Cyber-Prime 1.1 (2.6B)

Cyber-Prime 1.1 is a cybersecurity-focused instruction-tuned model in the Liquid Foundation Model (LFM2) family. It is intended for defensive security analysis and cybersecurity text tasks: extracting entities from threat reports, classifying phishing emails and anomalous HTTP requests, answering cybersecurity multiple-choice questions, and producing short threat-intelligence headlines.

The checkpoint is a full, merged model. Its training lineage starts from Liquid AI's LFM2-2.6B base through earlier Cyber-Prime checkpoints; the final run continued from the prior Cyber-Prime checkpoint.

Benchmark results

The table uses the same models and scores shown in the benchmark graphic. Values are rounded to three decimals.

Overall average is the unweighted mean of the seven benchmark scores shown; it is a descriptive comparison, not an official CyberBench aggregate.

Evaluation protocol

• Test data were held out from the CyberBench training mix.
• CyNER, APTNER, SecMMLU, CyQuiz, email, and HTTP used two in-context examples from their training pools. CyNews was evaluated zero-shot, as in the CyberBench setup.
• Generation used greedy decoding (temperature 0) with the model's chat template. Reasoning text was excluded before task scoring where applicable.
• Email F1 treats phishing as the positive class; HTTP F1 treats anomalous as the positive class.
• The published baseline models in the graphic use the CyberBench paper's retrieval-based five-shot setup (zero-shot for CyNews). Cyber-Prime 1.1 was evaluated with two shots for the non-summarization tasks, so the cross-model bars are useful context, not a strictly matched comparison.

Training

Cyber-Prime 1.1 was developed from more than 75,000 cybersecurity training rows, combining supervised fine-tuning with a range of reinforcement-learning and reward-guided post-training techniques.

Intended use

• Defensive cybersecurity education and research.
• Cybersecurity entity extraction from reports and logs.
• Triage assistance for phishing-email and anomalous-HTTP classification.
• Cybersecurity multiple-choice question answering.
• Short threat-intelligence headline generation.

Use the model as an assistive component with human review. It is not a substitute for security controls, incident-response procedures, or expert validation, and it is not a reliable autonomous vulnerability assessment or exploitation agent.

Limitations

• Performance is measured on the listed benchmark test sets; it should not be assumed to transfer to every organization, threat actor, protocol, or language.
• NER recall remains lower than precision, especially for rare or densely packed entities.
• The MCQ test sets are small, and small score differences may be noise.
• The published baseline comparison uses a different few-shot count than the Cyber-Prime 1.1 run; prompts and serving stacks can materially change scores.
• The model can produce incorrect, outdated, or overconfident cybersecurity claims. Verify indicators, classifications, and recommendations independently before taking action.

Loading

import torch
from transformers import AutoModelForCausalLM, AutoTokenizer

repo = "Akahsizrr/Cyber-Prime-1.1-2.6B"
tokenizer = AutoTokenizer.from_pretrained(repo)
model = AutoModelForCausalLM.from_pretrained(
    repo,
    torch_dtype=torch.bfloat16,
    device_map="auto",
)

messages = [{
    "role": "user",
    "content": "Classify this HTTP request as normal or anomalous: GET /index.html HTTP/1.1",
}]
input_ids = tokenizer.apply_chat_template(
    messages,
    tokenize=True,
    add_generation_prompt=True,
    return_tensors="pt",
).to(model.device)
output = model.generate(input_ids, max_new_tokens=256, do_sample=False)
print(tokenizer.decode(output[0][input_ids.shape[-1]:], skip_special_tokens=True))

Use task-specific instructions and validate the output format expected by your downstream system. For NER, request a JSON object; for email and HTTP classification, request only the benchmark label; for CyNews-like summarization, request a concise headline.

License

This model is derived from LiquidAI/LFM2-2.6B and is distributed under the upstream LFM Open License v1.0, included in LICENSE. This is a custom license, not Apache-2.0. In particular, Section 5 does not license commercial use by a legal entity with annual revenue of USD 10 million or more; such use requires separate permission from the licensor. Review the complete license before use or redistribution.

Data and references

• Liu, Shi, and Buford, CyberBench: A Multi-Task Benchmark for Evaluating Large Language Models in Cybersecurity, AICS 2024.
• CyberBench code and evaluation harness.
• CyberMetric, SecBench, and SecEval supplied additional cybersecurity multiple-choice training examples.
• Published baseline values in the benchmark graphic are referenced from the CyberBench results table and the CyberBench paper; they were not re-run as part of this release evaluation.