license: apache-2.0 base_model: Qwen/Qwen3-4B tags: cybersecurity cve vulnerability fine-tuned rag triage gguf llama-cpp datasets: Voidreaper2026/cybersec-master-dataset language: en pipeline_tag: text-generation qwen3-4b-cybersec-GGUF — Cybersecurity Fine-Tuned Language Model A Qwen3-4B model fine-tuned on the Voidreaper2026/cybersec-master-dataset and quantised to GGUF Q8_0 for local deployment. The training corpus spans 1.8 million deduplicated records from NVD, OSV, GitHub Advisory Database, ExploitDB, MITRE ATT&CK, CISA KEV, Security Stack Exchange, Kali Linux tooling, and Vulners vulnerability intelligence. This model is designed to operate as the fast extraction and classification layer in a grounded triage pipeline — not as a standalone severity oracle. That distinction matters, and the rest of this card explains why. Quickstart llama.cpp bash# Install brew install llama.cpp # macOS winget install llama.cpp # Windows # Run as OpenAI-compatible server llama-server -hf Voidreaper2026/qwen3-4b-cybersec-GGUF:Q8_0 # Or run directly in terminal llama-cli -hf Voidreaper2026/qwen3-4b-cybersec-GGUF:Q8_0 Ollama bashollama run hf.co/Voidreaper2026/qwen3-4b-cybersec-GGUF:Q8_0 llama-cpp-python pythonfrom llama_cpp import Llama llm = Llama.from_pretrained( repo_id="Voidreaper2026/qwen3-4b-cybersec-GGUF", filename="model-Q8_0.gguf", n_ctx=4096 ) # Use in extraction mode — see recommended usage below response = llm.create_chat_completion( messages=[ { "role": "user", "content": """Extract the following fields from your knowledge of CVE-2023-44487. Return as JSON only. Return null for any field you cannot confirm with certainty. Fields: cve_id, cwe_ids, affected_products, attack_vector, privileges_required, patch_available, cisa_kev, mitre_attack_technique""" } ], temperature=0.1, max_tokens=512 ) print(response["choices"][0]["message"]["content"]) LM Studio / Jan Search for Voidreaper2026/qwen3-4b-cybersec-GGUF directly in the app. Training Data SourceRecordsDescriptionNVD500,935CVE database back to 2002OSV754,273Multi-ecosystem vulnerability DBGitHub Advisory DB328,525Security advisories, CC-BY 4.0Cybersec Causal Reasoning99,870Reasoning triplesSecurity Stack Exchange55,930Real-world Q&AExploitDB46,457Public exploit databaseVulners87,063Exploit and advisory intelligenceMITRE ATT&CK2,205Techniques, mitigations, groupsCISA KEV1,587Known Exploited VulnerabilitiesKali Linux Tools790Tool descriptions and flagsTotal (deduplicated)1,807,941 The Problem This Pipeline Solves Every LLM over-inflates CVE severity scores. This is a field-wide problem, not a model-specific one. It has nothing to do with training data quality. It is structural: Pre-training data is skewed by nature. The internet massively over-represents Critical and High CVEs. Security blogs, PoC writeups, advisories, and news articles are written about things worth writing about. Nobody publishes a detailed breakdown of a CVSS 4.2. Every LLM inherits this bias from pre-training, before any fine-tuning happens. NVD base scores are worst-case by design. CVSS base scores assume no mitigating controls, full network exposure, and worst-case environment. A legitimate 9.8 in the database might realistically be a 4.0 in most real deployments. A model learns the base score, not the contextualised one. Instruction tuning pushes toward caution. RLHF and instruction fine-tuning reward thorough, safety-conscious answers. In a security context that trains a systematic bias toward "better safe than sorry" severity framing. The result is that any LLM asked to score a CVE from memory will trend Critical. The pipeline below bypasses this entirely by ensuring severity scores are always retrieved from source data, never generated from model weights. Recommended Architecture: Grounded Triage Pipeline User Query │ ▼ ┌─────────────────────────────────────────────────────────────────┐ │ qwen3-4b-cybersec (Extraction Layer) │ │ │ │ Fast, cheap, runs fully local on CPU or AMD/NVIDIA GPU. │ │ Responsibilities: │ │ - Extract CVE IDs and affected product names │ │ - Classify CWE type and attack surface │ │ - Identify scope (network vs local vs physical) │ │ - Structure query for downstream retrieval │ │ - Flag whether CISA KEV / ATT&CK context is relevant │ │ │ │ Does NOT output severity scores or CVSS values. │ └────────────────────────┬────────────────────────────────────────┘ │ Structured: CVE IDs, CWEs, products ▼ ┌─────────────────────────────────────────────────────────────────┐ │ RAG Retrieval Layer │ │ │ │ Vector search over embedded cybersec-master-dataset. │ │ Returns verbatim from source: │ │ - CVSS v3.1 base score and full vector string │ │ - CWE classification │ │ - CISA KEV status │ │ - MITRE ATT&CK technique mapping │ │ - Patch and fix reference links │ └────────────────────────┬────────────────────────────────────────┘ │ │ If CVE not in index (zero-day, │ post-training, vendor advisory): ▼ ┌─────────────────────────────────────────────────────────────────┐ │ Web Search Fallback (No-RAG Path) │ │ │ │ Live lookups against NVD API, CISA KEV catalogue, │ │ CVE.mitre.org, vendor security bulletins. │ │ Output tagged source: web_search_backed. │ └────────────────────────┬────────────────────────────────────────┘ │ Retrieved or fetched context ▼ ┌─────────────────────────────────────────────────────────────────┐ │ Large Model (Triage and Synthesis Layer) │ │ │ │ Operates exclusively on retrieved context, never on weights. │ │ - Presents the source-retrieved CVSS score │ │ - Contextualises severity for the user's actual environment │ │ - Generates prioritised remediation steps │ │ - Cross-references ATT&CK techniques and CISA KEV status │ │ - Flags confidence: rag_backed / web_search_backed / │ │ model_generated (treat with caution) │ └─────────────────────────────────────────────────────────────────┘ Why each component earns its place qwen3-4b-cybersec is the economical workhorse. Entity extraction, CWE classification, product identification, and query structuring are exactly what a fine-tuned 4B model excels at. It runs fast, runs cheap, and runs entirely on local hardware including AMD GPUs via llama.cpp. By keeping it out of the scoring loop you get the benefit of its domain knowledge without exposure to the inflation bias that affects all LLMs. RAG retrieval is the score source. The cybersec-master-dataset contains original CVSS vectors, CISA KEV flags, and ATT&CK mappings from authoritative sources. Retrieving these verbatim completely bypasses the inflation problem — the score comes from NVD, not from model memory. This works regardless of which LLM you use elsewhere in the pipeline. Web search covers the temporal gap. For CVEs published after the training cutoff or outside the covered sources, the pipeline falls back to live NVD API lookups. The result is tagged with its source so downstream systems can apply appropriate confidence weighting. The large model synthesises, never invents. The bigger model receives fully grounded context and contextualises it — translating a raw CVSS vector into environment-specific risk. It is never asked to recall a score from weights, so its own inflation bias is never triggered. Confidence Flagging FlagMeaningTrust levelrag_backedScore retrieved verbatim from dataset indexHighweb_search_backedScore fetched live from NVD API or vendor advisoryHighmodel_generatedNo retrieval source found — model inference onlyLow — verify manually Any model_generated severity should be verified before being written to a ticketing system or used to set patch SLA deadlines. This applies to any LLM in this position, not just this model. RAG Implementation Notes Embedding the dataset pythonfrom datasets import load_dataset from sentence_transformers import SentenceTransformer ds = load_dataset("Voidreaper2026/cybersec-master-dataset", split="train") encoder = SentenceTransformer("sentence-transformers/all-MiniLM-L6-v2") # Embed at record level — each record maps to one CVE. # Sub-chunk embedding breaks CVSS vector coherence. def get_embed_text(record): convs = record["conversations"] assistant_turn = next((c["value"] for c in convs if c["from"] == "gpt"), "") cve_id = record.get("cve_id", "") return f"{cve_id} {assistant_turn}" NVD API fallback pythonimport httpx async def nvd_lookup(cve_id: str) -> dict: url = f"https://services.nvd.nist.gov/rest/json/cves/2.0?cveId={cve_id}" async with httpx.AsyncClient() as client: r = await client.get(url, timeout=10) r.raise_for_status() data = r.json() vulns = data.get("vulnerabilities", []) if not vulns: return {"source": "web_search_backed", "found": False, "cve_id": cve_id} cve = vulns[0]["cve"] metrics = cve.get("metrics", {}) cvss_data = ( metrics.get("cvssMetricV31", [{}])[0].get("cvssData", {}) or metrics.get("cvssMetricV30", [{}])[0].get("cvssData", {}) ) return { "source": "web_search_backed", "found": True, "cve_id": cve_id, "cvss_score": cvss_data.get("baseScore"), "cvss_vector": cvss_data.get("vectorString"), "severity": cvss_data.get("baseSeverity"), "description": cve.get("descriptions", [{}])[0].get("value", ""), "published": cve.get("published"), } Intended Use SOC L1/L2 assistant tooling within the pipeline architecture above Structured CVE entity extraction as a preprocessing step Vulnerability report drafting and summarisation Security awareness training content generation CTF hint generation and write-up assistance Out of Scope Standalone authoritative CVSS scoring from model output alone Automated patch prioritisation without RAG retrieval or NVD API verification Any workflow where model-generated severity feeds directly into SLA enforcement These constraints apply equally to all LLMs used for CVE scoring. Licence Apache 2.0. Training data sources retain their individual licences — see the dataset card for full attribution.