ADBait-1B-FP16

ADBait: Dynamic Android ADB Honeypot

ADBait is a fine-tuned language model designed to act as the backend brain for a dynamic Android Debug Bridge (ADB) honeypot. Built on top of ibm-granite/granite-4.0-h-1b, this model is trained to generate highly convincing, context-aware Android 14 shell environments to trap, delay, and analyze automated exploitation scripts and human attackers.

Rather than relying on static, hardcoded directory trees or predictable regex responses, ADBait generates realistic synthetic terminal outputs on the fly. Attackers will find outputs to be filled with accurate, dynamic data, such as popular installed user apps.

Model Details

• Architecture: LoRA merged into base model as FP16.
• Base Model: ibm-granite/granite-4.0-h-1b
• Target Environment: Android 14 (API Level 34) shell simulation.
• Format: Merged FP16

Training Data

This model was fine-tuned exclusively against the TitleOS/ADB-CursedHoneycomb dataset. The dataset consists of 250 curated, synthetic ChatML conversational structures mapping standard, aggressive, and exploratory ADB commands to their corresponding Android 14 outputs generated by Gemini 3.1 Flash-Lite.

Hardware & Fine-tuning

Training was executed on a single NVIDIA Tesla P40 (24GB VRAM). Due to the Pascal architecture's hardware constraints, the training pipeline utilized QLoRA in 4-bit precision with a strict float16 compute type to bypass the lack of bfloat16 and Flash Attention support. The resulting LoRA adapter is available in this repo.

Intended Use

ADBait is meant for security researchers and network administrators. Deploy this model behind a socket listener handling the ADB protocol handshake. Once the handshake completes, pipe the incoming shell commands directly into the model as user prompts, and return the model's generation to the socket as the shell output.

License

See license.md for the modified Mozilla Public License 2.0 license this model is provided under.

Disclaimer: This is a honeypot tool. Do not use this model as a source of factual Android documentation, as it is explicitly trained to hallucinate directory structures, process lists, and system variables to deceive attackers. Do not give ADBait access to real data.