CyberOps_Mistral_7B_LoRA

CyberOps-Mistral-7B-LoRA

A LoRA fine-tuned adapter for Mistral 7B Instruct v0.3, specialized for cybersecurity IT-operations reasoning — dual-use command intent analysis, failure diagnosis, security scope assessment, tool correctness, and cross-shell translation.

Adapter only — requires mistralai/Mistral-7B-Instruct-v0.3 as the base model.

Weights provenance: final_adapter from training run LORA-MISTRAL_7B-20260709-232328 (latest). Best confirmed benchmark across the iterative training loop: 88.1 (50-item rubric).

---

Model Details

---

Model-Family Compatibility

Optimized for the Mistral / Llama instruction-tuned family. The training data uses the Alpaca-style instruct format:

### Instruction:
[prompt]

### Response:
[answer]

The binding is to this prompt format, not the architecture. The same dataset trained on three bases shows the format mismatch — not capability — drives the gap:

Recommended base models for this adapter: mistralai/Mistral-7B-Instruct-v0.3 (primary), other Mistral 7B Instruct point releases, or Llama-3/3.1 8B Instruct (compatible format; requires retraining on that base). For DeepSeek/Gemma/ChatML/Qwen, use the model-agnostic dataset (below) rendered in each family's native format.

---

Datasets

• Training data (format-specific): dpevzner/Cybersecurity_Reasoning_Dataset_MistralFamily_7b — ~4,615 records in the Mistral/Llama ### Instruction:/### Response: format.
• Model-agnostic variant: dpevzner/Cybersecurity_Reasoning_Dataset — neutral canonical corpus + Mistral/DeepSeek/ChatML/Gemma rendered variants (to train other families without the format-mismatch penalty).

Curriculum (hard-ordered, 3-epoch)

New synthesis/repair records go in Epoch 3; placing them in Epoch 2 previously caused sharp regression in ambiguity reasoning (hard constraint). The benchmark is held out with zero overlap with training data.

---

Intended Use

For offline / air-gapped cybersecurity operations — a domain-specific reasoning assistant for authorized security testing and SOC support.

Capabilities: dual-use command intent analysis; failure diagnosis (privilege_failure, syntax_failure, environment_mismatch, dependency_absence, stale_documentation); security scope assessment; tool correctness (PowerShell/CMD/bash); cross-shell translation. Out of scope: general threat intel, malware RE, CVE assessment, offensive automation, general-purpose assistant use.

---

Benchmark

50-item rubric across five families. Best 88.1; stable 88.0 most recent.

Reached a capacity ceiling at ~88 (rank 16): further repairs fix targeted items but displace others ~1:1. Progressing requires higher LoRA rank, not more data.

---

Usage

from transformers import AutoTokenizer, AutoModelForCausalLM
from peft import PeftModel
import torch

BASE_MODEL = "mistralai/Mistral-7B-Instruct-v0.3"
ADAPTER    = "dpevzner/CyberOps_Mistral_7B_LoRA"

tokenizer = AutoTokenizer.from_pretrained(BASE_MODEL)
model = AutoModelForCausalLM.from_pretrained(
    BASE_MODEL, dtype=torch.float16, device_map="auto",
    max_memory={0: "5GiB", "cpu": "20GiB"})
model = PeftModel.from_pretrained(model, ADAPTER)
model.eval()

prompt = """### Instruction:
Analyze the ambiguous command: `Get-Process lsass`

### Response:"""

inputs = tokenizer(prompt, return_tensors="pt").to(model.device)
with torch.no_grad():
    out = model.generate(**inputs, max_new_tokens=256, do_sample=False, use_cache=False)
print(tokenizer.decode(out[0][inputs["input_ids"].shape[1]:], skip_special_tokens=True))

This adapter expects the ### Instruction: / ### Response: format; other formats degrade output quality due to the format binding described above.

---

Limitations

• Adapter-capacity ceiling at ~88 (rank 16) — repairs fix items but regress others ~1:1.
• Safety scope is the weakest family (~70) — items ss_001/002/006/007/010 inconsistent.
• Ambiguity reasoning oscillates (ar_008/009/010) under heavy contrast-pair synthesis.
• Substring-based scoring — a correctly paraphrased answer can be scored a miss.
• GPU telemetry reads zero (NVML polling gap) — cosmetic; training is correct.
• Synthetic evaluation only — live-operations performance not measured.

---

Ethical Considerations

Trained to analyze dual-use commands for defensive security operations. Not for generating offensive tooling, attack automation, or unauthorized access. All training data was synthesized under operator oversight with explicit content-governance controls.

---

Citation

@misc{cyberops_mistral_7b_lora_2026,
  title  = {CyberOps-Mistral-7B-LoRA: A LoRA Adapter for Cybersecurity IT-Operations Reasoning},
  author = {Pevzner, D.},
  year   = {2026},
  note   = {LoRA (r=16, alpha=32) adapter for Mistral 7B Instruct v0.3, trained on ~4,615
            synthetic cybersecurity reasoning records; best benchmark 88.1 on a 50-item rubric.}
}

---

Training environment: Alienware M16R2 / RTX 4070 Laptop GPU / Windows 11. Weights from run LORA-MISTRAL_7B-20260709-232328 (script v4.7).