| --- |
| language: en |
| license: apache-2.0 |
| tags: |
| - security |
| - pentest |
| - vulnerability-detection |
| - gliner |
| - decision-model |
| - praetor |
| base_model: fastino/GLiNER2.5-Decide |
| library_name: gliner2 |
| pipeline_tag: text-classification |
| --- |
| |
| # Haruspex Adapters |
|
|
| Pre-trained domain adapters for [Haruspex](https://github.com/TyrusRC/haruspex) — a calibrated decision model for security verdict enrichment in [Praetor](https://github.com/TyrusRC/praetor). |
|
|
| Each adapter specializes [GLiNER2.5-Decide](https://huggingface.co/fastino/GLiNER2.5-Decide) (494M params) on one security domain via LoRA (~30 MB per adapter, 7.9M trainable params). |
|
|
| ## Model Performance |
|
|
| | Domain | Epochs | Accuracy | Brier Score | Training Rows | Categories | |
| |--------|--------|----------|-------------|---------------|------------| |
| | `security` | 10 | **88.5%** | 0.089 | 629 | 14 | |
| | `cloud` | 5 | **88.9%** | 0.093 | 428 | 9 | |
| | `llm` | 10 | **95.7%** | 0.014 | 278 | 9 | |
| | `mobile` | 5 | **92.3%** | 0.060 | 462 | 9 | |
| | `network` | 3 | **94.4%** | 0.019 | 280 | 9 | |
|
|
| Evaluated on held-out test sets (20% stratified split). Brier score measures calibration quality (lower is better). |
|
|
| ## Decision Categories |
|
|
| Each adapter handles these decision types: |
|
|
| - **off_scanner_adjudication** — Is this scanner hit a real, reportable finding? |
| - **off_cve_applicable** — Is this CVE applicable to this target's version and config? |
| - **off_severity** — Is this finding HIGH severity? |
| - **off_chain_worthy** — Is this finding worth chaining with another for escalated impact? |
| - **off_verdict** — Is the probe result VULNERABLE (vs. safe/informational)? |
| - **off_template_relevance** — Is this probe template relevant to this target's tech stack? |
| - **off_test_class** — Should this test class run on this target? |
| - **def_alert_triage** — Is this defensive alert a true positive? |
| - **def_alert_severity** — Is this alert high severity requiring escalation? |
|
|
| The `security` domain has 5 additional categories: `def_incident_route`, `def_phish`, `def_rule_applicable`, `def_data_source`, `def_cve_urgency`. |
|
|
| ## Usage with Praetor |
|
|
| ```bash |
| cd praetor && ./setup.sh # downloads adapters from HuggingFace, sets .env |
| ``` |
|
|
| Start the server: |
|
|
| ```bash |
| cd haruspex && uv run python -m haruspex.serve --port 3000 \ |
| --adapters security=runs/security,cloud=runs/cloud,llm=runs/llm,mobile=runs/mobile,network=runs/network |
| ``` |
|
|
| Praetor auto-detects the local server. Verify: `decision_status`. |
|
|
| ## Standalone Usage |
|
|
| ```bash |
| pip install haruspex |
| hf download TyrusRC/haruspex-adapters --local-dir runs/ |
| python -m haruspex.serve --port 3000 --adapters security=runs/security |
| |
| curl -X POST http://127.0.0.1:3000/v1/evaluate \ |
| -H "Content-Type: application/json" \ |
| -d '{"state":"Server returns SQL error: pg_query(): Query failed","questions":{"q":{"type":"boolean","instructions":"Is this a real finding?","criteria":{"true":"exploitable","false":"safe"}}}}' |
| ``` |
|
|
| ## Training |
|
|
| Retrain with custom data (optional): |
|
|
| ```bash |
| cd haruspex |
| uv run python -m haruspex.train --train data/security_train.jsonl --out runs/security --epochs 10 |
| # Resume interrupted training: |
| uv run python -m haruspex.train --train data/security_train.jsonl --out runs/security --epochs 10 --save-every 50 --resume |
| ``` |
|
|
| ## Model Details |
|
|
| - **Base:** [fastino/GLiNER2.5-Decide](https://huggingface.co/fastino/GLiNER2.5-Decide) (494M params) |
| - **Fine-tuning:** LoRA (7.9M trainable / 1.6% of total) |
| - **Optimal epochs:** 3–10 per domain (determined by held-out eval) |
| - **Checkpoint:** `--save-every N` + `--resume` for long runs |
| - **License:** Apache 2.0 |
|
|
