MODELCARD.md

---
language:
- en
license: apache-2.0
base_model: mistralai/Mistral-7B-Instruct-v0.3
library_name: peft
pipeline_tag: text-generation
datasets:
- dpevzner/Cybersecurity_Reasoning_Dataset_MistralFamily_7b
- dpevzner/Cybersecurity_Reasoning_Dataset
tags:
- cybersecurity
- lora
- peft
- mistral
- security-operations
- threat-analysis
- dual-use-detection
- it-operations
model-index:
- name: CyberOps_Mistral_7B_LoRA
  results: []
---

# CyberOps-Mistral-7B-LoRA

A LoRA fine-tuned adapter for **Mistral 7B Instruct v0.3**, specialized for cybersecurity
IT-operations reasoning — dual-use command intent analysis, failure diagnosis, security
scope assessment, tool correctness, and cross-shell translation.

> **Adapter only** — requires `mistralai/Mistral-7B-Instruct-v0.3` as the base model.

**Weights provenance:** `final_adapter` from training run
`LORA-MISTRAL_7B-20260709-232328` (latest). Best confirmed benchmark across the iterative
training loop: **88.1** (50-item rubric).

---

## Model Details

| Field | Value |
|---|---|
| **Base model** | `mistralai/Mistral-7B-Instruct-v0.3` |
| **Adapter type** | LoRA (PEFT 0.19.1) |
| **LoRA rank `r`** | 16 |
| **`lora_alpha`** | 32 |
| **`lora_dropout`** | 0.05 |
| **`bias`** | none |
| **Target modules** | `q_proj, k_proj, v_proj, o_proj, gate_proj, up_proj, down_proj` (all linear) |
| **Trainable parameters** | ~41,943,040 (~1.10% of base); 448 LoRA tensors |
| **Task type** | `CAUSAL_LM` |
| **Training method** | Supervised fine-tuning (SFT) via TRL; iterative single-epoch repair on prior best |
| **Effective batch** | 8 (per-device 1 × grad-accum 8) |
| **Learning rate** | 2e-4 |
| **Max sequence length** | 1024 |
| **Training records** | ~4,615 (123 curriculum files) |
| **Frameworks** | TRL 1.2.0 · Transformers 5.6.2 · PEFT 0.19.1 · PyTorch 2.5.1+cu121 |
| **Hardware** | NVIDIA RTX 4070 Laptop GPU (8 GB) · 64 GB RAM · ~5.56 GB peak VRAM |
| **Best benchmark** | **88.1** avg (50-item rubric) |

---

## Model-Family Compatibility

Optimized for the **Mistral / Llama instruction-tuned family**. The training data uses the
Alpaca-style instruct format:

```
### Instruction:
[prompt]

### Response:
[answer]
```

**The binding is to this prompt *format*, not the architecture.** The same dataset trained
on three bases shows the format mismatch — not capability — drives the gap:

| Base model | Prompt format | Best benchmark |
|---|---|---|
| `mistralai/Mistral-7B-Instruct-v0.3` | native (Alpaca) | **88.1** |
| `deepseek-ai/deepseek-llm-7b-chat` | mismatched | **47.38** |
| `microsoft/Phi-3.5-mini-instruct` | mismatched | early experiments |

Recommended base models for **this** adapter: `mistralai/Mistral-7B-Instruct-v0.3`
(primary), other Mistral 7B Instruct point releases, or Llama-3/3.1 8B Instruct (compatible
format; requires retraining on that base). **For DeepSeek/Gemma/ChatML/Qwen, use the
model-agnostic dataset** (below) rendered in each family's native format.

---

## Datasets

- **Training data (format-specific):**
  [`dpevzner/Cybersecurity_Reasoning_Dataset_MistralFamily_7b`](https://huggingface.co/datasets/dpevzner/Cybersecurity_Reasoning_Dataset_MistralFamily_7b)
  — ~4,615 records in the Mistral/Llama `### Instruction:`/`### Response:` format.
- **Model-agnostic variant:**
  [`dpevzner/Cybersecurity_Reasoning_Dataset`](https://huggingface.co/datasets/dpevzner/Cybersecurity_Reasoning_Dataset)
  — neutral canonical corpus + Mistral/DeepSeek/ChatML/Gemma rendered variants (to train
  other families without the format-mismatch penalty).

### Curriculum (hard-ordered, 3-epoch)

| Epoch | Folders | Records |
|---|---|---|
| 1 | `03_toolknowledge`, `05_detection_rules` | ~1,077 |
| 2 | `04_goldens`, `05_seedcases` | ~1,508 |
| 3 | `06_contrast_pairs` | ~2,030 |

New synthesis/repair records go in Epoch 3; placing them in Epoch 2 previously caused sharp
regression in ambiguity reasoning (hard constraint). The benchmark is held out with zero
overlap with training data.

---

## Intended Use

For **offline / air-gapped cybersecurity operations** — a domain-specific reasoning
assistant for authorized security testing and SOC support.

**Capabilities:** dual-use command intent analysis; failure diagnosis (`privilege_failure`,
`syntax_failure`, `environment_mismatch`, `dependency_absence`, `stale_documentation`);
security scope assessment; tool correctness (PowerShell/CMD/bash); cross-shell translation.
**Out of scope:** general threat intel, malware RE, CVE assessment, offensive automation,
general-purpose assistant use.

---

## Benchmark

50-item rubric across five families. Best **88.1**; stable **88.0** most recent.

| Family | Items | Baseline | Best |
|---|---|---|---|
| tool_correctness | 10 | ~73 | ~91.7 |
| cross_shell_translation | 10 | ~71 | ~97 |
| failure_diagnosis | 10 | ~30 | ~85 |
| ambiguity_reasoning | 10 | ~100 | ~95.8 |
| safety_scope | 10 | ~10 | ~70 |
| **Overall** | **50** | **56.28** | **88.1** |

Reached a **capacity ceiling at ~88 (rank 16)**: further repairs fix targeted items but
displace others ~1:1. Progressing requires higher LoRA rank, not more data.

---

## Usage

```python
from transformers import AutoTokenizer, AutoModelForCausalLM
from peft import PeftModel
import torch

BASE_MODEL = "mistralai/Mistral-7B-Instruct-v0.3"
ADAPTER    = "dpevzner/CyberOps_Mistral_7B_LoRA"

tokenizer = AutoTokenizer.from_pretrained(BASE_MODEL)
model = AutoModelForCausalLM.from_pretrained(
    BASE_MODEL, dtype=torch.float16, device_map="auto",
    max_memory={0: "5GiB", "cpu": "20GiB"})
model = PeftModel.from_pretrained(model, ADAPTER)
model.eval()

prompt = """### Instruction:
Analyze the ambiguous command: `Get-Process lsass`

### Response:"""

inputs = tokenizer(prompt, return_tensors="pt").to(model.device)
with torch.no_grad():
    out = model.generate(**inputs, max_new_tokens=256, do_sample=False, use_cache=False)
print(tokenizer.decode(out[0][inputs["input_ids"].shape[1]:], skip_special_tokens=True))
```

This adapter expects the `### Instruction:` / `### Response:` format; other formats degrade
output quality due to the format binding described above.

---

## Limitations

- **Adapter-capacity ceiling at ~88 (rank 16)** — repairs fix items but regress others ~1:1.
- **Safety scope is the weakest family (~70)** — items ss_001/002/006/007/010 inconsistent.
- **Ambiguity reasoning oscillates** (ar_008/009/010) under heavy contrast-pair synthesis.
- **Substring-based scoring** — a correctly paraphrased answer can be scored a miss.
- **GPU telemetry reads zero** (NVML polling gap) — cosmetic; training is correct.
- **Synthetic evaluation only** — live-operations performance not measured.

---

## Ethical Considerations

Trained to analyze **dual-use** commands for **defensive** security operations. Not for
generating offensive tooling, attack automation, or unauthorized access. All training data
was synthesized under operator oversight with explicit content-governance controls.

---

## Citation

```bibtex
@misc{cyberops_mistral_7b_lora_2026,
  title  = {CyberOps-Mistral-7B-LoRA: A LoRA Adapter for Cybersecurity IT-Operations Reasoning},
  author = {Pevzner, D.},
  year   = {2026},
  note   = {LoRA (r=16, alpha=32) adapter for Mistral 7B Instruct v0.3, trained on ~4,615
            synthetic cybersecurity reasoning records; best benchmark 88.1 on a 50-item rubric.}
}
```

---

*Training environment: Alienware M16R2 / RTX 4070 Laptop GPU / Windows 11. Weights from run
`LORA-MISTRAL_7B-20260709-232328` (script v4.7).*