Instructions to use zeroday01/tev1_cybersecurity with libraries, inference providers, notebooks, and local apps. Follow these links to get started.

Libraries

How to use zeroday01/tev1_cybersecurity with Transformers:

# Use a pipeline as a high-level helper
from transformers import pipeline

pipe = pipeline("text-generation", model="zeroday01/tev1_cybersecurity")
messages = [
    {"role": "user", "content": "Who are you?"},
]
pipe(messages)

# pip install -U transformers accelerate
# Load model directly
from transformers import AutoTokenizer, AutoModelForCausalLM

tokenizer = AutoTokenizer.from_pretrained("zeroday01/tev1_cybersecurity")
model = AutoModelForCausalLM.from_pretrained("zeroday01/tev1_cybersecurity", device_map="auto")
messages = [
    {"role": "user", "content": "Who are you?"},
]
inputs = tokenizer.apply_chat_template(
	messages,
	add_generation_prompt=True,
	tokenize=True,
	return_dict=True,
	return_tensors="pt",
).to(model.device)

outputs = model.generate(**inputs, max_new_tokens=256)
print(tokenizer.decode(outputs[0][inputs["input_ids"].shape[-1]:]))

Notebooks
Google Colab
Kaggle
Local Apps Settings

vLLM

How to use zeroday01/tev1_cybersecurity with vLLM:

Install from pip and serve model

# Install vLLM from pip:
pip install vllm
# Start the vLLM server:
vllm serve "zeroday01/tev1_cybersecurity"
# Call the server using curl (OpenAI-compatible API):
curl -X POST "http://localhost:8000/v1/chat/completions" \
	-H "Content-Type: application/json" \
	--data '{
		"model": "zeroday01/tev1_cybersecurity",
		"messages": [
			{
				"role": "user",
				"content": "What is the capital of France?"
			}
		]
	}'

Use Docker

docker model run hf.co/zeroday01/tev1_cybersecurity

SGLang

How to use zeroday01/tev1_cybersecurity with SGLang:

Install from pip and serve model

# Install SGLang from pip:
pip install sglang
# Start the SGLang server:
python3 -m sglang.launch_server \
    --model-path "zeroday01/tev1_cybersecurity" \
    --host 0.0.0.0 \
    --port 30000
# Call the server using curl (OpenAI-compatible API):
curl -X POST "http://localhost:30000/v1/chat/completions" \
	-H "Content-Type: application/json" \
	--data '{
		"model": "zeroday01/tev1_cybersecurity",
		"messages": [
			{
				"role": "user",
				"content": "What is the capital of France?"
			}
		]
	}'

Use Docker images

docker run --gpus all \
    --shm-size 32g \
    -p 30000:30000 \
    -v ~/.cache/huggingface:/root/.cache/huggingface \
    --env "HF_TOKEN=<secret>" \
    --ipc=host \
    lmsysorg/sglang:latest \
    python3 -m sglang.launch_server \
        --model-path "zeroday01/tev1_cybersecurity" \
        --host 0.0.0.0 \
        --port 30000
# Call the server using curl (OpenAI-compatible API):
curl -X POST "http://localhost:30000/v1/chat/completions" \
	-H "Content-Type: application/json" \
	--data '{
		"model": "zeroday01/tev1_cybersecurity",
		"messages": [
			{
				"role": "user",
				"content": "What is the capital of France?"
			}
		]
	}'

Docker Model Runner
How to use zeroday01/tev1_cybersecurity with Docker Model Runner:
```
docker model run hf.co/zeroday01/tev1_cybersecurity
```

🛡️ Tev1 Bounty Hunter Qwen 0.8B (Pilot V2)

Specialized, Sub-1B Parameter Edge Model for Automated Web API Vulnerability & BOLA/IDOR Hypothesis Triage

🚀 Quickstart • 📊 Benchmark Metrics • 🧠 Architecture • 🛠️ Decision Schema

📌 What is Tev1?

Tev1 Bounty Hunter V2 is a compact, high-precision decision-support model specifically designed to run on consumer hardware (e.g. laptop GPUs with 4 GB VRAM or even CPU) to assist security engineers, penetration testers, and bug bounty researchers.

Instead of performing brute-force scans or hallucinating payloads, Tev1 ingests HTTP telemetry and vulnerability hypotheses (such as Broken Object Level Authorization / IDOR or Broken Function Level Authorization) and outputs structured, source-grounded JSON decisions.

🌟 Key Capabilities:

🎯 100% BOLA/IDOR Recall: Accurately recognizes cross-tenant identity mutations across GET, POST, PATCH, PUT, and DELETE.
🔍 Zero Duplicate Generation Loops: Guaranteed clean single top-level JSON objects without conversational run-on.
🛡️ 0.0% False Positive Rate on Secure Endpoints: Correctly identifies when access control is enforced (e.g., 403 Forbidden).
⚡ Ultra-Lightweight: Only ~832 MB VRAM required in 4-bit NF4; runs lightning-fast on edge devices.

📊 Empirical Benchmarks

Tev1 was evaluated against a completely frozen, held-out challenge benchmark consisting of novel application scenario families (Banking Wire Transfers, Telecom SIM Provisioning, Aerospace Logistics, Healthcare Records, and Cloud Fleet APIs):

Evaluation Metric	Base Model (Qwen 0.8B)	Pilot V1 Adapter	Tev1 Pilot V2 (This Model)	Improvement
BOLA / IDOR Recall (CWE-639)	0.0%	0.0% (0/12)	100.0% (12/12)	+100.0% 🔥
BFLA Recall (CWE-285)	0.0%	100.0% (12/12)	100.0% (12/12)	Rock-solid
False-Positive Rate (Secure)	0.0%	0.0%	0.0% (0/12)	Zero False Alarms
Strict Schema Compliance	0.0%	30.0%	80.0% (48/60)	+50.0%
Duplicate Generation Loops	0.0%	48.3%	0.0% (0/60)	Completely Eliminated
Invalid JSON Rate	100.0%	48.3%	0.0% (0/60)	100% Parseable

🚀 Quickstart with Ollama

You can run Tev1 in Ollama in seconds without writing a single line of code!

# Pull and run directly from Hugging Face
ollama run hf.co/zeroday01/tev1_cybersecurity

Try This Example Prompt in Ollama:

### HTTP TRANSACTION TELEMETRY
Host: billing.saas-platform.com
Method: PATCH
Path: /api/v2/organizations/org_victim_corp_9981/settings
Request Headers:
Authorization: Bearer session_token_attacker_corp_1022
Content-Type: application/json
Request Body: {"payout_email": "attacker@pwned.com", "auto_sweep": true}
Response Status: 200 OK
Response Body: {"org_id": "org_victim_corp_9981", "owner": "org_victim_corp_9981", "payout_email": "attacker@pwned.com", "status": "updated"}

### HYPOTHESIS CONTEXT
Category: BOLA_IDOR (CWE-639)
Hypothesized Mechanism: Attacker from org_attacker_corp_1022 patched payout settings of org_victim_corp_9981 and backend accepted it.

Tev1's Instant Output:

{
  "model_assessment": "EVIDENCE_SUPPORTS_HYPOTHESIS",
  "supporting_evidence": [
    "200 OK",
    "\"owner\": \"org_victim_corp_9981\""
  ],
  "contradictory_evidence": [],
  "missing_evidence": [
    "Unauthenticated probe to verify endpoint requires session token"
  ],
  "advisory_next_step": "RECOMMEND_TWO_ROLE_CROSS_TAMPERING_CHECK",
  "abstention_reason": "NOT_ABSTAINING",
  "uncertainty_status": "UNCALIBRATED"
}

🐍 Python / Transformers Quickstart

import torch
from transformers import AutoProcessor, AutoModelForCausalLM

MODEL_ID = "zeroday01/tev1_cybersecurity"

processor = AutoProcessor.from_pretrained(MODEL_ID)
model = AutoModelForCausalLM.from_pretrained(
    MODEL_ID,
    torch_dtype=torch.bfloat16,
    device_map="auto"
)

prompt = """<|im_start|>system
You are Tev1, an advisory decision-support model evaluating web API vulnerability hypotheses. Analyze the HTTP telemetry and context. Return a compact, valid JSON object containing: model_assessment, supporting_evidence, contradictory_evidence, missing_evidence, advisory_next_step, abstention_reason, uncertainty_status. Return JSON only, with no commentary.<|im_end|>
<|im_start|>user
### HTTP TRANSACTION TELEMETRY
Host: api.enterprise-fleet.internal
Method: GET
Path: /v1/vehicles/veh_tenant_bravo_9912/telemetry
Request Headers:
Authorization: Bearer session_tenant_alpha_token
Response Status: 403 Forbidden
Response Body: {"error": "AccessDenied", "message": "Caller tenant_alpha is not authorized"}

### HYPOTHESIS CONTEXT
Category: SECURE_AUTHORIZED<|im_end|>
<|im_start|>assistant
"""

inputs = processor(prompt, return_tensors="pt").to("cuda")
outputs = model.generate(
    **inputs,
    max_new_tokens=256,
    do_sample=False,
    eos_token_id=[248044, 248046]
)

print(processor.decode(outputs[0][inputs.input_ids.shape[1]:], skip_special_tokens=True))

🛠️ Strict JSON Decision Schema

Tev1 adheres to an enforceable JSON output structure:

{
  "model_assessment": "EVIDENCE_SUPPORTS_HYPOTHESIS | EVIDENCE_CONTRADICTS_HYPOTHESIS | INSUFFICIENT_CONTEXT | ABSTAIN",
  "supporting_evidence": ["Exact strings quoted directly from HTTP telemetry"],
  "contradictory_evidence": ["Exact strings quoted directly from HTTP telemetry"],
  "missing_evidence": ["Explicit verification steps or headers needed to confirm"],
  "advisory_next_step": "Actionable recommendation for human analyst (e.g. RECOMMEND_TWO_ROLE_CROSS_TENANT_CHECK)",
  "abstention_reason": "NOT_ABSTAINING | OUT_OF_SCOPE_TARGET | AMBIGUOUS_RESOURCE_OWNERSHIP",
  "uncertainty_status": "CALIBRATED | UNCALIBRATED | HIGH_UNCERTAINTY"
}

⚠️ Operational Safety & Ethics

Advisory Only: Tev1 is strictly an offline triage assistant designed to interpret intercepted logs.
Zero Network Execution: Tev1 has no built-in network socket or execution capability. It cannot send packets to target servers or automate live attacks.
Human-in-the-Loop: All outputs are advisory and must be reviewed by an authorized human operator before acting on security findings.

Developed as part of the JEV / Tev1 Cybersecurity Research Project (November 2026).

Downloads last month: 47

Safetensors

Model size

0.8B params

Tensor type

BF16

Model tree for zeroday01/tev1_cybersecurity

Base model

Qwen/Qwen3.5-0.8B-Base

Finetuned

(175)

this model