TyrusRC/haruspex-adapters

Haruspex Adapters

Pre-trained domain adapters for Haruspex — a calibrated decision model for security verdict enrichment in Praetor.

Each adapter specializes GLiNER2.5-Decide (494M params) on one security domain via LoRA (~30 MB per adapter, 7.9M trainable params).

Model Performance

Domain	Epochs	Accuracy	Brier Score	Training Rows	Categories
security	10	88.5%	0.089	629	14
cloud	5	88.9%	0.093	428	9
llm	10	95.7%	0.014	278	9
mobile	5	92.3%	0.060	462	9
network	3	94.4%	0.019	280	9

Evaluated on held-out test sets (20% stratified split). Brier score measures calibration quality (lower is better).

Decision Categories

Each adapter handles these decision types:

• off_scanner_adjudication — Is this scanner hit a real, reportable finding?
• off_cve_applicable — Is this CVE applicable to this target's version and config?
• off_severity — Is this finding HIGH severity?
• off_chain_worthy — Is this finding worth chaining with another for escalated impact?
• off_verdict — Is the probe result VULNERABLE (vs. safe/informational)?
• off_template_relevance — Is this probe template relevant to this target's tech stack?
• off_test_class — Should this test class run on this target?
• def_alert_triage — Is this defensive alert a true positive?
• def_alert_severity — Is this alert high severity requiring escalation?

The security domain has 5 additional categories: def_incident_route, def_phish, def_rule_applicable, def_data_source, def_cve_urgency.

Usage with Praetor

cd praetor && ./setup.sh   # downloads adapters from HuggingFace, sets .env

Start the server:

cd haruspex && uv run python -m haruspex.serve --port 3000 \
  --adapters security=runs/security,cloud=runs/cloud,llm=runs/llm,mobile=runs/mobile,network=runs/network

Praetor auto-detects the local server. Verify: decision_status.

Standalone Usage

pip install haruspex
hf download TyrusRC/haruspex-adapters --local-dir runs/
python -m haruspex.serve --port 3000 --adapters security=runs/security

curl -X POST http://127.0.0.1:3000/v1/evaluate \
  -H "Content-Type: application/json" \
  -d '{"state":"Server returns SQL error: pg_query(): Query failed","questions":{"q":{"type":"boolean","instructions":"Is this a real finding?","criteria":{"true":"exploitable","false":"safe"}}}}'

Training

Retrain with custom data (optional):

cd haruspex
uv run python -m haruspex.train --train data/security_train.jsonl --out runs/security --epochs 10
# Resume interrupted training:
uv run python -m haruspex.train --train data/security_train.jsonl --out runs/security --epochs 10 --save-every 50 --resume

Model Details

• Base: fastino/GLiNER2.5-Decide (494M params)
• Fine-tuning: LoRA (7.9M trainable / 1.6% of total)
• Optimal epochs: 3–10 per domain (determined by held-out eval)
• Checkpoint: --save-every N + --resume for long runs
• License: Apache 2.0