Cyber-Prime 1.1: Specialized Security Weights Teardown

Cyber-Prime 1.1 is a specialized 2.6-billion-parameter language model developed by security researcher Akahsizrr. Built directly on Liquid AI’s Liquid Foundation Model (LFM2-2.6B) backbone, the model is trained across 75,000 domain-specific cybersecurity rows.

Evaluated against the peer-reviewed CyberBench benchmark suite (Liu, Shi, and Buford, AICS 2024), Cyber-Prime 1.1 achieves a 0.592 overall cybersecurity average. This score decisively outperforms generalist open baselines, including Mistral-7B-Instruct (0.510), Zephyr-7B-beta (0.552), and Llama-2-7B (0.452).

Most notably, on Advanced Persistent Threat named entity extraction (APTNER), the 2.6B checkpoint hits 0.490. This result closes within two percent of proprietary GPT-4 (0.500) while operating inside a sub-3 GB memory footprint suitable for completely air-gapped enterprise Security Operations Centers (SOCs).

The release underscores a massive operational shift away from monolithic cloud APIs for deterministic log triage and indicator extraction. Much like how specialized lightweight architectures disrupted proprietary reasoning models across Hugging Face, Cyber-Prime 1.1 trades conversational fluff for fast, specialized token mechanics.

By keeping processing entirely on-premises, security engineers can finally analyze sensitive network telemetry without routing confidential corporate payloads through external cloud providers.

The Architectural Foundation: Continuous-Time Dynamics in Security Triage

Most attempts to build domain-specific cybersecurity models apply Low-Rank Adaptation (LoRA) or full parameter fine-tuning to standard transformer architectures such as Llama, Mistral, or Qwen. While these checkpoints memorize security vocabulary, they inherit the quadratic computational complexity, O(N²), of standard softmax attention.

In a production SOC, analysts constantly ingest high-throughput telemetry streams: Suricata alerts, Zeek connection logs, and HTTP reverse-proxy payloads. When analyzing these massive streams, standard transformer architectures suffer from three fatal operational bottlenecks:

• Quadratic KV-Cache Memory Bloat: Softmax attention forces the Key-Value (KV) cache to expand linearly with every additional log line, quickly consuming available video memory.
• Sequential Processing Delays: Autoregressive attention over long syslog buffers introduces severe latency spikes during real-time incident triage.
• Token Boundary Blurring: Softmax attention heads easily hallucinate boundaries across complex regular expressions, IP octets, and hexadecimal payload strings.

Cyber-Prime 1.1 solves these limitations by adopting Liquid AI’s LFM2-2.6B as its foundational backbone. Liquid Foundation Models replace conventional multi-head self-attention mechanisms with continuous-time dynamical systems and structured linear state-space models (SSMs) interleaved with feed-forward gating layers.

Liquid AI publicly articulated this exact design thesis when releasing their lightweight foundation models, highlighting that compact architectures can master structured extraction and agentic tasks while remaining under strict hardware constraints:

The checkpoint hosted on Hugging Face (Akahsizrr/Cyber-Prime-1.1-2.6B) is a fully merged parameter model. Its development lineage stems directly from LiquidAI/LFM2-2.6B, continuing through iterative optimization passes over Cyber-Prime 1.0.

Training Regimen and Dual Optimization Objectives

The model was trained on more than 75,000 curated cybersecurity rows spanning raw telemetry, adversary playbooks, and threat intelligence syntax. The training pipeline integrates two complementary methodologies:

1. Supervised Fine-Tuning (SFT): Focused on structured JSON emission, MITRE ATT&CK Enterprise Matrix mapping, Common Weakness Enumeration (CWE) classifications, and regex-conforming indicator parsing.
2. Reward-Guided Reinforcement Learning: Post-training utilizes specialized reward models calibrated against factual precision in entity boundaries. Unlike generalist chat models where RLHF often dilutes technical precision, Cyber-Prime 1.1 explicitly penalizes indicator hallucination and false-positive attribution.

Empirical Teardown: CyberBench Forensic Evaluation

Evaluating cybersecurity models requires domain-specific suites that measure token-level extraction fidelity alongside high-level reasoning. The checkpoint underwent evaluation on the peer-reviewed CyberBench benchmark suite (Liu, Shi, and Buford, AICS 2024), with supplementary validation drawn from SecBench, SecEval, and CyberMetric.

The evaluation protocol enforced greedy decoding (temperature 0) through the model’s native chat template. Reasoning traces were stripped prior to scoring. With the exception of CyNews (evaluated zero-shot), tasks ran under a two-shot in-context configuration.

Core Benchmark Takeaways: What the Deltas Reveal

A rigorous review of these results exposes five distinct performance patterns that every security engineering team should understand:

1. Frontier Entity Extraction Parity (APTNER): The APTNER benchmark evaluates an LLM’s capacity to isolate complex campaign tags (such as UNC2452 or Sandworm), target sectors, malware families, and dynamic command-and-control infrastructure. Cyber-Prime 1.1 jumped from 0.413 in version 1.0 to 0.490, effectively matching GPT-4 (0.500) while beating Mistral-7B (0.262) by 87.0% relative.
2. Decisive Headline Synthesis Superiority (CyNews): On CyNews threat synthesis, Cyber-Prime 1.1 scored 0.430, substantially outperforming GPT-4 (0.275). General-purpose models struggle with cybersecurity news generation because alignment training injects conversational hedging and wordy introductions. Cyber-Prime 1.1 outputs concise threat titles conforming directly to threat intelligence standards.
3. Factual Memory Scaling Boundaries (SecMMLU & CyQuiz): Multiple-choice knowledge retrieval is the primary area where Cyber-Prime 1.1 trails GPT-4 (0.600 vs. 0.830 on SecMMLU). A 2.6B parameter model has less latent storage to memorize voluminous compliance catalogs like NIST SP 800-53 or ISO 27001. It operates as an agile parser and triage classifier, not an encyclopedia.
4. Enterprise Phishing Accuracy: Scoring 0.890 F1 on email phishing detection, Cyber-Prime 1.1 matches 7B baselines while requiring less than half the compute resources.
5. Robust Reverse-Proxy Log Triage: Achieving 0.628 F1 on HTTP attack logs, the model successfully filters high-volume web application traffic without drowning security analysts in false positives.

Threat Intelligence Capabilities: Bridging Raw Telemetry and Structured STIX/TAXII

Modern Cyber Threat Intelligence (CTI) operations face a persistent parsing bottleneck. Analysts must ingest dozens of unstructured vendor advisories, raw incident response notes, and CERT bulletins, extracting actionable Indicators of Compromise (IoCs) without leaking internal network topologies to public endpoints.

Just as developers have adopted running local models via developer CLI tools to protect proprietary internal code, SOC teams require sovereign models that process unredacted forensic data inside their private network perimeter.

Cyber-Prime 1.1 demonstrates high operational competence across three core threat intelligence workflows:

• High-Density IoC Extraction and Entity Boundary Disambiguation: Generalist models frequently stumble on ambiguous technical boundaries, such as confusing a file path containing a regex pattern with an execution parameter. Cyber-Prime 1.1 maintains strict token boundaries across Windows registry keys, Authenticode hashes (MD5, SHA-256), C2 beaconing URIs, and MITRE ATT&CK techniques.
• High-Throughput Log Anomaly Classification: In production web proxy auditing, benign requests outnumber malicious payloads by factors exceeding 10,000 to 1. Commercial cloud APIs become cost-prohibitive when scoring millions of daily request lines. Cyber-Prime 1.1 serves as an efficient local gatekeeper, isolating SQL injection, cross-site scripting (XSS), and local file inclusion (LFI) attempts.
• Automated Inbound Phishing Pre-Screening: By learning from genuine phishing headers, deceptive SPF and DKIM authentication misalignments, and social engineering linguistic signals, the model delivers an F1 score of 0.890. This enables security runbooks to pre-screen suspicious messages automatically before analyst review.

Exploit Discovery vs. Defensive Hardening: Forensic Demarcation

A common misconception across enterprise security leadership is that any language model scoring well on cybersecurity benchmarks can function as an autonomous offensive weapon.

A rigorous audit of Cyber-Prime 1.1 reveals a clear operational boundary: this model is a defensive hardening engine, not an autonomous exploit generator.

Where Cyber-Prime 1.1 genuinely excels is in accelerating the surrounding defensive posture:

• Detection Engineering: Generating validated Sigma rules, YARA patterns, and Snort signatures directly from vulnerability advisories.
• Root-Cause Analysis: Mapping crash traces and Git patch diffs to precise CWE indices and recommending defensive input sanitization logic.
• Forensic Timeline Reconstruction: Transforming volatile memory analysis outputs (such as Volatility plugin logs) into clean, chronological incident timelines.

Open-Source Accessibility, Quantization, and the Licensing Trap

Deploying machine learning models inside regulated security environments demands strict operational parameters: zero telemetry leakage, deterministic infrastructure costs, and strict compliance with governance frameworks (FedRAMP, HIPAA, SOC 2).

Local Edge Footprint and GGUF Quantization

Because Cyber-Prime 1.1 is built on LFM2-2.6B, its unquantized 16-bit brain float checkpoint occupies approximately 5.2 GB of storage. To support local SOC workstations, laptops, and edge devices, community maintainer mradermacher released quantized GGUF weights on Hugging Face:

• Q4_K_M (4-bit medium quantization): Weighs only 1.62 GB. It runs smoothly on consumer GPU VRAM, Apple Silicon Unified Memory, or standard laptop CPU RAM via llama.cpp. Much like how desktop benchmark tests show massive performance gains on quantized local weights, deploying sub-2 GB models locally ensures sub-second alert responses.
• Q8_0 (8-bit quantization): Weighs approximately 2.85 GB, preserving more than 99.2% of original 16-bit extraction fidelity while sustaining inference speeds beyond 80 tokens per second on commodity silicon.

Similar to the privacy principles outlined in our technical analysis of air-gapped local model deployment, maintaining threat telemetry entirely on-premises grants organizations complete immunity from cloud vendor data collection policies.

The Licensing Fine Print: Section 5 Commercial Revenue Cap

Organizations evaluating commercial adoption must inspect the model license carefully. Cyber-Prime 1.1 is not published under standard Apache-2.0 or MIT permissions.

Because it derives directly from LiquidAI/LFM2-2.6B, Cyber-Prime 1.1 inherits the upstream LFM Open License v1.0.

This open distribution model reflects a broader movement championed across the Hugging Face community. As Hugging Face CEO Clément Delangue emphasized during his testimony before the US Congress, open-source AI distributes technological capabilities to hundreds of thousands of independent businesses rather than concentrating power within a handful of cloud monopolies:

For academic researchers, independent blue teams, incident response specialists, and startups operating under the $10M revenue threshold, Cyber-Prime 1.1 is fully accessible, royalty-free, and deployable within completely air-gapped networks.

Strategic Verdict: The Rise of Sovereign SOC Micro-Models

Cyber-Prime 1.1 represents a maturing phase in specialized machine learning. While hyperscalers pour billions into training trillion-parameter generalist models, Security Operations Centers operate under strict physical boundaries: strict data sovereignty, capped memory limits, and the requirement for deterministic, low-latency log processing.

By pairing Liquid AI’s state-space architecture with focused cybersecurity reinforcement tuning, Cyber-Prime 1.1 establishes three decisive operational advantages:

1. Air-Gapped Feasibility: The full 2.6B parameter model executes on an ordinary consumer GPU or standard laptop CPU without any external network connectivity.
2. Specialized Benchmark Parity: It outperforms 7B transformer baselines on CyNER and matches proprietary GPT-4 on Advanced Persistent Threat entity extraction.
3. Total Telemetry Sovereignty: It eliminates third-party data exfiltration risks, allowing security teams to inspect sensitive network telemetry without cloud exposure.

While larger enterprises must evaluate its commercial licensing boundaries, Cyber-Prime 1.1 proves that compact, continuous-time open weights can challenge proprietary frontier models in mission-critical defense operations.