🌟 Sepal-4B

A typed decision model for security operations (SOC) work

NOTE

• This is the full training run of Sepal at 4B, on the same recipe and corpus as Sepal-0.8B.
• The scores below are from our own development panels, one seed. Test partitions were not read.

📋 Overview

• Sepal answers typed questions about a given state (an alert, a log window, a policy, a document) in one pass: yes/no (noul), choice among up to 255 options, and score levels. Every answer comes with calibrated probabilities, not free text.
• It is specialised for SOC decisions: alert verdicts, rule and policy matching, ATT&CK mapping, vulnerability priority, injection detection in attacker-controlled fields, response gating, and "insufficient evidence" abstention, with general decision data mixed in to keep broad skills.
• It handles long log windows (states up to about 16k tokens) with many custom yes/no criteria, and tool and intent selection.
• It is an adapter (LoRA rank 64 plus a decision head) on the post-trained Qwen3.5-4B.

🔧 Method

• Trained with Unsloth's decision trainer (Clef head, one prompt per record) using LoRA rank 64, alpha 128, on every linear layer of the language model; lr 1e-4, cosine with 10% warm-up, one epoch, 64 records a step (8 x 8).
• Training corpus full-v15: 691,705 records, 449.4M tokens, 149 sources (security layer about 41% of tokens), including generated SOC data, long log windows with custom criteria, tool-selection data built from training splits only, public security datasets, and general decision datasets. Every training record was screened against our benchmark: zero exact or near copies, and no shared instances.
• 10,808 steps, 32 GPU-hours on one RTX PRO 6000 (96 GB), training inputs up to 24,576 tokens.
• One temperature per question type and option-count bucket, fitted on held-out datasets, is stored in sepal.json.

📊 Scores

Development panels of our own benchmark (SOCDecide 0.7.0), our long-log and tool panels, and held-out general datasets. Test partitions were not read.

Panel	Sepal-4B	Sepal-0.8B
Security decisions, macro skill (SEC-dev)	0.916	0.822
Security coverage at 5% error	1.000	0.846
Security coverage at 1% error	0.849	0.558
Long log windows with custom criteria, skill (LONG-LOG)	0.779	0.590
Long logs at 16k tokens, skill	0.668	0.485
"Insufficient evidence" detection on long logs, F1	0.95	0.92
Tool and intent selection, macro skill (TOOL)	0.965	0.926
Unseen security sources, skill	0.467	0.337
General decisions, skill (GEN-dev)	0.466	0.338
Calibration error (ECE, held-out report half)	0.020	0.031

Public Decision Index 0.3 (our own run, HLE not included):

	Sepal-4B	Sepal-0.8B
Decision Index (balanced skill)	41.82	26.59
Raw index	56.32	44.95
Knowledge & Reasoning / Language / Retrieval & Classification / Tools / Arts (skill)	28.6 / 43.7 / 51.7 / 59.2 / 19.6	12.8 / 17.5 / 42.2 / 49.5 / 12.8

Our tool and intent data is built from the training splits of some public datasets that the index also draws on; every row the index scores is excluded from training, and our screening found no copies, but gains there are partly in-distribution.

📁 Files

• adapter_model.safetensors, adapter_config.json: the LoRA adapter for Qwen/Qwen3.5-4B (revision 851bf6e806efd8d0a36b00ddf55e13ccb7b8cd0a).
• joint_head.safetensors, joint_head_config.json, unsloth_decision_config.json: the decision head read by Unsloth's decision trainer.
• sepal.json: training settings, versions and the fitted temperatures.
• Tokenizer files from the base model.

💫 Quantization

Coming Soon!

🤝 Contributors

Developed with ❤️ by BlossomAI

---

_{Star ⭐️ this repo if you find it valuable!}