KIN — Cybersecurity Verification Translator (3B)

KIN is an authoritative, fine-tuned cybersecurity model built on Qwen2.5-3B-Instruct. It translates ambiguous machine-generated security claims into leveled briefs with replayable evidence checks.

No check, no confidence.

Evaluation & Leaderboard Status


What KIN Does

KIN processes PR diffs, review threads, agent traces, or vulnerability writeups and produces a structured five-field brief:

  1. Claim — What is alleged
  2. Blast Radius — What breaks if true
  3. Root Cause Mechanics — The underlying generator: CWE, invariant, missing check
  4. Reproducible Verification — PoC, failing test, AST check, or execution command
  5. Falsification Criteria — Confidence level and exactly what evidence would disprove it

The core rule: no "critical" without a replayable check. That refusal IS the product.


What Sets KIN Apart

  • Names Concrete Products: CrowdStrike Falcon, Velociraptor, Duo MFA, KnowBe4 — not generic "implement EDR".
  • Grounds in Real CVEs: Contextualizes against CVE-2023-4863, CVE-2021-44228, CVE-2024-3094, and more.
  • Real Incident Context: References lessons from MGM, Colonial Pipeline, NotPetya, Maersk, and Merck breaches.
  • Direct & Opinionated: Opens immediately with the finding and action item, eliminating boilerplate AI disclaimers.

Quickstart: Transformers

from transformers import pipeline

messages = [
    {
        "role": "system",
        "content": (
            "You are KIN — a sharp cybersecurity AI partner. Direct, opinionated, specific. "
            "Name tools, CVEs, companies. Sound like a senior engineer at a bar, not a textbook. "
            "Lead with your boldest take. End with a specific action. Max 2-3 paragraphs. "
            "Open with your take, not your title. No 'As a cybersecurity AI expert.' "
            "Name products: 'CrowdStrike Falcon' not 'use EDR'. 'Duo push MFA' not 'implement MFA'."
        )
    },
    {
        "role": "user",
        "content": "How do I detect a lateral movement foothold after an active directory credential dump?"
    }
]

pipe = pipeline("text-generation", model="nyxspecter4/kin-sft-lora", device_map="auto")
output = pipe(messages, max_new_tokens=512, return_full_text=False)
print(output[0]["generated_text"])

Quickstart: Ollama, GGUF & llama.cpp

This repo ships the Q4_K_M GGUF (1.93 GB) next to the full Safetensors weights, so local CPU/GPU inference is one command:

# Direct from Hugging Face with Ollama (pulls Q4_K_M from this repo)
ollama run hf.co/nyxspecter4/kin-sft-lora

Or build from the included Modelfile (LoRA-adapter path):

git clone https://huggingface.co/nyxspecter4/kin-sft-lora
cd kin-sft-lora
ollama create kin -f Modelfile
ollama run kin

With llama.cpp:

llama-cli -hf nyxspecter4/kin-sft-lora -p "How do I detect credential-dump lateral movement?"

Quantization Matrix

Quant Format Precision File Size Recommended Hardware Status
Q4_K_M 4-bit Medium 1.93 GB Laptops & M1/M2/M3 Macs (fastest) ✅ In this repo
Q5_K_M 5-bit Medium ~2.5 GB Standard desktops (balanced) Planned
Q8_0 8-bit High ~3.8 GB Workstations / servers (max fidelity) Planned
FP16 16-bit Full ~6.2 GB GPU VRAM >= 8 GB (uncompressed) Planned

Training Details

Parameter Value
Base Architecture Qwen/Qwen2.5-3B-Instruct
Method LoRA SFT + DPO Alignment
LoRA Rank / Alpha 8 / 16
Target Modules q_proj, k_proj, v_proj, o_proj
Alignment Data nyxspecter4/kin-cyber-dpo-v2 (1,637 DPO pairs)

Limitations

  • 3B-class model: strong at triage, brief-writing, and checklist enforcement — always validate critical findings with a replayable check or scanner before acting.
  • The five-field brief is a reasoning aid, not a formal audit artifact.
  • Long-context codebases should be pre-filtered (diff/relevant file chunks) before prompting.
Downloads last month
1,569
Safetensors
Model size
3B params
Tensor type
F32
·
F16
·
Inference Providers NEW
This model isn't deployed by any Inference Provider. 🙋 Ask for provider support

Model tree for nyxspecter4/kin-sft-lora

Base model

Qwen/Qwen2.5-3B
Quantized
(283)
this model

Space using nyxspecter4/kin-sft-lora 1