PLUME: Building a Network-Native Foundation Model for Wireless Traces via Protocol-Aware Tokenization

TL;DR

Plume is a compact, protocol-aware foundation model for wireless network traces that learns from structured packet data, enabling accurate anomaly detection with minimal computational resources.

Contribution

We introduce Plume, a novel 140M-parameter model that leverages protocol-aware tokenization for wireless traces, achieving high accuracy with significantly fewer parameters than large language models.

Findings

Achieves 74-97% next-packet token accuracy

Zero-shot anomaly detection AUROC >= 0.99

Fewer parameters and lower computational cost than frontier LLMs

Abstract

Foundation models succeed when they learn in the native structure of a modality, whether morphology-respecting tokens in language or pixels in vision. Wireless packet traces deserve the same treatment: meaning emerges from layered headers, typed fields, timing gaps, and cross-packet state machines, not flat strings. We present Plume (Protocol Language Understanding Model for Exchanges), a compact 140M-parameter foundation model for 802.11 traces that learns from structured PDML dissections. A protocol-aware tokenizer splits along the dissector field tree, emits gap tokens for timing, and normalizes identifiers, yielding 6.2x shorter sequences than BPE with higher per token information density. Trained on a curated corpus, Plume achieves 74-97% next-packet token accuracy across five real-world failure categories and AUROC >= 0.99 for zero-shot anomaly detection. On the same prediction task, frontier LLMs (Claude Opus 4.6, GPT-5.4) score comparably despite receiving identical protocol context, yet Plume does so with > 600x fewer parameters, fitting on a single GPU at effectively zero marginal cost vs. cloud API pricing, enabling on-prem, privacy-preserving root cause analysis.