Upload README.md with huggingface_hub
Browse files
README.md
CHANGED
|
@@ -3,43 +3,6 @@ base_model: meta-llama/Llama-3.1-8B-Instruct
|
|
| 3 |
library_name: peft
|
| 4 |
model_name: corvus-v2-8b
|
| 5 |
license: llama3.1
|
| 6 |
-
gated: true
|
| 7 |
-
extra_gated_heading: "Acknowledge license to access Corvus v2"
|
| 8 |
-
extra_gated_description: "Access is automatically approved after you confirm the license and intended defensive use."
|
| 9 |
-
extra_gated_button_content: "Agree and get access"
|
| 10 |
-
extra_gated_prompt: "By requesting access, you agree to the Llama 3.1 Community License and the CVERiskPilot Commercial Use Addendum, confirm you will use Corvus v2 for defensive vulnerability triage, and consent to share your contact details with CVERiskPilot."
|
| 11 |
-
extra_gated_fields:
|
| 12 |
-
Organization: text
|
| 13 |
-
Role:
|
| 14 |
-
type: select
|
| 15 |
-
options:
|
| 16 |
-
- Security Engineer
|
| 17 |
-
- Security Leader
|
| 18 |
-
- Developer
|
| 19 |
-
- Researcher
|
| 20 |
-
- Consultant / MSSP
|
| 21 |
-
- Student
|
| 22 |
-
- Other
|
| 23 |
-
Intended use:
|
| 24 |
-
type: select
|
| 25 |
-
options:
|
| 26 |
-
- Internal vulnerability triage
|
| 27 |
-
- Client service delivery
|
| 28 |
-
- Research
|
| 29 |
-
- Evaluation / benchmarking
|
| 30 |
-
- Education
|
| 31 |
-
- Other
|
| 32 |
-
Deployment preference:
|
| 33 |
-
type: select
|
| 34 |
-
options:
|
| 35 |
-
- Local workstation
|
| 36 |
-
- Self-hosted GPU server
|
| 37 |
-
- Cloud VM / container
|
| 38 |
-
- Comparing before platform purchase
|
| 39 |
-
- Other
|
| 40 |
-
I have read and agree to the Llama Community License terms: checkbox
|
| 41 |
-
I understand Corvus v2 is for defensive vulnerability triage and not offensive security operations: checkbox
|
| 42 |
-
I understand hosted, managed, API-accessible, or redistributed commercial use requires a commercial license from CVERiskPilot: checkbox
|
| 43 |
language:
|
| 44 |
- en
|
| 45 |
tags:
|
|
@@ -52,12 +15,10 @@ tags:
|
|
| 52 |
- sft
|
| 53 |
- transformers
|
| 54 |
- trl
|
| 55 |
-
- gguf
|
| 56 |
pipeline_tag: text-generation
|
| 57 |
datasets:
|
| 58 |
- custom
|
| 59 |
model_type: llama
|
| 60 |
-
quantized_by: llama-cpp-python
|
| 61 |
---
|
| 62 |
|
| 63 |
# Corvus™ v2 — Vulnerability Triage Model
|
|
@@ -66,6 +27,12 @@ quantized_by: llama-cpp-python
|
|
| 66 |
|
| 67 |
Built by [CVERiskPilot](https://cveriskpilot.com) — 100% Veteran Owned, Texas, USA.
|
| 68 |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| 69 |
## Why This Exists
|
| 70 |
|
| 71 |
Offensive AI is accelerating. AI fuzzers are finding thousands of zero-days across every major codebase. The scanning problem is being solved. The triage problem is getting 10x harder.
|
|
@@ -87,13 +54,6 @@ Corvus doesn't find vulnerabilities. It decides what to do about them — at mac
|
|
| 87 |
| Training loss (final) | 0.461 |
|
| 88 |
| Throughput | 11.9 samples/sec |
|
| 89 |
|
| 90 |
-
### Available Formats
|
| 91 |
-
|
| 92 |
-
| Format | Size | Use Case |
|
| 93 |
-
|--------|------|----------|
|
| 94 |
-
| `corvus-v2-f16.gguf` | 16 GB | Maximum quality, needs 16GB+ VRAM |
|
| 95 |
-
| `corvus-v2-q4km.gguf` | 4.6 GB | Recommended — fits 8GB GPU, minimal quality loss |
|
| 96 |
-
|
| 97 |
## Intended Use
|
| 98 |
|
| 99 |
**Use this model for:** Prioritizing and triaging software vulnerabilities in security operations workflows. Deciding which CVEs need immediate attention vs. scheduled patching vs. risk acceptance.
|
|
@@ -137,65 +97,11 @@ Corvus outputs structured JSON with five fields:
|
|
| 137 |
| `INVESTIGATE` | Insufficient data to make a confident decision |
|
| 138 |
| `DEFER` | Non-critical, low EPSS, no KEV listing, internal-only asset |
|
| 139 |
|
| 140 |
-
##
|
| 141 |
-
|
| 142 |
-
### Ollama (Recommended)
|
| 143 |
-
|
| 144 |
-
```bash
|
| 145 |
-
# Create a Modelfile
|
| 146 |
-
cat > Modelfile <<'EOF'
|
| 147 |
-
FROM ./corvus-v2-q4km.gguf
|
| 148 |
-
|
| 149 |
-
SYSTEM """You are a senior vulnerability triage analyst. Given vulnerability data including CVE details, CVSS scores, EPSS probability, KEV listing status, and asset context, produce a structured triage decision as JSON with the following fields:
|
| 150 |
-
|
| 151 |
-
- severityOverride: string or null (override reason if priority differs from CVSS)
|
| 152 |
-
- priority: "CRITICAL" | "HIGH" | "MEDIUM" | "LOW"
|
| 153 |
-
- recommendedAction: "PATCH_IMMEDIATELY" | "SCHEDULE_PATCH" | "MITIGATE" | "ACCEPT_RISK" | "INVESTIGATE" | "DEFER"
|
| 154 |
-
- reasoning: string (detailed explanation referencing specific technical factors)
|
| 155 |
-
- confidenceScore: number between 0.0 and 1.0
|
| 156 |
-
|
| 157 |
-
Output ONLY valid JSON. No markdown, no explanation outside the JSON object."""
|
| 158 |
|
| 159 |
-
|
| 160 |
-
PARAMETER num_predict 512
|
| 161 |
-
PARAMETER stop <|eot_id|>
|
| 162 |
-
PARAMETER stop <|end_of_text|>
|
| 163 |
-
EOF
|
| 164 |
|
| 165 |
-
|
| 166 |
-
ollama create corvus-triage -f Modelfile
|
| 167 |
-
ollama run corvus-triage
|
| 168 |
-
```
|
| 169 |
-
|
| 170 |
-
### llama.cpp
|
| 171 |
-
|
| 172 |
-
```bash
|
| 173 |
-
./llama-cli -m corvus-v2-q4km.gguf \
|
| 174 |
-
--temp 0.1 \
|
| 175 |
-
-p "CVE: CVE-2024-3094\nTitle: XZ Utils Backdoor\nSeverity: CRITICAL\nCVSS: 10.0\nEPSS: 0.97\nKEV: Yes\nPackage: xz-utils@5.6.0\nDescription: Malicious backdoor in XZ Utils allowing unauthorized SSH access"
|
| 176 |
-
```
|
| 177 |
-
|
| 178 |
-
### Python (transformers)
|
| 179 |
-
|
| 180 |
-
```python
|
| 181 |
-
from transformers import AutoModelForCausalLM, AutoTokenizer
|
| 182 |
-
|
| 183 |
-
model = AutoModelForCausalLM.from_pretrained(
|
| 184 |
-
"CVRP/corvus-v2-8b",
|
| 185 |
-
device_map="auto",
|
| 186 |
-
torch_dtype="auto",
|
| 187 |
-
)
|
| 188 |
-
tokenizer = AutoTokenizer.from_pretrained("CVRP/corvus-v2-8b")
|
| 189 |
-
|
| 190 |
-
messages = [
|
| 191 |
-
{"role": "system", "content": "You are a senior vulnerability triage analyst..."},
|
| 192 |
-
{"role": "user", "content": "CVE: CVE-2024-3094\nTitle: XZ Utils Backdoor\nSeverity: CRITICAL\nCVSS: 10.0\nEPSS: 0.97\nKEV: Yes"},
|
| 193 |
-
]
|
| 194 |
-
|
| 195 |
-
inputs = tokenizer.apply_chat_template(messages, return_tensors="pt").to(model.device)
|
| 196 |
-
outputs = model.generate(inputs, max_new_tokens=512, temperature=0.1)
|
| 197 |
-
print(tokenizer.decode(outputs[0][inputs.shape[-1]:], skip_special_tokens=True))
|
| 198 |
-
```
|
| 199 |
|
| 200 |
## Input Format
|
| 201 |
|
|
|
|
| 3 |
library_name: peft
|
| 4 |
model_name: corvus-v2-8b
|
| 5 |
license: llama3.1
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| 6 |
language:
|
| 7 |
- en
|
| 8 |
tags:
|
|
|
|
| 15 |
- sft
|
| 16 |
- transformers
|
| 17 |
- trl
|
|
|
|
| 18 |
pipeline_tag: text-generation
|
| 19 |
datasets:
|
| 20 |
- custom
|
| 21 |
model_type: llama
|
|
|
|
| 22 |
---
|
| 23 |
|
| 24 |
# Corvus™ v2 — Vulnerability Triage Model
|
|
|
|
| 27 |
|
| 28 |
Built by [CVERiskPilot](https://cveriskpilot.com) — 100% Veteran Owned, Texas, USA.
|
| 29 |
|
| 30 |
+
## Distribution Status
|
| 31 |
+
|
| 32 |
+
Corvus v2 weights are **not currently distributed on Hugging Face**.
|
| 33 |
+
|
| 34 |
+
This repository remains public for model documentation, licensing terms, and release-status updates while distribution strategy is under review.
|
| 35 |
+
|
| 36 |
## Why This Exists
|
| 37 |
|
| 38 |
Offensive AI is accelerating. AI fuzzers are finding thousands of zero-days across every major codebase. The scanning problem is being solved. The triage problem is getting 10x harder.
|
|
|
|
| 54 |
| Training loss (final) | 0.461 |
|
| 55 |
| Throughput | 11.9 samples/sec |
|
| 56 |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| 57 |
## Intended Use
|
| 58 |
|
| 59 |
**Use this model for:** Prioritizing and triaging software vulnerabilities in security operations workflows. Deciding which CVEs need immediate attention vs. scheduled patching vs. risk acceptance.
|
|
|
|
| 97 |
| `INVESTIGATE` | Insufficient data to make a confident decision |
|
| 98 |
| `DEFER` | Non-critical, low EPSS, no KEV listing, internal-only asset |
|
| 99 |
|
| 100 |
+
## Availability
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| 101 |
|
| 102 |
+
If distribution resumes, CVERiskPilot will publish updated instructions here.
|
|
|
|
|
|
|
|
|
|
|
|
|
| 103 |
|
| 104 |
+
For evaluation, partnership, or commercial licensing inquiries, contact [sales@cveriskpilot.com](mailto:sales@cveriskpilot.com).
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| 105 |
|
| 106 |
## Input Format
|
| 107 |
|