Opal-8B โ€” a security-specialized Llama-3.1-8B that beats the stock model

Opal-8B is stock Llama-3.1-8B-Instruct with defensive-security expertise trained in via LoRA โ€” so it keeps the base model's general ability and adds a large security edge on top. On our harness it beats stock Llama-3.1-8B-Instruct overall, wins on math and security, and matches it on code.

Built by Cognis Digital (US). Native Llama-3.1 tool-calling. Part of the Opal suite with the Opal router.

Why this works (and the merges didn't)

We first tried merging open models (DARE-TIES). Every merge lost to stock Instruct โ€” a merge only interpolates its components, it can't exceed them, and the grafts degraded the base's code/math. The fix was to stop merging and train: a LoRA on frozen stock Instruct, on a defensive-security corpus generated by open teacher models (gpt-oss-20b, Phi-4). Training adds capability; merging only averages it. That is the entire difference between the table below and a loss.

Benchmarks (measured here โ€” Ollama, greedy, n = 25 subset, identical harness)

code = HumanEval pass@1 (executed); math = GSM8K exact-match; sec = a transparent defensive-security keyword rubric (bench/tasks/sec.json: Cobalt Strike detection, SQLi, MCP threat-modeling, Sigma, UEFI bootkit). blend = 0.45ยทcode + 0.25ยทmath + 0.30ยทsec.

model code math sec blend
Opal-8B (Q4_K_M) 0.88 0.76 0.424 0.713
Llama-3.1-8B-Instruct (stock peer) 0.92 0.68 0.212 0.648

Opal wins the blend (0.713 vs 0.648), wins math and security, and is within noise on code. Honest note: stock Instruct is marginally ahead on raw HumanEval (0.92 vs 0.88) โ€” we publish that, not hide it. Every number reproduces with the harness in this repo.

Published frontier reference (official full-set numbers, different harness, context only โ€” an 8B is not a frontier model):

model HumanEval GSM8K source
Llama-3.1-8B-Instruct 72.6 84.5 Meta official evals
GPT-4o 90.2 ~96 public reports
Claude 3.5 Sonnet 92.0 96.4 Anthropic

HumanEval/GSM8K are saturated at the frontier and no longer reported head-to-head; shown only to place the 8B class. No frontier-parity claim.

Quantization ladder

file size use
opal-8b-Q4_K_M.gguf 4.9 GB default โ€” best size/quality
opal-8b-Q5_K_M.gguf 5.7 GB higher quality
opal-8b-Q6_K.gguf 6.6 GB near-lossless
opal-8b-Q8_0.gguf 8.5 GB maximum fidelity

Native tool-calling (Ollama)

import ollama
ollama.chat(model="opal-8b", messages=[{"role":"user","content":"weather in Charleston?"}],
            tools=[{"type":"function","function":{"name":"get_weather",
              "parameters":{"type":"object","properties":{"location":{"type":"string"}},
              "required":["location"]}}}])

What it's for

Detection engineering (Sigma/Suricata), threat modeling, MCP/agent security, firmware/ICS reasoning, secure code review, agentic tool use โ€” with general code/reasoning at Llama-3.1-8B-Instruct level.

How it was made

Base: Llama-3.1-8B-Instruct (frozen). LoRA (r=16) trained locally on CPU (no cloud) over a defensive-security SFT corpus distilled from gpt-oss-20b + Phi-4, then merged and quantized. Recipe and harness are in the repo.

Limitations & safety

Inherits Llama-3.1-Instruct's alignment and knowledge cutoff. Security content is for authorized, defensive use (detection, threat modeling, hardening). Verify generated code before running it.

License

Apache-2.0. Trainer/quantizer: PEFT + llama.cpp.

Downloads last month
193
GGUF
Model size
8B params
Architecture
llama
Hardware compatibility
Log In to add your hardware

4-bit

5-bit

Inference Providers NEW
This model isn't deployed by any Inference Provider. ๐Ÿ™‹ Ask for provider support

Model tree for cognis-digital/Opal-8B-GGUF

Adapter
(2573)
this model