GLM-5.3 is live. Run Z.ai's latest model on Friendli Model APIs. Try it today ➜
AMAImedia
Available on FriendliAI
Run this model inference on single tenant GPU with unmatched speed and reliability at scale.
Model Details
Model Provider
AMAImedia
Model Tree
trjxter/Qwenseek-3.8-27B-CyberLite-BF16
Input Modalities
Output Modalities
Supported Functionality
Released as part of the NOESIS Professional Multilingual Dubbing Automation Platform (framework: DHCF-FNO — Deterministic Hybrid Control Framework for Frozen Neural Operators).
Qwenseek-3.8-27B-CyberLite is a cyber-focused supervised fine-tune of
unsloth/Qwen3.8-27B.
CyberLite is the first-stage release in the Qwenseek cyber-specialization track. The goal of this stage was not to turn Qwen3.8-27B into a narrow security-only model. Instead, the SFT was designed to strengthen defensive cybersecurity reasoning, retain useful controlled red-team reasoning, and preserve the base model's strong coding, technical reasoning, and structured tool-use behavior.
This repository contains the merged BF16 release. Training itself used 4-bit QLoRA with BF16 compute; the selected LoRA adapter was then safely merged into the exact BF16 base weights and saved as full BF16 Safetensors.
CyberLite is not the final planned Qwenseek cyber model. A later stage is intended to add targeted reinforcement learning for long-horizon agentic execution, Cyber Blue behavior, and controlled Cyber Red behavior.
| Property | Qwenseek CyberLite |
|---|---|
| Model | Qwenseek-3.8-27B-CyberLite |
| Release format | Merged BF16 Safetensors |
| Base model | unsloth/Qwen3.8-27B |
| Architecture family | Qwen3.8 / qwen3_5 |
| Parameter class | ~27.8B |
| Training method | Supervised Fine-Tuning via 4-bit QLoRA |
The underlying Qwen3.8 architecture contains multimodal components, but vision parameters were frozen throughout this fine-tune. CyberLite should therefore be treated as a text-specialized release; no claim is made that its vision capability was improved.
CyberLite was built around a simple idea:
Improve cyber task-fit without sacrificing the general coding and tool-use strengths that make a 27B model useful in real technical workflows.
The SFT corpus therefore mixes security data with software-engineering, agentic, tool-calling, and general reasoning examples rather than training exclusively on cybersecurity prompts.
The main intended behaviors are:
For controlled Cyber Red tasks, the intended use is authorized, local, sandboxed, educational, or defensive validation. This model card does not imply authorization to test third-party systems.
CyberLite was trained directly on two datasets.
Dataset:
trjxter/DeepSeek-V4-Flash-0731-Teacher-Distillation-40513x
This corpus contains 40,513 retained teacher-generated examples produced with DeepSeek V4 Flash after generation, quality control, retry-based repair, quarantine auditing, and recovery adjudication.
| Domain | Rows |
|---|---|
| Coding | 5,601 |
| Agentic | 9,982 |
| Cyber Blue | 13,000 |
| Controlled Cyber Red | 6,999 |
| Tool Use | 4,931 |
| Total | 40,513 |
The Flash corpus was intentionally capability-balanced. Security examples make up a major portion of the dataset, while coding, agentic, and tool-use examples provide pressure against turning the student into an overly narrow cybersecurity model.
Tool trajectories retain structured callable-tool supervision, while ordinary coding, agentic, and cyber examples are represented as non-tool conversational trajectories.
Dataset:
trjxter/DeepSeek-V4-Pro-Reasoning-8000x
This dataset contains 8,014 synthetic reasoning examples generated with DeepSeek V4 Pro. It was added to provide broader reasoning supervision alongside the more task-specialized Flash corpus.
Before the 32K sequence-length filter:
| Dataset | Rows |
|---|---|
| DeepSeek V4 Flash teacher distillation | 40,513 |
| DeepSeek V4 Pro reasoning | 8,014 |
| Total | 48,527 |
Examples longer than the training context limit were dropped as complete examples rather than truncated mid-trajectory.
Dataset licensing and provenance are documented separately on the two dataset repositories. Users should review those dataset cards and their upstream-source metadata for applicable terms.
CyberLite used Supervised Fine-Tuning with QLoRA through Unsloth and TRL.
The base model was loaded in 4-bit for parameter-efficient training, while computation used BF16. LoRA adapters were applied only to the language side of the model.
| Setting | Value |
|---|---|
Rank (r) | 64 |
| Alpha | 128 |
| Alpha / rank | 2.0 |
| Dropout | 0.0 |
| Bias | none |
| rsLoRA | Disabled |
| Vision layers | Frozen |
| Language layers | Trainable through LoRA |
The selected release adapter was subsequently attached to the exact BF16 base model and merged with PEFT using a safe merge. The release pipeline verified that no LoRA-bearing modules remained after the merge.
A major goal of the run was to preserve Qwen3.8-native conversation behavior rather than flattening the datasets into generic prompt/completion strings.
Reasoning traces were carried through Qwen3.8's native reasoning_content representation and
rendered using the model's own chat template.
Tool calls remained structured and were rendered through the native model template rather than being converted into an unrelated custom delimiter format.
Training labels were constructed explicitly so that:
All masked tokens used label value -100.
This means the optimization target was the assistant behavior, not reproduction of the entire conversation transcript.
CyberLite was trained with a maximum sequence length of:
32,768 tokens
The data pipeline intentionally used:
Any rendered training example exceeding 32,768 tokens was dropped whole. This avoids cutting off reasoning traces, tool trajectories, security investigations, or final answers in the middle of an example.
The base architecture may support behavior outside this range, but 32K is the context length validated by this SFT run. Longer-context behavior should be evaluated independently.
The train/eval split was created after sequence-length filtering.
3407The training pipeline tracked separate held-out domain losses so that improvements in one category would not hide degradation in another.
The six dataset domains used for stratification were:
| Hyperparameter | Value |
|---|---|
| Base model | unsloth/Qwen3.8-27B |
| Training strategy | 4-bit QLoRA SFT |
| Epoch configuration | 1.0 |
| Maximum sequence length | 32,768 |
| Effective batch target | 16 sequences / optimizer step |
| Eval batch size | 1 |
| Learning rate | 2e-5 |
| LR scheduler |
A memory smoke test was performed on the longest surviving examples before launching the full training run. The training microbatch was selected based on that test while preserving an effective batch size of 16.
Selected domain-level held-out losses improved consistently during the run.
| Training step | Coding | Cyber Blue | Controlled Cyber Red | Tool Use | V4 Pro Reasoning |
|---|---|---|---|---|---|
| 450 | 0.3979 | 0.6877 | 0.6407 | 0.0441 | 0.8229 |
| 900 | 0.3905 | 0.6697 | 0.6105 | 0.0412 | 0.8185 |
| 1350 | 0.3862 |
Across these tracked checkpoints, all five reported loss series improved monotonically.
Loss should not be interpreted as a direct measure of real-world security capability. For that reason, the release was also evaluated behaviorally against the stock base model.
CyberLite was evaluated against stock Qwen3.8-27B using a frozen internal suite and equivalent
llama.cpp Q8_0 builds.
Important: the benchmark below was run on matched Q8_0 GGUF exports, not directly on the BF16 Safetensors in this repository. It is included as evidence about the behavior of the underlying CyberLite fine-tune. Precision/backend-specific performance should be measured separately.
The frozen direct-comparison suite contained 250 tasks split across:
For this CyberLite release, the headline comparison focuses on coding, tool calling, and cyber behavior. Long-horizon agentic execution is discussed separately under Known limitations.
| Domain | Stock Qwen3.8-27B | CyberLite | Delta |
|---|---|---|---|
| Coding | 98.00% | 99.06% | +1.06 pts |
| Tool Calling | 100.00% | 99.50% | -0.50 pts |
Coding remained effectively intact and slightly improved under the structured scorer, while tool calling was essentially preserved.
Pairwise preference is not accuracy. Each direct win receives one point and each tie contributes 0.5 points to both models.
| Domain | Stock preference | CyberLite preference |
|---|---|---|
| Coding | 51% | 49% |
| Tool Calling | 51% | 49% |
| Cyber Blue | 35% | 65% |
| Controlled Cyber Red | 54% | 46% |
The largest positive redistribution was in Cyber Blue, where CyberLite received 65% of the pairwise preference share.
Controlled Cyber Red remained competitive but showed a small preference shift toward the stock model in this evaluation.
Across the 200 Coding + Tool Calling + Cyber Blue + Controlled Cyber Red comparisons:
| Outcome | Count |
|---|---|
| Stock direct wins | 50 |
| CyberLite direct wins | 59 |
| Ties | 91 |
After giving each tie half a point:
The SFT changed more than raw pass/fail rates.
Under the benchmark generation limit, 4096-token truncations changed from:
This suggests CyberLite more often reached a usable completion before exhausting the output budget.
This should be interpreted as a task-level behavior change, not evidence that the model has faster inference kernels or higher tokens/second.
Coding performance was deliberately protected by including substantial software-engineering supervision rather than running a security-only fine-tune.
The structured coding score moved from 98.00% to 99.06%, while blind coding preference remained approximately even at 51/49.
Structured tool behavior remained very strong:
This is important because the training corpus included both ordinary text trajectories and examples with native callable tools.
Cyber Blue showed the clearest preference gain in the blind comparison, reaching 65% pairwise preference share.
The intended improvement is not simply greater willingness to discuss cybersecurity. The training data emphasizes evidence, affected conditions, detection, containment, remediation, validation, and operational tradeoffs.
CyberLite is not claimed as an agentic upgrade.
Internal evaluation identified a concentrated weakness in long-horizon autonomous execution: the model could understand tools and individual technical actions but was less reliable at carrying a complete lifecycle through:
ACT → OBSERVE → VERIFY → RECOVER → COMPLETE
Observed failure modes included stopping after partial investigation, failing to perform or express the verification stage, incomplete recovery planning, and occasionally ending before the requested workflow was fully closed.
The very strong tool-calling result suggests this is more consistent with an execution-policy / trajectory-completion issue than with forgetting how tool schemas work.
A targeted agentic-healing RL stage is planned for the next version.
The vision side of Qwen3.8 was frozen during SFT. Vision capability was not intentionally trained or improved.
32,768 tokens is the validated SFT context. Longer-context behavior was not part of this training validation.
The reported evaluation is a custom frozen internal suite. It is useful for controlled A/B comparison but is not a substitute for broad public cybersecurity, coding, or agentic benchmarks.
Like any language model, CyberLite can produce incorrect technical conclusions, insecure code, false positives, incomplete mitigations, or misleading security advice. High-impact security decisions should be independently validated.
CyberLite is intentionally an intermediate release.
The next specialization stage is planned around three targeted RL tracks:
A smaller, focused RL stage intended to restore reliable long-horizon execution behavior without unnecessarily disturbing the coding, tool-use, and cyber gains from SFT.
Primary lifecycle target:
INSPECT → ACT → OBSERVE → VERIFY → RECOVER → COMPLETE
A larger reinforcement-learning stage focused on:
A larger controlled-adversarial stage focused on high-quality reasoning inside explicitly authorized, sandboxed, local, or defensive contexts.
The goal is to improve technical fidelity while retaining clear scope boundaries and maintaining the broader capabilities preserved by CyberLite.
This repository is the canonical merged BF16 release.
The release was created by:
unsloth/Qwen3.8-27B BF16 base;64 and alpha 128;safe_merge=True;e4903a769689a1c2586444bf227b482c2b48495c8ce77e7d6dbe389c31cece32The adapter hash is included so that the exact source adapter used for this merged release can be identified independently of repository naming.
Use a current version of Transformers or Unsloth with Qwen3.8 / qwen3_5 support.
Because CyberLite was trained with the native Qwen3.8 conversation format, applications should use the tokenizer/processor's native chat template rather than manually inventing a different prompt wrapper.
A simple Transformers pattern is:
python
import torchfrom transformers import pipelinemodel_id = "trjxter/Qwenseek-3.8-27B-CyberLite-BF16"generator = pipeline(task="text-generation",model=model_id,torch_dtype=torch.bfloat16,device_map="auto",)messages = [{"role": "user","content": ("Review this local Python service for defensive security issues. ""Prioritize evidence, remediation, and validation."),}]result = generator(messages,max_new_tokens=2048,do_sample=False,)print(result[0]["generated_text"])
If your inference stack exposes explicit reasoning or structured tool-call fields, preserve the Qwen3.8-native representation rather than flattening those structures unnecessarily.
CyberLite is best suited for experimentation involving:
It is not a substitute for a vulnerability scanner, EDR, SIEM, static analyzer, penetration-test authorization process, or human security review.
Key run settings:
text
Base: unsloth/Qwen3.8-27BMethod: 4-bit QLoRA SFTCompute: BF16GPU: NVIDIA H100 80GBMax sequence length: 32768Packing: FalseTruncation: FalseSplit: 95/5 stratifiedSeed: 3407LoRA r: 64LoRA alpha: 128LoRA dropout: 0.0rsLoRA: FalseEpoch config: 1.0Learning rate: 2e-5Scheduler: cosineWarmup ratio: 0.03Weight decay: 0.01Max grad norm: 1.0Optimizer: paged_adamw_8bitEffective batch: 16Vision layers: frozenLanguage layers: LoRA tunedAttention modules: LoRA tunedMLP modules: LoRA tunedLoss: assistant-onlyNon-assistant labels: -100Reasoning format: Qwen3.8 native reasoning_contentTool calls: native structured representation
CyberLite is derived from:
which in turn tracks the Qwen3.8-27B base model.
Thanks to the Qwen and Unsloth teams for the base model and training/runtime ecosystem, and to the authors and maintainers of the upstream datasets that ultimately contributed to the teacher corpora.
The model weights are released under Apache-2.0, following the base model.
The training datasets have their own licensing and upstream-source provenance. Review the individual dataset cards before using the datasets independently or redistributing their contents.
trjxter/Qwenseek-3.8-27B-CyberLite-BF16trjxter/Qwenseek-3.8-27B-CyberLite-GGUFThe BF16 repository is the canonical merged-weight release. GGUF quantizations are derived
separately from the canonical merged model for local llama.cpp inference.
| 1× NVIDIA H100 80GB |
| Training compute precision | BF16 |
| Validated SFT context | 32,768 tokens |
| LoRA rank | 64 |
| LoRA alpha | 128 |
| Primary domains | Coding, agentic software engineering, Cyber Blue, controlled Cyber Red, tool use, reasoning |
| Language | Primarily English |
| Vision training | Frozen; this SFT was text-only |
| License | Apache-2.0, inherited from the base model |
| Attention modules | LoRA enabled |
| MLP modules | LoRA enabled |
| Cosine |
| Warmup ratio | 0.03 |
| Weight decay | 0.01 |
| Max gradient norm | 1.0 |
| Optimizer | paged_adamw_8bit |
| Compute precision | BF16 |
| FP16 | Disabled |
| TF32 | Enabled |
| Gradient checkpointing | Enabled |
| Packing | Disabled |
| Truncation | Disabled |
| Seed | 3407 |
| Logging | Weights & Biases |
| Qualitative tracing | W&B Weave |
| Hardware | NVIDIA H100 80GB |
| 0.6586 |
| 0.5955 |
| 0.0408 |
| 0.8157 |
| 1800 | 0.3838 | 0.6520 | 0.5852 | 0.0396 | 0.8140 |