Azoth is the model bundle behind Atomdrift Scan. It takes cleave's report of what a file can do, expressed as MITRE ATT&CK techniques and MBC behaviors, and returns a score. Scan applies your false-positive budget to that score and calls the file benign, suspicious, or hostile.

It is a routed ensemble. One general LightGBM model scores every file. Specialists for 6 file groups and 62 file types score files in their own domain: PE, ELF, JavaScript, PDF, and so on. A file is flagged when any route crosses its threshold. Routing exists because evidence differs by format. A PE's section table is signal. A PDF's stream dictionary is signal. A shell script's token distribution is signal. A generalist trained over all of them learns averages; a specialist learns the format.

Inference runs on CPU with no cloud scoring, telemetry, or per-call cost. Weights, training pipeline, evaluation harness, and capability schema are Apache 2.0. Azoth is model data, not a CLI. Install Scan if you want to scan something.

What azoth does not do

It does not execute samples and it does not read raw bytes. It scores what cleave extracted. If cleave cannot decompose a sample, say an unknown packer or behavior that only appears at runtime, that evidence is missing and azoth cannot score it. Treat a benign verdict as one static-analysis signal, not proof that a file is safe.

Use the bundle

atomscan --model-dir /path/to/azoth suspect.bin

config.json records the deployed thresholds. Each route has its own directory holding a models/seed_*.onnx ensemble and feature_spec.json, the features those models expect. Scores are the models' raw probabilities; there is no separate calibrator. The deployed default is L25: 0.25 expected false positives per million benign files.

Design

No prompt injection. There is no instruction channel. A sample cannot talk the classifier out of its training the way it can an LLM. The attack surface is the feature pipeline, not the model.

Hierarchy-aware. MBC is a tree. Azoth learns combinations across leaves, objectives, and intent, so a set of individually boring capabilities can still trip it when the combination is what real families do.

Local and fast. Small enough for CPU inference and quick enough to scan a full disk on commodity hardware. Same weights on a laptop, a CI runner, or an endpoint agent.

Numbers

Thresholds were fit on a 17.5-million-row partition of the labeled corpus. Published numbers come from a locked 2.2-million-row test partition, disjoint from training and calibration. Per-filetype PR AUC, ROC AUC, F1, and recall at L25 are on GitHub, next to the weights, pipeline, and harness. Read the contributing capabilities, not just the verdict.

Dataset providers

Azoth is only as good as its corpus. Thanks to the people who collect, label, and publish malware samples. The training corpus draws from:

• MalwareBazaar (abuse.ch)
• VirusShare
• Backstabber's Knife Collection
• DataDog Malicious Software Packages Dataset
• VX Underground
• PyPI MalRegistry
• Linux Malware Samples
• Tim (Wadhwa-)Brown's Linux Malware Repo
• JavaScript Malware Collection
• Objective-See macOS Malware Collection
• Practical Security Analytics PE Malware ML Dataset
• Ultimate RAT Collection