jeff-adapter-soc-gguf

The LoRA GGUF of jeff-adapter-soc (Jeff v1.3), for llama.cpp.

Security alert triage. Applies a security team's playbook to a new alert - ignore, investigate, isolate, block or escalate.

This repository holds only the adapter. Load it on top of the base GGUF from mstrasser/jeff-base-gguf; there is no separate full model per adapter.

It works on either base format: Q8_0 (recommended, within 0.4 points of full precision on every adapter test) or Q4_K_M (within 0.4 points).

Files

soc.jeff.json has a temperature for each format (temperature_by_format: f16, q8_0, q4_k_m); use the one for your base format, so the probabilities stay calibrated.

Results

The same test, through llama.cpp: the base GGUF plus this LoRA GGUF, with the temperature refitted for each format. Running Jeff with llama.cpp

All results, and the same test at full precision against the untrained model and the base alone: jeffhub.ai/adapters/soc.

How to run it

Use llama.cpp commit cb7934c52ca8710994b2ecc19775ebefcfdb8d01 or newer: it needs the qwen35 architecture and LoRA on the output layer.

hf download mstrasser/jeff-base-gguf --local-dir jeff-gguf
hf download mstrasser/jeff-adapter-soc-gguf --local-dir jeff-gguf
cd jeff-gguf
llama-server -m models/base-q8_0.gguf -c 8192 -np 1 --lora-init-without-apply --lora loras/soc.gguf

Jeff is not a chat model. For each decision you run one forward pass over the prompt and read the probabilities of the answer codes; you never sample text.

1. Build the prompt exactly as Jeff does (the question, the state, the options as answer codes, and the changing state field under "Latest", then the chat template with thinking off). The Jeff repository builds it for you (jeff.model.decision_messages).
2. Tokenize without a beginning-of-sequence token, with special tokens parsed.
3. Run one forward pass over the whole prompt from an empty state, with this adapter active. Clear the state between prompts: Qwen3.5 has recurrent layers, so a reused state would carry over.
4. Read the probabilities. Take the logits of the first N answer-code tokens (token_ids[:N], N = the number of options), divide by the temperature for this adapter and your format, and apply a softmax over those N.

With llama-server, each decision is one POST /completion with "n_predict": 1, "cache_prompt": false, a lora list that names every loaded adapter (scale 1 for this one, 0 for the rest; an adapter left out of the list keeps scale 1.0), a logit bias of +1000 on every answer-code token of the request, and n_probs set to the number of options. From the llama.cpp library: load the base once with llama_model_load_from_file, this adapter once with llama_adapter_lora_init, and per request call llama_set_adapters_lora with scale 1, clear the memory, decode once and read llama_get_logits_ith(ctx, -1).

The full guide, with an example prompt and request: Running Jeff with llama.cpp.

Data and licence

Adapter licence: CC BY-NC 4.0 (Creative Commons Attribution-NonCommercial 4.0: free to use and share with credit, but not for commercial purposes). The JeffHub page still lists the adapter's licence as to be decided; this release uses CC BY-NC 4.0.

Qwen3.5-0.8B notice: these weights were modified from Qwen3.5-0.8B by the Jeff project: jeff-base is a fine-tune of Qwen3.5-0.8B, and this adapter was trained on top of it. Qwen3.5-0.8B is Copyright 2026 Alibaba Cloud and licensed under the Apache License, Version 2.0; a copy of that licence is in LICENSE.

To confirm: the adapter's licence and whether it may be released, given the UNSW-NB15 and CERT terms.

It was trained on:

• UNSW-NB15 (network alerts). Licence: Free use for academic research; commercial use prohibited (ReadMe.pdf, copyright Nour Moustafa) (non-commercial use only) · Not made by a model

  Moustafa and Slay, "UNSW-NB15 - a comprehensive data set for network intrusion detection systems", MilCIS 2015.

  To confirm: whether an adapter trained on UNSW-NB15 may be published or used commercially

• EMBER 2018 (endpoint alerts). Licence: MIT (data files; the code in the same repository is AGPL-3.0) (open licence) · Not made by a model

  Anderson and Roth, "EMBER - An Open Dataset for Training Static PE Malware Machine Learning Models", arXiv:1804.04637, 2018.

• CERT Insider Threat Test Dataset r4.2 (insider alerts). Licence: ExactData end-user agreement, "Copyright 2011 ExactData, LLC, All Rights Reserved"; no redistribution, derivative works only to the minimal extent necessary (all rights reserved; publishing anything built on it needs the owner’s permission) · Not made by a model

  Lindauer, Insider Threat Test Dataset, Carnegie Mellon University, 2020. The data is synthetic (CERT's generator), from 2010-2011.

  To confirm: with the licence owner, whether anything built on the insider rows (the adapter, the test set) may be published

• Synthetic playbooks and alert context. Licence: Built for this adapter; terms follow the adapter's licence (made for this adapter) · Made by GLM 5.3 (own hardware), for the reworded texts; everything else by code

  285 fictional organisations with their playbooks, inventories and thresholds, and the alert context (hosts, directions, lookups), generated by code with fixed seeds. Playbooks and some alerts were reworded by GLM 5.3 and checked by code.

Links

• The adapter at full precision: mstrasser/jeff-adapter-soc (revision v1.3)
• The base GGUF: mstrasser/jeff-base-gguf
• Adapter page: jeffhub.ai/adapters/soc
• Running Jeff with llama.cpp: jeffhub.ai/docs/llama-cpp

Jeff is an independent project. It uses the same request format as Jev but is not affiliated with or endorsed by TypeSafe, the makers of Jev.