ab9b-v3: a small, fast, reasoning defensive-cyber agent (PRIVATE research release, 2026-10-05)

What it is. ab9b-v2a (Qwen3.5-9B dense + three continued LoRA rounds: r1 → v2a → v3) taught to reason before it answers. v2 was trained and served with thinking OFF and had no reasoning signal; v3 adds verified reasoning traces so the model plans, reads evidence, and only then answers — while staying small (9B dense), fast, and security-focused.

The novel bit — reasoning you can trust. The reasoning data is not teacher free-text that might be wrong. Every agent trace is correct by construction: the family oracle's solution trajectory is replayed against the real sandbox files and each step is wrapped in a grounded <think> block (box/v3_work.py). 2,520 such traces across 16 defensive task families (counting, enumeration, date/version reasoning, multi-file joins — the exact skills v2 skipped), plus the ATT&CK-extraction and tool-policy streams from v2, plus 30% replay of the v2 mix. Result: mix-v3 = 10,365 rows, 5.1M training tokens, 28% of the loss on reasoning tokens (v2 had ~0). One epoch, continued from v2a-ck900 at lr 5e-5.

Files

path	what
ab9b-v3-Q4_K_M.gguf	the model (aligned, 5.4 GB, Q4_K_M)
variants/ab9b-v3-abl-Q4_K_M.gguf	a layer-abliterated variant (see "Abliterated variant")
adapters/v3/	the LoRA adapter (r=32) on Qwen3.5-9B; it already contains r1+v2a+v3 in one adapter
evidence/	the eval scorecard, the mix manifest, the training journal
SHA256SUMS	sha256 of every file

Results (ab's own harness, dev tier; evidence/scorecard.json)

Trained 867 steps / 1 epoch / 12.7M tokens, final train loss 0.036, 1166 tok/s.

metric	ab9b-v3
composite (coding2+vuln2+agent2)	0.663
agent2 (tool-use agent)	0.675
vuln2 (vuln review)	0.582
coding2	0.732
security_write	0.895
vulnfind	0.693 · coding 0.85 · agentic 0.80
XSTest safe-prompt compliance	0.989 (does not over-refuse)
XSTest unsafe-prompt refusal	0.276
decode (batch 1, no MTP)	37 tok/s

It now emits a <think> reasoning block then a short answer; serve with enable_thinking to control it (see "Run it"). The reasoning is the headline change over v2; the harness composite is in the same range as the r1/v2 lineage while the agentic and reasoning behaviour improved.

Honest limits (read before using)

• The reasoning traces are templated narrations of oracle-correct trajectories, not free-form chains of thought — they reliably teach the pattern (plan → read evidence → answer) and the specific skills, but the prose is formulaic; final train loss 0.036 means it fit the templates closely, so watch for rigid phrasing. The 30% replay is there to protect general ability.
• The think-toggle is soft: the training renders prompts thinking-off while the targets contain <think>, so the model tends to think when the task looks like one; it is not a hard on/off switch.
• Small test slices; no fresh cyber-battery/league comparison was run for v3 (time-boxed overnight build). Treat the table as the general harness, not the full mission-2 battery.
• Synthetic, defensive training data; not red-teamed for misuse.
• Licence: base is Apache-2.0 (Qwen3.5-9B); the mix combines public feeds (NVD/MITRE/CIRCL) and programmatic data under their own licences, not reviewed for redistribution, so this repo stays private (license: other).

Abliterated variant (variants/ab9b-v3-abl-Q4_K_M.gguf)

Produced with the project's own uncenkit (Arditi-2024 refusal-direction method): a refusal direction was estimated from harmless/harmful prompt pairs (layer 19, separation 1.362) and orthogonalized out of the attention o_proj and MLP down_proj weights (40 tensors). This deliberately removes the model's refusal behaviour — XSTest unsafe-prompt refusal will drop well below the aligned model's 0.276. It is included as an uncensored research variant of our own model; the aligned ab9b-v3-Q4_K_M.gguf is the default. Use the abliterated variant only in authorized, lawful security-research contexts.

Run it

llama-server -m ab9b-v3-Q4_K_M.gguf --host 127.0.0.1 --port 8090 -ngl 999 -fa on --jinja \
  -c 16384 -np 1 --chat-template-kwargs '{"enable_thinking":true}' --reasoning-format none

enable_thinking:true + reasoning-format none keeps the <think>…</think> block inline (the model was trained that way); set enable_thinking:false for terse answers. Native tool calling works through --jinja; the text agent protocol is CALL: list_dir(path) / read_file / grep then FINAL:.

Provenance

LoRA training on one rented RTX 3090 under written pre-registered rules (evidence/): defensive/benign data only, 100% oracle-verified reasoning, nothing from the reserved evaluation families, continued from v2a-ck900. Built 2026-10-05.