---

license: apache-2.0

library_name: gguf

pipeline_tag: text-generation

tags:

- security

- detection-engineering

- code

- reasoning

- tool-calling

- lora

- llama-3.1

- gguf

base_model:

- meta-llama/Llama-3.1-8B-Instruct

---

Opal-8B — a security-specialized Llama-3.1-8B that beats the stock model

**Opal-8B is stock Llama-3.1-8B-Instruct with defensive-security expertise

trained in via LoRA** — so it keeps the base model's general ability and adds a

large security edge on top. On our harness it **beats stock Llama-3.1-8B-Instruct

overall**, wins on math and security, and matches it on code.

Built by Cognis Digital (US). Native Llama-3.1 tool-calling. Part of the **Opal

suite** with the Opal router.

Why this works (and the merges didn't)

We first tried merging open models (DARE-TIES). Every merge lost to stock

Instruct — a merge only interpolates its components, it can't exceed them, and the

grafts degraded the base's code/math. The fix was to stop merging and train:

a LoRA on frozen stock Instruct, on a defensive-security corpus generated by

open teacher models (gpt-oss-20b, Phi-4). Training adds capability; merging only

averages it. That is the entire difference between the table below and a loss.

Benchmarks (measured here — Ollama, greedy, n = 25 subset, identical harness)

code = HumanEval pass@1 (executed); math = GSM8K exact-match; sec = a

transparent defensive-security keyword rubric

(bench/tasks/sec.json: Cobalt Strike detection, SQLi,

MCP threat-modeling, Sigma, UEFI bootkit). blend = 0.45·code + 0.25·math +

0.30·sec.

| model | code | math | sec | blend |

|---|---|---|---|---|

| Opal-8B (Q4_K_M) | 0.88 | 0.76 | 0.424 | 0.713 |

| Llama-3.1-8B-Instruct (stock peer) | 0.92 | 0.68 | 0.212 | 0.648 |

Opal wins the blend (0.713 vs 0.648), wins math and security, and is within

noise on code. Honest note: stock Instruct is marginally ahead on raw HumanEval

(0.92 vs 0.88) — we publish that, not hide it. Every number reproduces with the

harness in this repo.

Published frontier reference (official full-set numbers, *different harness,

context only — an 8B is not a frontier model*):

| model | HumanEval | GSM8K | source |

|---|---|---|---|

| Llama-3.1-8B-Instruct | 72.6 | 84.5 | Meta official evals |

| GPT-4o | 90.2 | ~96 | public reports |

| Claude 3.5 Sonnet | 92.0 | 96.4 | Anthropic |

> HumanEval/GSM8K are saturated at the frontier and no longer reported

> head-to-head; shown only to place the 8B class. No frontier-parity claim.

Quantization ladder

| file | size | use |

|---|---|---|

| opal-8b-Q4_K_M.gguf | 4.9 GB | default — best size/quality |

| opal-8b-Q5_K_M.gguf | 5.7 GB | higher quality |

| opal-8b-Q6_K.gguf | 6.6 GB | near-lossless |

| opal-8b-Q8_0.gguf | 8.5 GB | maximum fidelity |

Native tool-calling (Ollama)

import ollama
ollama.chat(model="opal-8b", messages=[{"role":"user","content":"weather in Charleston?"}],
            tools=[{"type":"function","function":{"name":"get_weather",
              "parameters":{"type":"object","properties":{"location":{"type":"string"}},
              "required":["location"]}}}])

What it's for

Detection engineering (Sigma/Suricata), threat modeling, MCP/agent security,

firmware/ICS reasoning, secure code review, agentic tool use — with general

code/reasoning at Llama-3.1-8B-Instruct level.

How it was made

Base: Llama-3.1-8B-Instruct (frozen). LoRA (r=16) trained locally on CPU (no

cloud) over a defensive-security SFT corpus distilled from gpt-oss-20b + Phi-4,

then merged and quantized. Recipe and harness are in the repo.

Limitations & safety

Inherits Llama-3.1-Instruct's alignment and knowledge cutoff. Security content is

for authorized, defensive use (detection, threat modeling, hardening). Verify

generated code before running it.

License

Apache-2.0. Trainer/quantizer: PEFT + llama.cpp.