#898 deploy upgraded model card v5

README.md

@@ -5,6 +5,7 @@ language:
 base_model: Qwen/Qwen2.5-3B-Instruct
 library_name: transformers
 pipeline_tag: text-generation
+model_name: KIN-Verification-Translator
 tags:
   - cybersecurity
   - security
@@ -21,126 +22,112 @@ tags:
   - incident-response
   - MITRE-ATT&CK
   - OWASP
-  - conversational
-  - llama-cpp
-  - gguf
-  - qwen
+model-index:
+  - name: KIN-Verification-Translator
+    results:
+      - task:
+          name: text-generation
+          type: text-generation
+        metrics:
+          - name: gap-delta-eval
+            type: gap-delta-eval
+            value: pending
 ---
 
-# KIN — Cybersecurity Verification Translator (3B)
+# KIN — Verification Translator (3B Canonical)
 
-KIN is an authoritative, fine-tuned cybersecurity model built on **Qwen2.5-3B-Instruct**. It translates ambiguous machine-generated security claims into leveled briefs with replayable evidence checks.
+KIN translates machine-generated security claims into leveled briefs with replayable evidence checks. Not a chatbot. Not an encyclopedia. A bridge between agent output and human decisions.
 
-**No check, no confidence.**
+**No check, no confidence.** If the claim has no replayable verification, KIN refuses to sound sure. That refusal is the product.
 
-## Evaluation & Leaderboard Status
+## The Problem
 
-* **Hugging Face Open LLM Leaderboard:** [Job PENDING Evaluation](https://huggingface.co/datasets/open-llm-leaderboard/requests/blob/main/nyxspecter4/kin-sft-lora_eval_request_False_bfloat16_Original.json)
-* **Downloads:** **1,000+** and climbing
+Maintainers are drowning in AI-shaped reports that look expert and are not. Copilot files critical PRs. Huntr contestants submit AI-generated writeups. Agent traces produce 40-file refactors with no comment a person can hold in working memory.
 
----
-
-## What KIN Does
-
-KIN processes PR diffs, review threads, agent traces, or vulnerability writeups and produces a structured **five-field brief**:
+The scarce skill is no longer "can a human write the exploit narrative." The scarce thing is **can a human know what the machine just claimed, and whether to trust it.**
 
-1. **Claim** — What is alleged
-2. **Blast Radius** — What breaks if true
-3. **Root Cause Mechanics** — The underlying generator: CWE, invariant, missing check
-4. **Reproducible Verification** — PoC, failing test, AST check, or execution command
-5. **Falsification Criteria** — Confidence level and exactly what evidence would disprove it
+## The Five-Field Brief
 
-The core rule: **no "critical" without a replayable check.** That refusal IS the product.
+Every KIN translation bottoms out in five fields:
 
----
+1. **Claim** — one sentence: what is alleged
+2. **Blast radius** — what breaks if true: data, money, identity, model weights
+3. **Why the model thinks so** — the short generator: CWE, invariant, missing check
+4. **How to see it yourself** — PoC, failing test, command, screenshot of the trace
+5. **Confidence and what would falsify it** — what evidence would disprove the claim
 
-## What Sets KIN Apart
+Rendered at three altitudes: TL;DR (maintainer), Mechanic (mid engineer), First p
+rinciples (beginner). Same object, different compression ratio.
 
-- **Names Concrete Products**: CrowdStrike Falcon, Velociraptor, Duo MFA, KnowBe4 — not generic "implement EDR".
-- **Grounds in Real CVEs**: Contextualizes against CVE-2023-4863, CVE-2021-44228, CVE-2024-3094, and more.
-- **Real Incident Context**: References lessons from MGM, Colonial Pipeline, NotPetya, Maersk, and Merck breaches.
-- **Direct & Opinionated**: Opens immediately with the finding and action item, eliminating boilerplate AI disclaimers.
+## Canonical Status
 
----
+This is the canonical KIN model (3B, merged weights). GGUF version at [kin-sft-lora-gguf](https://huggingface.co/nyxspecter4/kin-sft-lora-gguf).
 
-## Quickstart: Transformers
+## Quick Start
 
 ```python
 from transformers import pipeline
 
 messages = [
-    {
-        "role": "system",
-        "content": (
-            "You are KIN — a sharp cybersecurity AI partner. Direct, opinionated, specific. "
-            "Name tools, CVEs, companies. Sound like a senior engineer at a bar, not a textbook. "
-            "Lead with your boldest take. End with a specific action. Max 2-3 paragraphs. "
-            "Open with your take, not your title. No 'As a cybersecurity AI expert.' "
-            "Name products: 'CrowdStrike Falcon' not 'use EDR'. 'Duo push MFA' not 'implement MFA'."
-        )
-    },
-    {
-        "role": "user",
-        "content": "How do I detect a lateral movement foothold after an active directory credential dump?"
-    }
+    {"role": "system", "content": "You are KIN — a verification translator. Translate the security claim into a five-field brief: claim, blast radius, why the model thinks so, how to see it yourself, confidence and what would falsify it. If field 4 is missing, refuse to sound sure. Render at TL;DR, mechanic, and first-principles levels."},
+    {"role": "user", "content": "<paste PR diff, review comment, or agent trace here>"}
 ]
 
-pipe = pipeline("text-generation", model="nyxspecter4/kin-sft-lora", device_map="auto")
+pipe = pipeline("text-generation", model="nyxspecter4/kin-sft-lora", device="cuda")
 output = pipe(messages, max_new_tokens=512, return_full_text=False)
 print(output[0]["generated_text"])
 ```
 
----
-
-## Quickstart: Ollama, GGUF & llama.cpp
-
-This repo ships the **Q4_K_M GGUF (1.93 GB)** next to the full Safetensors weights, so local CPU/GPU inference is one command:
+## Ollama (one command)
 
 ```bash
-# Direct from Hugging Face with Ollama (pulls Q4_K_M from this repo)
-ollama run hf.co/nyxspecter4/kin-sft-lora
+ollama pull nyxspecter4/kin-sft-lora-gguf:Q4_K_M
+ollama run nyxspecter4/kin-sft-lora-gguf:Q4_K_M
 ```
 
-Or build from the included `Modelfile` (LoRA-adapter path):
+## Critical: System Prompt
 
-```bash
-git clone https://huggingface.co/nyxspecter4/kin-sft-lora
-cd kin-sft-lora
-ollama create kin -f Modelfile
-ollama run kin
-```
+KIN was trained with a specific verification translator persona. Using a different prompt will degrade quality significantly.
 
-With llama.cpp:
+> You are KIN — a verification translator. Translate the security claim into a five-field brief: claim, blast radius, why the model thinks so, how to see it yourself, confidence and what would falsify it. If field 4 is missing, refuse to sound sure. Render at TL;DR, mechanic, and first-principles levels.
 
-```bash
-llama-cli -hf nyxspecter4/kin-sft-lora -p "How do I detect credential-dump lateral movement?"
-```
-
-### Quantization Matrix
-
-| Quant Format | Precision | File Size | Recommended Hardware | Status |
-|---|---|---|---|---|
-| **Q4_K_M** | 4-bit Medium | **1.93 GB** | Laptops & M1/M2/M3 Macs (fastest) | ✅ In this repo |
-| Q5_K_M | 5-bit Medium | ~2.5 GB | Standard desktops (balanced) | Planned |
-| Q8_0 | 8-bit High | ~3.8 GB | Workstations / servers (max fidelity) | Planned |
-| FP16 | 16-bit Full | ~6.2 GB | GPU VRAM >= 8 GB (uncompressed) | Planned |
-
----
-
-## Training Details
+## Training Details (v1 — current shipped weights)
 
 | Parameter | Value |
 |-----------|-------|
-| Base Architecture | `Qwen/Qwen2.5-3B-Instruct` |
-| Method | LoRA SFT + DPO Alignment |
-| LoRA Rank / Alpha | 8 / 16 |
-| Target Modules | `q_proj`, `k_proj`, `v_proj`, `o_proj` |
-| Alignment Data | `nyxspecter4/kin-cyber-dpo-v2` (1,637 DPO pairs) |
-
----
+| Base model | Qwen2.5-3B-Instruct |
+| Method | LoRA SFT + DPO |
+| LoRA rank | 8 |
+| LoRA alpha | 16 |
+| Target modules | q_proj, k_proj, v_proj, o_proj |
+| Training data | 1,635 DPO pairs (verified audit vs vague filing) |
+| Framework | TRL 0.14.0, Transformers 4.48.0 |
+| Merged weights | Yes (6.2GB safetensors) |
+| Temperature | 0.3 recommended |
+
+## v2 Retrain (PENDING —
+ verification translator expansion)
+
+| Parameter | KIN v1 (current) | KIN v2 (target) |
+|-----------|-----------------|-----------------|
+| LoRA rank | 8 | 16 |
+| LoRA alpha | 16 | 32 |
+| Target modules | 4 (attention) | 7 (all-linear) |
+| Training data | 1,635 pairs | ~2,135 pairs (+500 PR review translation) |
+| Pair shape | audit vs vague | brief+check vs jargon |
+
+## The DPO Contrast
+
+The training data encodes a single preference: **chosen** = structured audit with root cause, fix, and regression test. **Rejected** = vague filing with guesses and no verification. The v2 expansion adds PR review and bounty report translation pairs with the same contrast.
 
 ## Limitations
 
-- 3B-class model: strong at triage, brief-writing, and checklist enforcement — always validate critical findings with a replayable check or scanner before acting.
-- The five-field brief is a reasoning aid, not a formal audit artifact.
-- Long-context codebases should be pre-filtered (diff/relevant file chunks) before prompting.
+- v1 was trained on monk-plugin bug bounty scenarios, not general PR reviews
+- The five-field brief structure is emergent from training, not enforced by architecture
+- Field 4 (replayable check) quality depends on the input containing enough signal
+- The hash seal (diff + brief + test command) is planned for v2, not yet implemented
+
+## License
+
+Apache 2.0
+<!-- deploy-trigger: retrigger after @v7 fix -->