Instructions to use trjxter/Qwenseek-3.8-27B-CyberLite-BF16 with libraries, inference providers, notebooks, and local apps. Follow these links to get started.

Libraries

How to use trjxter/Qwenseek-3.8-27B-CyberLite-BF16 with Transformers:

# Use a pipeline as a high-level helper
from transformers import pipeline

pipe = pipeline("text-generation", model="trjxter/Qwenseek-3.8-27B-CyberLite-BF16")
messages = [
    {
        "role": "user",
        "content": [
            {"type": "image", "url": "https://huggingface.co/datasets/huggingface/documentation-images/resolve/main/p-blog/candy.JPG"},
            {"type": "text", "text": "What animal is on the candy?"}
        ]
    },
]
pipe(text=messages)

# Load model directly
from transformers import AutoProcessor, AutoModelForMultimodalLM

processor = AutoProcessor.from_pretrained("trjxter/Qwenseek-3.8-27B-CyberLite-BF16")
model = AutoModelForMultimodalLM.from_pretrained("trjxter/Qwenseek-3.8-27B-CyberLite-BF16", device_map="auto")
messages = [
    {
        "role": "user",
        "content": [
            {"type": "image", "url": "https://huggingface.co/datasets/huggingface/documentation-images/resolve/main/p-blog/candy.JPG"},
            {"type": "text", "text": "What animal is on the candy?"}
        ]
    },
]
inputs = processor.apply_chat_template(
	messages,
	add_generation_prompt=True,
	tokenize=True,
	return_dict=True,
	return_tensors="pt",
).to(model.device)

outputs = model.generate(**inputs, max_new_tokens=40)
print(processor.decode(outputs[0][inputs["input_ids"].shape[-1]:]))

Notebooks
Google Colab
Kaggle
Local Apps Settings

vLLM

How to use trjxter/Qwenseek-3.8-27B-CyberLite-BF16 with vLLM:

Install from pip and serve model

# Install vLLM from pip:
pip install vllm
# Start the vLLM server:
vllm serve "trjxter/Qwenseek-3.8-27B-CyberLite-BF16"
# Call the server using curl (OpenAI-compatible API):
curl -X POST "http://localhost:8000/v1/chat/completions" \
	-H "Content-Type: application/json" \
	--data '{
		"model": "trjxter/Qwenseek-3.8-27B-CyberLite-BF16",
		"messages": [
			{
				"role": "user",
				"content": "What is the capital of France?"
			}
		]
	}'

Use Docker

docker model run hf.co/trjxter/Qwenseek-3.8-27B-CyberLite-BF16

SGLang

How to use trjxter/Qwenseek-3.8-27B-CyberLite-BF16 with SGLang:

Install from pip and serve model

# Install SGLang from pip:
pip install sglang
# Start the SGLang server:
python3 -m sglang.launch_server \
    --model-path "trjxter/Qwenseek-3.8-27B-CyberLite-BF16" \
    --host 0.0.0.0 \
    --port 30000
# Call the server using curl (OpenAI-compatible API):
curl -X POST "http://localhost:30000/v1/chat/completions" \
	-H "Content-Type: application/json" \
	--data '{
		"model": "trjxter/Qwenseek-3.8-27B-CyberLite-BF16",
		"messages": [
			{
				"role": "user",
				"content": "What is the capital of France?"
			}
		]
	}'

Use Docker images

docker run --gpus all \
    --shm-size 32g \
    -p 30000:30000 \
    -v ~/.cache/huggingface:/root/.cache/huggingface \
    --env "HF_TOKEN=<secret>" \
    --ipc=host \
    lmsysorg/sglang:latest \
    python3 -m sglang.launch_server \
        --model-path "trjxter/Qwenseek-3.8-27B-CyberLite-BF16" \
        --host 0.0.0.0 \
        --port 30000
# Call the server using curl (OpenAI-compatible API):
curl -X POST "http://localhost:30000/v1/chat/completions" \
	-H "Content-Type: application/json" \
	--data '{
		"model": "trjxter/Qwenseek-3.8-27B-CyberLite-BF16",
		"messages": [
			{
				"role": "user",
				"content": "What is the capital of France?"
			}
		]
	}'

Unsloth Desktop
Docker Model Runner
How to use trjxter/Qwenseek-3.8-27B-CyberLite-BF16 with Docker Model Runner:
```
docker model run hf.co/trjxter/Qwenseek-3.8-27B-CyberLite-BF16
```
Browse Quantizations to use this model in llama.cpp, Ollama, LM Studio, or any compatible app.

Qwenseek-3.8-27B-CyberLite-BF16

Qwenseek-3.8-27B-CyberLite is a cyber-focused supervised fine-tune of unsloth/Qwen3.8-27B.

CyberLite is the first-stage release in the Qwenseek cyber-specialization track. The goal of this stage was not to turn Qwen3.8-27B into a narrow security-only model. Instead, the SFT was designed to strengthen defensive cybersecurity reasoning, retain useful controlled red-team reasoning, and preserve the base model's strong coding, technical reasoning, and structured tool-use behavior.

This repository contains the merged BF16 release. Training itself used 4-bit QLoRA with BF16 compute; the selected LoRA adapter was then safely merged into the exact BF16 base weights and saved as full BF16 Safetensors.

CyberLite is not the final planned Qwenseek cyber model. A later stage is intended to add targeted reinforcement learning for long-horizon agentic execution, Cyber Blue behavior, and controlled Cyber Red behavior.

Model summary

Property	Qwenseek CyberLite
Model	`Qwenseek-3.8-27B-CyberLite`
Release format	Merged BF16 Safetensors
Base model	`unsloth/Qwen3.8-27B`
Architecture family	Qwen3.8 / `qwen3_5`
Parameter class	~27.8B
Training method	Supervised Fine-Tuning via 4-bit QLoRA
Training compute	1× NVIDIA H100 80GB
Training compute precision	BF16
Validated SFT context	32,768 tokens
LoRA rank	64
LoRA alpha	128
Primary domains	Coding, agentic software engineering, Cyber Blue, controlled Cyber Red, tool use, reasoning
Language	Primarily English
Vision training	Frozen; this SFT was text-only
License	Apache-2.0, inherited from the base model

The underlying Qwen3.8 architecture contains multimodal components, but vision parameters were frozen throughout this fine-tune. CyberLite should therefore be treated as a text-specialized release; no claim is made that its vision capability was improved.

What is CyberLite?

CyberLite was built around a simple idea:

Improve cyber task-fit without sacrificing the general coding and tool-use strengths that make a 27B model useful in real technical workflows.

The SFT corpus therefore mixes security data with software-engineering, agentic, tool-calling, and general reasoning examples rather than training exclusively on cybersecurity prompts.

The main intended behaviors are:

defensive vulnerability analysis;
secure-code review and remediation;
evidence-driven security reasoning;
detection, containment, remediation, and validation planning;
controlled and sandboxed adversarial reasoning;
technical coding and software-engineering work;
structured tool calling;
reasoning-heavy technical problem solving.

For controlled Cyber Red tasks, the intended use is authorized, local, sandboxed, educational, or defensive validation. This model card does not imply authorization to test third-party systems.

Training data

CyberLite was trained directly on two datasets.

1. DeepSeek V4 Flash teacher-distillation corpus

Dataset:
trjxter/DeepSeek-V4-Flash-0731-Teacher-Distillation-40513x

This corpus contains 40,513 retained teacher-generated examples produced with DeepSeek V4 Flash after generation, quality control, retry-based repair, quarantine auditing, and recovery adjudication.

Retained composition

Domain	Rows
Coding	5,601
Agentic	9,982
Cyber Blue	13,000
Controlled Cyber Red	6,999
Tool Use	4,931
Total	40,513

The Flash corpus was intentionally capability-balanced. Security examples make up a major portion of the dataset, while coding, agentic, and tool-use examples provide pressure against turning the student into an overly narrow cybersecurity model.

Tool trajectories retain structured callable-tool supervision, while ordinary coding, agentic, and cyber examples are represented as non-tool conversational trajectories.

2. DeepSeek V4 Pro reasoning corpus

Dataset:
trjxter/DeepSeek-V4-Pro-Reasoning-8000x

This dataset contains 8,014 synthetic reasoning examples generated with DeepSeek V4 Pro. It was added to provide broader reasoning supervision alongside the more task-specialized Flash corpus.

Combined source size

Before the 32K sequence-length filter:

Dataset	Rows
DeepSeek V4 Flash teacher distillation	40,513
DeepSeek V4 Pro reasoning	8,014
Total	48,527

Examples longer than the training context limit were dropped as complete examples rather than truncated mid-trajectory.

Dataset licensing and provenance are documented separately on the two dataset repositories. Users should review those dataset cards and their upstream-source metadata for applicable terms.

Training methodology

CyberLite used Supervised Fine-Tuning with QLoRA through Unsloth and TRL.

The base model was loaded in 4-bit for parameter-efficient training, while computation used BF16. LoRA adapters were applied only to the language side of the model.

LoRA configuration

Setting	Value
Rank (`r`)	64
Alpha	128
Alpha / rank	2.0
Dropout	0.0
Bias	`none`
rsLoRA	Disabled
Vision layers	Frozen
Language layers	Trainable through LoRA
Attention modules	LoRA enabled
MLP modules	LoRA enabled

The selected release adapter was subsequently attached to the exact BF16 base model and merged with PEFT using a safe merge. The release pipeline verified that no LoRA-bearing modules remained after the merge.

Sequence formatting and loss construction

A major goal of the run was to preserve Qwen3.8-native conversation behavior rather than flattening the datasets into generic prompt/completion strings.

Native reasoning

Reasoning traces were carried through Qwen3.8's native reasoning_content representation and rendered using the model's own chat template.

Native tool calls

Tool calls remained structured and were rendered through the native model template rather than being converted into an unrelated custom delimiter format.

Assistant-only loss

Training labels were constructed explicitly so that:

system tokens were masked;
user tokens were masked;
tool/input-prefix tokens were masked;
assistant reasoning remained trainable;
assistant final answers remained trainable;
native assistant tool-call tokens remained trainable.

All masked tokens used label value -100.

This means the optimization target was the assistant behavior, not reproduction of the entire conversation transcript.

Context handling

CyberLite was trained with a maximum sequence length of:

32,768 tokens

The data pipeline intentionally used:

no sequence packing;
no mid-example truncation;
complete-example filtering before train/eval splitting.

Any rendered training example exceeding 32,768 tokens was dropped whole. This avoids cutting off reasoning traces, tool trajectories, security investigations, or final answers in the middle of an example.

The base architecture may support behavior outside this range, but 32K is the context length validated by this SFT run. Longer-context behavior should be evaluated independently.

Train/eval split

The train/eval split was created after sequence-length filtering.

Train: 95%
Held-out evaluation: 5%
Split strategy: deterministic and stratified by domain
Seed: 3407

The training pipeline tracked separate held-out domain losses so that improvements in one category would not hide degradation in another.

The six dataset domains used for stratification were:

coding;
agentic;
Cyber Blue;
controlled Cyber Red;
tool use;
V4 Pro reasoning.

Training configuration

Hyperparameter	Value
Base model	`unsloth/Qwen3.8-27B`
Training strategy	4-bit QLoRA SFT
Epoch configuration	1.0
Maximum sequence length	32,768
Effective batch target	16 sequences / optimizer step
Eval batch size	1
Learning rate	`2e-5`
LR scheduler	Cosine
Warmup ratio	0.03
Weight decay	0.01
Max gradient norm	1.0
Optimizer	`paged_adamw_8bit`
Compute precision	BF16
FP16	Disabled
TF32	Enabled
Gradient checkpointing	Enabled
Packing	Disabled
Truncation	Disabled
Seed	3407
Logging	Weights & Biases
Qualitative tracing	W&B Weave
Hardware	NVIDIA H100 80GB

A memory smoke test was performed on the longest surviving examples before launching the full training run. The training microbatch was selected based on that test while preserving an effective batch size of 16.

Held-out training metrics

Selected domain-level held-out losses improved consistently during the run.

Training step	Coding	Cyber Blue	Controlled Cyber Red	Tool Use	V4 Pro Reasoning
450	0.3979	0.6877	0.6407	0.0441	0.8229
900	0.3905	0.6697	0.6105	0.0412	0.8185
1350	0.3862	0.6586	0.5955	0.0408	0.8157
1800	0.3838	0.6520	0.5852	0.0396	0.8140

Across these tracked checkpoints, all five reported loss series improved monotonically.

Loss should not be interpreted as a direct measure of real-world security capability. For that reason, the release was also evaluated behaviorally against the stock base model.

Evaluation

CyberLite was evaluated against stock Qwen3.8-27B using a frozen internal suite and equivalent llama.cpp Q8_0 builds.

Important: the benchmark below was run on matched Q8_0 GGUF exports, not directly on the BF16 Safetensors in this repository. It is included as evidence about the behavior of the underlying CyberLite fine-tune. Precision/backend-specific performance should be measured separately.

The frozen direct-comparison suite contained 250 tasks split across:

Coding
Tool Calling
Agentic
Cyber Blue
Controlled Cyber Red

For this CyberLite release, the headline comparison focuses on coding, tool calling, and cyber behavior. Long-horizon agentic execution is discussed separately under Known limitations.

Objective structured scoring

Domain	Stock Qwen3.8-27B	CyberLite	Delta
Coding	98.00%	99.06%	+1.06 pts
Tool Calling	100.00%	99.50%	-0.50 pts

Coding remained effectively intact and slightly improved under the structured scorer, while tool calling was essentially preserved.

Blind pairwise preference

Pairwise preference is not accuracy. Each direct win receives one point and each tie contributes 0.5 points to both models.

Domain	Stock preference	CyberLite preference
Coding	51%	49%
Tool Calling	51%	49%
Cyber Blue	35%	65%
Controlled Cyber Red	54%	46%

The largest positive redistribution was in Cyber Blue, where CyberLite received 65% of the pairwise preference share.

Controlled Cyber Red remained competitive but showed a small preference shift toward the stock model in this evaluation.

Non-agentic aggregate

Across the 200 Coding + Tool Calling + Cyber Blue + Controlled Cyber Red comparisons:

Outcome	Count
Stock direct wins	50
CyberLite direct wins	59
Ties	91

After giving each tie half a point:

Stock preference: 47.75%
CyberLite preference: 52.25%

Behavioral observations

The SFT changed more than raw pass/fail rates.

More concise completion behavior

Under the benchmark generation limit, 4096-token truncations changed from:

Stock: 12
CyberLite: 1

This suggests CyberLite more often reached a usable completion before exhausting the output budget.

This should be interpreted as a task-level behavior change, not evidence that the model has faster inference kernels or higher tokens/second.

Coding preservation

Coding performance was deliberately protected by including substantial software-engineering supervision rather than running a security-only fine-tune.

The structured coding score moved from 98.00% to 99.06%, while blind coding preference remained approximately even at 51/49.

Tool-use preservation

Structured tool behavior remained very strong:

Stock: 100.0%
CyberLite: 99.5%

This is important because the training corpus included both ordinary text trajectories and examples with native callable tools.

Cyber Blue specialization

Cyber Blue showed the clearest preference gain in the blind comparison, reaching 65% pairwise preference share.

The intended improvement is not simply greater willingness to discuss cybersecurity. The training data emphasizes evidence, affected conditions, detection, containment, remediation, validation, and operational tradeoffs.

Known limitations

Long-horizon agentic execution

CyberLite is not claimed as an agentic upgrade.

Internal evaluation identified a concentrated weakness in long-horizon autonomous execution: the model could understand tools and individual technical actions but was less reliable at carrying a complete lifecycle through:

ACT → OBSERVE → VERIFY → RECOVER → COMPLETE

Observed failure modes included stopping after partial investigation, failing to perform or express the verification stage, incomplete recovery planning, and occasionally ending before the requested workflow was fully closed.

The very strong tool-calling result suggests this is more consistent with an execution-policy / trajectory-completion issue than with forgetting how tool schemas work.

A targeted agentic-healing RL stage is planned for the next version.

Text-only specialization

The vision side of Qwen3.8 was frozen during SFT. Vision capability was not intentionally trained or improved.

Context beyond 32K

32,768 tokens is the validated SFT context. Longer-context behavior was not part of this training validation.

Internal benchmark scope

The reported evaluation is a custom frozen internal suite. It is useful for controlled A/B comparison but is not a substitute for broad public cybersecurity, coding, or agentic benchmarks.

Cybersecurity reliability

Like any language model, CyberLite can produce incorrect technical conclusions, insecure code, false positives, incomplete mitigations, or misleading security advice. High-impact security decisions should be independently validated.

Planned V2 work

CyberLite is intentionally an intermediate release.

The next specialization stage is planned around three targeted RL tracks:

1. Targeted Agentic Healing RL

A smaller, focused RL stage intended to restore reliable long-horizon execution behavior without unnecessarily disturbing the coding, tool-use, and cyber gains from SFT.

Primary lifecycle target:

INSPECT → ACT → OBSERVE → VERIFY → RECOVER → COMPLETE

2. Major Cyber Blue RL

A larger reinforcement-learning stage focused on:

defensive investigation;
detection quality;
vulnerability triage;
secure remediation;
containment planning;
verification;
operational decision-making;
evidence-grounded security analysis.

3. Major Controlled Cyber Red RL

A larger controlled-adversarial stage focused on high-quality reasoning inside explicitly authorized, sandboxed, local, or defensive contexts.

The goal is to improve technical fidelity while retaining clear scope boundaries and maintaining the broader capabilities preserved by CyberLite.

BF16 release details

This repository is the canonical merged BF16 release.

The release was created by:

loading the exact unsloth/Qwen3.8-27B BF16 base;
attaching the selected frozen CyberLite LoRA adapter;
verifying LoRA rank 64 and alpha 128;
merging with safe_merge=True;
verifying that zero LoRA-bearing modules remained after merge;
running a generation smoke test;
saving the merged model as BF16 Safetensors.

Release artifact

Precision: BF16
Serialization: Safetensors
Weight shards: 12
Merged size: approximately 54.72 GB
Release adapter SHA-256:
e4903a769689a1c2586444bf227b482c2b48495c8ce77e7d6dbe389c31cece32

The adapter hash is included so that the exact source adapter used for this merged release can be identified independently of repository naming.

Usage

Use a current version of Transformers or Unsloth with Qwen3.8 / qwen3_5 support.

Because CyberLite was trained with the native Qwen3.8 conversation format, applications should use the tokenizer/processor's native chat template rather than manually inventing a different prompt wrapper.

A simple Transformers pattern is:

import torch
from transformers import pipeline

model_id = "trjxter/Qwenseek-3.8-27B-CyberLite-BF16"

generator = pipeline(
    task="text-generation",
    model=model_id,
    torch_dtype=torch.bfloat16,
    device_map="auto",
)

messages = [
    {
        "role": "user",
        "content": (
            "Review this local Python service for defensive security issues. "
            "Prioritize evidence, remediation, and validation."
        ),
    }
]

result = generator(
    messages,
    max_new_tokens=2048,
    do_sample=False,
)

print(result[0]["generated_text"])

If your inference stack exposes explicit reasoning or structured tool-call fields, preserve the Qwen3.8-native representation rather than flattening those structures unnecessarily.

Recommended use

CyberLite is best suited for experimentation involving:

defensive cybersecurity analysis;
secure software engineering;
vulnerability triage;
remediation planning;
controlled local security validation;
technical reasoning;
code generation and review;
structured tool-use experiments.

It is not a substitute for a vulnerability scanner, EDR, SIEM, static analyzer, penetration-test authorization process, or human security review.

Reproducibility notes

Key run settings:

Base:                  unsloth/Qwen3.8-27B
Method:                4-bit QLoRA SFT
Compute:               BF16
GPU:                   NVIDIA H100 80GB

Max sequence length:   32768
Packing:               False
Truncation:            False
Split:                 95/5 stratified
Seed:                  3407

LoRA r:                64
LoRA alpha:            128
LoRA dropout:          0.0
rsLoRA:                False

Epoch config:          1.0
Learning rate:         2e-5
Scheduler:             cosine
Warmup ratio:          0.03
Weight decay:          0.01
Max grad norm:         1.0
Optimizer:             paged_adamw_8bit
Effective batch:       16

Vision layers:         frozen
Language layers:       LoRA tuned
Attention modules:     LoRA tuned
MLP modules:           LoRA tuned

Loss:                  assistant-only
Non-assistant labels:  -100
Reasoning format:      Qwen3.8 native reasoning_content
Tool calls:            native structured representation

Training datasets

Base model

CyberLite is derived from:

unsloth/Qwen3.8-27B

which in turn tracks the Qwen3.8-27B base model.

Thanks to the Qwen and Unsloth teams for the base model and training/runtime ecosystem, and to the authors and maintainers of the upstream datasets that ultimately contributed to the teacher corpora.

License

The model weights are released under Apache-2.0, following the base model.

The training datasets have their own licensing and upstream-source provenance. Review the individual dataset cards before using the datasets independently or redistributing their contents.

Release family

BF16: trjxter/Qwenseek-3.8-27B-CyberLite-BF16
GGUF: trjxter/Qwenseek-3.8-27B-CyberLite-GGUF

The BF16 repository is the canonical merged-weight release. GGUF quantizations are derived separately from the canonical merged model for local llama.cpp inference.