Instructions to use ConsensusProtocol-Thanos/Gork-27b-Cybersecurity-FP8-Dynamic with libraries, inference providers, notebooks, and local apps. Follow these links to get started.

Libraries

How to use ConsensusProtocol-Thanos/Gork-27b-Cybersecurity-FP8-Dynamic with Transformers:

# Use a pipeline as a high-level helper
from transformers import pipeline

pipe = pipeline("text-generation", model="ConsensusProtocol-Thanos/Gork-27b-Cybersecurity-FP8-Dynamic")
messages = [
    {"role": "user", "content": "Who are you?"},
]
pipe(messages)

# pip install -U transformers accelerate
# Load model directly
from transformers import AutoTokenizer, AutoModelForCausalLM

tokenizer = AutoTokenizer.from_pretrained("ConsensusProtocol-Thanos/Gork-27b-Cybersecurity-FP8-Dynamic")
model = AutoModelForCausalLM.from_pretrained("ConsensusProtocol-Thanos/Gork-27b-Cybersecurity-FP8-Dynamic", device_map="auto")
messages = [
    {"role": "user", "content": "Who are you?"},
]
inputs = tokenizer.apply_chat_template(
	messages,
	add_generation_prompt=True,
	tokenize=True,
	return_dict=True,
	return_tensors="pt",
).to(model.device)

outputs = model.generate(**inputs, max_new_tokens=256)
print(tokenizer.decode(outputs[0][inputs["input_ids"].shape[-1]:]))

Notebooks
Google Colab
Kaggle
Local Apps Settings

vLLM

How to use ConsensusProtocol-Thanos/Gork-27b-Cybersecurity-FP8-Dynamic with vLLM:

Install from pip and serve model

# Install vLLM from pip:
pip install vllm
# Start the vLLM server:
vllm serve "ConsensusProtocol-Thanos/Gork-27b-Cybersecurity-FP8-Dynamic"
# Call the server using curl (OpenAI-compatible API):
curl -X POST "http://localhost:8000/v1/chat/completions" \
	-H "Content-Type: application/json" \
	--data '{
		"model": "ConsensusProtocol-Thanos/Gork-27b-Cybersecurity-FP8-Dynamic",
		"messages": [
			{
				"role": "user",
				"content": "What is the capital of France?"
			}
		]
	}'

Use Docker

docker model run hf.co/ConsensusProtocol-Thanos/Gork-27b-Cybersecurity-FP8-Dynamic

SGLang

How to use ConsensusProtocol-Thanos/Gork-27b-Cybersecurity-FP8-Dynamic with SGLang:

Install from pip and serve model

# Install SGLang from pip:
pip install sglang
# Start the SGLang server:
python3 -m sglang.launch_server \
    --model-path "ConsensusProtocol-Thanos/Gork-27b-Cybersecurity-FP8-Dynamic" \
    --host 0.0.0.0 \
    --port 30000
# Call the server using curl (OpenAI-compatible API):
curl -X POST "http://localhost:30000/v1/chat/completions" \
	-H "Content-Type: application/json" \
	--data '{
		"model": "ConsensusProtocol-Thanos/Gork-27b-Cybersecurity-FP8-Dynamic",
		"messages": [
			{
				"role": "user",
				"content": "What is the capital of France?"
			}
		]
	}'

Use Docker images

docker run --gpus all \
    --shm-size 32g \
    -p 30000:30000 \
    -v ~/.cache/huggingface:/root/.cache/huggingface \
    --env "HF_TOKEN=<secret>" \
    --ipc=host \
    lmsysorg/sglang:latest \
    python3 -m sglang.launch_server \
        --model-path "ConsensusProtocol-Thanos/Gork-27b-Cybersecurity-FP8-Dynamic" \
        --host 0.0.0.0 \
        --port 30000
# Call the server using curl (OpenAI-compatible API):
curl -X POST "http://localhost:30000/v1/chat/completions" \
	-H "Content-Type: application/json" \
	--data '{
		"model": "ConsensusProtocol-Thanos/Gork-27b-Cybersecurity-FP8-Dynamic",
		"messages": [
			{
				"role": "user",
				"content": "What is the capital of France?"
			}
		]
	}'

Docker Model Runner
How to use ConsensusProtocol-Thanos/Gork-27b-Cybersecurity-FP8-Dynamic with Docker Model Runner:
```
docker model run hf.co/ConsensusProtocol-Thanos/Gork-27b-Cybersecurity-FP8-Dynamic
```

Gork-27B-Cybersecurity-FP8-Dynamic

FP8-Dynamic quantization of Gork-27B-Cybersecurity: 30 GB instead of 54 GB; security, general and BFCL scores are within 2 points of the BF16 model, and most within one.

A 27B cybersecurity assistant fine-tuned from Qwen/Qwen3.8-27B for threat intelligence, incident response and secure-code review.

Highlights

Far stronger on security knowledge. Well ahead of the base on CyberMetric and held-out security data, and ahead on SecEval and CTIBench.
No general-capability regression. At or above the base on GSM8K, MMLU-Pro and IFEval.
Strong tool use. Higher pass rate than the base on Sleipnir's tool-use suite, and ahead of it on single calls and user-contributed functions in BFCL.
Concise. About 1.4x fewer output tokens per answer than the base, at higher accuracy.
262K context. Extensible to 1M with YaRN as in the base model.
Open weights, Apache-2.0. Run it directly, or per token on Heimdallm.

Model Overview


Model type	Causal LM. Dense hybrid of Gated DeltaNet (linear attention) and full attention in a 3:1 layer pattern, with a 1-layer multi-token-prediction head (inherited from Qwen3.8).
Base model	Qwen/Qwen3.8-27B (text model only)
Parameters	27B (incl. MTP head)
Context length	262,144 native · 1,000,000 with YaRN
Modalities	Text in, text out
Languages	English (security corpora are overwhelmingly English; multilingual chat is inherited, not tuned)
Precision	FP8 E4M3 weights (per-channel scales) and dynamic per-token FP8 activations, compressed-tensors format, made with llm-compressor `FP8_DYNAMIC` (data-free). Embeddings, `lm_head`, norms, the DeltaNet `in_proj_a`/`in_proj_b` gates and the MTP head stay BF16. 30 GB.
License	Apache-2.0

Other versions

Gork-27b-Cybersecurity: BF16, 54 GB
Gork-27b-Cybersecurity-NVFP4: NVFP4, 24 GB

Intended Use

Primary use cases

Threat-intel summarisation and extraction (IOCs, TTPs, actor attribution with confidence)
Incident-response playbook assistance and post-incident report drafting
Secure-code review and vulnerability explanation (CWE mapping, remediation guidance)
Security education and certification study (CISSP / Sec+ style Q&A)

Out of scope

Autonomous offensive operations against systems without written authorisation to test
Generating novel, weaponised exploit code or malware
Legal, compliance or regulatory determinations without a qualified human reviewer

Dual-use notice. Security knowledge is inherently dual-use. The model is tuned to be more useful to defenders than a general model, and it will still explain how attacks work because defenders need that. Read Safety before exposing it to untrusted users.

Training

Supervised fine-tune of Qwen3.8-27B on a curated cybersecurity dataset, trained with QLoRA and merged back into BF16 weights, then averaged in equal parts with the base weights. The averaging keeps the security gains and restores most of the base model's multi-call tool use.

Knowledge cut-off: November 2026. CVEs and advisories published after this date are unknown unless supplied in context.

Evaluation

All numbers compare this FP8-Dynamic checkpoint, the unquantized Gork-27B (BF16, for reference) and the unmodified Qwen3.8-27B base with no input truncation; the better of FP8-Dynamic and base is bolded. Higher is better except NLL. Benchmarks ran on lm-evaluation-harness and the BFCL runner over vLLM, with vLLM's weight-only kernels for the quantized checkpoint; scoring details are in BENCHMARK-RESULTS.md.

Security

Benchmark	What it measures	FP8-Dynamic	Gork-27B (BF16)	Qwen3.8-27B (base)
Validation NLL — held-out in-domain examples	fit to the security distribution (lower is better; perplexity in parentheses)	0.641 (1.90)	0.640 (1.90)	0.962 (2.62)
CyberMetric-500	security knowledge QA	0.954	0.952	0.746
SecEval (2,182, multi-select)	security knowledge across nine domains	0.794	0.794	0.781
CTIBench — MCQ (2,500)	threat-intel knowledge	0.737	0.736	0.714
CTIBench — RCM (1,000)	map CVE → CWE	0.732	0.734	0.726
MMLU — computer_security	general security knowledge	0.88	0.87	0.88

General-capability regression

IFEval and GSM8K are full; MMLU-Pro is a 33% stratified subset (~4,000 of ~12,000 questions). GSM8K is scored through the chat template (few-shot examples as turns).

Benchmark	What it measures	FP8-Dynamic	Gork-27B (BF16)	Qwen3.8-27B (base)
GSM8K (flexible-extract)	grade-school math reasoning	0.910	0.917	0.898
MMLU-Pro (~4,000-Q subset)	broad reasoning across 14 domains	0.726	0.721	0.612
IFEval — prompt-level strict	instruction following	0.630	0.649	0.529
IFEval — instruction-level strict	instruction following	0.736	0.753	0.629

The security tuning did not cost general capability: this checkpoint is at or above the base on every task.

Token efficiency

On the same 1,000 CTIBench CVE→CWE prompts, the FP8-Dynamic checkpoint emits 1.4x fewer output tokens per answer than the base.

	FP8-Dynamic	Gork-27B (BF16)	Qwen3.8-27B (base)
Mean output tokens/answer	137.6	134.0	192.0
Median	91	95	127
p90	185	192	327
Accuracy	0.732	0.734	0.726

Tool calling (BFCL v4)

Category	What it measures	FP8-Dynamic	Gork-27B (BF16)	Qwen3.8-27B (base)
Simple (Python, Java, JavaScript)	one call to one given function	0.801	0.808	0.800
Multiple	choosing the right function among several	0.965	0.965	0.975
Parallel	several calls in one turn	0.710	0.725	0.820
Parallel multiple	several calls across several functions	0.735	0.720	0.835
Live (user-contributed)	real-world function definitions	0.848	0.844	0.823
Multi-turn	stateful tasks over several turns	0.484	0.495	0.583
Irrelevance	declining tools that do not fit the request	0.841	0.846	0.732

Like the BF16 model, it leads the base on single calls and user-contributed functions, and declines unrelated tools more reliably.

Agent use (Sleipnir)

Measured in Sleipnir, a coding-agent harness, over the same OpenAI-compatible endpoint.

Test	What it measures	FP8-Dynamic	Gork-27B (BF16)	Qwen3.8-27B (base)
Tool-use suite (9 scenarios, 5 samples each)	picking the right next tool call in situations taken from real team runs	0.67	0.76	0.60

Quickstart

On GPUs with FP8 tensor cores (compute capability 8.9 and newer) vLLM runs weights and activations in FP8; on Ampere it runs the weights through its weight-only Marlin kernels (W8A16).

vLLM

vllm serve ConsensusProtocol-Thanos/Gork-27b-Cybersecurity-FP8-Dynamic \
  --max-model-len 262144 \
  --enable-auto-tool-choice --tool-call-parser qwen3_coder \

For Transformers, use the BF16 model.

Chat Template and Tool Calling

Gork is a direct-answer model: it replies without a chain-of-thought phase, and thinking is disabled in the chat template. It uses ChatML-style roles and XML-style <tool_call><function=…> calls, with the standard function-calling schema.

Sampling

temperature=0.7, top_p=0.8, top_k=20, presence_penalty=1.5. The shipped generation_config.json carries this preset.

Safety and Limitations

Known limitations

CVE details recalled from memory (IDs, CWE, CVSS) can be wrong; verify them against NVD.
Attribution confidence is over-stated; treat actor names as hypotheses.
English-centric. Non-English security content is handled by inherited base capability only.
Text only. For screenshots, OCR first or use the vision-capable base model.
Designed for the chat template; raw text completion is not supported.
This is a v0.1 preview checkpoint, quantized to FP8-Dynamic.

Safety behaviour

Refuses or redirects weaponised exploit development, unauthorised access to named targets, non-consensual surveillance, and malware generation.
Will explain attack techniques and reverse-engineer provided samples.

License

Citation

@misc{gork2026,
  title        = {Gork-27B-Cybersecurity: A Cybersecurity Fine-tune of Qwen3.8-27B},
  author       = {Consensus Protocol LLC},
  year         = {2026},
  url          = {https://huggingface.co/ConsensusProtocol-Thanos/Gork-27b-Cybersecurity},
  note         = {Version 0.1 preview}
}

Acknowledgements

Qwen team for the base model. The Sigma, YARA, MITRE ATT&CK and NVD communities for making defensive knowledge public.

Downloads last month: 30

Safetensors

Model size

27B params

Tensor type

BF16

F8_E4M3

Model tree for ConsensusProtocol-Thanos/Gork-27b-Cybersecurity-FP8-Dynamic

Base model

Qwen/Qwen3.8-27B

Finetuned

ConsensusProtocol-Thanos/Gork-27b-Cybersecurity

Quantized

(4)

this model