Kali-Terminus-v2
Kali-Terminus-v2 is a fine-tuned LFM2.5-350M model specialized for Kali Linux terminal command execution. It converts natural language instructions into precise shell commands with native LFM2.5 <|tool_call_start|>/<|tool_call_end|> JSON tool calls.
This is the Executor Agent in a multi-agent penetration-testing system — it translates one bounded instruction into one structured terminal action.
Model Details
| Property | Value |
|---|---|
| Base Model | LFM2.5-350M |
| Architecture | LFM2 hybrid (10 conv + 6 full-attention layers) |
| Parameters | 350M |
| Context Length | 128K tokens (trained with 1024) |
| Fine-Tuning | LoRA (r=16, alpha=32, 11 target modules) |
| Training Data | iselabvn/Kali-terminal-executor-v2 (2,418 samples) |
| Precision | float32 (merged) |
| Format | <|im_start|> / <|im_end|> with native <|tool_call_start|>/<|tool_call_end|> JSON tool calls |
Performance
Evaluated across 5 scenarios (26 turns) covering network recon, system enumeration, web recon, DNS recon, and self-correction:
| Metric | Score |
|---|---|
| Strict Pass Rate | 92.31% |
| Tool Call Parse Rate | 100.0% |
| Exactly One Tool Call | 100.0% |
| Semantic Command Accuracy | 92.31% |
Comparison with V1
| Model | Strict Pass Rate | Improvement |
|---|---|---|
| Kali-Terminus-v1 (FunctionGemma-270M) | 65.8% | — |
| Kali-Terminus-v1 (LFM2.5-350M) | 50.0% | — |
| Kali-Terminus-v2 | 92.31% | +42.3 pp over v1 LFM2.5 |
Dataset
Fine-tuned on iselabvn/Kali-terminal-executor-v2, a curated collection of 2,418 shell command execution pairs combining 1,380 source records with 1,000 synthetically augmented records (DeepSeek-V4-Flash).
Top tools in training data:
nmap · dig · gobuster · curl · whatweb · sqlmap · find · hydra · uname · ss · subfinder · dnsrecon · ffuf · id · nikto
Usage
from transformers import AutoModelForCausalLM, AutoTokenizer
model = AutoModelForCausalLM.from_pretrained("iselabvn/Kali-Terminus-v2", trust_remote_code=True)
tokenizer = AutoTokenizer.from_pretrained("iselabvn/Kali-Terminus-v2", trust_remote_code=True)
messages = [
{"role": "user", "content": "Scan port 80 on 192.168.1.1"}
]
inputs = tokenizer.apply_chat_template(
messages,
tools=[{
"type": "function",
"function": {
"name": "exec",
"description": "Execute a shell command in the Kali terminal.",
"parameters": {
"type": "object",
"properties": {"command": {"type": "string"}},
"required": ["command"]
}
}
}],
add_generation_prompt=True,
return_tensors="pt"
)
outputs = model.generate(**inputs, max_new_tokens=256)
response = tokenizer.decode(outputs[0][inputs["input_ids"].shape[-1]:], skip_special_tokens=False)
print(response)
# Expected: <|tool_call_start|>{"name": "exec", "arguments": {"command": "nmap -p 80 192.168.1.1"}}<|tool_call_end|>
Tool Call Format
Kali-Terminus-v2 produces native LFM2.5 tool calls wrapped in <|tool_call_start|> and <|tool_call_end|> tokens, output as JSON:
<|tool_call_start|>{"name": "exec", "arguments": {"command": "nmap -p 80 192.168.1.1"}}<|tool_call_end|>
A system instruction Output function calls as JSON. is prepended so the model emits JSON rather than the default Pythonic calls.
Tool Call Format
Kali-Terminus-v2 produces native LFM2.5 tool calls wrapped in <|tool_call_start|> and <|tool_call_end|> tokens, output as JSON:
<|tool_call_start|>{"name": "exec", "arguments": {"command": "nmap -p 80 192.168.1.1"}}<|tool_call_end|>
A system instruction Output function calls as JSON. is prepended so the model emits JSON rather than the default Pythonic calls.
Intended Use
- Executor Agent in multi-agent penetration-testing systems
- Single-Turn Kali Terminal Assistant — converts natural language to shell commands
- Not recommended for general conversation or chatbot use
Limitations
- Designed for single-turn command generation; multi-turn interaction requires external state management
- Commands target authorized lab environments only; not for production systems without human review
- Best performance on the 15 core Kali/Linux tools seen during training
Training Details
| Hyperparameter | Value |
|---|---|
| LoRA rank | 16 |
| LoRA alpha | 32 |
| LoRA dropout | 0.05 |
| Target modules | in_proj, out_proj, q_proj, k_proj, v_proj, w1, w2, w3, gate_proj, up_proj, down_proj |
| Learning rate | 2e-4 (cosine) |
| Batch size | 4 |
| Gradient accumulation | 4 |
| Effective batch size | 16 |
| Epochs | 3 (best checkpoint at step 352, ~2.7 epochs) |
| Max sequence length | 1024 |
| Optimizer | AdamW |
| Precision | bfloat16 |
Citation
@misc{kali-terminus-v2,
author = {ISeLab},
title = {Kali-Terminus-v2: Fine-tuned LFM2.5-350M for Kali Linux Terminal Execution},
year = {2026},
publisher = {Hugging Face},
url = {https://huggingface.co/iselabvn/Kali-Terminus-v2}
}