oN8WeJbq5Jo7Pk/CVE-Heretic-Fable5-27B-GGUF

Trial93

A Qwen3.6-27B finetune for CVE writeups and reverse engineering. Abliterated.

Trained on a curated, source-balanced 28.6K-row SFT mix in which CVE writeups, distilled reasoning, and agentic traces each contribute meaningful weight (cap of 12K rows per source so no single dataset dominates). Then abliterated to remove refusals on lawful security research. The LoRA adapter is merged back into the base before quantization, so this ships as a single standalone GGUF.

TL;DR

• Base: Qwen/Qwen3.6-27B (Apache 2.0)
• Recipe: LoRA r=32, alpha=64, target_modules=all-linear on 8× B200 (DDP), constant LR + warmup, eval-driven early-stopping with patience 4, length-grouped sampler. Adapter then merged into base.
• Abliteration: 1000-trial Optuna sweep using the Heretic recipe; trial 93 selected from the Pareto front of fewest refusals and lowest KL. KL = 0.0041, refusals = 10/100 down from a baseline of 90/100, with the rest of model behavior essentially unchanged.
• Quantization shipped: Q5_K_M GGUF (~18 GB). Fits cleanly on a single 24 GB GPU (3090/4090) at 32K context, 16 GB with KV-cache quantization.

Quickstart

Ollama

# Pull the GGUF
ollama pull oN8WeJbq5Jo7Pk/CVE-Heretic-Fable5-27B-GGUF:Q5_K_M

# Or, if you have the local GGUF + the Modelfile from this repo:
ollama create fable5-trial93 -f Modelfile.fable5
ollama run fable5-trial93

Sampling

This is a Qwen3.6 thinking-mode-capable model. Recommended sampling (matches what I trained and benched with):

Mode	temperature	top_p	top_k	min_p
thinking / hard reasoning	0.6	0.95	20	0
instruct / chat	0.7	0.8	20	0

The shipped Modelfile.fable5 sets repeat_penalty 1.1 and stops on <|im_start|> / <|im_end|>.

Default system prompt

This model was trained almost entirely on technical security and RE data, with no casual-conversation examples. Given a trivial input (for example "hi") and no system prompt, it can occasionally produce filler reasoning or an unsolicited code block instead of a normal reply. The shipped Modelfile.fable5 sets a default system prompt that resolves this while keeping full depth on real technical tasks:

You are a security and reverse-engineering assistant. Match response length to the task: one or two sentences for greetings or simple questions, full depth for technical work.

If you load the raw GGUF in another client, set a short system prompt of your own; any reasonable one removes the behavior.

Send a single system message. Like all Qwen3.6 models, the chat template requires the system message to be first and the only one. Clients that send two or more system messages fail with System message must be at the beginning (some agent frameworks and plugins do this). Consolidate everything into one system prompt.

Training data

The full deduped pool is ~101K rows but heavily dominated by CVE content. Training uses a balanced variant capped at 12K rows per source. The CVE source is not randomly down-sampled to that cap; it is curated for topic coverage. Every CVE writeup is classified by vulnerability type (XSS, SQLi, RCE, memory-safety, use-after-free, DoS, info-disclosure, path traversal, auth / access-control, CSRF, SSRF, deserialization, crypto, with a CWE-id fallback for the rest), near-duplicate writeups are removed with MinHash/LSH (Jaccard 0.7), and the survivors are stratified round-robin sampled across types so no single vulnerability class dominates the CVE slice. Everything is then token-capped at 8192 and exact-deduplicated. Final train+val composition (28,935 rows total, 28,646 train + 289 val):

Upstream HF datasets used directly (96.2%)

These rows are normalized to a unified ChatML message format (the build step drops the fictional-persona preamble in mythos, parses ChatML text into messages for lordx64, and so on) but their content comes from the upstream datasets:

Upstream dataset	Rows in train	Share
build-small-hackathon/CVE_Vulnerailities_Detailed	11,874	41.5%
WithinUsAI/claude_mythos_distilled_25k	5,256	18.3%
11-47/claude_opus_4.8_distill_5k	4,963	17.3%
lordx64/agentic-distill-fable-5-sft	4,554	15.9%
PawanKrd/claude-fable-5-code	581	2.0%
ppbhatt500/kernelbook-opus4.8-multiturn-traces	225	0.8%
nonopasser/go_sft_claude-opus-4.8_100	98	0.3%
direct upstream subtotal	27,551	96.2%

Synthetic SFT generated for this finetune (3.8%)

Produced locally with a Claude Opus distillation agent. These rows aren't from any HF dataset; they're new (user, assistant) pairs generated by the agent, then quality-filtered. The agent was seeded in three different ways:

Synthetic category	Rows	Seeded from
synthetic-code-grounded	420	Real source files mined from notune/fable5-repos (per-language quotas, sweet-spot file size) and King3Djbl/fable5-dataset.
synthetic-distilled	321	(input, teacher-output) pairs scraped from messy upstream trace dumps. Seeds drawn from: Glint-Research/Fable-5-traces, attentionAllYouNeed/Vibe-Coding-Claude-Fable-5, HelioAI/Fable-5-Distill-Reasoning-462x, victor/fable-5-boeing-747-trace, armand0e/claude-opus-4.8-pi-traces, Crownelius/Complete-FABLE.5-traces-2M
synthetic-generated	354	Free-form generation seeded from real user prompts mined from the same upstream messy datasets
synthetic subtotal	1,095	3.8%

Notes

• Val split is drawn from the same distribution (289 rows; CVE share 43.3%).
• HelioAI/Fable-5-Distill-Reasoning-462x supplied 461 reasoning-only rows in the raw pool but was dropped before balancing because its rows lacked a synthesized final answer; it survives in the recipe as a seed source for synthetic-distilled instead.
• The defining feature of this finetune is the CVE share at ~42%. Most public Qwen3.6 finetunes train on general instruction-following data; here the 12K cap was chosen specifically so CVE content stays heavy enough to teach the model real vulnerability-analysis vocabulary without crowding out reasoning and agentic traces from the other sources.

Training recipe

Single-file Modal recipe, reproducible end to end:

• 8× NVIDIA B200, CUDA 12.8, PyTorch BF16
• LoRA: r=32, alpha=64, dropout=0.05, target_modules="all-linear" via PEFT
• Sequence length 8192, per-device batch size 1, gradient accumulation 16 (effective batch 16)
• Optimizer adamw_torch, learning rate 1e-4, constant_with_warmup (100 warmup steps)
• Gradient checkpointing enabled (use_reentrant=False), required since 27B at 8192 OOMs without it
• Length-grouped sampler (custom): groups similar-length rows in a batch to cut padding waste
• Evaluation every 200 steps on a 400-row held-out subset of val.jsonl
• EarlyStoppingCallback(patience=4) + load_best_model_at_end=True, metric_for_best_model="eval_loss", so the shipped weights are the eval-best checkpoint, not the last one
• After training: PeftModel.from_pretrained(base, ADAPTER).merge_and_unload() produces standalone safetensors, then llama.cpp convert_hf_to_gguf.py and llama-quantize give the Q5_K_M GGUF

Abliteration (Heretic, trial 93)

The merged 8× model still had Qwen's default refusal pattern on the kind of security-research queries this model is supposed to answer. To remove those without damaging the rest of the network, I ran a 1000-trial Heretic sweep:

• direction_index = 26.84 (the refusal direction in residual-stream activation space)
• Orthogonalization applied to both attn.o_proj and mlp.down_proj with row normalization at LoRA rank 3
• KL divergence target = 0.01, achieved KL = 0.00409 (well below target, minimal distortion)
• Refusal evaluation set: 100 prompts from mlabonne/harmful_behaviors (held-out test split)
• Refusals: 10/100 (baseline 90/100), an ~89% reduction in refusal rate at near-zero KL cost
• Trial 93 was selected from the Pareto front of (refusals, KL): the fewest refusals among trials that also had the lowest KL

Benchmarks

Mini head-to-head on a single RTX 3090

I compared this model against three popular public Qwen3.6-27B variants on a 5-task mini-bench (sysadmin diagnostics, Ghidra MCP tool use, general programming, malware-pseudocode triage, system design at scale). Setup: Ollama, direct /api/chat, single-turn, temperature 0.4, num_ctx=16384, fresh load per model.

Model	Quant	T1	T2	T3	T4	T5	Total	Mean tok/s	Total wall-clock
DavidAU Heretic NEO-CODE	Q4_K_M	4	4	3.5	5	4.5	21	31.7	598s
unsloth MTP	UD-Q4_K_XL	4.5	4	4.5	5	4	22	35.2	665s
hotdogs Fable-5 LoRA	UD-Q4_K_XL + LoRA	4.5	4	3.5	4	4	20	32.3	909s
this (trial93)	Q5_K_M	5	4	4	4	5	22	33.2	158s

Scoring 0-5 per task, qualitative. The wall-clock gap is primarily because the hotdogs Fable-5 variant applies its LoRA at inference time, while trial93's adapter is merged. The two open public variants tie on quality at 22; trial93 ties them at 22 with 3.8-5.8× less wall-clock time end-to-end.

Where trial93 won the head-to-head:

• T1 (sysadmin / nginx 502): only model that named php-fpm explicitly, used the actual nginx error vocabulary ("upstream prematurely closed", "no live upstreams"), bypassed nginx with a direct backend curl /healthz, and grep'd config for the specific limits (worker_connections, keepalive).
• T5 (URL shortener at 100M new + 10B redirects/day): realistic math callouts (10B/day ≈ 116k rps), monthly Postgres partitioning with correct syntax, stale-while-revalidate at edge, hot-tier pin-top-0.1% with async refresh.

Where it lost:

• T4 (malware MITRE mapping): got the YARA anchor right (the literal VirtualAlloc API hash 0x91AFCA54, the most specific anchor of all 4 models) but mis-mapped 2 of 6 ATT&CK techniques (PEB anti-debug to T1562.001 instead of T1622, API hashing to T1574.001 instead of T1027.007). The CVE training data is rich in CWE / impact / remediation language but lighter on MITRE technique IDs specifically.

Limitations

• Specialist, not a chat model. With no system prompt, trivial inputs (for example "hi") can trigger filler reasoning or an unsolicited code block. The shipped Modelfile includes a default system prompt that resolves this; keep a system prompt set in your client.
• MITRE ATT&CK technique IDs are sometimes off (see T4 above). If you need accurate technique mapping, post-process or fine-tune on technique-tagged data.
• Not a frontier model. This is 27B at Q5 on a single GPU. It will trail Claude / GPT-5 / Gemini-3 on hard agentic chains, especially multi-turn tool use.
• Single-turn tool-calling is solid via Ollama's native function-calling API; multi-turn agent loops (tool_call, then tool_result, then the next tool_call) should be tested with your harness.
• Abliteration removes refusals, including on prompts the original Qwen would have refused for safety reasons. This is intentional for the target use case (security research, RE, defensive analysis), but it means the model will answer requests it would otherwise decline. Operate accordingly.

Responsible use

This model is intended for defensive security work, vulnerability research, reverse engineering, and CTF use. It is not licensed or intended for unauthorized intrusion, malware deployment, or operations against systems you do not have permission to test. The abliteration step makes the model more forthcoming on dual-use security topics. Use it inside the same legal and ethical bounds you would apply to any other security tool.

Links

• Site: dgresesjr.com
• Buy me a coffee: buymeacoffee.com/dgresesjr

Citation

If this model is useful in your work, a credit link is appreciated. The full training recipe and abliteration parameters are documented in the Training recipe and Abliteration sections above; the chat template and sampling parameters ship in Modelfile.fable5.

@misc{trial93_2026,
  title = {Trial93: Qwen3.6-27B Fable5 CVE/RE Specialist (Abliterated)},
  author = {dgresesjr},
  year = {2026},
  howpublished = {\url{https://huggingface.co/oN8WeJbq5Jo7Pk/CVE-Heretic-Fable5-27B-GGUF}},
}

Base model: Qwen/Qwen3.6-27B, Apache 2.0.

Abliteration framework: Heretic by p-e-w.