edgeguard-cypher-qwen3-4b-v0.8-feedback-validated-gguf

EdgeGuard Cypher Qwen3-4B v0.8 feedback-validated (GGUF)

EdgeGuard translates an analyst's question about cyber-threat intelligence into a read-only Cypher query over the EdgeGuard knowledge graph (Neo4j, built from MISP). EdgeGuard is developed by IICT-BAS and Ratio1 in the ResilMesh Open Call.

Status: Superseded. Served on the EdgeGuard edge node in July 2026.

Model

• Base model: Qwen/Qwen3-4B-Instruct-2507 (revision cdbee75f17c01a7cc42f958dc650907174af0554, Apache-2.0)
• Training: QLoRA continuation of the v0.5.3 weights.
• Training data: qwen-prompt-cypher-v0.8-feedback-validated: 800 training, 100 validation and 100 sealed-test rows, validated against the live graph after operator feedback.
• Output: One read-only Cypher query that returns graph objects.
• Quantization: Q4_K_M, SHA256 1da636448aafe9f2ff1826008e5f6f10ccd33488172c386f84783b0f5b485f77

Evaluation

Intended use

Writing read-only Cypher queries for the EdgeGuard graph schema of its time, run behind the EdgeGuard schema and read-only validator (the guard). Research and evaluation of small text-to-Cypher models.

Do not run its output against a database without a read-only validator. Do not use it as a source of threat intelligence: it writes queries, it does not know facts.

Limitations

• Bound to the EdgeGuard graph schema it was trained on; later schema changes (for example October 2026) are not reflected.
• Answers come only from the graph; the model does not check that a query's result is complete.

Files

• edgeguard-cypher-qwen3-4b-v0.8-feedback-validated.Q4_K_M.gguf
• artifact_manifest.json: hashes, sizes and training settings

Usage

Send the question as a single user message, with no system prompt; the reply is one Cypher query.

llama-server -m edgeguard-cypher-qwen3-4b-v0.8-feedback-validated.Q4_K_M.gguf -c 4096
curl -s localhost:8080/v1/chat/completions -d '{"messages":[{"role":"user","content":"Which CVEs does CISA list as known exploited?"}],"temperature":0,"max_tokens":256}'

EdgeGuard edge nodes load it through LLM_INFERENCE_API with MODEL_NAME=ratio1/edgeguard-cypher-qwen3-4b-v0.8-feedback-validated-gguf and MODEL_FILENAME=edgeguard-cypher-qwen3-4b-v0.8-feedback-validated.Q4_K_M.gguf.

Other versions

Versions v0.2, v0.3, v0.5.0–v0.5.2, v0.5.4–v0.5.9 and v0.7 were trained but their weights were not kept; only the versions on the Hub remain. Later versions (v0.11 and newer) are not public.