---
language: en
license: apache-2.0
tags:
  - security
  - pentest
  - vulnerability-detection
  - gliner
  - decision-model
  - praetor
base_model: fastino/GLiNER2.5-Decide
library_name: gliner2
pipeline_tag: text-classification
---

# Haruspex Adapters

Pre-trained domain adapters for [Haruspex](https://github.com/TyrusRC/haruspex) — a calibrated decision model for security verdict enrichment in [Praetor](https://github.com/TyrusRC/praetor).

Each adapter specializes [GLiNER2.5-Decide](https://huggingface.co/fastino/GLiNER2.5-Decide) (494M params) on one security domain via LoRA (~30 MB per adapter, 7.9M trainable params).

## Model Performance

| Domain | Epochs | Accuracy | Brier Score | Training Rows | Categories |
|--------|--------|----------|-------------|---------------|------------|
| `security` | 10 | **88.5%** | 0.089 | 629 | 14 |
| `cloud` | 5 | **88.9%** | 0.093 | 428 | 9 |
| `llm` | 10 | **95.7%** | 0.014 | 278 | 9 |
| `mobile` | 5 | **92.3%** | 0.060 | 462 | 9 |
| `network` | 3 | **94.4%** | 0.019 | 280 | 9 |

Evaluated on held-out test sets (20% stratified split). Brier score measures calibration quality (lower is better).

## Decision Categories

Each adapter handles these decision types:

- **off_scanner_adjudication** — Is this scanner hit a real, reportable finding?
- **off_cve_applicable** — Is this CVE applicable to this target's version and config?
- **off_severity** — Is this finding HIGH severity?
- **off_chain_worthy** — Is this finding worth chaining with another for escalated impact?
- **off_verdict** — Is the probe result VULNERABLE (vs. safe/informational)?
- **off_template_relevance** — Is this probe template relevant to this target's tech stack?
- **off_test_class** — Should this test class run on this target?
- **def_alert_triage** — Is this defensive alert a true positive?
- **def_alert_severity** — Is this alert high severity requiring escalation?

The `security` domain has 5 additional categories: `def_incident_route`, `def_phish`, `def_rule_applicable`, `def_data_source`, `def_cve_urgency`.

## Usage with Praetor

```bash
cd praetor && ./setup.sh   # downloads adapters from HuggingFace, sets .env
```

Start the server:

```bash
cd haruspex && uv run python -m haruspex.serve --port 3000 \
  --adapters security=runs/security,cloud=runs/cloud,llm=runs/llm,mobile=runs/mobile,network=runs/network
```

Praetor auto-detects the local server. Verify: `decision_status`.

## Standalone Usage

```bash
pip install haruspex
hf download TyrusRC/haruspex-adapters --local-dir runs/
python -m haruspex.serve --port 3000 --adapters security=runs/security

curl -X POST http://127.0.0.1:3000/v1/evaluate \
  -H "Content-Type: application/json" \
  -d '{"state":"Server returns SQL error: pg_query(): Query failed","questions":{"q":{"type":"boolean","instructions":"Is this a real finding?","criteria":{"true":"exploitable","false":"safe"}}}}'
```

## Training

Retrain with custom data (optional):

```bash
cd haruspex
uv run python -m haruspex.train --train data/security_train.jsonl --out runs/security --epochs 10
# Resume interrupted training:
uv run python -m haruspex.train --train data/security_train.jsonl --out runs/security --epochs 10 --save-every 50 --resume
```

## Model Details

- **Base:** [fastino/GLiNER2.5-Decide](https://huggingface.co/fastino/GLiNER2.5-Decide) (494M params)
- **Fine-tuning:** LoRA (7.9M trainable / 1.6% of total)
- **Optimal epochs:** 3–10 per domain (determined by held-out eval)
- **Checkpoint:** `--save-every N` + `--resume` for long runs
- **License:** Apache 2.0