Cyber-F1-AWQ

Cyber-F1-AWQ

Cyber-F1 is a security-domain large language model, instruction fine-tuned for cybersecurity work and delivered here as a 4-bit weight-quantized checkpoint for on-premise deployment. It is the LLM component of the secAI RAG stack, paired with DuyTa/sec-embedding (retriever) and DuyTa/sec-rerank (reranker).

Model

Training

Fine-tuned on secAI cybersecurity data drawn from the last five years of authoritative sources, then quantized for deployment:

• NVD — 173,473 CVEs (five most recent years)
• MITRE CWE — 768 weakness types, mapped to ~92% of CVEs
• CAPEC / ATT&CK — 443 / 174 entries
• Exploit-DB — 3,139 exploits (2021–2026)

The instruction-tuning set is 49,756 samples combining real data (~51k HF-public samples) and task-targeted synthetic data, normalized (dedup, back-translation, QC cosine ≥ 0.7) and labeled (CVE-ID, CWE-ID, severity, task, citation source). Data groups: security terminology, RAG documents, instruction-tuning pairs, bilingual (EN/VI) data, and vulnerability reports/analysis. Training datasets: DuyTa/Cyber_F1_v2 and DuyTa/cve-kgrag-db. Training hardware: 2×A100 80GB.

Fine-tuning is multi-task, covering: translation, vulnerability reporting, pentest guidance, exploit-code drafting and explanation, static analysis (SAST), auto-remediation, and agentic tool use.

Acceptance (nghiệm thu) — reported KPIs

Evaluated on a 1,000-sample security test set (40% CVE identification/classification, 40% remediation advice, 20% real-world scenario reasoning). All KPIs met their acceptance thresholds. Raw per-sample logs and evaluation code are delivered with the acceptance package.

Answer quality (RAG):

Task capabilities:

Performance (NVIDIA A100 80GB, full chatflow Hybrid Search → Rerank → LLM):

Minimum serving hardware: 1×A100 80GB, RAM ≥ 128GB, SSD ≥ 2TB.

Usage

# vLLM, OpenAI-compatible endpoint
from openai import OpenAI

client = OpenAI(base_url="http://localhost:8001/v1", api_key="EMPTY")
resp = client.chat.completions.create(
    model="DuyTa/Cyber-F1-AWQ",
    messages=[{"role": "user", "content": "What is CVE-2025-0282? Give CVSS, impact, affected products, and remediation."}],
)
print(resp.choices[0].message.content)

License

Released under Apache-2.0 for on-premise deployment. The base model is a Qwen3.5-MoE checkpoint; credit for the base weights belongs to the Qwen team.