PLUME: Building a Network-Native Foundation Model for Wireless Traces via Protocol-Aware Tokenization

2026-03-13

AI Summary

This work addresses the limitations of conventional large language models, which disregard the protocol structure of wireless packets, thereby constraining modeling efficiency and analytical capability. To overcome this, the authors propose PLUME, a native foundation model tailored for 802.11 traffic, featuring a protocol-aware tokenization mechanism that converts PDML parsing outputs into high-semantic-density token sequences. This approach preserves field hierarchy, inter-packet timing intervals, and state dependencies while significantly compressing sequence length. Built upon a 140M-parameter Transformer architecture and leveraging self-supervised pretraining with zero-shot inference, PLUME achieves 74–97% next-packet prediction accuracy across five real-world fault scenarios and attains zero-shot anomaly detection AUROC scores of at least 0.99—matching the performance of trillion-scale models while reducing parameter count by over 600×.

Technology Category

• Planning, Routing, and Scheduling: Planning with Language Models
• Machine Learning: Large Multimodal Models (LMMs)
• Natural Language Processing: (Large) Language Models

Application Category

• User Modeling, Personalization and Recommendation: Large Language Models (LLM) for user modeling and recommendation
• Graph Algorithms and Modeling for the Web: Foundation models and LLMs for Web-related graphs
• Systems and Infrastructure for Web, Mobile and WoT: Applied ML and AI for Web-based mobile applications

Abstract

Foundation models succeed when they learn in the native structure of a modality, whether morphology-respecting tokens in language or pixels in vision. Wireless packet traces deserve the same treatment: meaning emerges from layered headers, typed fields, timing gaps, and cross-packet state machines, not flat strings. We present Plume (Protocol Language Understanding Model for Exchanges), a compact 140M-parameter foundation model for 802.11 traces that learns from structured PDML dissections. A protocol-aware tokenizer splits along the dissector field tree, emits gap tokens for timing, and normalizes identifiers, yielding 6.2x shorter sequences than BPE with higher per token information density. Trained on a curated corpus, Plume achieves 74-97% next-packet token accuracy across five real-world failure categories and AUROC >= 0.99 for zero-shot anomaly detection. On the same prediction task, frontier LLMs (Claude Opus 4.6, GPT-5.4) score comparably despite receiving identical protocol context, yet Plume does so with > 600x fewer parameters, fitting on a single GPU at effectively zero marginal cost vs. cloud API pricing, enabling on-prem, privacy-preserving root cause analysis.

Problem

• wireless traces
• protocol-aware tokenization
• foundation model
• 802.11
• anomaly detection

Innovation

• protocol-aware tokenization
• foundation model
• wireless packet traces
• zero-shot anomaly detection
• structured PDML dissection