Opal 8B GGUF

Opal-8B — a security-specialized Llama-3.1-8B that beats the stock model

Opal-8B is stock Llama-3.1-8B-Instruct with defensive-security expertise trained in via LoRA — so it keeps the base model's general ability and adds a large security edge on top. On our harness it beats stock Llama-3.1-8B-Instruct overall, wins on math and security, and matches it on code.

Built by Cognis Digital (US). Native Llama-3.1 tool-calling. Part of the Opal suite with the Opal router.

Why this works (and the merges didn't)

We first tried merging open models (DARE-TIES). Every merge lost to stock Instruct — a merge only interpolates its components, it can't exceed them, and the grafts degraded the base's code/math. The fix was to stop merging and train: a LoRA on frozen stock Instruct, on a defensive-security corpus generated by open teacher models (gpt-oss-20b, Phi-4). Training adds capability; merging only averages it. That is the entire difference between the table below and a loss.

Benchmarks (measured here — Ollama, greedy, n = 25 subset, identical harness)

code = HumanEval pass@1 (executed); math = GSM8K exact-match; sec = a transparent defensive-security keyword rubric (bench/tasks/sec.json: Cobalt Strike detection, SQLi, MCP threat-modeling, Sigma, UEFI bootkit). blend = 0.45·code + 0.25·math + 0.30·sec.

model	code	math	sec	blend
Opal-8B (Q4_K_M)	0.88	0.76	0.424	0.713
Llama-3.1-8B-Instruct (stock peer)	0.92	0.68	0.212	0.648

Opal wins the blend (0.713 vs 0.648), wins math and security, and is within noise on code. Honest note: stock Instruct is marginally ahead on raw HumanEval (0.92 vs 0.88) — we publish that, not hide it. Every number reproduces with the harness in this repo.

Published frontier reference (official full-set numbers, different harness, context only — an 8B is not a frontier model):

model	HumanEval	GSM8K	source
Llama-3.1-8B-Instruct	72.6	84.5	Meta official evals
GPT-4o	90.2	~96	public reports
Claude 3.5 Sonnet	92.0	96.4	Anthropic

HumanEval/GSM8K are saturated at the frontier and no longer reported head-to-head; shown only to place the 8B class. No frontier-parity claim.

Quantization ladder

file	size	use
opal-8b-Q4_K_M.gguf	4.9 GB	default — best size/quality
opal-8b-Q5_K_M.gguf	5.7 GB	higher quality
opal-8b-Q6_K.gguf	6.6 GB	near-lossless
opal-8b-Q8_0.gguf	8.5 GB	maximum fidelity

Native tool-calling (Ollama)

import ollama
ollama.chat(model="opal-8b", messages=[{"role":"user","content":"weather in Charleston?"}],
            tools=[{"type":"function","function":{"name":"get_weather",
              "parameters":{"type":"object","properties":{"location":{"type":"string"}},
              "required":["location"]}}}])

What it's for

Detection engineering (Sigma/Suricata), threat modeling, MCP/agent security, firmware/ICS reasoning, secure code review, agentic tool use — with general code/reasoning at Llama-3.1-8B-Instruct level.

How it was made

Base: Llama-3.1-8B-Instruct (frozen). LoRA (r=16) trained locally on CPU (no cloud) over a defensive-security SFT corpus distilled from gpt-oss-20b + Phi-4, then merged and quantized. Recipe and harness are in the repo.

Limitations & safety

Inherits Llama-3.1-Instruct's alignment and knowledge cutoff. Security content is for authorized, defensive use (detection, threat modeling, hardening). Verify generated code before running it.

License

Apache-2.0. Trainer/quantizer: PEFT + llama.cpp.