Cyber-F1-AWQ

Cyber-F1 is a security-domain large language model, instruction fine-tuned for cybersecurity work and delivered here as a 4-bit weight-quantized checkpoint for on-premise deployment. It is the LLM component of the secAI RAG stack, paired with DuyTa/sec-embedding (retriever) and DuyTa/sec-rerank (reranker).

Model

Base	Qwen3.5-MoE, A3B (~35B total parameters, ~3B active) — Qwen3_5MoeForConditionalGeneration
Architecture	Mixture-of-Experts, 40 layers, 256 experts, 8 active experts/token
Hidden size	2048, 16 attention heads
Max context	up to 262,144 tokens (native); served at 16k, effective accuracy to ~12k
Quantization	4-bit weights, compressed-tensors / AWQ-style, group size 32 (pack-quantized)
Fine-tuning	Instruction tuning with LoRA (PEFT), then post-training weight quantization
Serving	vLLM (OpenAI-compatible endpoint), on-premise

Training

Fine-tuned on secAI cybersecurity data drawn from the last five years of authoritative sources, then quantized for deployment:

• NVD — 173,473 CVEs (five most recent years)
• MITRE CWE — 768 weakness types, mapped to ~92% of CVEs
• CAPEC / ATT&CK — 443 / 174 entries
• Exploit-DB — 3,139 exploits (2021–2026)

The instruction-tuning set is 49,756 samples combining real data (~51k HF-public samples) and task-targeted synthetic data, normalized (dedup, back-translation, QC cosine ≥ 0.7) and labeled (CVE-ID, CWE-ID, severity, task, citation source). Data groups: security terminology, RAG documents, instruction-tuning pairs, bilingual (EN/VI) data, and vulnerability reports/analysis. Training datasets: DuyTa/Cyber_F1_v2 and DuyTa/cve-kgrag-db. Training hardware: 2×A100 80GB.

Fine-tuning is multi-task, covering: translation, vulnerability reporting, pentest guidance, exploit-code drafting and explanation, static analysis (SAST), auto-remediation, and agentic tool use.

Acceptance (nghiệm thu) — reported KPIs

Evaluated on a 1,000-sample security test set (40% CVE identification/classification, 40% remediation advice, 20% real-world scenario reasoning). All KPIs met their acceptance thresholds. Raw per-sample logs and evaluation code are delivered with the acceptance package.

Answer quality (RAG):

Metric	Result	Target	Pass
Faithfulness	98.48%	≥ 98%	✅
Answer Relevance	92.88%	≥ 90%	✅
Entity Precision (CVE/CWE)	100%	= 100%	✅
Hallucination Rate	0.8%	< 2%	✅

Task capabilities:

Capability	Result	Target	Pass
Exploit explanation	100% (60/60)	≥ 85%	✅
Auto-remediation	100% (60/60)	≥ 60%	✅
Static analysis (SAST, OWASP Top 10 / CWE Top 25)	85% (51/60)	≥ 85%	✅

Performance (NVIDIA A100 80GB, full chatflow Hybrid Search → Rerank → LLM):

Metric	Result	Target	Pass
Chatflow throughput	105.6 tok/s	≥ 25 tok/s	✅
LLM decode speed	~25–35 tok/s (probe ≥ 28)	≥ 28 tok/s	✅
TTFT	~900–1,500 ms	—	✅
Concurrency	~30 users, ~0.6–0.7 RPS on 3×A100 80GB	—	✅

Minimum serving hardware: 1×A100 80GB, RAM ≥ 128GB, SSD ≥ 2TB.

Usage

# vLLM, OpenAI-compatible endpoint
from openai import OpenAI

client = OpenAI(base_url="http://localhost:8001/v1", api_key="EMPTY")
resp = client.chat.completions.create(
    model="DuyTa/Cyber-F1-AWQ",
    messages=[{"role": "user", "content": "What is CVE-2025-0282? Give CVSS, impact, affected products, and remediation."}],
)
print(resp.choices[0].message.content)

License

Released under Apache-2.0 for on-premise deployment. The base model is a Qwen3.5-MoE checkpoint; credit for the base weights belongs to the Qwen team.