sec-rerank

sec-rerank

This is a fine-tuned version of Qwen/Qwen3-Reranker-0.6B — a listwise generative reranker (second-stage ranker), not an embedding model.

It was trained on grouped query–document examples whose hard negatives were mined from a local Qdrant collection (cve_kb) built from CVE investigation trajectories. It does not emit dense vectors; it reorders first-stage candidates (e.g. from DuyTa/sec-embedding). It is the reranker component of the secAI stack, paired with DuyTa/Cyber-F1-AWQ.

Training

From notebooks/Qwen3_Reranker_Colab.ipynb (ms-swift):

(query, positive, negative) rows are converted to SWIFT grouped ranking schema:

• messages — system instruction + user query
• positive_messages — gold CVE passage
• negative_messages — Qdrant-mined hard-negative CVE passage(s)

Train-time instruction:

Given a Vietnamese cybersecurity search query, retrieve passages from the CVE knowledge base that directly answer it.

SWIFT fills the native Qwen3-Reranker {Instruction} slot from that system message.

Hard-negative mining

Positives and negatives are real CVE core-chunk text from local Qdrant cve_kb (NVD/MITRE). The negative is a near-miss CVE from the same collection — typically a different CWE (hard_negative_type: different_cwe): high lexical overlap, wrong document. The listwise objective ranks the gold passage above those mined hard negatives.

Split: 33.6k train / 4.2k validation grouped examples.

Training corpus

Built from five years of authoritative cybersecurity sources: NVD (173,473 CVEs), MITRE CWE (768 weakness types, mapped to ~92% of CVEs), CAPEC/ATT&CK (443/174 entries) and Exploit-DB (3,139 exploits, 2021–2026). Public datasets: DuyTa/Cyber_F1_v2, DuyTa/cve-kgrag-db.

Training hardware: 2×A100 80GB.

Acceptance (nghiệm thu) — reported KPIs

Measured on NVIDIA A100 80GB in the full production chatflow (Hybrid Search → Rerank → LLM), on a 1,000-sample security test set (40% CVE identification/classification, 40% remediation advice, 20% real-world scenario reasoning):

Raw per-sample logs (reranking-precision-at-1.jsonl) and evaluation code are delivered with the acceptance package.

Inference

Score each (query, document) with the native Qwen3-Reranker generative yes/no head. Use only to rerank a short candidate list from dense / hybrid retrieval.

# vLLM / OpenAI-compatible rerank endpoint
# POST /v1/rerank
{
  "model": "DuyTa/sec-rerank",
  "query": "CVE-2021-44228 JNDI lookup on log4j",
  "documents": ["...", "..."]
}

Attribution & license

Released under Apache-2.0. Derived from Qwen/Qwen3-Reranker-0.6B (Apache-2.0); credit for the base reranker belongs to the Qwen team.