vectrayx-base-260m-gguf/README.md

---
language:
- es
- en
license: apache-2.0
tags:
- cybersecurity
- tool-use
- function-calling
- thinking
- llama-cpp
- gguf
- latam
- spanish
base_model: []
model_type: llama
pipeline_tag: text-generation
library_name: gguf
---

# VectraYX-Base-260M

**VectraYX-Base-260M** is a 260M parameter language model specialized in cybersecurity for Latin America, trained from scratch in Spanish. It supports native tool use with `<|tool_call|>`, explicit reasoning with `<think>`, and technical conversation in Latin American Spanish.

> Compact architecture, efficient on CPU/GPU, deployable with Ollama and llama.cpp.

---

## Key Features

- **260M parameters** — lightweight, fast, deployable on consumer hardware
- **Native tool use** — generates `<|tool_call|>{...}<|/tool_call|>` JSON blocks
- **Chain-of-thought** — explicit reasoning with `<think>...</think>` tags
- **LATAM-first** — trained on Latin American Spanish corpus (laws, regulations, regional context)
- **Cybersecurity-first** — CVE Q&A, threat classification, pentesting commands, MITRE ATT&CK
- **GGUF / llama.cpp** — compatible with Ollama, LM Studio, llama.cpp

---

## Architecture

| Parameter | Value |
|---|---|
| Total parameters | 260M |
| Layers | 16 |
| Attention heads | 16 |
| KV heads (GQA) | 4 |
| d_model | 1024 |
| d_ffn | 4096 |
| Vocab size | 16,384 |
| Context length | 1,024 tokens |
| RoPE theta | 10,000 |
| QK-Norm | No |
| Tie embeddings | Yes |
| GGUF architecture | `llama` |

---

## Training Pipeline

### Phase 1 — General Pretraining
- **Corpus:** general conversational Spanish
- **Tokens seen:** ~4.24B
- **Goal:** linguistic base and Latin American Spanish comprehension

### Phase 2 — Technical Specialization
- **Corpus:** cybersecurity documentation, CVEs, writeups, tools
- **Tokens seen:** 2.03B (epochs=1.0)
- **Steps:** 15,500 | **Final loss:** 2.07
- **Total accumulated:** 6.27B tokens (~1.2× Chinchilla optimal for 260M)

### Phase 3 — Domain Adaptation (tools + LATAM)
- **Corpus:** 31,969 hybrid examples with `<think>` + LATAM + tool SFT
  - Cybersec hybrids generated with GPT-4.1-mini + real Kali/Ubuntu sandbox
  - LATAM: cybersecurity laws, regulations, regional corpus
  - Tool SFT inherited from VectraYX-Nano
- **Epochs:** 0.1 (surgical pass, no overfitting)
- **Mix:** 70% tools, 20% tech replay, 10% conv replay

### SFT — Instructions + tool use + thinking
- **Data:** 17,508 examples with loss masking on assistant turns
- **Thinking:** supervised `<think>` examples (Option A)
- **Curriculum:**
  - Epoch 1: 100% conversational
  - Epoch 2: 70% conv + 30% CVE Q&A
  - Epoch 3: 55% conv + 30% CVE + 15% tool use (with `<think>`)
- **Steps:** 1,065 | **Final loss:** 0.064

---

## Benchmarks — VectraYX-Bench

Evaluated with the internal VectraYX-Bench harness (B1–B5), N=1 seed.

| Benchmark | Description | Base (post-P3) | Post-SFT |
|---|---|---|---|
| **B1** CVE Q&A | Keyword recall in CVE responses | 0.337 | 0.341 |
| **B2** Classification | Threat classification accuracy | 0.215 | 0.185 |
| **B3** Commands | Tool match in pentesting commands | 0.210 | **0.350** |
| **B4** Tool use | Correct JSON tool activation | 0.230 | 0.230 |
| **B5** Conversational | Coherence in Spanish dialogue | 0.691 | **0.755** |

> **Note:** B2 drops slightly post-SFT — expected, as SFT prioritizes tool use and conversation over classification. B3 and B5 show the largest gains.

---

## Qualitative Evaluation (22 questions, 7 categories)

Zero-shot evaluation with llama.cpp on CPU (Azure Standard_D8s_v3). N=22 questions covering CVE knowledge, tool use, chain-of-thought, pentesting commands, MITRE ATT&CK, and conversation.

### Results by Category

| Category | Questions | Passed | Score |
|---|---|---|---|
| Pentesting commands | 4 | 4 | **100%** |
| MITRE ATT&CK | 2 | 1 | 50% |
| Conversation (cybersecurity ES) | 4 | 1 | 25% |
| CVE Knowledge | 4 | 0 | 0%* |
| Tool Use | 5 | 0 | 0%* |
| Thinking | 3 | 0 | 0% |
| **TOTAL** | **22** | **6** | **27%** |

> *CVE and Tool Use require external augmentation: the model is designed to query CVE facts via `<|tool_call|>` rather than memorize them. With tool augmentation (NVD/CISA KEV backend) scores improve significantly (see B1=0.341, B4=0.230 in VectraYX-Bench).

### Behavioral Metrics

| Metric | Value |
|---|---|
| `<think>` activated (when appropriate) | 41% of responses |
| `<|tool_call|>` generated (zero-shot) | 14% of responses |
| Responds in Spanish | 82% of responses |

### Example Responses

**Nmap scan with chain-of-thought + tool_call:**
```
Q: Give me the exact nmap command to detect services and versions on 192.168.1.0/24,
   scanning all TCP ports.

A: <think>To detect services and versions on 192.168.1.0/24, I should use nmap
with the -sV flag which detects open service versions. I will run nmap -sV
192.168.1.1 to get this information.</think>
<|tool_call|>{"name": "bash_exec", "args": {"cmd": "nmap -sV -p- 192.168.1.0/24"}}<|/tool_call|>
```

**SUID binaries (exact answer):**
```
Q: What is the find command to search for SUID binaries in Linux that could be
   used for privilege escalation?

A: find / -perm -4000 -type f 2>/dev/null
```

**Hydra SSH brute-force with reasoning:**
```
Q: How would you use Hydra to brute-force SSH on 10.0.0.1 with rockyou.txt?

A: <think>The user wants to perform a brute-force attack on SSH at 10.0.0.1
using the rockyou.txt wordlist. I should use Hydra with -l for the user
and -P for the wordlist.</think>
hydra -l root -P /usr/share/wordlists/rockyou.txt ssh://10.0.0.1 -t 4
```

**Gobuster directory fuzzing:**
```
Q: Give me a gobuster command for directory fuzzing on http://target.com using common.txt.

A: gobuster dir -u http://target.com -w /usr/share/wordlists/dirb/common.txt
```

### Observations

- **Primary strength:** pentesting command generation (nmap, hydra, gobuster, find SUID) — 100% accuracy with direct prompts.
- **Chain-of-thought:** `<think>` activates in 41% of responses, including complex commands and incident analysis.
- **CVE knowledge:** the model has general severity knowledge but does not memorize specific CVEs — intentional design. With tool augmentation (NVD/CISA KEV) responses are precise.
- **Zero-shot tool use:** `<|tool_call|>` activation is lower on generic prompts. The model responds best when the system prompt includes the exact tool schema from training.

---

## Quick Start

### With Ollama

```bash
ollama run jsantillana/vectrayx-base-260m
```

### With llama.cpp

```bash
llama-cli -m vectrayx-base-260m-f16.gguf \
  --prompt "<|system|>You are VectraYX, a cybersecurity expert for LATAM.<|end|><|user|>How do I scan open ports on a network?<|end|><|assistant|>" \
  -n 512 --temp 0.7
```

### With Python (llama-cpp-python)

```python
from llama_cpp import Llama

llm = Llama(model_path="vectrayx-base-260m-f16.gguf", n_ctx=1024)
response = llm(
    "<|system|>You are VectraYX, cybersecurity expert for LATAM.<|end|>"
    "<|user|>Explain CVE-2021-44228<|end|><|assistant|>",
    max_tokens=512,
    temperature=0.7,
)
print(response["choices"][0]["text"])
```

---

## Conversation Format

```
<|system|>System instructions<|end|>
<|user|>User question<|end|>
<|assistant|><think>
Internal reasoning here...
</think>
<|tool_call|>{"name": "nvd_get_cve", "args": {"cve_id": "CVE-2021-44228"}}<|/tool_call|>
<|tool_result|>{"cvss_score": 9.8, "severity": "CRITICAL", ...}<|/tool_result|>
Response to user...<|end|>
```

### Available Tools

| Tool | Description |
|---|---|
| `nvd_get_cve(cve_id)` | Get CVSS score, description and references for a CVE |
| `nvd_search(query, limit)` | Search recent CVEs by keyword |
| `cisa_kev_check(cve_id)` | Check if a CVE is in CISA's KEV catalog |
| `mitre_get_technique(technique_id)` | Describe a MITRE ATT&CK technique |
| `otx_check_ioc(ioc_type, value)` | Check IP/domain/hash reputation in AlienVault OTX |
| `bash_exec(cmd)` | Execute a bash command for analysis or forensics |

---

## Training Data

The model was trained on:
- General conversational Spanish corpus (Phase 1)
- Cybersecurity technical documentation and CVEs (Phase 2)
- **Synthetic hybrid dataset** generated with GPT-4.1-mini + real Kali Linux sandbox:
  - `help_grounding`, `unknown_tool`, `man_section`, `multi_hop_2/3`
  - `recovery`, `negative_no_tool`, `cvss_reasoning`, `ad_attacks`
  - `malware_analysis`, `red_blue_dual`, `compliance_report`
- **LATAM corpus:** Latin American cybersecurity laws, national regulations, regional context
- **Tool SFT** inherited from VectraYX-Nano: `tool_sft_mini_v1`, `tool_sft_v3_bash`, `tooluse_dataset`

---

## Responsible Use

This model is designed for cybersecurity professionals, incident response teams, and educators in Latin America. Knowledge of offensive techniques is included for **educational and defensive purposes**.

**Do not use for:** unauthorized attacks, exploitation of systems without permission, or illegal activities.

---

## VectraYX Family

| Model | Params | Specialty |
|---|---|---|
| VectraYX-Nano | ~35M | Ultra-lightweight, edge, LATAM |
| **VectraYX-Base-260M** | 260M | Cybersecurity LATAM, tool use, thinking |

---

## Citation

```bibtex
@misc{vectrayx-base-260m-2026,
  title        = {VectraYX-Base-260M: A Cybersecurity Language Model for Latin America},
  author       = {Santillana, Juan S.},
  year         = {2026},
  publisher    = {Hugging Face},
  url          = {https://huggingface.co/jsantillana/vectrayx-base-260m-gguf}
}
```

---

*Trained on Azure H100 NVL · Pipeline: PyTorch + llama.cpp · Exported to GGUF*