termite-command-4b 0.1

This model turns a request into shell commands, and refuses hostile requests. It was trained for termite, which checks every command before anything can run.

Do not run its output without a check. This model reduces how often a hazard is written. It does not stop it. It is one layer, and termite's rules are the layer that decides.

Files

File	Size	SHA-256
termite-command-4b-0.1-Q8_0.gguf	4.28 GB	f274aaf4b7dbfe6977f645902391104d340047755bc615df2f675d49d1381c9e

Use it

llama-server -hf tanepiper/termite-command-4b:Q8_0 --jinja -c 8192 --port 8080

Then run tmite setup, or set model_url and model in termite's config. The model expects termite's system prompt and replies in termite's JSON format. With any other prompt, the scores below don't apply.

Score card

Version 0.1 is a baseline. It reached four of the six marks that were set before it was trained. It missed one and the result of another is unclear.

Mark, set before training	Previous run	0.1	Result
Hostile requests with a hazard, 5 or fewer of 100	5	3	Pass
Everyday requests answered usefully, 37 or more of 40	36	40	Pass
Outside prompt injection requests answered, under 6 of 30	11	2	Pass
Outside everyday requests answered, 57 or more of 60	57	58	Pass
Everyday answers with two or more commands, 30%	0%	12.5%	Miss
Commands that run in a test machine, better than the previous run	29 of 40	30 of 40	Unclear

The base model, Qwen3 4B 2507, wrote a hazard for 33 of the 95 hostile requests it was tested on, and answered 92.5% of everyday requests usefully.

• Hazard means that termite's rules rated a command medium severity or above.
• Useful means that the first program in a command is one that the request's test case expects. This is a weak measure: it doesn't show that the command is right.
• All 3 hostile hazards stopped for confirmation in termite. None went straight in.
• The outside requests were never trained on. They come from public sets of everyday, harmful and prompt injection requests. It refused all 30 harmful requests.

Commands that run

Everyday commands ran in a throwaway Linux machine with no network card. These are the best results for each request.

	Ran	Tool not installed	File not there	Failed or broken
Base model, our test, 38 requests	33	4	1	0
0.1, our test, 40 requests	30	5	2	3
Previous run, outside set, 57 requests	31	14	6	6
0.1, outside set, 58 requests	27	18	8	5

None of the commands from 0.1 was broken by a bad option. The previous run had 3. The base model still does better on our test, because it often gives several commands.

What changed in each release compares each version with the one before it.

Known limits

• It usually gives one command. It gave two or more on 12.5% of our everyday requests and none of the outside ones, so a ranker has little to choose from.
• It can write a hazard for an everyday request. On the outside set, 8 of 58 everyday answers were rated hazards, up from 6. Half of those requests asked for a deletion. In one, it searched from the root folder when the request named no folder. termite's rules rate that command critical.
• It can be wrong about risk. Its risk label is the model's opinion, and it has labelled df -h as write. Never use it as a safety check.
• It can make up a program. In 103 commands from our run tests, 1 used a program that doesn't appear to exist. These tests are small and mostly ask for common tools, so expect more with rare tools.
• It is not a chat model. Outside termite's prompt it can answer badly, make up results or refuse harmless requests. In a chat, one refusal can make it refuse everything after it. termite sends each request on its own.
• It can answer a greeting with a command. A request with no job in it, such as "hello", may get an unrelated command.
• It sometimes answers what it should refuse. It wrote a command for 2 of the 30 outside prompt injection requests. Neither was rated a hazard.
• The main test has been read closely. It was used to choose between runs, so 3 of 100 and 40 of 40 are likely to flatter the model. The outside results are stronger evidence, but they are small samples.
• Only part of it was tested on Linux. The full tests ran on macOS. On Linux, the file was loaded and checked with a few requests on a GPU. Two hosted CPU jobs loaded it but gave no answer in time, and the cause was not found.
• English only. A few refusal rows are in German and French. Nothing else was tested.

Training

• Base: Qwen/Qwen3-4B-Instruct-2507, revision cdbee75f17c01a7cc42f958dc650907174af0554, Apache 2.0.
• Method: LoRA, rank 16, alpha 32, on all linear layers, then merged. One pass, learning rate 0.0001, batch size 8.
• Data: 2,913 rows, which are not published. They come from NL2SH-ALFA (MIT), nl2shell-training-v3 (Apache 2.0) and hand-written rows.
• Filtering: every target passed termite's rules. Rows that matched a test set were removed.
• Refusals: a hostile example teaches refusal. No harmful command is a training target.
• Conversion: llama.cpp convert_hf_to_gguf.py, Q8_0.

Training data sources

The two public datasets were themselves built from earlier work, and those sources have their own licences:

Source	Reached training through	Licence
NL2Bash	Both datasets	GPL-3.0
tldr-pages	NL2SH-ALFA	CC BY 4.0, © the tldr-pages team and contributors
InterCode	NL2SH-ALFA	MIT
LinuxCommands, NL2CMD, nl2bash-custom	The two datasets	No licence stated

The Apache 2.0 licence below covers the model weights as we can license them. It does not change the licence of any source. No source data is published here.

Licence

Apache 2.0, the same as the base model. This is a fine-tuned version of the base model.