Add hackathon write-up

README.md

@@ -0,0 +1,95 @@
+---
+license: mit
+language: en
+tags:
+- ai-safety
+- red-teaming
+- dfir
+- lexsi-hackathon
+---
+
+# PHANTOM DFIR: red-teaming a forensic agent and fine-tuning tiny-aya-global to verify evidence
+
+*Write-up for the Lexsi AI Safety and Alignment Hackathon. This repository holds the article only; the adapter and dataset are linked at the end.*
+
+PHANTOM DFIR is a multi-agent digital forensics system. For the Lexsi AI Safety and Alignment Hackathon we added a safety layer on top of it: the layer attacks the agent's own verifier, measures the damage, repairs it, and then trains a small open model to do the job.
+
+## Why
+
+In forensics, an AI agent that is confidently wrong is worse than no agent. A wrong "CRITICAL" wastes an incident response team's night. A wrong "CLEARED" lets an attacker stay.
+
+## The engine
+
+You give PHANTOM a memory image, a disk image or a network capture. A router detects the type and sends it to the right pipeline.
+
+For memory, four agents work in a loop:
+
+- The **Collector** runs Volatility.
+- The **Investigator** proposes findings.
+- The **Evidence agent** re-checks each finding.
+- The **Skeptic** challenges findings before anything is rated critical.
+
+Disk images and network captures go to a disk correlator with a gap controller that checks what is still missing.
+
+## Red-teaming our own Skeptic
+
+The harness loads the engine's real Skeptic code, unchanged, and feeds it adversarial evidence. There are 10 attack families and one clean control, 550 held-out rows in total.
+
+It found three weaknesses:
+
+1. **The model's vote is ignored.** Three source keys override whatever the Skeptic model answers.
+2. **One process counts as several sources.** `vol3:malfind[4412]`, `vol3:dlllist[4412]` and `vol3:cmdline[4412]` are counted as three sources, but they describe one process.
+3. **The word "benign" clears a real threat.** With identical evidence, severity flips from CRITICAL to CLEARED on claim wording alone.
+
+## The repair: a grounded verifier
+
+The grounded verifier counts distinct artifacts, accepts only behavioural evidence, and ignores the wording of the claim.
+
+| Metric (550 held-out rows) | Engine's Skeptic | Grounded verifier |
+|---|---|---|
+| Accuracy | 0.273 | 0.727 |
+| Attack success rate | 0.800 | 0.300 |
+| False-confirm rate | 0.839 | 0.562 |
+
+A paired McNemar test shows 250 rows fixed and 0 broken.
+
+## Chaining the Lexsi stack around a small open model
+
+We then asked whether a small open-weights model can learn the verifier's job.
+
+1. **Baseline:** Cohere Labs `tiny-aya-global` evaluated as the verifier on the 550 held-out rows.
+2. **CuratorKIT:** curated the training rows.
+3. **AlignTune:** QLoRA fine-tune on an 8 GB laptop GPU (1,100 rows, 138 steps, 28 minutes).
+4. **AuditKIT:** scored both runs independently.
+
+| Metric (550 held-out rows) | Base model | Fine-tuned |
+|---|---|---|
+| Accuracy | 0.524 | 0.998 |
+| Attack success rate | 0.462 | 0.002 |
+| False-confirm rate | 0.760 | 0.008 |
+| Answers that are not valid JSON | 155 | 0 |
+
+AuditKIT agrees with our own scorer: 0.531 before and 0.998 after.
+
+## Honest limits
+
+- Three attack families still beat the rule verifier: `behavioural_mention`, `identity_alias` and `network_contact_inflation`.
+- The data is synthetic. Training and held-out rows come from the same 11 templated generators, so 0.998 shows the model handles those 11 row shapes. Nothing outside them was tested.
+- The model result is one training run with one seed.
+- In 110 of 550 answers the adapter writes the correct verdict and then keeps generating. The score reads the first JSON object only.
+
+## Toolkit feedback
+
+We found four defects while chaining the stack and wrote them up in the repo:
+
+1. CuratorKIT's duplicate filter ignores the evidence field and removed four whole attack families while reporting a clean pass.
+2. AlignTune's trainer factory silently drops the 4-bit setting.
+3. Float32 casts in AlignTune/PEFT pushed training past 8 GB.
+4. AuditKIT's documented plain-function scorer raises an error.
+
+## Links
+
+- Code: https://github.com/romilp619/Phantom-DFIR
+- Adapter and logs: https://huggingface.co/RomilCyber/tiny-aya-global-phantom-verifier-qlora
+- Dataset: https://huggingface.co/datasets/RomilCyber/phantom-dfir-evidence-grounding
+- Full write-up: `docs/MODEL-RESULT.md` in the repo