Intended use
The model is intended for research and prototyping tasks such as:
- mapping security observations to candidate MITRE ATT&CK tactics and techniques;
- extracting ATT&CK-relevant evidence from incident descriptions and reports;
- assisting analysts with threat-intelligence triage and structured summaries;
- exploring multimodal security-analysis workflows.
Treat its output as analyst assistance. Verify technique IDs, claims, and
recommended actions against the current MITRE ATT&CK knowledge base and the
underlying evidence before operational use.
Model details
Table with columns: Field, Value| Field | Value |
|---|
| Base model | unsloth/Qwen3.5-2B |
| Architecture | Qwen3_5ForConditionalGeneration |
| Parameters | approximately 2.27B |
| Modalities | text, image, and video inputs; text output |
| Native context length | 262,144 tokens |
| Weight format | Safetensors, full 16-bit checkpoint |
| Library | Transformers |
| License | Apache 2.0 |
The repository configuration was generated with Transformers 5.3.0. Use a
recent Transformers release with Qwen3.5 support.
Quick start
pip install -U transformers accelerate torch pillow
from transformers import AutoModelForImageTextToText, AutoProcessor model_id = "jithinodattu/Qwen3.5-2B__mitreaware" processor = AutoProcessor.from_pretrained(model_id)model = AutoModelForImageTextToText.from_pretrained( model_id, torch_dtype="auto", device_map="auto",) messages = [ { "role": "user", "content": [ { "type": "text", "text": ( "Analyze the following observation and return the most likely " "MITRE ATT&CK technique IDs with brief evidence: " "PowerShell downloaded and executed an encoded payload." ), } ], }] inputs = processor.apply_chat_template( messages, add_generation_prompt=True, tokenize=True, return_dict=True, return_tensors="pt",).to(model.device) generated = model.generate(**inputs, max_new_tokens=512)new_tokens = generated[:, inputs["input_ids"].shape[1]:]print(processor.batch_decode(new_tokens, skip_special_tokens=True)[0])
For repeatable evaluation, prompt the model to return a fixed schema, for
example:
{ "techniques": [ { "id": "TXXXX.XXX", "name": "Technique name", "evidence": "Text span or observation supporting the mapping", "confidence": 0.0 } ]}
Training and evaluation
This checkpoint was fine-tuned with Unsloth and Hugging Face TRL. The training
dataset, preprocessing procedure, hyperparameters, compute configuration, and
task-specific evaluation results have not yet been documented in this model
card. Until those details and benchmark results are published, users should not
assume a measured improvement over the base model.
Recommended evaluation should include technique-level precision, recall, and
F1; exact and hierarchical ATT&CK matching; hallucinated technique rate; and
performance on reports from sources not represented in the training data.
Limitations
- The model may invent, mislabel, or confuse ATT&CK technique IDs.
- ATT&CK evolves over time, so model knowledge may not match the current release.
- Security reports often omit context needed for a confident mapping.
- Outputs may inherit factual, cultural, and safety limitations from the base model and fine-tuning data.
- The model has not been presented here as validated for autonomous detection, incident response, attribution, or other high-impact decisions.
License and attribution
This checkpoint is released under the Apache 2.0 license. It is derived from
unsloth/Qwen3.5-2B, which in turn
derives from Qwen3.5-2B. Review the upstream model card for additional base-model
details, usage guidance, and citations.
Fine-tuning and checkpoint publication: jithinodattu.