beau-warren/blueteam-lilHybrid-cyber-LM-v0.5

BlueTeam lilHybrid Cyber LM v0.5

A small experimental hybrid for defensive repository review:

user → 100M LM → confined static analyzer → 100M LM → validated report → user

The language model selects the directory requested by the user and explains analyzer results. It does not own filesystem access or vulnerability truth. Deterministic code validates the path, reads supported source files, decides bounded findings, and preserves canonical verdicts, paths, lines, evidence, and CWE identifiers.

What it does

Use the linked Docker harness to point the hybrid at a repository on your computer:

WORKSPACE=/absolute/path/to/repository make harness-setup
WORKSPACE=/absolute/path/to/repository make harness-chat

The host directory is bind-mounted read-only at /workspace inside the container; it is not copied into the Docker image. The analyzer reads supported source files without executing or modifying them, and the LM turns its grounded findings into a user-facing report:

host repository → read-only /workspace mount → analyzer → LM explanation → report

The downloadable GGUF alone cannot access files or scan a directory. Repository scanning requires the controller/analyzer from the GitHub project below.

The deployment and fine-tuning scaffold is available at Cyber_Blueteam_OpenInterp_fine-tuning. The intended coding harness is Open Interpreter; the reproducible container in the repository pins Open Interpreter 0.0.39.

This is educational research software, not a production vulnerability scanner. Absence of a finding is not evidence that a repository is secure.

Model lineage

The approximately 100.7M-parameter causal LM began with beau-warren/blueteam-cyber-base-v0.3.0. Successive local supervised fine-tuning experiments taught defensive reporting and Open Interpreter interaction. This release branches from the strongest earlier Open Interpreter checkpoint and adds a focused one-tool contract:

{"action":"scan_repository","path":"/workspace/src"}

After receiving a bounded tool result, it returns a short overview plus exactly one indexed explanation per finding. The controller validates both stages and falls back to deterministic prose if the second response is malformed.

Only the Q8_0 GGUF inference artifact is published here. Optimizer state, training checkpoints, datasets, W&B files, credentials, and private run artifacts are excluded.

Files

GGUF SHA-256:

3a56cf5917ff76d9a75cf3252d3af84f5f1b313d4e6ea2f091815ba03151984f

Recommended use: Open Interpreter hybrid

Clone the harness repository:

git clone https://github.com/beau-warren/Cyber_Blueteam_OpenInterp_fine-tuning.git
cd Cyber_Blueteam_OpenInterp_fine-tuning
python3 -m venv .venv
.venv/bin/pip install --upgrade pip
.venv/bin/pip install -e '.[train,dev]'
make download-model

Run the included fixture:

make harness-setup
make harness-chat

Or mount your own repository read-only:

WORKSPACE=/absolute/path/to/repository make harness-setup
WORKSPACE=/absolute/path/to/repository make harness-chat

Example prompt:

Inspect /workspace for vulnerabilities, please.

Stop the stack:

WORKSPACE=/absolute/path/to/repository make harness-down

The container disables general shell/tool execution, mounts the requested repository read-only, uses an internal Docker network, drops Linux capabilities, and does not publish a host port. Review the isolation settings before mounting sensitive code.

Direct Ollama use

Download the inference files:

hf download beau-warren/blueteam-lilHybrid-cyber-LM-v0.5 \
  blueteam-lilHybrid-cyber-LM-v0.5-Q8_0.gguf \
  Modelfile \
  --local-dir blueteam-lilHybrid-cyber-LM-v0.5
cd blueteam-lilHybrid-cyber-LM-v0.5
ollama create blueteam-lilhybrid-cyber-lm-v0.5:latest -f Modelfile
ollama run blueteam-lilhybrid-cyber-lm-v0.5:latest

Direct Ollama use provides only the language model. It cannot read or scan local files without the external controller. It may emit the learned action JSON rather than a conversational answer; use the GitHub harness for actual directory scans.

Fine-tuning

The focused run used assistant-masked causal supervised fine-tuning. System, user, and tool-result tokens were context; losses applied only to assistant actions/presentations and EOS.

The audited SFT corpus contained complete LM→tool→LM trajectories, first-action drills, invalid and missing path cases, non-scan responses, plus frozen English/security replay. The generated corpus had zero duplicate IDs/conversations, family/template leakage, held-out harness-canary leakage, or supervised unsafe tools.

Evaluation

The frozen native gate contains 720 one-tool episodes decoded greedily in FP16. The parent emitted the prior report contract and scored 0% under the new one-tool protocol.

Q8_0/Open Interpreter gates:

• —absolute /workspace selection and scan: pass
• —relative src/payments selection and scan: pass
• —path outside /workspace rejected without scanning: pass
• —exact held-out path, line, evidence, and CWE-89: pass
• —benign allowlisted SQL lookalike absent from findings: pass

Legacy regression:

These protocol and synthetic-suite scores are not estimates of real-world vulnerability-detection accuracy.

Strengths

• —Very small local deployment footprint.
• —Reliable compact actions when an explicit absolute path is supplied.
• —Strong current-workspace path handling.
• —Code-enforced path confinement and read-only scanning.
• —Canonical findings cannot be overridden by model prose.
• —Deterministic fallback for malformed explanations.
• —No cloud inference required.

Known weaknesses

• —Missing-path clarification: 18.75% episode success.
• —Non-scan requests: 50.00%.
• —Invalid-path recovery: 53.75%.
• —Relative paths: 74.38%.
• —Explanations are often generic.
• —The 100M model has weak general reasoning, arithmetic, and open-ended conversation.
• —Analyzer rules are narrow; unsupported vulnerabilities will be missed.
• —Static rules do not model arbitrary interprocedural or framework-specific data flow.
• —Q8_0 and FP16 behavior may differ on prompts outside the tested gates.

Intended and out-of-scope uses

Intended:

• —learning small-model SFT and hybrid-agent design;
• —local defensive demonstrations on authorized code;
• —research into bounded LM/tool orchestration;
• —generating an advisory report from deterministic analyzer facts.

Out of scope:

• —autonomous exploitation, offensive targeting, or code execution;
• —scanning systems without authorization;
• —compliance certification or production security sign-off;
• —treating “no findings” as a clean bill of health;
• —using model output as the sole basis for remediation.

License

Released under the MIT License. Open Interpreter, Ollama, base-model data, and any downstream training datasets remain subject to their own licenses and terms.