SecBERT-CoreAI — Apple Core AI

A Core AI (.aimodel) build of jackaduma/SecBERT for on-device inference on Apple Silicon. Upstream ships PyTorch weights and no Core AI build.

What the model is. A BERT-base masked-LM pretrained on security text (APT reports, CVE/vulnerability text, CASIE). It has no classification head, so there are no predicted labels. This bundle returns a sentence embedding (mean-pooled, L2-normalised); the masked-LM head is not exported.

Outputs

main takes input_ids and attention_mask (int32, fixed length 512). The runtime names outputs after the producing op, not after the wrapper's keys, so select by shape:

Shape	Meaning
[1,768]	mean-pooled, L2-normalised embedding (our pooling; upstream ships token-level hidden states and an MLM head)

No labels: this is an encoder.

Probes and results

Probes are in cases-secbert.txt (six security-domain sentences, then two off-domain controls).

#	Probe	embedding max abs diff	relative to max abs element	cosine vs PyTorch	nearest other probe (cosine)
1	The APT29 group used spearphishing attachments to deliver a backdoor to government targets.	9.69e-08	4.7e-07	1.0000000000	#3 (0.306)
2	CVE-2021-44228 is a remote code execution vulnerability in Apache Log4j via JNDI lookups.	1.32e-07	5.3e-07	1.0000000000	#5 (0.300)
3	The ransomware encrypts files with AES-256 and demands payment in Bitcoin.	9.31e-08	7.4e-07	1.0000000000	#5 (0.331)
4	Attackers exploited an unpatched SQL injection flaw to exfiltrate the customer database.	1.12e-07	8.6e-07	1.0000000000	#1 (0.291)
5	The malware establishes persistence through a registry run key and contacts a command-and-control se	8.75e-08	4.4e-07	1.0000000000	#3 (0.331)
6	Enable multi-factor authentication and rotate credentials after the breach.	1.14e-07	7.2e-07	1.0000000000	#5 (0.301)
7	The recipe calls for two cups of flour and a teaspoon of baking soda.	9.31e-08	3.2e-07	1.0000000000	#1 (0.262)
8	The football match ended with a late goal in the second half.	9.78e-08	4.4e-07	1.0000000000	#7 (0.255)

Measured equivalence

Exported graph vs the original PyTorch model (float32), same inputs, raw outputs diffed.

• Worst absolute difference over all outputs: 1.322e-07
• Worst residual relative to output magnitude: 8.6e-07 (float32 rounding)
• Minimum cosine between embeddings: 1.0000000000

This is arithmetic equivalence only. There is no quality benchmark here (no F1, no accuracy, no comparison with upstream's reported numbers), and no speed or memory measurement.

Built by

ahmedandaloes — Apple Silicon builds (Core AI, MLX, GGUF) of security and language models that ship none: ahmedandaloes.com

Need a model in a format that is not here — another runtime, another quantisation, your own checkpoint? That is the same job. Ask.

Use

import asyncio, numpy as np
from coreai.runtime import AIModel, NDArray, SpecializationOptions
from transformers import AutoTokenizer

async def run(text):
    tok = AutoTokenizer.from_pretrained(".")
    model = await AIModel.load("secbert.aimodel", SpecializationOptions.default())
    fn = model.load_function("main")
    enc = tok([text], padding="max_length", truncation=True, max_length=512, return_tensors="np")
    out = await fn({"input_ids": NDArray(enc["input_ids"].astype("int32")),
                    "attention_mask": NDArray(enc["attention_mask"].astype("int32"))})
    arrs = [np.asarray(v.numpy()) for v in out.values()]
    return next(a for a in arrs if a.shape == (1, 768))

Files

secbert.aimodel/ (graph), manifest.json, validation.json, ref-output.json, cases-secbert.txt, arabic_encoder_coreai.py (exporter and measurer), requirements.txt, tokenizer/config files.

Limits

• Fixed at 512 tokens; longer inputs need chunking.
• 8 English probes measured (listed above); nothing else was.
• Softmax and thresholding are the caller's steps.
• No fill-mask / MLM output. The upstream repo ships no tokenizer_config.json; the tokenizer here loads from vocab.txt + config.json with transformers' BERT defaults (lower-casing on). The reference and the bundle were measured with that same tokenizer, so the equivalence holds, but whether those defaults match how SecBERT was pretrained was not checked.
• The nearest-probe column is a sanity print of the embeddings, not an evaluation.

Licence and attribution

apache-2.0, as declared in the upstream Hub card. A derivative of jackaduma/SecBERT; credit for the model is theirs.