✨ Key Features
Table with columns: Capability, Description| Capability | Description |
|---|
| 🛡️ Cyber Expert | Offensive + defensive security, penetration testing, red/blue team |
| 🧠 Causal Analysis | Step-by-step security reasoning (MITRE ATT&CK, OWASP) |
| 🚨 Incident Response | Detection, containment, and response playbooks |
| 🔍 Threat Intel | CVE analysis, IOC correlation, ransomware indicators |
| 💻 Code & Exploit | Python/Bash security tooling, exploit analysis |
| 🎛️ Adjustable | --lora-scaled lets you control LoRA strength (0.1–0.7+) |
| 🌏 Thai + English | Native bilingual base model support |
Table with columns: Parameter, Value| Parameter | Value |
|---|
| Base Model | InternScience/Agents-A1-4B |
| Parameters | ~4.62B (4.29B trainable-excluded) |
| Architecture | Qwen3.5 hybrid (Linear + Full attention) |
| LoRA Rank | r=64, alpha=128, dropout=0.0 |
| Target Modules | q/k/v/o_proj, gate/up/down_proj (all linear) |
| Training Data | 168,793 samples (Fenrir + Trendyol + ShareGPT) |
| Max Seq Length | 4096 tokens |
| Training Steps |
📊 Training Data
Trained on 3 curated cybersecurity datasets (all English, unified system prompt):
Table with columns: Dataset, Rows, Content| Dataset | Rows | Content |
|---|
| AlicanKiraz0/Cybersecurity-Dataset-Fenrir-v2.1 | 99,869 | Causal analysis, threat intel, MITRE, ransomware, red/blue team |
| Trendyol/Trendyol-Cybersecurity-Instruction-Tuning-Dataset | 53,201 | Cyber-defense, C2 analysis, DLP, honeypot, insider threat |
| ChaoticNeutrals/Cybersecurity-ShareGPT | 15,723 | Cybersecurity Q&A + step-by-step reasoning |
Training details:
- Method: BF16 LoRA via Unsloth (no quantization loss)
- Optimizer: AdamW 8-bit, lr=1e-4, cosine schedule, warmup 3%
- Effective batch size: 16 (4× RTX 3060 12GB)
🚀 Usage
llama.cpp — LoRA (Recommended)
This repo ships gguf/cyber_lora_v1.gguf — a GGUF-format LoRA adapter that works with any
Agents-A1-4B base GGUF via --lora-scaled.
Tune the strength with the scale value:
0.1 — subtle cyber knowledge boost (keeps base personality)
0.3 — balanced security-aware assistant
0.5 — strong cybersecurity expert behavior
0.7 — heavy security specialization (may override base style)
>0.7 — possible overfit artifacts / style override; test per use case
# With our Fable heretic GGUF (recommended — uncensored + cyber)
llama-server \
-m /models/Agents-A1-4B-Fable-Preview-heretic-F16.gguf \
--lora-scaled /models/cyber_lora_v1.gguf:0.5 \
--host 0.0.0.0 --port 8080 \
--n-gpu-layers 999 \
--ctx-size 32768 \
--flash-attn on \
--cont-batching \
--mlock \
--temp 0.95 \
--top-k 40 \
--top-p 0.9 \
--min-p 0.0 \
-n -1 \
--no-mmap \
--parallel 1 --tools all \
--dry-multiplier 0.0 \
--jinja --dry-sequence-breaker none --repeat-penalty 1.1
# Or with our Kimi heretic GGUF (coding-focused base)
llama-server \
-m /models/Agents-A1-4B-kimi-Preview-heretic-IQ4_NL.gguf \
--lora-scaled /models/cyber_lora_v1.gguf:0.5 \
--host 0.0.0.0 --port 8080 \
--n-gpu-layers 999 \
--ctx-size 32768 \
--flash-attn on \
--cont-batching \
--mlock \
--temp 0.95 \
--top-k 40 \
--top-p 0.9 \
--min-p 0.0 \
-n -1 \
--no-mmap \
--parallel 1 --tools all \
--dry-multiplier 0.0 \
--jinja --dry-sequence-breaker none --repeat-penalty 1.1
# CLI quick test
llama-cli -m Agents-A1-4B-Fable-Preview-heretic-F16.gguf \
--lora-scaled cyber_lora_v1.gguf:0.5 \
-p "What is SQL injection and how do I prevent it?" -n 256
💡 Compatible base models (any Agents-A1-4B GGUF works):
Since LoRA only adds weights, you can also apply it to the plain
InternScience/Agents-A1-4B GGUF of your choice.
from transformers import AutoModelForCausalLM, AutoTokenizer
from peft import PeftModel
base = "InternScience/Agents-A1-4B"
adapter = "hotdogs/Agents-A1-4B-cyber-lora"
model = AutoModelForCausalLM.from_pretrained(base, torch_dtype="auto", device_map="auto", trust_remote_code=True)
model = PeftModel.from_pretrained(model, adapter)
tokenizer = AutoTokenizer.from_pretrained(adapter)
messages = [
{"role": "system", "content": "You are an elite AI security expert specializing in offensive security, defensive strategies, threat intelligence, incident response, and vulnerability analysis."},
{"role": "user", "content": "What is SQL injection and how do I prevent it?"},
]
inputs = tokenizer.apply_chat_template(messages, tokenize=True, return_tensors="pt")
outputs = model.generate(inputs, max_new_tokens=256, temperature=0.6)
print(tokenizer.decode(outputs[0]))
💬 Example Prompts
Table with columns: Prompt (Thai), English Equivalent| Prompt (Thai) | English Equivalent |
|---|
SQL injection คืออะไร ป้องกันยังไง | What is SQL injection and how do I prevent it? |
ตรวจจับ lateral movement ด้วย Windows Event ID ยังไง | How would you detect lateral movement using Windows Event ID correlation? |
MITRE ATT&CK ใช้ยังไงใน incident response | How is MITRE ATT&CK used in incident response? |
สัญญาณ ransomware มีอะไรบ้าง SOC ต้องทำยังไง | What are common indicators of ransomware and how should a SOC respond? |
# Thai prompt via llama-cli
llama-cli -m Agents-A1-4B-Fable-Preview-heretic-F16.gguf \
--lora-scaled cyber_lora_v1.gguf:0.5 \
--flash-attn on --cont-batching --mlock \
--temp 0.95 --top-k 40 --top-p 0.9 --min-p 0.0 \
--no-mmap --parallel 1 --tools all \
--dry-multiplier 0.0 --jinja --dry-sequence-breaker none \
-p "SQL injection คืออะไร ป้องกันยังไง" -n 256
📦 Downloads
Table with columns: File, Size, Description| File | Size | Description |
|---|
adapter_model.safetensors | 340 MB | PEFT LoRA adapter (BF16) |
gguf/cyber_lora_v1.gguf | 339 MB | GGUF LoRA for llama.cpp --lora-scaled |
tokenizer.json | 20 MB | Tokenizer |
chat_template.jinja | 8.98 kB |
⚠️ Disclaimer
This model is fine-tuned on cybersecurity content including offensive techniques. Use it
only for authorized security testing, education, and defensive purposes. The authors are
not responsible for any misuse. Always follow applicable laws and obtain permission before
testing systems you do not own.
🙏 Acknowledgements / ขอบคุณ
💖 Support / โปรดสนับสนุน
If you find this model useful, please consider supporting my work!
หากคุณคิดว่าโมเดลนี้มีประโยชน์ กรุณาสนับสนุนผลงานของฉันด้วยนะคะ! 🙏
₿ Bitcoin — BTC:
bc1qf27cyk3vmugcdyv9xdtuv5jwz37863crpj5c9v
Thank you for your support! 🙏✨
ขอบคุณมากๆ สำหรับการสนับสนุนค่า! 💖🤗
Built with ❤️ by UKA — 18-year-old coder & cybersecurity expert