language:
- en
license: apache-2.0
base_model: Qwen/Qwen3.5-4B-Base
base_model_relation: adapter
library_name: peft
datasets:
- macmacmacmac/Sev-behavioral-research-v1
- macmacmacmac/openai-agent-swarmtraces
tags:
- sev
- research
- cybersecurity
- agent-activity
- decision-model
- lora
Sev-4B: security evidence and response policies
Sev-4B scores supplied answers to questions about security logs and recovered
programs. v0.3.1-html-contrast-research continues
v0.3.0-response-policy-research. It is a Qwen3.5-4B LoRA adapter with a
decision head. It does not generate text.
On 175 policy questions from 35 source programs held out of training, this
checkpoint answers 158/175, 90.3%, up from 147/175 on v0.3.0. At the
calibration-selected alert cut it catches 35/35 required approvals and
raises 5/140 false alerts, 3.6%, under the 5% ceiling. v0.3.0 raised
14/140 and failed that ceiling. Twelve of those fourteen were allowed HTML
reads. This pass trains the contrast on the same program: writing innerText
requires approval, and parsing HTML does not. The DNS diagnostic was not rerun.
The trial's isolation-and-packing check failed. v0.3.0 remains available.
Use
Install the Sev runtime. A generic text-generation pipeline does not load the decision head.
git clone https://github.com/maceip/Sev.git
cd Sev
uv sync --extra serve
uv run python -m kev.serve \
--run macmacmacmac/Sev-4B@v0.3.1-html-contrast-research --port 8009
Send TypeSafe-shaped requests to POST /v1/systemone. Supply the observed
evidence, the applicable policy, and explicit answer choices. The model reads
supplied code without executing it. Its scores support analyst review; they do
not establish that a program ran, identify its human owner, or prove agent origin.
The checkpoint ships with temperature 1.0. The false-alert cut for the
policy panel is 1.0 on that raw approval probability: alert only when the
approval option is certain. That cut was chosen on the 140 policy calibration
questions, at a 5% false-alert budget, and then applied to development.
Reported evaluation uses
KEV_BACKEND=torch KEV_DTYPE=fp32 KEV_MERGE=1 on CUDA. Accelerated serving can
differ numerically. The API's confidence rescales the largest probability above
chance; it is not an independently verified correctness probability.
Training and lineage
| Setting | Value |
|---|---|
| Backbone | Qwen/Qwen3.5-4B-Base@1001bb4d826a52d1f399e183466143f4da7b741b |
| Immediate parent | macmacmacmac/Sev-4B@a1824aefba305fda86e3503b895a7d9b3871f79a |
| Selected run | sev-r2-response-policy-4b-v2/00-trial-0 |
| Training records / questions | 6,577 / 9,456 |
| Retained curriculum records | 6,438 |
| Added source programs / policy questions | 139 / 278 |
| Epochs / seed | 1 / 4 |
| Learning rate | 2.5e-6 |
| Batch / accumulation | 4 / 2 |
| LoRA / head | Rank 16, all targets / 256 dimensions |
| Precision | fp32 frozen weights, bf16 autocast |
| Updates / forward tokens | 823 / 1,505,379 |
| Rejected or truncated training records | 0 |
All previous curriculum records remain byte-identical. They include native Sysmon, ExCyTIn, GUIDE, public classification and authored-rule replay, and 446 SwarmTraces static-program records. The added programs have authored API-specific policies and checked labels. Their source text is real recovered code, not a native execution trace. Source-closure groups separate training, calibration and development. No locked test was read.
Training configuration, provenance,
and data lineage pin the inputs. The original
v0.1.0-research
synthetic-origin preview is a separate historical lineage. The previous
v0.2.0-swarmtraces-research
release remains available unchanged.
Matched development results
| Policy decision | v0.3.0 | v0.3.1 |
|---|---|---|
| Correct argmax answers | 147/175 | 158/175 |
| Required approvals detected at the alert cut | 25/35 | 35/35 |
| False alerts at that cut | 14/140 | 5/140 |
| Allowed HTML questions flagged | 12/21 | 0/21 |
Each alert cut was selected on calibration only, with a 5% false-alert budget. v0.3.1's cut is 1.0 on the raw approval probability. The 5 remaining false alerts are 4 console questions and 1 plain-text question. These are explicit policy decisions on a development panel, not measured detection rates in live networks.
The retained-task table and the DNS result below were measured on v0.3.0. They were not rerun for v0.3.1.
| Retained panel | v0.2.0 | v0.3.0, not rerun here |
|---|---|---|
| Manual SwarmTraces | 65/83 | 66/83 |
| Static SwarmTraces | 345/354 | 347/354 |
| Native Sysmon | 409/410 | 409/410 |
| ExCyTIn | 398/398 | 398/398 |
| Original Sysmon | 62/64 | 62/64 |
| General | 86/105 | 86/105 |
| GUIDE triage | 130/231 | 131/231 |
| GUIDE detector | 638/1,064 | 639/1,064 |
All 25 correctness-retention checks pass. Unchanged totals do not imply unchanged individual answers. GUIDE detector calibrated negative log loss worsens by 0.0116 and Brier by 0.0077. No matched continuation without the new component was run, so the isolated causal contribution of SwarmTraces is not established.
On v0.3.0 the DNS diagnostic was 21/32 and failed the zero-new-error check. v0.3.1 did not rerun it. Policy evaluation, DNS evaluation, and registered screen retain the complete comparisons.
Calibration and artifact verification
The shipped temperature minimizes question-weighted negative log loss on 2,674 calibration questions from 1,920 records. Five-fold diagnostics keep all 465 source groups intact across task families. Raw calibration ECE is 0.07626 and out-of-fold ECE is 0.03386. This is a calibration diagnostic, not fresh field validation. Development and DNS observations were excluded from fitting.
Only temperature metadata changed when assembling the serving copy. Learned head tensors, adapter and tokenizer bytes match the evaluated checkpoint. Calibration, integrity evidence, and SHA256SUMS identify the release files.
Research iteration is paused following this release. The 0.8B and 9B checkpoints are not updated by this publication.
License and attribution
Source and adapter/head weights carry Apache-2.0 notices. Preserve LICENSE, NOTICE and the Qwen BASE_LICENSE. Sev builds on Kev by Jared Palmer and Qwen3.5 by the Qwen team.
Each dataset retains its own terms. Upstream SwarmTraces reuse terms remain unverified; the model license does not relicense those artifacts. The collection includes metadata-only entries, and membership does not imply training use. The historical synthetic source's notice applies only to that source. See data provenance.