Azoth is the open model bundle behind Atomdrift Scan. It reads cleave's output — MITRE ATT&CK techniques and MBC behaviors extracted from the sample — and produces route-specific model scores and hostile operating points. Scan applies the selected false-positive budget and derives its user-facing benign, suspicious, or hostile verdict.

Anything cleave can decompose can be represented for Azoth: more than 100 source, binary, bytecode, package, archive, document, and configuration formats. A general model covers every recognized input; file-group and file-type specialists handle formats with enough training data.

Inference runs locally on CPU with no cloud scoring, telemetry, or per-call cost. Weights, the training pipeline, and the capability schema are Apache 2.0. Install Atomdrift Scan if you want a scanner; Azoth itself is model data and documentation, not a standalone end-user CLI.

What azoth does not do

It does not execute samples. It does not read bytes. If cleave cannot decompose a sample — unrecognized packer, dynamic loader it cannot follow, control flow it cannot reconstruct — azoth cannot recover — for example an unsupported packer or behavior visible only at runtime — the model cannot score that missing evidence. Treat a benign verdict as one static-analysis signal, not proof that a file is safe.

Use the bundle

atomscan --model-dir /path/to/azoth suspect.bin

The bundle contains config.json, route-specific feature_spec.json files, and ONNX models. Routes may ship one model.onnx or a models/seed_*.onnx ensemble. The current deployed bundle defaults to L25 (0.25 expected false positives per million benign files).

Design

No prompt injection. There is no instruction channel. A malicious sample cannot talk the classifier into ignoring its training the way it can with an LLM. The attack surface is the feature pipeline, not the model.

Hierarchy-aware. MBC is a tree; azoth learns combinations across leaves, objectives, and intent. A set of individually unremarkable capabilities can still trip the model when the combination matches what real families do.

Local and fast. Distilled for CPU inference; fast enough to scan a full disk on commodity hardware. Same weights on a laptop, a CI runner, or an endpoint agent.

Status and numbers

The model is a weighted ensemble — classifiers trained on different slices of the capability space, blended by calibrated weights. TPR, FPR, and per-family breakdowns will be published once the holdout corpus is locked and the thresholds stop moving. Weights, training pipeline, and evaluation harness are on GitHub. Until then: read the contributing capabilities, not just the verdict.

Dataset providers

azoth is only as good as the corpus it learns from. Credit to the researchers and curators who collect, label, and publish malware samples — the training corpus draws from:

• MalwareBazaar (abuse.ch)
• VirusShare
• Backstabber's Knife Collection
• DataDog Malicious Software Packages Dataset
• VX Underground
• PyPI MalRegistry
• Linux Malware Samples
• Tim (Wadhwa-)Brown's Linux Malware Repo
• JavaScript Malware Collection
• Objective-See macOS Malware Collection
• Practical Security Analytics PE Malware ML Dataset
• Ultimate RAT Collection