Instructions to use ConsensusProtocol-Thanos/Gork-27b-Cybersecurity with libraries, inference providers, notebooks, and local apps. Follow these links to get started.

Libraries

How to use ConsensusProtocol-Thanos/Gork-27b-Cybersecurity with Transformers:

# Use a pipeline as a high-level helper
from transformers import pipeline

pipe = pipeline("text-generation", model="ConsensusProtocol-Thanos/Gork-27b-Cybersecurity")
messages = [
    {"role": "user", "content": "Who are you?"},
]
pipe(messages)

# pip install -U transformers accelerate
# Load model directly
from transformers import AutoTokenizer, AutoModelForCausalLM

tokenizer = AutoTokenizer.from_pretrained("ConsensusProtocol-Thanos/Gork-27b-Cybersecurity")
model = AutoModelForCausalLM.from_pretrained("ConsensusProtocol-Thanos/Gork-27b-Cybersecurity", device_map="auto")
messages = [
    {"role": "user", "content": "Who are you?"},
]
inputs = tokenizer.apply_chat_template(
	messages,
	add_generation_prompt=True,
	tokenize=True,
	return_dict=True,
	return_tensors="pt",
).to(model.device)

outputs = model.generate(**inputs, max_new_tokens=256)
print(tokenizer.decode(outputs[0][inputs["input_ids"].shape[-1]:]))

Notebooks
Google Colab
Kaggle
Local Apps Settings

vLLM

How to use ConsensusProtocol-Thanos/Gork-27b-Cybersecurity with vLLM:

Install from pip and serve model

# Install vLLM from pip:
pip install vllm
# Start the vLLM server:
vllm serve "ConsensusProtocol-Thanos/Gork-27b-Cybersecurity"
# Call the server using curl (OpenAI-compatible API):
curl -X POST "http://localhost:8000/v1/chat/completions" \
	-H "Content-Type: application/json" \
	--data '{
		"model": "ConsensusProtocol-Thanos/Gork-27b-Cybersecurity",
		"messages": [
			{
				"role": "user",
				"content": "What is the capital of France?"
			}
		]
	}'

Use Docker

docker model run hf.co/ConsensusProtocol-Thanos/Gork-27b-Cybersecurity

SGLang

How to use ConsensusProtocol-Thanos/Gork-27b-Cybersecurity with SGLang:

Install from pip and serve model

# Install SGLang from pip:
pip install sglang
# Start the SGLang server:
python3 -m sglang.launch_server \
    --model-path "ConsensusProtocol-Thanos/Gork-27b-Cybersecurity" \
    --host 0.0.0.0 \
    --port 30000
# Call the server using curl (OpenAI-compatible API):
curl -X POST "http://localhost:30000/v1/chat/completions" \
	-H "Content-Type: application/json" \
	--data '{
		"model": "ConsensusProtocol-Thanos/Gork-27b-Cybersecurity",
		"messages": [
			{
				"role": "user",
				"content": "What is the capital of France?"
			}
		]
	}'

Use Docker images

docker run --gpus all \
    --shm-size 32g \
    -p 30000:30000 \
    -v ~/.cache/huggingface:/root/.cache/huggingface \
    --env "HF_TOKEN=<secret>" \
    --ipc=host \
    lmsysorg/sglang:latest \
    python3 -m sglang.launch_server \
        --model-path "ConsensusProtocol-Thanos/Gork-27b-Cybersecurity" \
        --host 0.0.0.0 \
        --port 30000
# Call the server using curl (OpenAI-compatible API):
curl -X POST "http://localhost:30000/v1/chat/completions" \
	-H "Content-Type: application/json" \
	--data '{
		"model": "ConsensusProtocol-Thanos/Gork-27b-Cybersecurity",
		"messages": [
			{
				"role": "user",
				"content": "What is the capital of France?"
			}
		]
	}'

Docker Model Runner
How to use ConsensusProtocol-Thanos/Gork-27b-Cybersecurity with Docker Model Runner:
```
docker model run hf.co/ConsensusProtocol-Thanos/Gork-27b-Cybersecurity
```
Browse Quantizations to use this model in llama.cpp, Ollama, LM Studio, or any compatible app.

Gork-27B-Cybersecurity

A 27B cybersecurity assistant fine-tuned from Qwen/Qwen3.8-27B for threat intelligence, incident response and secure-code review.

Highlights

Far stronger on security knowledge. Well ahead of the base on CyberMetric and held-out security data, and ahead on SecEval and CTIBench.
No general-capability regression. At or above the base on GSM8K, MMLU-Pro and IFEval.
Strong tool use. Higher pass rate than the base on Sleipnir's tool-use suite, and ahead of it on single calls and user-contributed functions in BFCL.
Concise. About 1.4x fewer output tokens per answer than the base, at higher accuracy.
262K context. Extensible to 1M with YaRN as in the base model.
Open weights, Apache-2.0. Run it directly, or per token on Heimdallm.

Model Overview


Model type	Causal LM. Dense hybrid of Gated DeltaNet (linear attention) and full attention in a 3:1 layer pattern, with a 1-layer multi-token-prediction head (inherited from Qwen3.8).
Base model	Qwen/Qwen3.8-27B (text model only)
Parameters	27B (incl. MTP head)
Context length	262,144 native · 1,000,000 with YaRN
Modalities	Text in, text out
Languages	English (security corpora are overwhelmingly English; multilingual chat is inherited, not tuned)
Precision	BF16 safetensors
License	Apache-2.0

Quantized versions

Repository	Format	Size
Gork-27b-Cybersecurity-FP8-Dynamic	FP8 weights and activations	30 GB
Gork-27b-Cybersecurity-NVFP4	NVFP4 MLP, FP8 attention	24 GB

Both stay within two points of this model on the security and general benchmarks. On BFCL, FP8 stays within two points in every category, and NVFP4 does too except parallel tool calls, where it is three to four points higher. Results in BENCHMARK-RESULTS.md.

Intended Use

Primary use cases

Threat-intel summarisation and extraction (IOCs, TTPs, actor attribution with confidence)
Incident-response playbook assistance and post-incident report drafting
Secure-code review and vulnerability explanation (CWE mapping, remediation guidance)
Security education and certification study (CISSP / Sec+ style Q&A)

Out of scope

Autonomous offensive operations against systems without written authorisation to test
Generating novel, weaponised exploit code or malware
Legal, compliance or regulatory determinations without a qualified human reviewer

Dual-use notice. Security knowledge is inherently dual-use. The model is tuned to be more useful to defenders than a general model, and it will still explain how attacks work because defenders need that. Read Safety before exposing it to untrusted users.

Training

Supervised fine-tune of Qwen3.8-27B on a curated cybersecurity dataset, trained with QLoRA and merged back into BF16 weights, then averaged in equal parts with the base weights. The averaging keeps the security gains and restores most of the base model's multi-call tool use.

Knowledge cut-off: November 2026. CVEs and advisories published after this date are unknown unless supplied in context.

Evaluation

All numbers compare Gork against the unmodified Qwen3.8-27B base with no input truncation. Higher is better except NLL. Benchmarks ran on lm-evaluation-harness and the BFCL runner over vLLM; scoring details are in BENCHMARK-RESULTS.md.

Security

Benchmark	What it measures	Gork-27B	Qwen3.8-27B (base)
Validation NLL — held-out in-domain examples	fit to the security distribution (lower is better; perplexity in parentheses)	0.640 (1.90)	0.962 (2.62)
CyberMetric-500	security knowledge QA	0.952	0.746
SecEval (2,182, multi-select)	security knowledge across nine domains	0.794	0.781
CTIBench — MCQ (2,500)	threat-intel knowledge	0.736	0.714
CTIBench — RCM (1,000)	map CVE → CWE	0.734	0.726
MMLU — computer_security	general security knowledge	0.87	0.88

Gork is far stronger on the in-domain objective and on CyberMetric, and ahead on SecEval and both CTIBench tasks.

General-capability regression

Identical settings for both models. IFEval and GSM8K are full; MMLU-Pro is a 33% stratified subset (~4,000 of ~12,000 questions). GSM8K is scored through the chat template (few-shot examples as turns).

Benchmark	What it measures	Gork-27B	Qwen3.8-27B (base)
GSM8K (flexible-extract)	grade-school math reasoning	0.917	0.898
MMLU-Pro (~4,000-Q subset)	broad reasoning across 14 domains	0.721	0.612
IFEval — prompt-level strict	instruction following	0.649	0.529
IFEval — instruction-level strict	instruction following	0.753	0.629

The security tuning did not cost general capability: Gork is at or above the base on every task.

Token efficiency

On the same 1,000 CTIBench CVE→CWE prompts, Gork is more accurate than the base while emitting 1.4x fewer output tokens per answer.

	Gork-27B	Qwen3.8-27B (base)
Mean output tokens/answer	134.0	192.0
Median	95	127
p90	192	327
Accuracy	0.734	0.726

Tool calling (BFCL v4)

Category	What it measures	Gork-27B	Qwen3.8-27B (base)
Simple (Python, Java, JavaScript)	one call to one given function	0.808	0.800
Multiple	choosing the right function among several	0.965	0.975
Parallel	several calls in one turn	0.725	0.820
Parallel multiple	several calls across several functions	0.720	0.835
Live (user-contributed)	real-world function definitions	0.844	0.823
Multi-turn	stateful tasks over several turns	0.495	0.583
Irrelevance	declining tools that do not fit the request	0.846	0.732

Gork leads the base on single calls and user-contributed functions, and declines unrelated tools more reliably.

Agent use (Sleipnir)

Measured in Sleipnir, a coding-agent harness, over the same OpenAI-compatible endpoint.

Test	What it measures	Gork-27B	Qwen3.8-27B (base)
Tool-use suite (9 scenarios, 5 samples each)	picking the right next tool call in situations taken from real team runs	0.76	0.60

In single end-to-end runs, Gork fixed a failing unit-test suite and triaged a 200 KB SSH log, identifying the brute-force source and the compromised account.

Quickstart

vLLM

vllm serve ConsensusProtocol-Thanos/Gork-27b-Cybersecurity \
  --max-model-len 262144 \
  --enable-auto-tool-choice --tool-call-parser qwen3_coder

Transformers

Requires transformers>=5.20.

from transformers import AutoModelForCausalLM, AutoTokenizer
import torch

model_id = "ConsensusProtocol-Thanos/Gork-27b-Cybersecurity"
tokenizer = AutoTokenizer.from_pretrained(model_id)
model = AutoModelForCausalLM.from_pretrained(model_id, dtype=torch.bfloat16, device_map="auto")

messages = [{"role": "user", "content": "Classify this URL as phishing or benign and explain: hxxp://login-micros0ft[.]support"}]
inputs = tokenizer.apply_chat_template(messages, add_generation_prompt=True, tokenize=True,
                                       return_dict=True, return_tensors="pt").to(model.device)
out = model.generate(**inputs, max_new_tokens=2048)
print(tokenizer.decode(out[0][inputs["input_ids"].shape[-1]:], skip_special_tokens=True))

Heimdallm (hosted, OpenAI-compatible)

from openai import OpenAI

client = OpenAI(base_url="https://staging.heimdallm.com/v1", api_key="YOUR_HEIMDALLM_KEY")
resp = client.chat.completions.create(
    model="conpro/gork-27b",
    messages=[
        {"role": "system", "content": "You are a security analyst. Be concise."},
        {"role": "user", "content": "Review this Python for security problems and name the CWE: cur.execute(\"SELECT * FROM users WHERE name = '%s'\" % name)"},
    ],
)
print(resp.choices[0].message.content)

Chat Template and Tool Calling

Gork is a direct-answer model: it replies without a chain-of-thought phase, and thinking is disabled in the chat template. It uses ChatML-style roles and XML-style <tool_call><function=…> calls, with the standard function-calling schema.

Sampling

temperature=0.7, top_p=0.8, top_k=20, presence_penalty=1.5. The shipped generation_config.json carries this preset.

Safety and Limitations

Known limitations

CVE details recalled from memory (IDs, CWE, CVSS) can be wrong; verify them against NVD.
Attribution confidence is over-stated; treat actor names as hypotheses.
English-centric. Non-English security content is handled by inherited base capability only.
Text only. For screenshots, OCR first or use the vision-capable base model.
Designed for the chat template; raw text completion is not supported.
This is a v0.1 preview checkpoint.

Safety behaviour

Refuses or redirects weaponised exploit development, unauthorised access to named targets, non-consensual surveillance, and malware generation.
Will explain attack techniques and reverse-engineer provided samples.

License

Citation

@misc{gork2026,
  title        = {Gork-27B-Cybersecurity: A Cybersecurity Fine-tune of Qwen3.8-27B},
  author       = {Consensus Protocol LLC},
  year         = {2026},
  url          = {https://huggingface.co/ConsensusProtocol-Thanos/Gork-27b-Cybersecurity},
  note         = {Version 0.1 preview}
}

Acknowledgements

Qwen team for the base model. The Sigma, YARA, MITRE ATT&CK and NVD communities for making defensive knowledge public.

Downloads last month: 57

Safetensors

Model size

27B params

Tensor type

BF16

Model tree for ConsensusProtocol-Thanos/Gork-27b-Cybersecurity

Base model

Qwen/Qwen3.8-27B

Finetuned

(873)

this model

Quantizations

4 models