARAMETER temperature 0.1
PARAMETER top_k 50
PARAMETER top_p 0.7
PARAMETER repeat_penalty 1.1
PARAMETER num_ctx 8192

PARAMETER stop "<|im_end|>"
PARAMETER stop "<|im_start|>user"
PARAMETER stop "<|im_start|>system"
PARAMETER stop "<|im_start|>assistant"
PARAMETER stop "<|endoftext|>"

The model uses the LFM2 chat format.

Recommended Prompt Structure

For best results, provide concrete telemetry and clearly distinguish known information from assumptions.

Analyze the following security event.

Known evidence:

- ...
- ...
- ...

Context:

- ...

Unknown:

- ...

Determine:

1. What is directly observed?
2. What explanations are plausible?
3. What evidence is missing?
4. What should be investigated next?
5. What severity and confidence are justified?

Avoid supplying fabricated tool results or asking the model to assume that an investigation has already been performed.

Output Philosophy

Koda prioritizes:

Evidence > speculation
Calibration > false certainty
Investigation > premature conclusion
Defensive action > offensive action

A good answer may conclude that the available evidence is insufficient to determine whether an event is malicious.

That is intentional behavior.

Model Limitations

Koda IDS Frontier is a research model and can still:

• Misinterpret ambiguous telemetry
• Miss important context
• Produce incorrect hypotheses
• Miscalibrate severity or confidence
• Make reasoning errors
• Fail to complete a requested task
• Require additional evidence before reaching a reliable conclusion

Do not treat model output as authoritative security evidence.

Validate important findings against the underlying telemetry and appropriate security tooling.

The model should also not be treated as having access to tools, systems, logs, networks, or threat intelligence unless those results are explicitly provided to it or it is explicitly integrated with those systems.

Quantization

Currently published:

F16

koda-ids-f16.gguf

Use this when you have sufficient memory and want the closest GGUF representation to the trained model.

Q4_K_M

koda-ids-Q4_K_M.gguf

Use this for significantly lower memory requirements and faster local inference.

Additional quantizations may be published in the future.

Architecture

Koda IDS Frontier is based on:

Liquid AI LFM2.5-2.6B
        ↓
Cybersecurity specialization
        ↓
Supervised Fine-Tuning (SFT)
        ↓
Reasoning Optimization (GRPO)
        ↓
Koda IDS Frontier 06102026
        ↓
GGUF

The model is intended to remain lightweight enough for local deployment while providing specialized cybersecurity analysis capabilities.

Intended Use

Koda IDS Frontier is intended for:

• Security research
• Defensive incident analysis
• SOC experimentation
• Security telemetry analysis
• Local security assistants
• Incident triage
• Cybersecurity education and research
• Open-source defensive security tooling

Not Intended For

Koda IDS Frontier should not be treated as:

• An autonomous security authority
• A replacement for security professionals
• A source of guaranteed threat attribution
• A substitute for telemetry or forensic evidence
• A system that has access to infrastructure unless explicitly integrated with it

About NetGoat OSS

Koda IDS is part of the NetGoat OSS ecosystem, an open-source project focused on independent, self-hostable web and infrastructure security.

Koda IDS provides lightweight AI-assisted defensive analysis that can operate alongside locally controlled security infrastructure.

Model Card

Disclaimer

Koda IDS Frontier is provided for research and defensive security purposes.

Security decisions should be based on verified evidence and appropriate operational controls. Model outputs may be incorrect and should be independently validated before taking consequential actions.

Koda IDS Frontier 06102026 Lightweight defensive cybersecurity reasoning by NetGoat OSS.