KeiZen-1

KeiZen 1

Tiny binary classifier that detects secrets in .env files.

KeiZen 1 reads KEY=VALUE lines and classifies them as SECRET or NON_SENSITIVE. It runs in <1ms per line on modest hardware — no GPU required.

Highlights

Architecture

Input: "KEY=VALUE line"
         |
         +--> Tokenizer (BERT WordPiece)
         |         |
         |         v
         |    BERT-Tiny (2 layers, 128 hidden, ~4.1M params)
         |         |
         |         v
         |    CLS Embedding (128-dim)
         |         |
         +--> Feature Engine (29 numeric features)
                  |
                  v
             Feature Projection (Linear 29->32 + BN + ReLU, ~1K params)
                  |
                  v
             Feature Vector (32-dim)
                  |
                  v
             Fusion: Concat(128, 32) = 160
                  |
                  v
             Classifier: Linear(160->32) + ReLU -> Linear(32->2)
                  |
                  v
             Softmax -> SECRET | NON_SENSITIVE

Base model: prajjwal1/bert-tiny (2 layers, 128 hidden, 2 attention heads)

Inference Pipeline

User --> Tokenizer --> input_ids + attention_mask --+
        Feature Engine --> 29 numeric features ------+--> KeiZen 1 (ONNX)
                                                            |
                                                    BERT-Tiny + Fusion + Classifier
                                                            |
                                                            v
                                                     logits [0.02, 0.98]
                                                            |
                                                            v
                                                    {"label": "SECRET",
                                                     "confidence": 0.98}

                                          Total latency: ~0.8ms on CPU

Engineered Features (29)

Features
  |
  +-- Entropy
  |     value_entropy, key_entropy
  |
  +-- Length
  |     value_length, key_length, line_length
  |
  +-- Key Patterns
  |     ALL_CAPS, SECRET/KEY/TOKEN, word_count, has_underscore
  |
  +-- Value Patterns
  |     hex, base64, uuid, ip, url, numeric, boolean, common_word
  |
  +-- API Detection
  |     sk_live_ prefix, ghp_ prefix, AKIA prefix, hf_ prefix
  |
  +-- Special
        private_key, jwt, has_@, mixed_case, digit_ratio, alpha_ratio

The model combines raw text embeddings with hand-crafted features:

• Entropy: Shannon entropy of value and key
• Length: value length, key length, line length
• Key patterns: ALL_CAPS, contains SECRET/KEY/TOKEN/PASSWORD, word count
• Value patterns: hex, base64, UUID, IP, URL, numeric, boolean, common word
• API prefixes: sk_live_, ghp_, AKIA, hf_, npm_, etc.
• Special formats: private key, JWT, @ in value, mixed case, digit/alpha ratios

Benchmark Results

Overall Performance

Accuracy by Category

21 of 22 categories at 100%. The only miss: 1 of 4 connection strings misclassified (the model needs @ + password patterns in URIs to be more distinctive).

Latency Analysis

Runs on Modest Hardware

Tested on potato — an Intel i3-6100 @ 3.70GHz, 8GB RAM, no GPU, Debian 13.

potato Results

Same accuracy, same model, <1ms on a 2015 i3. No GPU needed.

Quick Start

ONNX (recommended)

pip install onnxruntime transformers

import onnxruntime as ort
import numpy as np
from transformers import AutoTokenizer

# Load
session = ort.InferenceSession("keizen1_int8.onnx")
tokenizer = AutoTokenizer.from_pretrained("keizen1")

def predict(line):
    enc = tokenizer(line, max_length=64, padding="max_length",
                    truncation=True, return_tensors="np")
    feats = compute_features(line)  # see benchmark.py
    fv = np.array([[feats[k] for k in FEATURE_NAMES]], dtype=np.float32)

    logits = session.run(None, {
        "input_ids": enc["input_ids"].astype(np.int64),
        "attention_mask": enc["attention_mask"].astype(np.int64),
        "features": fv,
    })[0]

    probs = np.exp(logits) / np.exp(logits).sum(axis=1, keepdims=True)
    pred = int(np.argmax(probs))
    return {
        "label": ["NON_SENSITIVE", "SECRET"][pred],
        "confidence": float(probs[0][pred]),
        "is_secret": pred == 1,
    }

# Usage
predict("PORT=3000")
# {'label': 'NON_SENSITIVE', 'confidence': 0.9991, 'is_secret': False}

predict("STRIPE_API_KEY=sk_live_51Nzabc123...")
# {'label': 'SECRET', 'confidence': 0.9847, 'is_secret': True}

PyTorch / SafeTensors

from transformers import AutoTokenizer, AutoModel
import torch

model = KeiZen1.from_pretrained("keizen1")  # see notebook for class definition
tokenizer = AutoTokenizer.from_pretrained("keizen1")

Files

Training

Synthetic Data (24K .env lines)
        |
        v
Feature Engineering (29 features + tokenizer)
        |
        v
Train/Val Split (80/20 stratified)
        |
        v
Fine-tune (8 epochs, LR=3e-5)
        |
        v
Best checkpoint (F1=0.995)
        |
        +---> SafeTensors (16.8 MB)
        +---> ONNX FP32  (16.8 MB)
        +---> ONNX INT8  (4.3 MB)

The model was trained on 24,000 synthetic .env lines (12K SECRET + 12K NON_SENSITIVE):

• Secrets: 100+ API key patterns (Stripe, AWS, GitHub, OpenAI, etc.), JWT tokens, passwords, private keys, DB connection strings, high-entropy strings
• Non-sensitive: ports, environments, hosts, feature flags, timeouts, log levels, booleans, paths, regions, protocols

Train it yourself:

pip install torch transformers scikit-learn onnx onnxruntime
jupyter notebook secret_detector.ipynb

Use Cases

                        KeiZen 1
                            |
          +---------+-------+-------+---------+
          |         |               |         |
          v         v               v         v
    CI/CD       Pre-commit      Code Review  Container
    Pipeline    Hook            Bot          Scanner
          |         |               |         |
          v         v               v         v
    Block .env  Local git       PR comment  Docker inspect
    push if     hook scans      flags       env variables
    secrets     before commit   exposed keys
    found

• CI/CD pipelines: Scan .env files before git push
• Code review: Detect secrets in pull requests
• Secret scanning: Audit configuration files
• Pre-commit hooks: Block accidental secret commits
• Container scanning: Check environment variables in Docker configs

License

apache-2.0