dpevzner

CyberOps_Mistral_7B_LoRA

README

License: apache-2.0

Model Details

Table with columns: Field, Value
Field	Value
Base model	`mistralai/Mistral-7B-Instruct-v0.3`
Adapter type	LoRA (PEFT 0.19.1)
LoRA rank `r`	16
`lora_alpha`	32
`lora_dropout`	0.05
`bias`	none
Target modules	`q_proj, k_proj, v_proj, o_proj, gate_proj, up_proj, down_proj` (all linear)
Trainable parameters	~41,943,040 (~1.10% of base); 448 LoRA tensors
Task type	`CAUSAL_LM`
Training method	Supervised fine-tuning (SFT) via TRL; iterative single-epoch repair on prior best
Effective batch	8 (per-device 1 × grad-accum 8)
Learning rate	2e-4
Max sequence length	1024
Training records	~4,615 (123 curriculum files)
Frameworks	TRL 1.2.0 · Transformers 5.6.2 · PEFT 0.19.1 · PyTorch 2.5.1+cu121
Hardware	NVIDIA RTX 4070 Laptop GPU (8 GB) · 64 GB RAM · ~5.56 GB peak VRAM
Best benchmark	88.1 avg (50-item rubric)

Model-Family Compatibility

Optimized for the Mistral / Llama instruction-tuned family. The training data uses the Alpaca-style instruct format:

markdown
### Instruction:
[prompt]

### Response:
[answer]

The binding is to this prompt format, not the architecture. The same dataset trained on three bases shows the format mismatch — not capability — drives the gap:

Table with columns: Base model, Prompt format, Best benchmark
Base model	Prompt format	Best benchmark
`mistralai/Mistral-7B-Instruct-v0.3`	native (Alpaca)	88.1
`deepseek-ai/deepseek-llm-7b-chat`	mismatched	47.38
`microsoft/Phi-3.5-mini-instruct`	mismatched	early experiments

Recommended base models for this adapter: mistralai/Mistral-7B-Instruct-v0.3 (primary), other Mistral 7B Instruct point releases, or Llama-3/3.1 8B Instruct (compatible format; requires retraining on that base). For DeepSeek/Gemma/ChatML/Qwen, use the model-agnostic dataset (below) rendered in each family's native format.

Datasets

Training data (format-specific): dpevzner/Cybersecurity_Reasoning_Dataset_MistralFamily_7b — ~4,615 records in the Mistral/Llama ### Instruction:/### Response: format.
Model-agnostic variant: dpevzner/Cybersecurity_Reasoning_Dataset — neutral canonical corpus + Mistral/DeepSeek/ChatML/Gemma rendered variants (to train other families without the format-mismatch penalty).

Curriculum (hard-ordered, 3-epoch)

Table with columns: Epoch, Folders, Records
Epoch	Folders	Records
1	`03_toolknowledge`, `05_detection_rules`	~1,077
2	`04_goldens`, `05_seedcases`	~1,508
3	`06_contrast_pairs`	~2,030

New synthesis/repair records go in Epoch 3; placing them in Epoch 2 previously caused sharp regression in ambiguity reasoning (hard constraint). The benchmark is held out with zero overlap with training data.

Intended Use

For offline / air-gapped cybersecurity operations — a domain-specific reasoning assistant for authorized security testing and SOC support.

Capabilities: dual-use command intent analysis; failure diagnosis (privilege_failure, syntax_failure, environment_mismatch, dependency_absence, stale_documentation); security scope assessment; tool correctness (PowerShell/CMD/bash); cross-shell translation. Out of scope: general threat intel, malware RE, CVE assessment, offensive automation, general-purpose assistant use.

Benchmark

50-item rubric across five families. Best 88.1; stable 88.0 most recent.

Table with columns: Family, Items, Baseline, Best
Family	Items	Baseline	Best
tool_correctness	10	~73	~91.7
cross_shell_translation	10	~71	~97
failure_diagnosis	10	~30	~85
ambiguity_reasoning	10	~100	~95.8
safety_scope

Reached a capacity ceiling at ~88 (rank 16): further repairs fix targeted items but displace others ~1:1. Progressing requires higher LoRA rank, not more data.

Usage

python
from transformers import AutoTokenizer, AutoModelForCausalLM
from peft import PeftModel
import torch

BASE_MODEL = "mistralai/Mistral-7B-Instruct-v0.3"
ADAPTER    = "dpevzner/CyberOps_Mistral_7B_LoRA"

tokenizer = AutoTokenizer.from_pretrained(BASE_MODEL)
model = AutoModelForCausalLM.from_pretrained(
    BASE_MODEL, dtype=torch.float16, device_map="auto",
    max_memory={0: "5GiB", "cpu": "20GiB"})
model = PeftModel.from_pretrained(model, ADAPTER)
model.eval()

prompt = """### Instruction:
Analyze the ambiguous command: `Get-Process lsass`

### Response:"""

inputs = tokenizer(prompt, return_tensors="pt").to(model.device)
with torch.no_grad():
    out = model.generate(**inputs, max_new_tokens=256, do_sample=False, use_cache=False)
print(tokenizer.decode(out[0][inputs["input_ids"].shape[1]:], skip_special_tokens=True))

This adapter expects the ### Instruction: / ### Response: format; other formats degrade output quality due to the format binding described above.

Limitations

Adapter-capacity ceiling at ~88 (rank 16) — repairs fix items but regress others ~1:1.
Safety scope is the weakest family (~70) — items ss_001/002/006/007/010 inconsistent.
Ambiguity reasoning oscillates (ar_008/009/010) under heavy contrast-pair synthesis.
Substring-based scoring — a correctly paraphrased answer can be scored a miss.
GPU telemetry reads zero (NVML polling gap) — cosmetic; training is correct.
Synthetic evaluation only — live-operations performance not measured.

Ethical Considerations

Trained to analyze dual-use commands for defensive security operations. Not for generating offensive tooling, attack automation, or unauthorized access. All training data was synthesized under operator oversight with explicit content-governance controls.

Citation

bibtex
@misc{cyberops_mistral_7b_lora_2026,
  title  = {CyberOps-Mistral-7B-LoRA: A LoRA Adapter for Cybersecurity IT-Operations Reasoning},
  author = {Pevzner, D.},
  year   = {2026},
  note   = {LoRA (r=16, alpha=32) adapter for Mistral 7B Instruct v0.3, trained on ~4,615
            synthetic cybersecurity reasoning records; best benchmark 88.1 on a 50-item rubric.}
}

Training environment: Alienware M16R2 / RTX 4070 Laptop GPU / Windows 11. Weights from run LORA-MISTRAL_7B-20260709-232328 (script v4.7).

Available on FriendliAI

Dedicated Endpoints

Run this model inference on single tenant GPU with unmatched speed and reliability at scale.

Learn more

Container

Run this model inference with full control and performance in your environment.

Learn more

Model Details

Model Provider

dpevzner

Model Tree

Base

mistralai/Mistral-7B-Instruct-v0.3

Adapter

this model

Input Modalities

Text

Output Modalities

Text

Supported Functionality

Dedicated EndpointsContainer

Explore FriendliAI today

Get started Talk to an engineer

README

License: apache-2.0

Model Details

Table with columns: Field, Value
Field	Value
Base model	`mistralai/Mistral-7B-Instruct-v0.3`
Adapter type	LoRA (PEFT 0.19.1)
LoRA rank `r`	16
`lora_alpha`	32
`lora_dropout`	0.05
`bias`	none
Target modules	`q_proj, k_proj, v_proj, o_proj, gate_proj, up_proj, down_proj` (all linear)
Trainable parameters	~41,943,040 (~1.10% of base); 448 LoRA tensors
Task type	`CAUSAL_LM`
Training method	Supervised fine-tuning (SFT) via TRL; iterative single-epoch repair on prior best
Effective batch	8 (per-device 1 × grad-accum 8)
Learning rate	2e-4
Max sequence length	1024
Training records	~4,615 (123 curriculum files)
Frameworks	TRL 1.2.0 · Transformers 5.6.2 · PEFT 0.19.1 · PyTorch 2.5.1+cu121
Hardware	NVIDIA RTX 4070 Laptop GPU (8 GB) · 64 GB RAM · ~5.56 GB peak VRAM
Best benchmark	88.1 avg (50-item rubric)

Model-Family Compatibility

Optimized for the Mistral / Llama instruction-tuned family. The training data uses the Alpaca-style instruct format:

markdown
### Instruction:
[prompt]

### Response:
[answer]

The binding is to this prompt format, not the architecture. The same dataset trained on three bases shows the format mismatch — not capability — drives the gap:

Table with columns: Base model, Prompt format, Best benchmark
Base model	Prompt format	Best benchmark
`mistralai/Mistral-7B-Instruct-v0.3`	native (Alpaca)	88.1
`deepseek-ai/deepseek-llm-7b-chat`	mismatched	47.38
`microsoft/Phi-3.5-mini-instruct`	mismatched	early experiments

Datasets

Training data (format-specific): dpevzner/Cybersecurity_Reasoning_Dataset_MistralFamily_7b — ~4,615 records in the Mistral/Llama ### Instruction:/### Response: format.
Model-agnostic variant: dpevzner/Cybersecurity_Reasoning_Dataset — neutral canonical corpus + Mistral/DeepSeek/ChatML/Gemma rendered variants (to train other families without the format-mismatch penalty).

Curriculum (hard-ordered, 3-epoch)

Table with columns: Epoch, Folders, Records
Epoch	Folders	Records
1	`03_toolknowledge`, `05_detection_rules`	~1,077
2	`04_goldens`, `05_seedcases`	~1,508
3	`06_contrast_pairs`	~2,030

Intended Use

For offline / air-gapped cybersecurity operations — a domain-specific reasoning assistant for authorized security testing and SOC support.

Benchmark

50-item rubric across five families. Best 88.1; stable 88.0 most recent.

Table with columns: Family, Items, Baseline, Best
Family	Items	Baseline	Best
tool_correctness	10	~73	~91.7
cross_shell_translation	10	~71	~97
failure_diagnosis	10	~30	~85
ambiguity_reasoning	10	~100	~95.8
safety_scope

Reached a capacity ceiling at ~88 (rank 16): further repairs fix targeted items but displace others ~1:1. Progressing requires higher LoRA rank, not more data.

Usage

python
from transformers import AutoTokenizer, AutoModelForCausalLM
from peft import PeftModel
import torch

BASE_MODEL = "mistralai/Mistral-7B-Instruct-v0.3"
ADAPTER    = "dpevzner/CyberOps_Mistral_7B_LoRA"

tokenizer = AutoTokenizer.from_pretrained(BASE_MODEL)
model = AutoModelForCausalLM.from_pretrained(
    BASE_MODEL, dtype=torch.float16, device_map="auto",
    max_memory={0: "5GiB", "cpu": "20GiB"})
model = PeftModel.from_pretrained(model, ADAPTER)
model.eval()

prompt = """### Instruction:
Analyze the ambiguous command: `Get-Process lsass`

### Response:"""

inputs = tokenizer(prompt, return_tensors="pt").to(model.device)
with torch.no_grad():
    out = model.generate(**inputs, max_new_tokens=256, do_sample=False, use_cache=False)
print(tokenizer.decode(out[0][inputs["input_ids"].shape[1]:], skip_special_tokens=True))

This adapter expects the ### Instruction: / ### Response: format; other formats degrade output quality due to the format binding described above.

Limitations

Adapter-capacity ceiling at ~88 (rank 16) — repairs fix items but regress others ~1:1.
Safety scope is the weakest family (~70) — items ss_001/002/006/007/010 inconsistent.
Ambiguity reasoning oscillates (ar_008/009/010) under heavy contrast-pair synthesis.
Substring-based scoring — a correctly paraphrased answer can be scored a miss.
GPU telemetry reads zero (NVML polling gap) — cosmetic; training is correct.
Synthetic evaluation only — live-operations performance not measured.

Ethical Considerations

Citation

bibtex
@misc{cyberops_mistral_7b_lora_2026,
  title  = {CyberOps-Mistral-7B-LoRA: A LoRA Adapter for Cybersecurity IT-Operations Reasoning},
  author = {Pevzner, D.},
  year   = {2026},
  note   = {LoRA (r=16, alpha=32) adapter for Mistral 7B Instruct v0.3, trained on ~4,615
            synthetic cybersecurity reasoning records; best benchmark 88.1 on a 50-item rubric.}
}

Training environment: Alienware M16R2 / RTX 4070 Laptop GPU / Windows 11. Weights from run LORA-MISTRAL_7B-20260709-232328 (script v4.7).