Sev-4B

Sev-4B: security evidence and response policies

Sev-4B scores supplied answers to questions about security logs and recovered programs. v0.3.0-response-policy-research adds explicit authorization-policy questions grounded in real SwarmTraces programs. It is a Qwen3.5-4B LoRA adapter with a decision head. It does not generate text.

On 175 policy questions from 35 source programs held out of training, accuracy increases from 127/175, 72.6%, to 147/175, 84.0% compared with the published v0.2.0 parent. The user selected this research release with its measured tradeoffs. 26 of 28 registered checks pass. The false-alert ceiling and zero-new-DNS-error check fail. Those results are preserved unchanged.

Use

Install the Sev runtime. A generic text-generation pipeline does not load the decision head.

git clone https://github.com/maceip/Sev.git
cd Sev
uv sync --extra serve
uv run python -m kev.serve \
  --run macmacmacmac/[email protected] --port 8009

Send TypeSafe-shaped requests to POST /v1/systemone. Supply the observed evidence, the applicable policy, and explicit answer choices. The model reads supplied code without executing it. Its scores support analyst review; they do not establish that a program ran, identify its human owner, or prove agent origin.

The checkpoint ships with temperature 1.6817928305074288. Set KEV_TEMPERATURE=1.0 for raw probabilities. Reported evaluation uses KEV_BACKEND=torch KEV_DTYPE=fp32 KEV_MERGE=1 on CUDA. Accelerated serving can differ numerically. The API's confidence rescales the largest probability above chance; it is not an independently verified correctness probability.

Training and lineage

All previous curriculum records remain byte-identical. They include native Sysmon, ExCyTIn, GUIDE, public classification and authored-rule replay, and 446 SwarmTraces static-program records. The added programs have authored API-specific policies and checked labels. Their source text is real recovered code, not a native execution trace. Source-closure groups separate training, calibration and development. No locked test was read.

Training configuration, provenance, and data lineage pin the inputs. The original v0.1.0-research synthetic-origin preview is a separate historical lineage. The previous v0.2.0-swarmtraces-research release remains available unchanged.

Matched development results

Each model's alert threshold was selected on calibration only, with an empirical 5% false-alert budget. The parent threshold is 0.887537 and this release's is 0.844982. Development false alerts increase from 8.6% to 10.0%, failing the 5% ceiling. Required-approval recall rises from 40.0% to 71.4%. These are explicit policy decisions on a development panel, not measured detection rates in live networks. Always predicting permitted would answer 140/175 correctly and detect none of the 35 required approvals.

All eleven extra threshold detections concern innerText or textContent. Thirteen of the twenty additional correct argmax answers are console-negative questions. The panel lacks console-positive and code-execution-positive cases; it has one onward-request positive. HTML-policy negatives remain weak at 2/21 correct argmax answers, and their threshold false alerts increase from 9/21 to 12/21. The aggregate does not establish every operation's detection quality.

All 25 correctness-retention checks pass. Unchanged totals do not imply unchanged individual answers. GUIDE detector calibrated negative log loss worsens by 0.0116 and Brier by 0.0077. No matched continuation without the new component was run, so the isolated causal contribution of SwarmTraces is not established.

The separate DNS diagnostic remains 21/32, with one repair and one new error. It contains eight authored summaries and controls inspired by one reported incident, not raw packet captures or eight independent incidents. It is evaluation-only. The new error fails the registered zero-regression criterion. Policy evaluation, DNS evaluation, and registered screen retain the complete comparisons.

Calibration and artifact verification

The shipped temperature minimizes question-weighted negative log loss on 2,674 calibration questions from 1,920 records. Five-fold diagnostics keep all 465 source groups intact across task families. Raw calibration ECE is 0.07626 and out-of-fold ECE is 0.03386. This is a calibration diagnostic, not fresh field validation. Development and DNS observations were excluded from fitting.

Only temperature metadata changed when assembling the serving copy. Learned head tensors, adapter and tokenizer bytes match the evaluated checkpoint. Calibration, integrity evidence, and SHA256SUMS identify the release files.

Research iteration is paused following this release. The 0.8B and 9B checkpoints are not updated by this publication.

License and attribution

Source and adapter/head weights carry Apache-2.0 notices. Preserve LICENSE, NOTICE and the Qwen BASE_LICENSE. Sev builds on Kev by Jared Palmer and Qwen3.5 by the Qwen team.

Each dataset retains its own terms. Upstream SwarmTraces reuse terms remain unverified; the model license does not relicense those artifacts. The collection includes metadata-only entries, and membership does not imply training use. The historical synthetic source's notice applies only to that source. See data provenance.