Agumon, a 2B model as an inline WAF (huggingface.co)

A recent announcement in the AI/ML community introduces Agumon, an innovative language model designed to function as an inline web application firewall (WAF). Developed as a LoRA adapter for the MiniCPM5-2B-Base model, Agumon analyzes raw HTTP requests in a single forward pass to decide whether to allow or block them, targeting to block no more than 0.01% of legitimate requests. In comparative tests against established WAF solutions like OWASP CRS and open-appsec, Agumon demonstrated impressive performance by blocking 98.1% of attacks in its own held-out test while maintaining a remarkably low false positive rate of just 0.0045%, showcasing its potential for effective threat mitigation without compromising legitimate traffic. Significantly, Agumon is intended to complement existing security measures rather than replace them, focusing on specific attack patterns while leaving other threats, such as brute force or credential stuffing, to traditional defenses. The model was trained on a diverse dataset comprising recorded HTTP sessions and various attack payloads, allowing it to excel at detecting a broad range of threats. Technical specifications reveal a latency of around 10.9 milliseconds per request on a single NVIDIA H100 GPU, making it a viable option for real-time application in web security. With ongoing enhancements planned, the release of Agumon could reshape how web applications safeguard against cyber threats, leveraging AI's potential for smarter, adaptive defense systems.