Model Card for Paralay1.1

Paralay1.1 is a LoRA/QLoRA fine-tuned cybersecurity assistant adapter based on unsloth/Qwen2.5-1.5B-Instruct-bnb-4bit. It is designed for defensive cybersecurity guidance, including incident response, log analysis, MITRE ATT&CK explanation, malware-defense investigation planning, cloud-security checklists, and general cyber-risk assessment.

This repository contains the PEFT LoRA adapter, not a full merged standalone model. To use it, load the base model and then attach this adapter.

Model Details

Model Description

Paralay1.1 is a supervised fine-tuned instruction-following adapter trained on cybersecurity conversation data. The model was fine-tuned using Unsloth, TRL SFTTrainer, PEFT LoRA adapters, and 4-bit quantized Qwen2.5-1.5B-Instruct.

The intended behavior is to provide structured, practical, and safety-aware defensive cybersecurity responses. The model is not intended to provide offensive exploitation instructions, malware creation, credential theft guidance, or unauthorized access assistance.

• Developed by: Om Choksi
• Shared by: OMCHOKSI108
• Model type: PEFT LoRA adapter / QLoRA fine-tuned causal language model adapter
• Base model: unsloth/Qwen2.5-1.5B-Instruct-bnb-4bit
• Language(s): Primarily English
• Domain: Defensive cybersecurity
• License: Not specified
• Finetuned from model: unsloth/Qwen2.5-1.5B-Instruct-bnb-4bit

Model Sources

• Repository: OMCHOKSI108/Paralay1.1
• Dataset: OMCHOKSI108/cybersecdata
• Demo: Not available
• Paper: Not available

Uses

Direct Use

Paralay1.1 can be used as a defensive cybersecurity assistant for:

• Incident response planning
• Phishing incident triage
• Suspicious log pattern explanation
• MITRE ATT&CK technique explanation
• Cloud misconfiguration response checklists
• Malware and ransomware investigation planning
• Security hardening recommendations
• Threat-intelligence style summaries

Example use cases:

• “A user clicked a suspicious link and entered credentials. Give an incident response plan.”
• “Analyze repeated failed SSH logins followed by one successful login.”
• “Explain MITRE ATT&CK T1059 with detection ideas.”
• “Give a checklist for an exposed AWS S3 bucket incident.”

Downstream Use

This adapter can be integrated into:

• Cybersecurity learning assistants
• SOC analyst support tools
• Defensive security chatbots
• Internal security training demos
• Incident response documentation helpers
• Lightweight local or cloud-hosted cyber assistant prototypes

Out-of-Scope Use

This model should not be used for:

• Malware generation
• Credential theft
• Phishing campaign generation
• Reverse shell or payload creation
• Bypassing antivirus or endpoint protection
• Unauthorized vulnerability exploitation
• Instructions to attack real systems
• Automated offensive cyber operations

The model is a small fine-tuned adapter and should not be treated as a complete security decision-making system.

Bias, Risks, and Limitations

Paralay1.1 has several important limitations:

• It is based on a 1.5B parameter instruction model, so reasoning depth is limited compared with larger LLMs.
• It may hallucinate threat actor names, CVEs, IOCs, or MITRE mappings.
• It may provide incomplete or overly generic security advice.
• Safety behavior is not fully reliable.
• The notebook evaluation showed that the model sometimes responded unsafely to misuse-style prompts.
• The model should not be used as the only source for real incident response decisions.
• Outputs should be reviewed by a qualified cybersecurity professional before operational use.

Safety Limitation Observed During Evaluation

A simple safety evaluation was performed on five cyber misuse prompts. The average safety score was 0.6 / 1.0. Some unsafe or partially unsafe responses were observed for requests involving phishing, keylogging, and reverse-shell style content.

Because of this, downstream applications should add an external safety filter, stronger refusal system prompt, or policy layer before exposing the model to users.

Recommendations

Users should:

• Use a strong defensive system prompt.
• Add a safety classifier or rule-based filter for harmful cyber requests.
• Verify all technical claims before use.
• Avoid using this model for real-world incident response without expert review.
• Treat generated IOCs, CVEs, and threat attribution as unverified unless independently confirmed.
• Use retrieval-augmented generation if accurate current threat intelligence is required.

How to Get Started with the Model

Install dependencies:

pip install unsloth transformers peft accelerate bitsandbytes