Model Description
This adapter conditions the base model to reason over retrieved
ATT&CK context documents rather than relying on parametric memory.
It is designed to be used with a ChromaDB RAG pipeline over the
MITRE ATT&CK enterprise dataset.
This adapter is not useful without the retrieval pipeline.
Training
Table with columns: Parameter, Value| Parameter | Value |
|---|
| Base model | Qwen/Qwen2.5-7B-Instruct |
| Method | QLoRA (4-bit NF4) |
| LoRA rank | 16 |
| Target modules | q_proj, k_proj, v_proj, o_proj |
| Training examples | 1,743 RAFT samples |
| Epochs | 2 |
| Dataset | MITRE ATT&CK STIX v2.1 |
Evaluation (with RAG)
Table with columns: Configuration, Score| Configuration | Score |
|---|
| Base Qwen 2.5 7B, no RAG | 35/80 (43.75%) |
| RAFT adapter, no RAG | 12/80 (15.00%) |
| Base Qwen 2.5 7B + RAG | 67/80 (83.75%) |
| RAFT adapter + RAG | 59/80 (73.75%) |
The 12/80 without RAG is expected and intentional — the model
was trained to depend on retrieval context, not memorize ATT&CK facts.
Intended Use
Threat intelligence queries grounded in MITRE ATT&CK:
- Technique attribution and explanation
- Threat actor TTP profiling
- Tactic-filtered group queries
- Multi-hop ATT&CK relationship analysis
Project
Part of Qwen-ATLAS — an adversarial security research project
studying retrieval poisoning and RAG system vulnerabilities in
threat intelligence contexts.