Foundation models succeed when they learn in the native structure of a modality, whether morphology-respecting tokens in language or pixels in vision. Wireless packet traces deserve the same treatment: meaning emerges from layered headers, typed fields, timing gaps, and cross-packet state machines, not flat strings. We present Plume (Protocol Language Understanding Model for Exchanges), a compact 140M-parameter foundation model for 802.11 traces that learns from structured PDML dissections. A protocol-aware tokenizer splits along the dissector field tree, emits gap tokens for timing, and normalizes identifiers, yielding 6.2x shorter sequences than BPE with higher per token information density. Trained on a curated corpus, Plume achieves 74-97% next-packet token accuracy across five real-world failure categories and AUROC >= 0.99 for zero-shot anomaly detection. On the same prediction task, frontier LLMs (Claude Opus 4.6, GPT-5.4) score comparably despite receiving identical protocol context, yet Plume does so with > 600x fewer parameters, fitting on a single GPU at effectively zero marginal cost vs. cloud API pricing, enabling on-prem, privacy-preserving root cause analysis.
@article{arxiv.2603.13647,
title = {PLUME: Building a Network-Native Foundation Model for Wireless Traces via Protocol-Aware Tokenization},
author = {Swadhin Pradhan and Shazal Irshad and Jerome Henry},
journal= {arXiv preprint arXiv:2603.13647},
year = {2026}
}
Comments
14-pages, 802.11 foundation model, matches frontier LLMs with 600x fewer params via protocol-aware tokenization, 5 figures, 12 tables, AUROC>=0.99 for zero-shot anomaly detection