Phantester

Phantester is a GPT-2 XL LoRA adapter for classifying constrained, structured file-integrity telemetry and recommending defensive actions.

Intended use

Use only behind a deterministic policy engine. The model must not receive keys, perform cryptography, delete files, or directly trigger containment.

Limitations

The initial corpus is synthetic and does not establish real-world ransomware detection accuracy. GPT-2 XL is not instruction-tuned and has a limited context window. Any output outside the documented schema is untrusted.

Release gate

Do not publish a checkpoint until it reaches at least 95% exact-match accuracy and 100% recall for canary failures on a reviewed held-out set, while all cryptographic fail-closed tests pass.

Training and evaluation

The published adapter was trained for three epochs on 80,000 synthetic examples, validated on 10,000 examples, and evaluated on a disjoint 10,000 example test split. Identical prompts are confined to one split.

Metric	Result
Exact JSON decision match	100%
Canary-failure recall	100%
Training loss	0.7183
Training runtime, H100 80GB	20m 25s

These results measure deterministic synthetic policy routing. They do not measure real-world ransomware detection and must not be interpreted as a production false-positive or false-negative rate.