Architecture

Zero Cloud Dependencies: How We Built Aegis-360M to Run 100% Local Outbound Intelligence on ARM

August 2026 · 6 min read

The paradigm shift: moving away from external LLM APIs — Groq, OpenAI, Anthropic — for automated email generation, lead scoring, and outreach dispatch. The core goal: true operational autonomy, with local feature extraction, security fast-paths, and local generative email modeling running entirely on a Linux ARM edge node.

Aegis-360M: a specialization of SmolLM2-360M-Instruct, fine-tuned via LoRA on real outbound sales and security telemetry, quantized to 4-bit GGUF (Q4_K_M), and served locally via llama.cpp.

Why a 360M Local Model Beats Cloud APIs

Data Privacy & Compliance. Contact records, company enrichment, and outreach history never leave the local runtime memory space. No third-party sees a single prospect.
Zero API Cost & Rate-Limit Immunity. No monthly token bills, no API keys, no exposure to vendor deprecation or outage windows.
Predictable Execution Pacing. Cloud calls jitter from 500ms to 5 seconds. Aegis-360M produces a full 200-token personalized email in 8–10 seconds — comfortably inside the 20-second B2B dispatch window.

Engineered Off the Grid: All 8 LLM Touchpoints Removed

Every inference call was redirected from cloud endpoints to the local systemd daemon aegis-360m.service, running llama-server on 127.0.0.1:8082, configured via aegis360.conf.

Email dispatch — cloud LLM → local Aegis-360M
Follow-up sequences — cloud LLM → local
GBP copy generation — cloud LLM → local
Data enricher — cloud LLM → local + heuristics
Removal request handling — cloud LLM → local
Vision data fill — cloud NIM → headless Playwright / local logic
Active learning pipeline — cloud LLM → local feature extraction
Terminal chat — cloud LLM → local

ARM Benchmarks (Measured)

258 MB

GGUF Q4_K_M footprint

44 tok/s

prompt evaluation

27.1 tok/s

generation, 2× Cortex-A72

~5s

120-token response

8–10s

full outreach email

Domain Adaptation: The LoRA Fine-Tune Pipeline

We trained on curated, real outbound outreach emails — human tone, direct value propositions, precise formatting — plus a dedicated security corpus of hostile/benign traffic for classification. Hyperparameters: rank 16, and a clean conversion path:

HuggingFace LoRA Adapter → convert_lora_to_gguf.py → llama-export-lora → Merged Standalone GGUF

Each stack gets its own adapter — email writes the outreach voice, security classifies traffic — loaded from the same local server. System hygiene in the same pass: removed a Snap-based Chromium disk leak (reclaiming ~4GB) and installed native headless Playwright so the browser layer stays lean alongside the 258MB GGUF.

The Security Stack: Aegis-360M-Sec

Defense is a different job than outreach — it needs classification, not sales prose — so security gets its own LoRA adapter and its own local runtime.

Trained on 17,933 real flagged events from brain.sqlite — hostile and benign traffic with forensic verdicts (threat level, intent category, FBI label, MITRE mapping, nation-state attribution) — plus low-severity/clean traffic for the good side of the balance.
Rank 16 LoRA, 1 epoch, bf16 — converged to a final loss of ~0.48 on the security corpus, fine-tuned to write concise forensic findings from raw incident context.
Shield-check flows through it locally — ambiguous traffic (the 20–50 band) is classified HOSTILE / BENIGN / SUSPICIOUS by the local model instead of a cloud API. Rule-based fast paths still block the obvious cases; the model handles the gray zone.
Dedicated server — the security LoRA is merged and served by its own aegis-360m-sec.service on 127.0.0.1:8083, keeping it isolated from the email model on :8082.
Call-prep, SWOT, threat-intel, and forensic prose now route through the same local engine — call scripts, reports, and incident responses generated on-edge with zero cloud calls.

Every external LLM touchpoint in the security stack is removed the same way as the marketing paths — one local model, two adapters, zero API.

Why This Matters

Most security stacks lean on enormous remote models — seconds of network latency, API overhead, and your prospects' data leaving your infrastructure. Aegis-SIGMA v6 flips it: a precision-tuned 360M model runs everything locally, at deterministic speed, with total data privacy.

Real security requires deterministic speed, complete data privacy, and total local control. "Core" 360M proves you don't need a multi-billion-parameter cloud behemoth for razor-sharp operational awareness.

Pre-release early access is open to a small group of developers, system architects, and security engineers building low-footprint agentic pipelines and edge security protocols. Deployment builds are available on request.