In the landscape of artificial intelligence, a common assumption reigns: for a model to handle precise, structured syntax translation, it needs billions of parameters. Conventional wisdom suggests that tiny models are too “forgetful” or prone to hallucination for technical workflows.

This experiment challenges that paradigm. By fine-tuning Google’s Gemma-3-270M-IT model specifically on Nmap syntax, I built a 100% offline, CPU-friendly command translator that achieves 90.00% strict accuracy—packaged into a portable shell with real-time output parsing and target-aware tab completion.

It illustrates a profound shift: we are moving away from huge, general-purpose cloud endpoints towards hyper-specialized, local assistants that run in milliseconds on standard CPU cores.

The Architecture of Specialization

Base model LLMs frequently fail at inline command-line generation due to two major flaws:

  1. Attention Drift: They output descriptive preambles instead of raw execution strings.
  2. Flag Hallucination: They confuse closely related arguments (like -sS and -sT) or guess port numbers and script names.

To solve this, I synthesized and merged 1,523 training examples focusing exclusively on Nmap commands:

  • Target Normalization: We substituted host IPs with a {TARGET} placeholder token, allowing the execution shell to safely map targets at runtime.
  • Lazy Network Language: Real-world operations are shorthand. The training set was appended with 123 lazy expressions (such as "ping sweep", "os scan", "vulns") mapped directly to their correct parameters.

Using Unsloth, the model was fine-tuned and quantized to Q4_K_M GGUF format. The final model is just 150MB in size, executing inferences in 20-50ms locally.

Moving Beyond Simple Wrappers: The Interactive Shell

A translator is only as good as the app surrounding it. In my standalone CLI tool (nmap_nl.py), the model is wrapped in an interactive shell that acts as a dynamic coordinator of intent:

  1. Dynamic Parsing: The tool stream-pipes Nmap’s stdout in real-time, extracts open ports (e.g. 445/tcp open), and saves them to a local target database (history.json).
  2. Context-Aware Autocomplete: When you type ports or -p and hit [Tab], the shell queries the history of the active target and suggests only the open ports discovered on that host during previous scans.
  3. Promptless Control: An optional --unsafe flag enables immediate command execution, bypassing the human confirmation prompt.

Benchmark Metrics

Model Checkpoint Training Size Strict Accuracy Functional Accuracy
Gemma-3-270M-IT (Baseline) 0 56.00% 56.00%
Gemma-3-270M-IT (Fine-Tuned) 1,523 90.00% 🚀 94.00% 🚀

If we ignore target-less commands (where the model appended {TARGET} to scans like -iR or -iL), the functional translation accuracy reaches 94.00%.

This experiment proves that small, quantized models running entirely locally can achieve production-grade precision when trained on focused, high-quality datasets.

The code and model weights are open-source and available on GitHub and Hugging Face.