barha/granite-cti-technique-mapping-lora

Granite 4.1 3B — CTI Technique Mapping LoRA

A LoRA adapter for ibm-granite/granite-4.1-3b that maps a Cyber Threat Intelligence (CTI) procedure sentence to its corresponding MITRE ATT&CK technique ID (e.g. T1547.001).

Evaluation

• Exact-match accuracy: 97.33% (292/300) on the held-out validation set.
• Errors are predominantly single-sentence/multi-technique cases where the gold label chose one of two defensible techniques; no parent/sub-technique granularity confusion was observed.

Intended use

Given a CTI procedure sentence, the model returns a single ATT&CK technique identifier. Prompt format:

What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
{procedure sentence}
</cti>

Quick start

from peft import PeftModel
from transformers import AutoModelForCausalLM, AutoTokenizer

base = AutoModelForCausalLM.from_pretrained('ibm-granite/granite-4.1-3b', device_map='cuda')
model = PeftModel.from_pretrained(base, 'barha/granite-cti-technique-mapping-lora')
tok = AutoTokenizer.from_pretrained('barha/granite-cti-technique-mapping-lora')

prompt = 'What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nGazer can establish persistence by creating a .lnk file in the Start menu.\n</cti>'
msgs = [{'role': 'user', 'content': prompt}]
inputs = tok.apply_chat_template(msgs, add_generation_prompt=True, return_tensors='pt').to('cuda')
out = model.generate(inputs, max_new_tokens=16)
print(tok.decode(out[0][inputs.shape[1]:], skip_special_tokens=True))  # -> T1547.001

Training

• Base: ibm-granite/granite-4.1-3b
• Method: LoRA (r=16, alpha=32, dropout=0.05), targeting q/k/v/o + gate/up/down projections
• Epochs: 3 | final train_loss 0.49
• Frameworks: PEFT 0.19.1, TRL 1.1.0, Transformers 4.57.x, PyTorch 2.6.0+cu124

LoRA adapter only (~124 MB); load on top of the base model as shown above.