GLM-5.2 is live. #1 throughput on OpenRouter, pay-per-token on FriendliAI. Try it today ➜
BeyondMemory
Available on FriendliAI
Run this model inference on single tenant GPU with unmatched speed and reliability at scale.
Model Details
Model Provider
BeyondMemory
Model Tree
unsloth/Qwen3.6-27B
Input Modalities
Output Modalities
Supported Functionality
| Base model | unsloth/Qwen3.6-27B (qwen3_5, hybrid Gated DeltaNet) |
| Parameters | 27B (LoRA adapter, r=32) |
| Precision | bf16 |
| Context window | 4096 tokens (training); base supports more |
| Modality | Text only (the base is vision-language; the vision tower is frozen and unused) |
| License | Apache 2.0 |
CTIBench, official protocol: system prompt "You are a cybersecurity expert specializing in cyberthreat intelligence.", greedy decode, n=500 per task (CTI-ATE uses the full 60-item set). The figure at the top of this card carries the full comparison.
The greedy column is our own measurement of their published model on this harness, at the same protocol we ran ours on. That is the like-for-like comparison. The thinking column, along with GPT-5.4 and Gemini 3.5 Flash, is as reported on the qwen36-secura model card; we did not run those ourselves.
On CTI-MCQ the frontier APIs remain ahead. That task is a closed-book quiz drawn largely from MITRE documentation, so it rewards breadth of memorized knowledge rather than the extraction and scoring work the rest of the benchmark measures.
Benchmark items are never trained on. Training data is decontaminated against every CTIBench split before training, fail closed, and the scores above are raw eval output.
Vulnerability triage (CTI-RCM). Give it a CVE description or an advisory and it returns the CWE weakness class with a short justification. Useful for backlog triage and for normalising vendor advisories that ship without a CWE mapping.
Severity scoring (CTI-VSP). It produces a full CVSS v3.1 base vector, metric by metric. Treat the output as a first-pass estimate to be reviewed, not as an authoritative score.
Report analysis (CTI-ATE). Give it a threat report and the MITRE Enterprise technique list, and it extracts the parent technique IDs. This is the model's strongest task and the one most worth automating.
Knowledge questions (CTI-MCQ). It answers multiple-choice security questions. For open-ended knowledge work a frontier API will generally serve you better; this model is tuned for structured CTI output, not for general recall.
Not intended for offensive tooling, exploit generation, or as an autonomous decision-maker in an incident response chain. Keep an analyst in the loop.
This repository holds the LoRA adapter (~640 MB), not merged weights. The base model
unsloth/Qwen3.6-27B is downloaded separately and the adapter is applied on top, so both loaders below
pull roughly 55 GB on first run.
python
from unsloth import FastLanguageModelmodel, proc = FastLanguageModel.from_pretrained("BeyondMemory/BeyondCTI-27B", max_seq_length=4096, load_in_4bit=False, dtype="bfloat16")tok = getattr(proc, "tokenizer", proc)FastLanguageModel.for_inference(model)SYS = "You are a cybersecurity expert specializing in cyberthreat intelligence."def ask(prompt, max_new_tokens=512):ids = tok.apply_chat_template([{"role": "system", "content": SYS}, {"role": "user", "content": prompt}],add_generation_prompt=True, enable_thinking=False, return_tensors="pt").to(model.device)out = model.generate(ids, max_new_tokens=max_new_tokens, do_sample=False)return tok.decode(out[0][ids.shape[1]:], skip_special_tokens=True).strip()print(ask("Analyze the following CVE description and map it to the appropriate CWE. Ensure the last ""line contains only the CWE ID. CVE Description: A SQL injection in the login form lets a ""remote attacker run arbitrary SQL via the username parameter."))
Serve the base text-only and attach the adapter as a LoRA module:
bash
vllm serve unsloth/Qwen3.6-27B \--enable-lora \--lora-modules beyondcti=BeyondMemory/BeyondCTI-27B \--max-lora-rank 32 \--language-model-only \--reasoning-parser qwen3 \--max-model-len 16384
Then call it with model="beyondcti". If you would rather serve a single merged checkpoint, merge
locally first with PeftModel.from_pretrained(base, adapter).merge_and_unload() and point vLLM at the
output directory.
python
from openai import OpenAIclient = OpenAI(base_url="http://localhost:8000/v1", api_key="EMPTY")r = client.chat.completions.create(model="beyondcti", temperature=0,messages=[{"role": "system", "content": "You are a cybersecurity expert specializing in cyberthreat intelligence."},{"role": "user", "content": "Analyze the following CVE description and calculate the CVSS v3.1 ""vector. Ensure the final line contains only the vector string. ""CVE Description: An unauthenticated remote attacker can execute ""arbitrary code by sending a crafted packet."},])print(r.choices[0].message.content)
Use greedy (temperature=0, do_sample=False) for all four tasks. The model is trained to answer
directly, so thinking mode adds latency without improving the structured tasks.
| Setup | VRAM |
|---|---|
| bf16 inference (adapter on base) | ~60 GB, one 80 GB card |
| 4-bit inference | ~20 GB |
| Fine-tuning (LoRA, bf16, batch 1) | ~70 GB, one 80 GB card |
Trained on a single H200 for one epoch.
| Method | Supervised fine-tuning, LoRA only, no continued pretraining |
| LoRA | r=32, alpha=64, RSLoRA, on q/k/v/o/gate/up/down |
| Schedule | 1 epoch, lr 1e-4 cosine, response-masked, packing off |
| Sequence length | 4096 |
| Hardware | 1× H200 |
CTI-MCQ is a closed-book knowledge test and sits near the base model's ceiling, so fine-tuning moves it very little; frontier APIs score higher there. CTI-ATE is measured on 60 items and carries a wide confidence interval, so read that column as a strong result rather than a settled one. Knowledge is bounded by the base model's cutoff, so recent CVEs and newly documented techniques may be missed. CVSS scoring reflects the conventions of its training distribution and can disagree with a vendor's own rating. General, non-CTI capability is not benchmarked; treat this as a task-specialized model.
bibtex
@misc{beyondcti27b,title = {BeyondCTI-27B: a task-specialized cyber threat intelligence model},author = {BeyondMemory},year = {2026},url = {https://huggingface.co/BeyondMemory/BeyondCTI-27B}}
Built on unsloth/Qwen3.6-27B and trained with Unsloth.
Evaluated on AI4Sec/cti-bench. Comparison figures
for other systems are taken from the qwen36-secura
model card.