---
license: apache-2.0
library_name: peft
tags:
  - ueba
  - insider-threat
  - soc-narrative
  - sft
  - qwen3-14b
  - smoke
  - cybersecurity
base_model: Qwen/Qwen3-14B
datasets:
  - Pankei/soc-narrative-dev-balanced-50
metrics:
  - accuracy
  - macro-f1
pipeline_tag: text-generation
model-index:
  - name: soc-narrative-sft-smoke-qwen3-14b
    results:
      - task:
          type: text-classification
          name: Insider Threat Detection
        dataset:
          type: Pankei/soc-narrative-dev-balanced-50
          name: SOC Narrative dev_balanced_50
          split: dev
        metrics:
          - type: accuracy
            value: N/A
            name: Accuracy
          - type: f1
            value: N/A
            name: Macro F1
---

# SOC Narrative SFT — Qwen3-14B (Smoke Test)

[![GitHub](https://img.shields.io/badge/GitHub-Repo-green)](https://github.com/Pancake2021/research_work_by_a_student)
[![Open In Colab](https://colab.research.google.com/assets/colab-badge.svg)](https://colab.research.google.com/github/Pancake2021/research_work_by_a_student/blob/main/notebooks/soc_narrative_demo.ipynb)
[![Hugging Face](https://img.shields.io/badge/🤗%20Hugging%20Face-Pankei-orange)](https://huggingface.co/Pankei)

LoRA adapter for **Qwen/Qwen3-14B** trained with **SFT LoRA** on **1 step (infrastructure test)** (step 1).

## Description

**SOC Narrative** is a framework for insider threat detection using small open-weight LLMs. A model receives a user/day window of events from the **CERT Insider Threat Dataset R4.2** and must produce a structured response with:
- **Risk label**: `normal`, `suspicious`, or `malicious`
- **Evidence**: cited event IDs supporting the decision
- **Reasoning**: brief explanation of the investigation logic

This project explores whether small LLMs (3B–14B) can match or exceed traditional ML baselines for UEBA (User and Entity Behavior Analytics).

## Metrics

> Evaluation results for this checkpoint are not yet available. See the [project repo](https://github.com/Pancake2021/research_work_by_a_student) for details.

## Quick Usage

```python
from transformers import AutoModelForCausalLM, AutoTokenizer
from peft import PeftModel

base = "Qwen/Qwen3-14B"
model = AutoModelForCausalLM.from_pretrained(base, torch_dtype="auto", device_map="auto")
model = PeftModel.from_pretrained(model, "Pankei/soc-narrative-sft-smoke-qwen3-14b")

tokenizer = AutoTokenizer.from_pretrained(base)
inputs = tokenizer("<your prompt>", return_tensors="pt").to(model.device)
output = model.generate(**inputs, max_new_tokens=256)
print(tokenizer.decode(output[0]))
```

> **Note**: This is a LoRA adapter (~30–160 MB). You need the full base model (Qwen/Qwen3-14B) to load it.

## Training Details

- **Base model**: Qwen/Qwen3-14B
- **Method**: SFT LoRA
- **Train data**: 1 step (infrastructure test)
- **Checkpoint**: step 1
- **LoRA rank**: 32, **alpha**: 64, **target modules**: q_proj, k_proj, v_proj, o_proj
- **Format**: Structured SOC Narrative (risk + evidence + reasoning)
- **Hardware**: NVIDIA H100 (80 GB)


## Limitations

- Evaluated on a small balanced sample (n=50) — results may not generalize to production distributions
- 1-step smoke test for training pipeline validation. Not intended for production use.
- Dataset is based on synthetic insider threat scenarios from CERT R4.2 (2016) — real-world performance may differ

## Citation

```bibtex
@misc{soc-narrative-2026,
  author = {Research project},
  title = {SOC Narrative: Small LLMs for UEBA / Insider Threat Detection},
  year = {2026},
  howpublished = {\url{https://github.com/Pancake2021/research_work_by_a_student}}
}
```