Void4388/LSO-run1-gguf

LSO Run 1 — GGUF quantizations

GGUF builds of LSO Run 1, a LoRA fine-tune of Qwen3.6-35B-A3B (MoE, 35B total / ~3B active) for security work. The tune is framed for defensive and educational use — recognizing malicious patterns, explaining techniques, hardening systems — but it is a dual-use model: it was also trained on attack-technique references and can produce offensive content when prompted. This repo hosts the quantizations only.

Files

File	Quant	Size
LSO-run1-f16.gguf	F16	71.07 GB
LSO-run1-Q6_K.gguf	Q6_K	28.51 GB

SHA256:

• LSO-run1-f16.gguf: d545bfe5f02af88ccc1e8f168f4e8630df28f984f4b44a883b4f3452a6b1fa53
• LSO-run1-Q6_K.gguf: 32bb34c7ac77e228f89d78f46ad309ee0f300d926ea1cdf48682e668e6cd4ea1

Base model

• Qwen/Qwen3.6-35B-A3B — Apache-2.0. Mixture-of-Experts, 35B total / ~3B active.
• GGUF architecture: qwen35moe, 753 tensors, general.name = "LSO Run1 Bf16".

Fine-tune (LSO Run 1)

• LoRA, r=16, alpha=32, dropout=0.05, targeting all linear layers.
• Base for training: Qwen/Qwen3.6-35B-A3B (bf16); seq_len 4096, sample packing, 1 epoch (~820 steps), LR 2e-5 (cosine, warmup 50).
• Trainer: Axolotl on an Akash H200 (1x H200, 24 CPU, 251 GiB RAM, persistent storage).
• Corpus (mixed, curated): MITRE ATT&CK + Sigma detection rules (defensive/detection), plus technique references used in security education and testing (HackTricks, WhiteRabbitNeo, 0xdf/HTB writeups, ExploitDB, CyberLLM). The dataset repo is private.

Quantization

python convert_hf_to_gguf.py <fused-bf16-dir> --outtype f16 --outfile LSO-run1-f16.gguf
./build/bin/llama-quantize LSO-run1-f16.gguf LSO-run1-Q6_K.gguf Q6_K

Usage

llama.cpp

llama-cli -m LSO-run1-Q6_K.gguf -p "..." -cnv
llama-server -m LSO-run1-f16.gguf --port 8080

LM Studio / Ollama — copy the .gguf into your models directory, or ollama create lso-run1 -f Modelfile with FROM ./LSO-run1-Q6_K.gguf.

Intended use

• Detection & triage: recognize malicious patterns, explain indicators, map to MITRE ATT&CK.
• Hardening & response: audit configs, write detection rules, explain remediation.
• Education & research: understanding attack/defense concepts in a lab context.

Dual-use notice

This is a dual-use security model. It is tuned and framed for defensive/educational work, but it retains offensive capability: with the appropriate prompt it can produce offensive or harmful content. There are no enforced guardrails — the restrictions below are usage rules for the operator, not technical guarantees. Treat outputs critically.

Out of scope / not intended for

• Unauthorized access, exploitation, or attacking systems you do not own or have written permission to test.
• Creating or deploying malware.
• Automated decisions without human review; the model can be wrong or produce harmful text.

Legal & safety notice

Use only within the law — in Germany e.g. 202a-202c StGB (and equivalent rules elsewhere); prepare/use tools only for authorized purposes. Outputs are unreviewed and provided without warranty; not a substitute for professional security advice or certified endpoint protection.

Provenance

• Adapter: Void4388/lso-run1-adapter (private)
• Fused bf16: Void4388/lso-run1-fused (private)
• Dataset: Void4388/lso-run1-dataset (private)
• Source/runbook: internal Gitea repo AI-Workspace/local-security-officer