Frost-Cyber-Mini-Uncensored-v1.1

Frost Cyber Mini Uncensored v1.1#

By Vatsal Bajpai (@xblack) · FrostWolfAI Labs.

Buy me a coffee

Everything here is released openly. If it's useful to you and you'd like to support more open-source work on AI, a coffee goes a long way — entirely optional.

A compact cybersecurity and software-engineering assistant from FrostWolfAI Labs, for security testing, CTI, secure coding and agentic tool-use workflows. It is a full LoRA SFT fine-tune of Spark-X2.6-4B-abliterated, with the adapters merged into the weights.

v1.1 public release. Benchmarked — see Benchmarks. GGUF builds are available in the GGUF repo.

What's in this revision#

v1.1 now includes an additional agentic fine-tuning phase on top of the cybersecurity SFT. This phase trains the model to follow a full agentic tool-use loop — read the task, inspect with tools, act, observe each tool result, recover from errors, and give a final answer — rather than emitting one-shot answers. The base cyber/CTI/secure-coding knowledge from the first SFT phase is retained. Training/loss curves for both phases are in Training.

Benchmarks#

Evaluated in thinking mode (native), temperature 0.0, greedy single-sample, served as Q8_0 GGUF via llama.cpp at 232k context.

⚠️ Always run this model with thinking enabled. With thinking disabled it degrades severely — it echoes JSON instead of answering. Non-think scores are invalid for this model.

Cyber knowledge#

General reasoning#

Agentic benchmarks (Terminal-Bench 2.1/4.0, DeepSWE, AutomationBench) are queued — results will be added to this card as they land.

Takeaways: strong cyber knowledge (CyberMetric ~85%) and CVE→CWE mapping (66.6%, GPT-4 territory) with solid CVSS severity estimation (MAD 1.54); extraction/attribution-style CTI tasks (ATE, TAA) are the weak spot — the agentic training makes the model emit tool calls on those prompt shapes instead of answering. Thinking mode is mandatory for this model.

Model#

import torch
from transformers import AutoModelForCausalLM, AutoTokenizer

repo = "FrostWolfAI/Frost-Cyber-Mini-Uncensored-v1.1"
tok = AutoTokenizer.from_pretrained(repo, trust_remote_code=True)
model = AutoModelForCausalLM.from_pretrained(repo, dtype=torch.bfloat16, device_map="cuda", trust_remote_code=True)
prompt = tok.apply_chat_template([{"role": "user", "content": "Who are you?"}], add_generation_prompt=True, tokenize=False, enable_thinking=True)  # keep thinking ON — see Benchmarks
x = tok(prompt, return_tensors="pt", add_special_tokens=False).to(model.device)
print(tok.decode(model.generate(**x, max_new_tokens=200)[0][x.input_ids.shape[1]:], skip_special_tokens=True))

Reasoning / thinking control#

The chat template supports a thinking channel. Control it per request with reasoning_effort:

• off / none / false / 0 — thinking disabled, direct answer. Not recommended for this model — it was trained with thinking and degrades severely without it (see Benchmarks).
• low (default) and high — thinking enabled. On a 4B these behave very similarly; treat it as on/off in practice.

A hard thinking-token ceiling is enforced at the server, not the template (see --reasoning-budget below). A budget is a ceiling, not a target: it truncates runaway thinking but does not make the model think longer.

Serving with llama.cpp (Windows)#

GGUF builds are published in the GGUF repo. Serve them with llama.cpp's llama-server. The custom spark2_5 architecture is supported by llama.cpp's convert_hf_to_gguf.py converter.

The chat template must be supplied explicitly (--chat-template-file); it is included in this repo as chat_template.jinja.

REM Windows (cmd/PowerShell). Q8_0 GGUF, full 232k context, 2 unified-KV slots.
llama-server.exe ^
  -m Frost-Cyber-Mini-Uncensored-v1.1-Q8_0.gguf ^
  -ngl 99 ^
  -np 2 -kvu -c 232000 ^
  --host 127.0.0.1 --port 8080 ^
  -fa on -ctk q8_0 -ctv q8_0 ^
  -b 4096 -ub 2048 ^
  --jinja --chat-template-file chat_template.jinja ^
  --reasoning-budget 8192

Flag notes:

Do not use DRY or other repetition-penalty samplers with this model for agentic coding. They penalize repeated token sequences, but agentic coding requires reproducing file paths, identifiers and edit targets byte-for-byte — a repetition penalty mutates those verbatim strings (e.g. changes case, swaps an extension, inserts a space) and corrupts tool calls. If a small model falls into a repeat loop in your agent, break it at the client level (de-duplicate identical tool calls, cap steps per turn) and/or use a small sampling temperature (~0.3–0.4) rather than a sequence penalty.

VRAM, Q8_0 at 232k / 2 unified slots: about 12 GB. BF16 at the same settings: about 16 GB.

Training#

Two phases, both LoRA SFT with assistant-token-only loss, merged into the weights after training.

Phase 1 — cybersecurity / CTI / secure-coding SFT#

Phase-1 validation curve:

Phase 2 — agentic tool-use fine-tuning#

Continued from the Phase-1 weights on an internal set of agentic tool-use trajectories (not publicly released), trained whole-trace at a 16k window so the model learns the full loop in context.

Phase-2 curve (validation at checkpoints, train at log steps):

Validation loss tracked below train loss and improved monotonically to the end with no overfit — a clean learning signal for the agentic loop.

Hyperparameters (both phases)#

Intended use#

For authorized security testing, research, defense and education. This model has its refusals removed, so you are responsible for how you use it and for following applicable law.