KIN — Cybersecurity Verification Translator (3B)
KIN is an authoritative, fine-tuned cybersecurity model built on Qwen2.5-3B-Instruct. It translates ambiguous machine-generated security claims into leveled briefs with replayable evidence checks.
No check, no confidence.
Evaluation & Leaderboard Status
- Hugging Face Open LLM Leaderboard: Job PENDING Evaluation
- Downloads: 1,000+ and climbing
What KIN Does
KIN processes PR diffs, review threads, agent traces, or vulnerability writeups and produces a structured five-field brief:
- Claim — What is alleged
- Blast Radius — What breaks if true
- Root Cause Mechanics — The underlying generator: CWE, invariant, missing check
- Reproducible Verification — PoC, failing test, AST check, or execution command
- Falsification Criteria — Confidence level and exactly what evidence would disprove it
The core rule: no "critical" without a replayable check. That refusal IS the product.
What Sets KIN Apart
- Names Concrete Products: CrowdStrike Falcon, Velociraptor, Duo MFA, KnowBe4 — not generic "implement EDR".
- Grounds in Real CVEs: Contextualizes against CVE-2023-4863, CVE-2021-44228, CVE-2024-3094, and more.
- Real Incident Context: References lessons from MGM, Colonial Pipeline, NotPetya, Maersk, and Merck breaches.
- Direct & Opinionated: Opens immediately with the finding and action item, eliminating boilerplate AI disclaimers.
Quickstart: Transformers
from transformers import pipeline
messages = [
{
"role": "system",
"content": (
"You are KIN — a sharp cybersecurity AI partner. Direct, opinionated, specific. "
"Name tools, CVEs, companies. Sound like a senior engineer at a bar, not a textbook. "
"Lead with your boldest take. End with a specific action. Max 2-3 paragraphs. "
"Open with your take, not your title. No 'As a cybersecurity AI expert.' "
"Name products: 'CrowdStrike Falcon' not 'use EDR'. 'Duo push MFA' not 'implement MFA'."
)
},
{
"role": "user",
"content": "How do I detect a lateral movement foothold after an active directory credential dump?"
}
]
pipe = pipeline("text-generation", model="nyxspecter4/kin-sft-lora", device_map="auto")
output = pipe(messages, max_new_tokens=512, return_full_text=False)
print(output[0]["generated_text"])
Quickstart: Ollama, GGUF & llama.cpp
This repo ships the Q4_K_M GGUF (1.93 GB) next to the full Safetensors weights, so local CPU/GPU inference is one command:
# Direct from Hugging Face with Ollama (pulls Q4_K_M from this repo)
ollama run hf.co/nyxspecter4/kin-sft-lora
Or build from the included Modelfile (LoRA-adapter path):
git clone https://huggingface.co/nyxspecter4/kin-sft-lora
cd kin-sft-lora
ollama create kin -f Modelfile
ollama run kin
With llama.cpp:
llama-cli -hf nyxspecter4/kin-sft-lora -p "How do I detect credential-dump lateral movement?"
Quantization Matrix
| Quant Format | Precision | File Size | Recommended Hardware | Status |
|---|---|---|---|---|
| Q4_K_M | 4-bit Medium | 1.93 GB | Laptops & M1/M2/M3 Macs (fastest) | ✅ In this repo |
| Q5_K_M | 5-bit Medium | ~2.5 GB | Standard desktops (balanced) | Planned |
| Q8_0 | 8-bit High | ~3.8 GB | Workstations / servers (max fidelity) | Planned |
| FP16 | 16-bit Full | ~6.2 GB | GPU VRAM >= 8 GB (uncompressed) | Planned |
Training Details
| Parameter | Value |
|---|---|
| Base Architecture | Qwen/Qwen2.5-3B-Instruct |
| Method | LoRA SFT + DPO Alignment |
| LoRA Rank / Alpha | 8 / 16 |
| Target Modules | q_proj, k_proj, v_proj, o_proj |
| Alignment Data | nyxspecter4/kin-cyber-dpo-v2 (1,637 DPO pairs) |
Limitations
- 3B-class model: strong at triage, brief-writing, and checklist enforcement — always validate critical findings with a replayable check or scanner before acting.
- The five-field brief is a reasoning aid, not a formal audit artifact.
- Long-context codebases should be pre-filtered (diff/relevant file chunks) before prompting.