cybercop-ai-v2

Cybercop AI V2

A LoRA adapter that turns Qwen2.5-7B-Instruct (4-bit) into a focused cyber-investigation assistant — trained to produce structured, procedure-oriented responses for cybercrime / online-scam / digital-forensics triage and reporting, in English and Taglish. V2 improves on the original jhenberthf/cybercop-ai adapter with a larger synthetic-augmented dataset, stricter unit-label scrubbing, and longer training.

Intended use: Exclusive internal use as an investigative-aid assistant. The adapter is a decision-support tool, not an authority — all outputs must be reviewed by a qualified human investigator before any action.

Model details

Improvements over V1

• Larger dataset: 2011 rows vs 99 (311 human-curated + 1700 LLM-synthesized), sourced from jhenberthf/cyber-investigator.
• Unit-label scrubbing: defensive regex pass replaces [REDACTED — specific operational-unit, regional-team, anti-cybercrime-group, and national-police] identifiers with [UNIT] before training — both inline on the dataset rows and as a defense-in-depth pass on generated outputs.
• Longer training: 502 steps vs 48, with checkpoint-based resume (checkpoint-50 → 150 → 200 → 250 → 502).
• Tighter sequence length: 256 vs 512 — matches the typical IR chunk length more closely.

Usage

Prompt format (important): the adapter was trained on Alpaca-format (### Instruction / ### Input / ### Response) text. Wrap that text inside a single Qwen chat-template user turn — do not feed raw Alpaca text, or the base Instruct model will echo the instruction and drift off-topic.

import torch
from peft import PeftModel
from transformers import AutoModelForCausalLM, AutoTokenizer

base = "unsloth/Qwen2.5-7B-Instruct-bnb-4bit"
adapter = "jhenberthf/cybercop-ai-v2"          # local path or HF repo

tokenizer = AutoTokenizer.from_pretrained(base)
if tokenizer.pad_token is None:
    tokenizer.pad_token = tokenizer.eos_token
model = AutoModelForCausalLM.from_pretrained(
    base, device_map={"": "cuda:0"}, torch_dtype=torch.bfloat16
)
model = PeftModel.from_pretrained(model, adapter)
model.eval()

instruction = ("You are a cyber-investigation assistant. Given a complaint, "
               "classify the likely cybercrime type, list immediate preservation "
               "steps, and outline the next investigative actions.")
inp = ("Victim reports being tricked into sending PHP 50,000 via GCash to a "
       "suspect after a 'customer service' impostor promised a refund for a "
       "purchase that was never delivered. The suspect account is now inactive.")

# Alpaca-format text wrapped as a single chat user turn
alpaca = f"### Instruction:\n{instruction}\n\n### Input:\n{inp}\n\n### Response:\n"
prompt = tokenizer.apply_chat_template(
    [{"role": "user", "content": alpaca}],
    tokenize=False, add_generation_prompt=True,
)

inputs = tokenizer(prompt, return_tensors="pt").to(model.device)
out = model.generate(
    **inputs, max_new_tokens=512, do_sample=False, temperature=1.0,
    repetition_penalty=1.05,
)
text = tokenizer.decode(out[0], skip_special_tokens=True)
# strip the prompt prefix, keep only the generated Response
gen = text[len(tokenizer.decode(inputs["input_ids"][0], skip_special_tokens=False)):]
resp = gen.split("### Response:")[-1].strip() if "### Response:" in gen else gen.strip()
print(resp)

Training notes

• Trained locally on a single consumer GPU (RTX 3050 6GB) via QLoRA, with adamw_torch optimizer, gradient checkpointing (non-reentrant), and bf16 precision.
• Training sequence: resumed from checkpoint-250 (step 250, loss 0.3552, epoch 0.497) and completed 502 steps on 2026-08-25. Total wall-clock from resume ≈ 2h15m.
• Loss trajectory (selected): 0.3552@250 → 0.32@300 → 0.30@350 → 0.28@400 → 0.27@450 → 0.2654@502.
• Dataset pre-processing: unit-label scrubbing via regex (see below), dedup of synthetic rows by hash.

Unit-label scrubbing

Before training, a defensive regex pass replaces the following categories with [UNIT] in all text fields (instruction, input, output, analysis):

• PNP operational cyber-response unit codes: [REDACTED — specific designations]
• Regional/provincial cyber response team names: [REDACTED — specific provincial and regional CRT designations]
• National Police anti-cybercrime group identifiers: [REDACTED — specific designations]
• Unit/regional designation patterns: [REDACTED — specific designations]
• Philippine national police organization references: [REDACTED — specific designations]

This is applied inline on every dataset row before training, and again on generated outputs at inference time as defense in depth — to avoid the adapter learning or leaking operational unit identifiers.

Limitations & caveats

• Not legal/operative authority. Outputs are suggestions; verify against current procedure before acting.
• Possible hallucination on unfamiliar schemes, jurisdictions, or technical specifics — always corroborate.
• Small curated core: 311 human-curated examples form the backbone; 1700 synthetic rows were LLM-authored from those same IR chunks (alpaca-style synthesis with the V1 adapter + Qdrant retrieval). Synthetic coverage is only as good as the source IRs and the V1 adapter that drafted them.
• LoRA only modifies a tiny fraction of weights; base-model limitations (bias, knowledge cutoff, 4-bit precision) still apply.
• 4-bit base can reduce factual precision vs. a full-precision model.

Responsible use

• Keep a human in the loop for any investigative or evidentiary decision.
• Do not present outputs as final findings without review.
• Red-team for leakage of operational detail before deployment.

License

Adapter weights released under a restrictive/internal-use understanding. Base model terms from unsloth/Qwen2.5-7B-Instruct-bnb-4bit and Qwen2.5 apply to the underlying weights.

Related

• V1 adapter: jhenberthf/cybercop-ai
• Training dataset: jhenberthf/cyber-investigator
• Qdrant collection: cybercop_irs (209 chunks, paraphrase-multilingual-MiniLM-L12-v2)