Kimi Cyber Reasoning

997 chain-of-thought records covering 13 cybersecurity disciplines and 4 systems engineering domains, distilled from the Kimi K3 reasoning model via API. Every record provides an explicit step-by-step <think> reasoning trace followed by a technical resolution, unified code diff fix, or structured tool invocation.

The dataset was curated as an anchor set for training, healing, and specializing compact reasoning models on systems security and tool calling without losing multi-step deduction.

Dataset Summary

• Total records: 997
• Language: English only
• Reasoning trace coverage: 996 / 997 records contain <think> reasoning (99.9%)
• Tool-calling records: 175 records (task: "tool_call"), with 172 emitting verified {"name": "...", "arguments": {...}} execution objects
• Token volume: 389,425 prompt tokens (mean 390.6), 2,802,204 completion tokens (mean 2,810.6, median 2,636, max 10,164)
• Teacher model: Kimi K3 (Moonshot AI MoE reasoning architecture)
• License: WTFPL (Do What the Fuck You Want to Public License)

Schema

Each row is a single JSON record containing a 3-message conversation and metadata:

{
  "messages": [
    {"role": "system",    "content": "..."},
    {"role": "user",      "content": "..."},
    {"role": "assistant", "content": "<think>\\n...reasoning...\\n</think>\\n\\n...answer..."}
  ],
  "domain": "network_security",
  "meta": {
    "seed": "Review nftables snippet egress filtering bugs and propose fixes",
    "subtopic": "firewall egress filtering",
    "task": "code_review",
    "prompt_tokens": 390,
    "completion_tokens": 2810,
    "cached_tokens": 0,
    "cost_usd": 0.043,
    "mock": false
  }
}

Turn Details

1. System turn: Sets the senior security engineer persona, enforces structured <think>...</think> execution, and specifies single-block JSON formatting for tool calls.
2. User turn: Structured prompt specifying domain, subtopic, task specification, and technical scenario.
3. Assistant turn: Opens with an internal <think>...</think> deduction trace analyzing root cause mechanics, memory layouts, or protocol invariants, followed by:
   • Technical analysis, vulnerability diagnosis, and unified diff fix, or
   • A single JSON tool invocation inside a standard code fence:

     ```json
     {"name": "<tool_name>", "arguments": {"<param>": "<val>"}}
     ```
     

Composition

Domains (17)

13 focused cybersecurity domains plus 4 systems engineering calibration domains.

Task Types (6)

Loading

from datasets import load_dataset

ds = load_dataset("echel0nn1881/kimi-cyber-reasoning", split="train")
print(f"Loaded {len(ds)} records")
print("Domain:", ds[0]["domain"], "| Task:", ds[0]["meta"]["task"])
print("Assistant sample:\n", ds[0]["messages"][2]["content"][:250])

Metadata Fields

Curation & Provenance

• Teacher: Generated via API calls to Kimi K3 (Moonshot AI).
• Post-processing: Reasoning traces were processed to remove language deliberation preambles and instruction hierarchy debates, preserving 100% of technical deduction, disassembly, code snippets, and tool parameters.
• Scope: Technical grounding spans both vulnerability mechanics (heap layouts, shellcode framing, ROP chains, injection vectors) and defensive countermeasures (compiler mitigations, kernel hardening, secure architecture).
• License: Released under WTFPL without downstream commercial restrictions.