--- license: apache-2.0 library_name: gguf pipeline_tag: text-generation tags: - security - detection-engineering - code - reasoning - tool-calling - lora - llama-3.1 - gguf base_model: - meta-llama/Llama-3.1-8B-Instruct --- # Opal-8B — a security-specialized Llama-3.1-8B that beats the stock model **Opal-8B is stock Llama-3.1-8B-Instruct with defensive-security expertise *trained in* via LoRA** — so it keeps the base model's general ability and adds a large security edge on top. On our harness it **beats stock Llama-3.1-8B-Instruct overall**, wins on math and security, and matches it on code. Built by Cognis Digital (US). Native Llama-3.1 tool-calling. Part of the **Opal suite** with the [Opal router](https://huggingface.co/cognis-digital/opal-router). ## Why this works (and the merges didn't) We first tried *merging* open models (DARE-TIES). Every merge **lost** to stock Instruct — a merge only interpolates its components, it can't exceed them, and the grafts degraded the base's code/math. The fix was to stop merging and **train**: a LoRA on frozen stock Instruct, on a defensive-security corpus generated by open teacher models (gpt-oss-20b, Phi-4). Training *adds* capability; merging only averages it. That is the entire difference between the table below and a loss. ## Benchmarks (measured here — Ollama, greedy, n = 25 subset, identical harness) `code` = HumanEval pass@1 (executed); `math` = GSM8K exact-match; `sec` = a transparent defensive-security keyword rubric ([`bench/tasks/sec.json`](bench/tasks/sec.json): Cobalt Strike detection, SQLi, MCP threat-modeling, Sigma, UEFI bootkit). `blend` = 0.45·code + 0.25·math + 0.30·sec. | model | code | math | sec | **blend** | |---|---|---|---|---| | **Opal-8B (Q4_K_M)** | 0.88 | **0.76** | **0.424** | **0.713** | | Llama-3.1-8B-Instruct (stock peer) | 0.92 | 0.68 | 0.212 | 0.648 | Opal **wins the blend (0.713 vs 0.648)**, **wins math and security**, and is within noise on code. Honest note: stock Instruct is marginally ahead on raw HumanEval (0.92 vs 0.88) — we publish that, not hide it. Every number reproduces with the harness in this repo. **Published frontier reference** (official full-set numbers, *different harness, context only — an 8B is not a frontier model*): | model | HumanEval | GSM8K | source | |---|---|---|---| | Llama-3.1-8B-Instruct | 72.6 | 84.5 | Meta official evals | | GPT-4o | 90.2 | ~96 | public reports | | Claude 3.5 Sonnet | 92.0 | 96.4 | Anthropic | > HumanEval/GSM8K are **saturated** at the frontier and no longer reported > head-to-head; shown only to place the 8B class. No frontier-parity claim. ## Quantization ladder | file | size | use | |---|---|---| | `opal-8b-Q4_K_M.gguf` | 4.9 GB | default — best size/quality | | `opal-8b-Q5_K_M.gguf` | 5.7 GB | higher quality | | `opal-8b-Q6_K.gguf` | 6.6 GB | near-lossless | | `opal-8b-Q8_0.gguf` | 8.5 GB | maximum fidelity | ## Native tool-calling (Ollama) ```python import ollama ollama.chat(model="opal-8b", messages=[{"role":"user","content":"weather in Charleston?"}], tools=[{"type":"function","function":{"name":"get_weather", "parameters":{"type":"object","properties":{"location":{"type":"string"}}, "required":["location"]}}}]) ``` ## What it's for Detection engineering (Sigma/Suricata), threat modeling, MCP/agent security, firmware/ICS reasoning, secure code review, agentic tool use — with general code/reasoning at Llama-3.1-8B-Instruct level. ## How it was made Base: `Llama-3.1-8B-Instruct` (frozen). LoRA (r=16) trained locally on CPU (no cloud) over a defensive-security SFT corpus distilled from gpt-oss-20b + Phi-4, then merged and quantized. Recipe and harness are in the repo. ## Limitations & safety Inherits Llama-3.1-Instruct's alignment and knowledge cutoff. Security content is for **authorized, defensive** use (detection, threat modeling, hardening). Verify generated code before running it. ## License Apache-2.0. Trainer/quantizer: PEFT + llama.cpp.
