dpevzner/CyberOps_Mistral_7B_LoRA

CyberOps-Mistral-7B-LoRA

A LoRA fine-tuned adapter for Mistral 7B Instruct v0.3, specialized for cybersecurity IT-operations reasoning — dual-use command intent analysis, failure diagnosis, security scope assessment, tool correctness, and cross-shell translation.

Adapter only — requires mistralai/Mistral-7B-Instruct-v0.3 as the base model.

Weights provenance: final_adapter from training run LORA-MISTRAL_7B-20260709-232328 (latest). Best confirmed benchmark across the iterative training loop: 88.1 (50-item rubric).

---

Model Details

Field	Value
Base model	mistralai/Mistral-7B-Instruct-v0.3
Adapter type	LoRA (PEFT 0.19.1)
LoRA rank r	16
lora_alpha	32
lora_dropout	0.05
bias	none
Target modules	q_proj, k_proj, v_proj, o_proj, gate_proj, up_proj, down_proj (all linear)
Trainable parameters	41,943,040 (1.10% of base); 448 LoRA tensors
Task type	CAUSAL_LM
Training method	Supervised fine-tuning (SFT) via TRL; iterative single-epoch repair on prior best
Effective batch	8 (per-device 1 × grad-accum 8)
Learning rate	2e-4
Max sequence length	1024
Training records	~4,615 (123 curriculum files)
Frameworks	TRL 1.2.0 · Transformers 5.6.2 · PEFT 0.19.1 · PyTorch 2.5.1+cu121
Hardware	NVIDIA RTX 4070 Laptop GPU (8 GB) · 64 GB RAM · ~5.56 GB peak VRAM
Best benchmark	88.1 avg (50-item rubric)

---

Model-Family Compatibility

Optimized for the Mistral / Llama instruction-tuned family. The training data uses the Alpaca-style instruct format:

### Instruction:
[prompt]

### Response:
[answer]

The binding is to this prompt format, not the architecture. The same dataset trained on three bases shows the format mismatch — not capability — drives the gap:

Base model	Prompt format	Best benchmark
mistralai/Mistral-7B-Instruct-v0.3	native (Alpaca)	88.1
deepseek-ai/deepseek-llm-7b-chat	mismatched	47.38
microsoft/Phi-3.5-mini-instruct	mismatched	early experiments

Recommended base models for this adapter: mistralai/Mistral-7B-Instruct-v0.3 (primary), other Mistral 7B Instruct point releases, or Llama-3/3.1 8B Instruct (compatible format; requires retraining on that base). For DeepSeek/Gemma/ChatML/Qwen, use the model-agnostic dataset (below) rendered in each family's native format.

---

Datasets

• Training data (format-specific): dpevzner/Cybersecurity_Reasoning_Dataset_MistralFamily_7b — ~4,615 records in the Mistral/Llama ### Instruction:/### Response: format.
• Model-agnostic variant: dpevzner/Cybersecurity_Reasoning_Dataset — neutral canonical corpus + Mistral/DeepSeek/ChatML/Gemma rendered variants (to train other families without the format-mismatch penalty).

Curriculum (hard-ordered, 3-epoch)

Epoch	Folders	Records
1	03_toolknowledge, 05_detection_rules	~1,077
2	04_goldens, 05_seedcases	~1,508
3	06_contrast_pairs	~2,030

New synthesis/repair records go in Epoch 3; placing them in Epoch 2 previously caused sharp regression in ambiguity reasoning (hard constraint). The benchmark is held out with zero overlap with training data.

---

Intended Use

For offline / air-gapped cybersecurity operations — a domain-specific reasoning assistant for authorized security testing and SOC support.

Capabilities: dual-use command intent analysis; failure diagnosis (privilege_failure, syntax_failure, environment_mismatch, dependency_absence, stale_documentation); security scope assessment; tool correctness (PowerShell/CMD/bash); cross-shell translation. Out of scope: general threat intel, malware RE, CVE assessment, offensive automation, general-purpose assistant use.

---

Benchmark

50-item rubric across five families. Best 88.1; stable 88.0 most recent.

Family	Items	Baseline	Best
tool_correctness	10	~73	~91.7
cross_shell_translation	10	~71	~97
failure_diagnosis	10	~30	~85
ambiguity_reasoning	10	~100	~95.8
safety_scope	10	~10	~70
Overall	50	56.28	88.1

Reached a capacity ceiling at ~88 (rank 16): further repairs fix targeted items but displace others ~1:1. Progressing requires higher LoRA rank, not more data.

---

Usage

from transformers import AutoTokenizer, AutoModelForCausalLM
from peft import PeftModel
import torch

BASE_MODEL = "mistralai/Mistral-7B-Instruct-v0.3"
ADAPTER    = "dpevzner/CyberOps_Mistral_7B_LoRA"

tokenizer = AutoTokenizer.from_pretrained(BASE_MODEL)
model = AutoModelForCausalLM.from_pretrained(
    BASE_MODEL, dtype=torch.float16, device_map="auto",
    max_memory={0: "5GiB", "cpu": "20GiB"})
model = PeftModel.from_pretrained(model, ADAPTER)
model.eval()

prompt = """### Instruction:
Analyze the ambiguous command: `Get-Process lsass`

### Response:"""

inputs = tokenizer(prompt, return_tensors="pt").to(model.device)
with torch.no_grad():
    out = model.generate(**inputs, max_new_tokens=256, do_sample=False, use_cache=False)
print(tokenizer.decode(out[0][inputs["input_ids"].shape[1]:], skip_special_tokens=True))

This adapter expects the ### Instruction: / ### Response: format; other formats degrade output quality due to the format binding described above.

---

Limitations

• Adapter-capacity ceiling at ~88 (rank 16) — repairs fix items but regress others ~1:1.
• Safety scope is the weakest family (~70) — items ss_001/002/006/007/010 inconsistent.
• Ambiguity reasoning oscillates (ar_008/009/010) under heavy contrast-pair synthesis.
• Substring-based scoring — a correctly paraphrased answer can be scored a miss.
• GPU telemetry reads zero (NVML polling gap) — cosmetic; training is correct.
• Synthetic evaluation only — live-operations performance not measured.

---

Ethical Considerations

Trained to analyze dual-use commands for defensive security operations. Not for generating offensive tooling, attack automation, or unauthorized access. All training data was synthesized under operator oversight with explicit content-governance controls.

---

Citation

@misc{cyberops_mistral_7b_lora_2026,
  title  = {CyberOps-Mistral-7B-LoRA: A LoRA Adapter for Cybersecurity IT-Operations Reasoning},
  author = {Pevzner, D.},
  year   = {2026},
  note   = {LoRA (r=16, alpha=32) adapter for Mistral 7B Instruct v0.3, trained on ~4,615
            synthetic cybersecurity reasoning records; best benchmark 88.1 on a 50-item rubric.}
}

---

Training environment: Alienware M16R2 / RTX 4070 Laptop GPU / Windows 11. Weights from run LORA-MISTRAL_7B-20260709-232328 (script v4.7).