Opal-8B-GGUF

Opal-8B — a security-specialized Llama-3.1-8B that beats the stock model

Opal-8B is stock Llama-3.1-8B-Instruct with defensive-security expertise trained in via LoRA — so it keeps the base model's general ability and adds a large security edge on top. On our harness it beats stock Llama-3.1-8B-Instruct overall, wins on math and security, and matches it on code.

Built by Cognis Digital (US). Native Llama-3.1 tool-calling. Part of the Opal suite with the Opal router.

Why this works (and the merges didn't)

We first tried merging open models (DARE-TIES). Every merge lost to stock Instruct — a merge only interpolates its components, it can't exceed them, and the grafts degraded the base's code/math. The fix was to stop merging and train: a LoRA on frozen stock Instruct, on a defensive-security corpus generated by open teacher models (gpt-oss-20b, Phi-4). Training adds capability; merging only averages it. That is the entire difference between the table below and a loss.

Benchmarks (measured here — Ollama, greedy, n = 25 subset, identical harness)

code = HumanEval pass@1 (executed); math = GSM8K exact-match; sec = a transparent defensive-security keyword rubric (bench/tasks/sec.json: Cobalt Strike detection, SQLi, MCP threat-modeling, Sigma, UEFI bootkit). blend = 0.45·code + 0.25·math + 0.30·sec.

Opal wins the blend (0.713 vs 0.648), wins math and security, and is within noise on code. Honest note: stock Instruct is marginally ahead on raw HumanEval (0.92 vs 0.88) — we publish that, not hide it. Every number reproduces with the harness in this repo.

Published frontier reference (official full-set numbers, different harness, context only — an 8B is not a frontier model):

HumanEval/GSM8K are saturated at the frontier and no longer reported head-to-head; shown only to place the 8B class. No frontier-parity claim.

Quantization ladder

Native tool-calling (Ollama)

import ollama
ollama.chat(model="opal-8b", messages=[{"role":"user","content":"weather in Charleston?"}],
            tools=[{"type":"function","function":{"name":"get_weather",
              "parameters":{"type":"object","properties":{"location":{"type":"string"}},
              "required":["location"]}}}])

What it's for

Detection engineering (Sigma/Suricata), threat modeling, MCP/agent security, firmware/ICS reasoning, secure code review, agentic tool use — with general code/reasoning at Llama-3.1-8B-Instruct level.

How it was made

Base: Llama-3.1-8B-Instruct (frozen). LoRA (r=16) trained locally on CPU (no cloud) over a defensive-security SFT corpus distilled from gpt-oss-20b + Phi-4, then merged and quantized. Recipe and harness are in the repo.

Limitations & safety

Inherits Llama-3.1-Instruct's alignment and knowledge cutoff. Security content is for authorized, defensive use (detection, threat modeling, hardening). Verify generated code before running it.

License

Apache-2.0. Trainer/quantizer: PEFT + llama.cpp.