Wolfram is the stage-2 analysis model of the HoneySentinel honeypot. It reads captured attacker activity — shell transcripts, uploaded payloads, logs — and returns structured incident analysis: intent, MITRE ATT&CK technique mapping, IOCs, de-obfuscation and a sophistication call. It runs locally on CPU, so no transcript ever leaves the operator's machine.
⬇ Download weights & GGUF (Hugging Face) · Model card · Quickstart · Usage example · Responsible use
The actual weights and quantized GGUFs live on Hugging Face: https://huggingface.co/Flexingmeow/wolfram-GGUF This repository is the documentation and method write-up. It does not host the weights.
A 9B language model built in three stages from a MIT-licensed base:
MiMo-V2.6-Distill-Qwen-9B → cyber QLoRA fine-tune (merged) → abliteration (refusal removal, last) → GGUF
Its job in the honeypot is narrow and concrete: a session has been captured and contained, and Wolfram answers what the attacker was trying to do. It emits a single compact JSON object — intent, objectives, ATT&CK techniques the commands actually evidence, IOCs that appear verbatim in the transcript, and a sophistication/confidence call. See the real prompt and an example response.
Two design choices matter:
- It runs entirely local. It's served through an OpenAI-compatible endpoint (llama.cpp's
llama-serverin production), called from the backend — never the honeypot engine — so the engine keeps its zero-egress property and the operator's own weights read the operator's own captures. No transcript is sent to a third party. - Refusals are removed, on purpose. A cyber-tuned model that keeps declining to "analyze malware" is useless for incident response. Wolfram is abliterated so it analyzes attacker-controlled input instead of refusing it — which is exactly why it must be deployed behind application-level content controls (see Responsible use).
Benchmarked base vs. the cyber fine-tune (merged) vs. final Wolfram. Full tables and method in the model card.
| Metric | base | +cyber (merged) | Wolfram |
|---|---|---|---|
| In-domain ATT&CK technique F1 | 0.148 | 0.898 | 0.89 |
| In-domain JSON-valid | 0.80 | 1.00 | 1.00 |
| Refusal rate (held-out harmful) | 78% | 97% | 0% |
| General reasoning (MMLU) | 0.47 | 0.52 | 0.505 |
| Math accuracy | 100% | 100% | 100% |
The win is the deployment task: ATT&CK technique F1 rose 6× (0.15 → 0.90) with perfect JSON formatting, while general ability was retained (no measurable forgetting). Abliteration takes refusals to 0% and is competence-neutral (final ≈ merged). Standalone cyber-knowledge MCQ did not move — the base already knows the facts; the gain is task and format competence, not new knowledge.
The simplest path is a GGUF with llama.cpp.
# 1. Download a quant (Q4_K_M is the fastest; Q6_K / Q8_0 trade speed for fidelity)
# 5.6 GB / 7.4 GB / 9.5 GB respectively
huggingface-cli download Flexingmeow/wolfram-GGUF wolfram-Q4_K_M.gguf --local-dir .
# 2. Serve it on an OpenAI-compatible endpoint (what HoneySentinel talks to)
llama-server -m wolfram-Q4_K_M.gguf -c 8192 -t 8 --host 127.0.0.1 --port 8080
# 3. Point HoneySentinel at it
# CHIMERA_URL=http://127.0.0.1:8080/v1 (see the honeypot repo's deploy guide)Or run it standalone with the honeypot's analysis prompt — see
examples/analysis-prompt.md for the exact system prompt, a
sample transcript, and the JSON it returns.
Performance (CPU). On an i7-9700 (8 cores), Q4_K_M, -t 8: prompt eval ≈ 38 tok/s,
generation ≈ 3.4 tok/s. Generation is memory-bandwidth-bound — more threads and flash-attention
do not help (benchmarked); a smaller quant is the only CPU lever. There is no speculative
decoding (the checkpoint carries no MTP head; GGUF conversion needed a one-line no_mtp=True
converter patch).
- Fine-tune (QLoRA): 2× NVIDIA T4 (Kaggle), 1 epoch / 458 steps,
train_loss 0.74. LoRA rank 16 / α 32,all-lineartargets (~43 M trainable, 0.48%), 4-bit NF4 base, LR 2e-4 cosine. ~7,328 examples: Primus (Reasoning/Instruct/Seed), uka-cyber, a dolly-15k replay slice for anti-forgetting, and generated honeypot command → ATT&CK-JSON pairs for the deployment task. - Abliteration (last): the refusal direction is extracted from the response region (where a reasoning model actually decides to refuse, not the prompt token), then removed by norm-preserving orthogonalization across layers 6–31. The cyber fine-tune raised refusals (78% → 97%) because the corpora are safety-flavored; abliterating after the SFT is what brings them to 0%. The method and code: mandoof1/abliteration.
- Quantization: GGUF Q4_K_M / Q6_K / Q8_0 via a patched
convert_hf_to_gguf.py+ llama.cppllama-quantize.
Full detail, data licenses, and the per-layer verification are in the model card.
Wolfram is a research artifact for defensive security, built and evaluated in an authorized academic context (an ADU capstone) and run locally on already-captured, contained attacker artifacts.
Its refusals are removed — it is not safety-aligned. It will engage with offensive-security content by design. If you deploy it, put it behind application-level content controls — in particular a filter for the mass-casualty / CBRN cluster (explosives, bio, chem, poisoning) — gated where the request and response text can actually be inspected, not inside the inference engine. The application remains responsible for its own content policy.
Everything the model returns is treated as untrusted by HoneySentinel: the transcript it reads is attacker-controlled and could try to steer the answer, so technique IDs must be well-formed and indicators are only kept when the text appears verbatim in the transcript — the model points at evidence, it does not get to invent it.
- HoneySentinel (honeypot-ui) — the honeypot and investigation workspace Wolfram is the analysis stage of.
- abliteration — the refusal-removal pipeline for
qwen3_5/ hybrid-attention models used in the last build stage. - Flexingmeow/wolfram-GGUF — the weights and GGUF downloads.
MIT (this documentation and the model edits). The base model XiaomiMiMo/MiMo-V2.6-Distill-Qwen-9B
is MIT. Training data is under its respective licenses (ODC-BY, Apache-2.0, CC-BY-SA-3.0; SecEval
CC-BY-NC used for evaluation only). See LICENSE.