Baller Knowledge UK · System Overview
A language model built from scratch, and the security system built around it - a model that checks instead of guessing, wired into a toolbox any AI can use.
The model
Own tokenizer, own transformer, own training loop - no other model's weights were ever used. The 312M flagship was grown from the 150M with net2net, keeping everything it had already learned.
| Version | Name | Params | What changed |
|---|---|---|---|
| v0.1 | Koachie-0 94M | 91M | First conversational model - instruction-formatted corpus. |
| v0.1.5 | Koachie-0 94M SFT | 91M | First fine-tune on human dialogue - first version that answers in shape. |
| v0.2 | Koachie 150M SFT | 154M | 150M pretrained on 3.28B FineWeb-Edu tokens; first 150M-class chat Koachie. |
| v0.2.1 | V5 150M SFT r2 | 154M | Fine-tune round 2 - val loss 2.594. |
| v0.2.2 | V5 150M SFT r3 | 154M | Fine-tune round 3 - val 2.527, decoder fixes. |
| v0.3 | V5 S1-Phase0 | 154M | Facts Pack drilled (capitals 96%) + multi-turn memory. Val 1.844. |
| v0.4 | 350M Base (mid-train) | 312M | 312M GROWN from the 150M (net2net), ~14B tokens. Base model. |
| v0.4.1 | 350M Base (r2) | 312M | 312M at 156k steps, ~23.7B tokens, val 2.8699. |
| v0.5 | 350M 40B Base (final) flagship | 312M | The finished 40B-token pretrain. Val 2.8042 (record), LAMBADA ppl 148.7. The flagship base. |
The security tools
Each runs locally and quotes its source instead of inventing. The detectors are a reliable floor that never hallucinates; the model is the judge on top.
scam_shield.pyScam & phishing explainerPaste any suspicious message. It scores the risk, lists each red flag, explains why it is dangerous, and cites a source (NCSC / Action Fraud). Rules-based, so it never hallucinates.
provenTakeover scam scored 100/100 with 5 flags; a normal message scored 0.
security_kb.pySecurity knowledge coreAnswers security questions by QUOTING authoritative sources - OWASP Top 10, MITRE ATT&CK, NCSC - plus a live CVE / NVD lookup. It quotes; it does not invent. Model-agnostic: every Koachie version shares it.
provenPulled CVE-2021-44228 (Log4Shell) live: CRITICAL, CVSS 10.0, quoted the official NVD text.
takeover_guard.pyRemote-takeover detectorScans the machine for remote-access tools (AnyDesk, TeamViewer + 13 more) and raises a plain-English STOP. The all-clear can only be given by a trusted person, in person - a remote scammer can never be in the room.
provenClean scan, alert, and the in-person guardian gate all fire correctly.
behaviour_watch.pyAccount-behaviour watcherReads a stream of account events and flags attack patterns: brute force (20 password guesses in 10 seconds) and post-login takeover bursts (password change + new payee + big transfer).
provenCaught both the brute-force and the takeover-burst patterns in test.
koachie_guard.pyThe orchestratorRuns every detector at once, weighs the combined signals into CLEAR / WARN / CRITICAL, and escalates to the human backup. This is the AI's real job - judging combined signals, not detecting from scratch.
provenFired CRITICAL on AnyDesk + banking site + fresh install, and escalated to the registered guardian.
The framework
The same registry holds Koachie's own security tools and hundreds of external ones. A small model uses one tool at a time; a bigger model chains them. The toolbox is fixed - the model gets better at wielding it as it grows.
Rules and lookups. They don't guess and don't hallucinate. Work on day one, no training.
Correlates weak signals, rates severity, explains in plain words, and catches the novel cases no rule covers.
Serious alerts are cleared only by someone the owner chose, in person. A caller can never be in the room.
The live pipes
Every no-key tool was tried one by one; these 220 returned real data, confirmed by the server's content-type. Tap a category to open it.
Straight about it