GLM-5.3 is live. Run Z.ai's latest model on Friendli Model APIs. Try it today ➜
Pankei
Available on FriendliAI
Run this model inference on single tenant GPU with unmatched speed and reliability at scale.
Run this model inference with full control and performance in your environment.
Model Details
Model Provider
Pankei
Model Tree
Qwen/Qwen3-14B
Input Modalities
Output Modalities
Supported Functionality
SOC Narrative is a framework for insider threat detection using small open-weight LLMs. A model receives a user/day window of events from the CERT Insider Threat Dataset R4.2 and must produce a structured response with:
normal, suspicious, or maliciousThis project explores whether small LLMs (3B–14B) can match or exceed traditional ML baselines for UEBA (User and Entity Behavior Analytics).
| Metric | Value |
|---|---|
| Accuracy | 0.84 |
| Macro F1 | 0.839 |
| Recall Malicious | 0.76 |
| Valid Format Rate | 0.86 |
| Actionability Rate | 0.78 |
python
from transformers import AutoModelForCausalLM, AutoTokenizerfrom peft import PeftModel base = "Qwen/Qwen3-14B"model = AutoModelForCausalLM.from_pretrained(base, torch_dtype="auto", device_map="auto")model = PeftModel.from_pretrained(model, "Pankei/soc-narrative-grpo-strict128-qwen3-14b") tokenizer = AutoTokenizer.from_pretrained(base)inputs = tokenizer("<your prompt>", return_tensors="pt").to(model.device)output = model.generate(**inputs, max_new_tokens=256)print(tokenizer.decode(output[0]))Note: This is a LoRA adapter (~30–160 MB). You need the full base model (Qwen/Qwen3-14B) to load it.
bibtex
@misc{soc-narrative-2026, author = {Research project}, title = {SOC Narrative: Small LLMs for UEBA / Insider Threat Detection}, year = {2026}, howpublished = {\url{https://github.com/Pancake2021/research_work_by_a_student}}}from transformers import AutoModelForCausalLM, AutoTokenizerfrom peft import PeftModel base = "Qwen/Qwen3-14B"model = AutoModelForCausalLM.from_pretrained(base, torch_dtype="auto", device_map="auto")model = PeftModel.from_pretrained(model, "Pankei/soc-narrative-grpo-strict128-qwen3-14b") tokenizer = AutoTokenizer.from_pretrained(base)inputs = tokenizer("<your prompt>", return_tensors="pt").to(model.device)output = model.generate(**inputs, max_new_tokens=256)print(tokenizer.decode(output[0]))@misc{soc-narrative-2026, author = {Research project}, title = {SOC Narrative: Small LLMs for UEBA / Insider Threat Detection}, year = {2026}, howpublished = {\url{https://github.com/Pancake2021/research_work_by_a_student}}}