Qwen3.5-2B-CyberSec

Qwen3.5-2B-CyberSec

An English Qwen3.5 2B checkpoint associated with the Trendyol Cybersecurity Instruction Tuning Dataset and exported in Transformers / Safetensors format.

This release is intended for research and local experimentation. The repository does not currently publish benchmark or safety-evaluation results, so the model should not be treated as a validated cybersecurity authority.

Lineage

• Immediate base: unsloth/Qwen3.5-2B
• Upstream family: Qwen3.5 2B
• Dataset recorded in repository metadata: Trendyol/Trendyol-Cybersecurity-Instruction-Tuning-Dataset
• Format: Transformers / Safetensors
• License: Apache-2.0

Load with Transformers

The configuration identifies a Qwen3.5 conditional-generation architecture with text and vision components. Use a recent Transformers release that supports this architecture.

from transformers import AutoModelForMultimodalLM, AutoProcessor

model_id = "reaperdoesntknow/Qwen3.5-2B-CyberSec"

processor = AutoProcessor.from_pretrained(model_id)
model = AutoModelForMultimodalLM.from_pretrained(
    model_id,
    device_map="auto",
)

messages = [
    {"role": "user", "content": [{"type": "text", "text": "Explain least privilege."}]}
]
inputs = processor.apply_chat_template(
    messages,
    add_generation_prompt=True,
    tokenize=True,
    return_dict=True,
    return_tensors="pt",
).to(model.device)

outputs = model.generate(**inputs, max_new_tokens=256)
answer = outputs[0][inputs["input_ids"].shape[-1]:]
print(processor.decode(answer, skip_special_tokens=True))

Dependency and device behavior can vary across Transformers versions. Pin a tested environment for reproducible use.

Intended use

• Research on small-model responses to cybersecurity instruction prompts.
• Local prototyping and qualitative evaluation.
• Comparison with the upstream Qwen3.5 2B checkpoint.
• Conversion and quantization experiments.

Evaluation status

No versioned benchmark report, baseline comparison, held-out test result, or safety evaluation is published in the repository reviewed for this card. Dataset association and a successful model export do not establish improved cybersecurity performance.

Useful next evidence would include:

• Results against the unchanged upstream base model.
• Held-out cybersecurity QA and scenario tests.
• General-capability regression checks.
• Hallucination, harmful-output, and misuse evaluations.
• A reproducible evaluation harness and exact revision hashes.

Limitations and safety

• The model can generate incorrect or unsafe technical guidance.
• Training data may contain errors, outdated practices, or sensitive dual-use material.
• The public card does not document dataset preprocessing, contamination checks, training hyperparameters, or checkpoint-selection criteria.
• Do not execute generated commands without review and isolation.
• Do not use the model as the sole basis for incident response, vulnerability disclosure, access-control, or other consequential security decisions.

GGUF build

For local GGUF variants, see reaperdoesntknow/Qwen3.5-2B-CyberSec-GGUF.

Part of the CIx cybersecurity model collection.

<!-- cix-keeper-ts:2026-10-03T13:16:31Z -->