---
license: apache-2.0
language:
  - en
tags:
  - security
  - incident-response
  - dfir
  - qwen2.5
  - qlora
  - gguf
  - ollama
  - post-quantum
  - 1.5b
base_model: Qwen/Qwen2.5-1.5B-Instruct
model_name: pq-sift-defender-Q4_K_M
pipeline_tag: text-generation
model-index:
  - name: pq-sift-defender-Q4_K_M
    results:
      - task:
          type: text-generation
          name: DFIR Triage Verdict
        metrics:
          - name: Overall Accuracy
            type: accuracy
            value: 96.3
          - name: BLOCK Accuracy
            type: accuracy
            value: 100.0
          - name: PASS Accuracy
            type: accuracy
            value: 94.6
---

# pq-sift-defender-Q4_K_M

QLoRA fine-tuned [Qwen2.5-1.5B-Instruct](https://huggingface.co/Qwen/Qwen2.5-1.5B-Instruct) for autonomous DFIR incident-response triage. Q4_K_M quantized GGUF for Ollama.

Built by [CycleCore Technologies](https://cyclecore.ai) for the [SANS FIND EVIL](https://findevil.devpost.com/) hackathon.

## What it does

Reads a security alert (EDR, WAF, IDS, phishing report) and produces a structured verdict: **PASS**, **FLAG**, or **BLOCK** with cited indicators. The model drives the [pq-sift-defender](https://github.com/CycleCoreTech/pq-sift-defender) agent, which wraps it with a SecurityGates pre-filter and a post-quantum signed audit trail (ML-DSA-65).

## Performance

Validated on 136 held-out samples spanning benign events, SSRF, SQL injection, command injection, path traversal, prompt injection, CVE-grounded attacks, boundary recovery, and malware memory dumps.

```
96.3% accuracy | 100% BLOCK | 94.6% PASS | 11s per triage | CPU-only
```

| Verdict | Accuracy | Count |
|---------|----------|-------|
| BLOCK   | 100%     | 72/72 |
| FLAG    | 75%      | 6/8   |
| PASS    | 94.6%    | 53/56 |

## Training

- **Method**: QLoRA (4-bit NF4, LoRA r=64, alpha=16, 5 epochs, lr=1e-4)
- **Data**: 785 unique ShareGPT-format samples across 7 batches (benign PASS, attack BLOCK, boundary recovery, FLAG + format, CVE-grounded, hard PASS)
- **Two-axis weighting**: per-batch oversampling (up to 1.8x for PASS) + per-sample quality-based loss scaling (A/B/C tiers)
- **Hardware**: RTX 5070Ti, 26 minutes
- **Pipeline**: Reproducible via `training/` directory in the [main repo](https://github.com/CycleCoreTech/pq-sift-defender)

## Usage with Ollama

```bash
# Download the GGUF and Modelfile from this repo, then:
ollama create pq-sift-defender -f Modelfile

# Or point your Modelfile FROM line at the downloaded GGUF path:
# FROM /path/to/pq-sift-defender-Q4_K_M.gguf
```

Then run with the agent:

```bash
pip install -e ".[dev]"  # from the main repo
PQ_SIFT_MODEL=pq-sift-defender pq-sift-defender investigate samples/path_traversal.json
```

Or test directly:

```bash
ollama run pq-sift-defender "Analyze this alert: PowerShell -enc SQBFAFgAIAAoA..."
```

## Files

| File | Size | Description |
|------|------|-------------|
| `pq-sift-defender-Q4_K_M.gguf` | 986 MB | Q4_K_M quantized model |
| `Modelfile` | 1.6 KB | Ollama import file with ChatML template + system prompt |

## Quantization

Converted from merged safetensors via `llama.cpp/convert_hf_to_gguf.py` (external, not Ollama's internal converter). Q4_K_M quantization. 986 MB on disk.

**Note**: Ollama 0.24.0's internal safetensors-to-GGUF converter has a known bug with transformers 5.9.0 models. Use the external llama.cpp converter if rebuilding from source.

## Hardware Requirements

| Resource | Requirement |
|----------|-------------|
| RAM      | 2-3 GB free |
| CPU      | One modern x86_64 core |
| Disk     | ~1 GB |
| GPU      | Not required |

| CPU | Inference time |
|-----|---------------|
| Intel Core i9-14900KF | 4s |
| AMD Ryzen 7 7800X3D | 11s |

## License

Apache 2.0