This is a submission for the Gemma 4 Challenge: Write About Gemma 4
What Happens When the Breach Happens Somewhere the World Forgot to Defend
I'm a 21-year-old Cybersecurity and Digital Forensics student at Caribbean Maritime University in Jamaica. My research group spent months building an academic proposal on IoT forensic challenges in the Caribbean — the gap in standards, the resource constraints, the fact that most forensic frameworks were designed for labs that don't exist here.
That research sat in a document. It felt incomplete. Not wrong — just theoretical.
Then I built Threat Trace in 12 days for the Gemma 4 Challenge and something clicked.
The problem I kept running into
Caribbean institutions — hospitals, universities, government facilities — are deploying IoT devices at scale. Smart sensors, networked cameras, connected infrastructure. Most of it is third-party managed, under-resourced, and running firmware that hasn't been updated in years.
When a breach happens, the forensic playbook assumes things that don't exist here. Dedicated forensic hardware. Large IT teams. Vendor support that shows up same-day. Regulatory frameworks that actually map to the local legal environment.
None of that is guaranteed in Jamaica. Most of it isn't there at all.
So when I started thinking about what to build for this challenge, I didn't want to build another generic demo. I wanted to build something that made the problem tangible — not a report you read and forget, but something you feel.
Why a simulator and not a tool
There's a difference between knowing forensic methodology and understanding why it matters.
I've studied the 6-stage forensic process. I know what chain of custody means. But reading about it and making a decision under pressure are different things. The second one sticks.
I built Threat Trace so that when you choose to reboot a compromised sensor instead of isolating it first, you feel it. The integrity meter drops. The feedback tells you exactly what you just destroyed. And then you have to keep going with contaminated evidence.
That's the lesson. Not a textbook explanation — the consequence.
The game generates a full investigation from any IoT incident you describe. Gemma 4 31B reads your scenario and builds 6 forensic stages, each with real decision points, real evidence, and real consequences for wrong choices. At the end you download a forensic report — actual methodology, actual findings, usable outside the game.
How I actually built it
I didn't start with code. I started with a scenario.
"A smart water pressure sensor at a children's hospital in Mandeville began sending encrypted packets during maintenance windows — always 1AM-3AM, never consecutive nights. A nurse in the maternity ward noticed hot water pressure dropped every time the anomaly occurred."
I wrote that prompt and fed it to Gemma 4 through the Google AI Studio API. What came back wasn't what I expected.
Gemma didn't just map an attack technique. It identified a function in the generated firmware called trigger_valve_bleed() — called immediately before send_encrypted_payload(). The physical pressure drop wasn't a side effect. It was a signal. The attacker was using the hospital's water valves as an out-of-band heartbeat to confirm successful exfiltration to a local observer.
I didn't tell Gemma to find that. It reasoned to it from context.
It also caught that the non-consecutive timing was deliberate evasion of threshold monitors. And it noted that a nurse — not IT, not a SIEM alert — was the first line of detection. That detail is the most Caribbean thing in the whole report. And Gemma put it there.
That's when I knew the model could carry this build.
The architecture decision that made it free to run
One API call per investigation. That's it.
When you submit a scenario, Gemma generates everything upfront — all 6 stages, every choice, every consequence, every narrative, the full report. During gameplay there are zero API calls. Every response is instant because it's already computed.
This matters because the communities this tool is meant for can't afford per-request costs at scale. Front-loading the generation makes free 24/7 deployment viable. Cached scenarios cost nothing to replay.
The structured JSON output from Gemma 4 was critical here. The model's thinking mode can produce loose text that breaks parsing. Forcing the output format through the API config takes the parse failure rate from around 50% to near-perfect. The game state is deterministic — the correct answer is pre-computed, so scoring requires no AI at runtime.
Why Gemma 4 31B specifically
Three reasons that weren't negotiable.
Context window. IoT incidents don't happen in isolation. Logs from 12 sensors, network captures, firmware analysis, infrastructure context — it all needs to be in one prompt for the model to reason across it. Gemma 4 31B's 256K context window handles that. Most open models cap at 8K-32K. That's not enough.
Structured output. The game lives or dies on clean JSON. Gemma 4 delivers it when you configure the output correctly.
Open model. The whole point of this build is accessibility. Using a closed API to solve an accessibility problem is a contradiction. Gemma is open. Anyone can run it locally, self-host it, extend it. That matters for the communities this is built for.
What the Caribbean context actually changes
Most forensic simulators are built for abstract environments. Generic corporations, unnamed cities, fictional institutions.
Every case Threat Trace generates is grounded in real Caribbean constraints — NWC managing critical hospital infrastructure remotely, university IT volunteers running forensic investigations with borrowed hardware, JCF Cybercrime Unit reporting requirements, the Jamaica Cybercrime Act.
When Gemma generates a case set in Mandeville or St. Elizabeth, it doesn't just change the location. It changes the available resources, the institutional dynamics, the observation chain. The Mandeville hospital case had a nurse as the first line of detection because the IT team was small and overwhelmed. Gemma inferred that from the context I gave it.
That specificity is what makes the tool feel real rather than academic.
What I actually learned
I started this as a student who'd written a research proposal about IoT forensics in the Caribbean. I finished it having built something that demonstrates the problem more clearly than the proposal did.
The 40/60 score and 70% evidence integrity on my first run through my own simulator told me more about my actual forensic decision-making than any exam has.
Gemma 4 didn't just power the build. It challenged me inside it.
That's what an open model at this capability level makes possible — not just better apps, but tools that give real feedback to the people who need it most, running in environments that can't afford anything else.
🔗 GitHub