---

license: other

license_name: modified-mit-mistral-ai-2025

license_link: LICENSE

base_model: mistralai/Devstral-2-123B-Instruct-2512

pipeline_tag: text-generation

tags:

- gguf

- vinci

- cyber

- cybersecurity

- defensive-security

- infrastructure-as-code

- simpledirect

- canadian-ai

---

<img src="./assets/vinci-vero-header.svg" alt="Vinci with Vero, its character" width="280" height="64">

Vinci Cyber 123B 1.0 — GGUF

!Vinci Cyber 123B — defensive security research

GGUF quantizations of simpledirect/Vinci-Cyber-123B-1.0,

for llama.cpp and compatible runtimes.

Vinci Cyber 123B is designed for **defensive infrastructure review and targeted

remediation**: propose a focused repair when needed, and leave correct configuration

alone.

Three formats. Direct task measurements. A clearer deployment choice.

All three tiers have now been evaluated on the V2-B neutral-review infrastructure

test. **Q8_0 matched the released BF16 model's task outcomes: 18/24 repairs and

24/24 correct configurations unchanged.** Q5_K_M repaired 12/24 and Q4_K_M 11/24;

both preserved 24/24 correct inputs. Every credited repair passed the reported

offline provider-schema check.

Choose from Q8_0, Q5_K_M and Q4_K_M using the measured trade-off between download

size and repair coverage below. These are single-run results on 24 matched pairs,

not general BF16 equivalence or a guarantee of security. Use independent checks

and human review before applying proposed changes.

!V2-B quantization comparison: Q8_0, 123.7 GiB, repaired 18/24; Q5_K_M, 82.3 GiB, repaired 12/24; Q4_K_M, 69.8 GiB, repaired 11/24. All three preserved 24/24 correct configurations.

*GGUF task measurements, not inferred source-model scores. File size is not the

total memory required for inference. These GGUF measurements cover V2-B only;

the main card

also reports V2-A and finding-guided BF16 results, where repair and restraint differ.*

Review and improvement

!Conceptual workflow: propose a repair or no change, check syntax and security independently, then obtain human approval before applying.

Recommended review workflow; a conceptual illustration, not an evaluation result.

Our direction is iterative improvement: use evaluated failure cases, independently

checked fixes and human-reviewed feedback to improve future releases, then evaluate

each new iteration. This release has fixed weights; it does not learn automatically

from use.

Files

| Tier | Size (measured) | Files |

|---|---|---|

| Q8_0 | 132,854,420,736 bytes (123.7 GiB) | Vinci-Cyber-123B-1.0-Q8_0/, 3 parts |

| Q5_K_M | 88,316,810,368 bytes (82.3 GiB) | Vinci-Cyber-123B-1.0-Q5_K_M/, 2 parts |

| Q4_K_M | 74,897,134,688 bytes (69.8 GiB) | Vinci-Cyber-123B-1.0-Q4_K_M/, 2 parts |

Sizes above were rechecked on September 23, 2026 by summing the uploaded parts'

Hub file sizes, including split-file headers. They describe download/storage size,

not the total RAM or VRAM needed for inference. Runtime overhead and context cache

require additional memory.

Choosing a format

| Format | Practical distinction | What has actually been checked |

|---|---|---|

| Q8_0 | Highest bit-depth and largest download of the three offered tiers | Structural metadata, uploaded file identity, and the neutral-review infrastructure test on GPU: 18/24 repaired, 24/24 unchanged (same as the BF16 release) |

| Q5_K_M | Intermediate bit-depth and download size | Structural metadata, uploaded file identity, and the neutral-review infrastructure test on GPU: 12/24 repaired, 24/24 unchanged |

| Q4_K_M | Smallest download: about 69.8 GiB across two parts | Structural metadata, file identity, a CPU smoke test, and the neutral-review infrastructure test on GPU: 11/24 repaired, 24/24 unchanged |

The Q4_K_M smoke test generated 47 greedy tokens. This verifies that the tested

CPU configuration could load and generate text; it is not a quality benchmark or a

GPU throughput measurement. No measured quantization-fidelity comparison is available.

On the infrastructure test below, Q8_0 matched the BF16 release; Q5_K_M and Q4_K_M

repaired fewer inputs while leaving every correct configuration unchanged.

Each tier is split into parts of at most 45 GB with llama-gguf-split. Point llama.cpp at

the first part (...-00001-of-0000N.gguf) and it loads the rest. GGUF-SHA256SUMS lists

the sha256 of every part.

You need a llama.cpp build that supports the mistral3 architecture. These files were

produced and tested with llama.cpp commit e6ab7c1a41054a888ada952eab4c886444c2f5ad

(2026-09-22); builds from mid-2026 and earlier may not load them.

llama-cli -m Vinci-Cyber-123B-1.0-Q4_K_M/Vinci-Cyber-123B-1.0-Q4_K_M-00001-of-00002.gguf \
  -ngl 999 -c 8192 --temp 0

Evaluation summary

Earlier BF16 adapter results — not GGUF measurements

| Test | Devstral 2 BF16 parent | Vinci Cyber 123B BF16 + adapter |

|---|---:|---:|

| Correct configurations left unchanged | 0/24 (0%) | 24/24 (100%) |

| Misconfigured inputs repaired by scanner criterion | 17/24 (70.8%) | 16/24 (66.7%) |

| Repair and preserve the already-correct counterpart | 0/24 (0%) | 16/24 (66.7%) |

| HumanEval coding problems passed | 144/164 (87.8%) | 144/164 (87.8%) |

The first three rows use a neutral review prompt on 24 matched infrastructure cases,

one greedy run per condition. Unsafe and already-correct counterparts were presented

independently. Cyber was tested as its trained adapter loaded on the BF16 parent;

the distributed weights merge that same adapter. The released merged BF16 weights were

re-run on the same tests: 18/24 repaired, 24/24 correct configurations unchanged, 18/24

with both halves correct, and HumanEval 144/164 (see the main card). GGUF task results are

reported below. The parent's zero paired score is caused by changes

to already-correct inputs, not zero repair capability. HumanEval is a separate test.

For the eight-category breakdown, methodology and evidence summary, see the

main model card.

GGUF task results

Q8_0, Q5_K_M and Q4_K_M were run on the same neutral-review infrastructure test with llama.cpp

e6ab7c1a on H200 GPUs (CUDA): the same prompts and token ids, greedy decoding and the

same scoring. Every GGUF part was checked against GGUF-SHA256SUMS before the run.

| Measured outcome | BF16 release | Q8_0 | Q5_K_M | Q4_K_M |

|---|---:|---:|---:|---:|

| Held-out set V2-B | | | | |

| Correct configurations left unchanged | 24/24 | 24/24 | 24/24 | 24/24 |

| Misconfigured inputs repaired by the scanner criterion | 18/24 | 18/24 | 12/24 | 11/24 |

| Repair and leave the corrected counterpart unchanged | 18/24 | 18/24 | 12/24 | 11/24 |

| Credited repairs passing provider-schema validation | 18/18 | 18/18 | 12/12 | 11/11 |

| Held-out set V2-A | | | | |

| Correct configurations left unchanged | 24/24 | 24/24 | 24/24 | 24/24 |

| Misconfigured inputs repaired by the scanner criterion | 9/24 | 9/24 | 6/24 | 6/24 |

| Credited repairs passing provider-schema validation | 9/9 | 9/9 | 6/6 | 6/6 |

| General coding | | | | |

| HumanEval (164 problems, greedy) | 144/164 | 143/164 | 144/164 | 146/164 |

Q8_0 matched the BF16 release on every pair. Q5_K_M and Q4_K_M kept full restraint

and added no gate failures; in six and seven cases respectively that the BF16 release

repaired, they made no edit.

All 16 credited earlier adapter-run repairs also passed the reported tofu validate

checks, as did all 17 parent repairs. This checks syntax and provider

schema, not cloud deployability or whether a secret was actually removed.

Under a separate finding-guided prompt format (D96_COMPATIBLE), the earlier BF16

adapter run recorded 1 invalid clear and 3 availability regressions. The released

merged BF16 weights recorded 1 invalid clear and 5 availability regressions, and

left 14/24 correct inputs unchanged (versus 23/24 in the adapter run). On V2-A

under that finding-guided format, the release recorded 4 new security findings.

Under that format the GGUF tiers repaired the same 20/24 as the BF16 release and left

14/24 (Q8_0), 19/24 (Q5_K_M) and 21/24 (Q4_K_M) correct inputs unchanged; each recorded

the same invalid clear, with 5, 3 and 3 availability regressions respectively, plus 1 and

2 new security findings for Q5_K_M and Q4_K_M. In a secrets-management case it base64-encoded

a hard-coded secret instead of removing it, clearing the scanner without restoring

the security property; it also unnecessarily rewrote that case's already-safe twin.

In an Azure API Management case it wrote an invalid backend protocol value

("https" instead of the allowed http or soap), and the finding still fired.

These outcomes are separate from the neutral-review results in the table above.

On V2-A neutral review, the released BF16 model repaired 9/24 versus its parent’s

15/24, while preserving 24/24 versus 0/24 correct inputs. V2-A GGUF results are in

the table above.

These narrow, single-run measurements do not establish broad cybersecurity capability.

See the main model card

for the full methodology, other prompt-format results and limitations.

Provenance

The tiers come from the same merged weights as the main repository, not from a separate

merge:

S18427 LoRA adapter + BF16 parent
        |  one merge (package_final.py)
        v
merged safetensors  -- shard-set sha256 f6c8b82262d5848135a007694b234fae60d97b58ffe7696cb6639b0ce22d5ea8
        |                          |
        v                          v
main repository              convert_hf_to_gguf.py -> BF16 GGUF master -> llama-quantize tiers

The conversion job re-hashed the merged shards and refused to run unless their shard-set

digest matched the value above. GGUF-STATUS.json records the digest, the llama.cpp commit

and the checks below.

Checks performed

| Check | Result |

|---|---|

| Source identity | shard-set digest re-verified before conversion |

| Structure (all tiers and the BF16 master) | architecture mistral3; 795 tensors; 125,025,988,608 parameters (equal to the safetensors); 88 layers; 96 attention heads, 8 KV heads; vocabulary 131,072; chat template present; YaRN rope metadata present |

| Runtime | Q4_K_M loaded in llama.cpp e6ab7c1a on CPU and produced coherent greedy text. Q8_0, Q5_K_M and Q4_K_M then ran the full infrastructure test on H200 GPUs (CUDA build of the same commit). |

| Remote identity | each part's Hub sha256 compared with GGUF-SHA256SUMS after upload |

Quantization fidelity (for example KL divergence against the BF16 master) was not

measured. It would describe drift from the master, not what the model can do.

Decoding defaults

The model's metadata may carry the base model's sampling defaults (temperature: 0.15).

Vinci evaluated with greedy decoding. Set decoding explicitly (--temp 0 for greedy) when

you need reproducible or comparable results.

Licence — a practical guide

The 123B release inherits Mistral AI’s Modified MIT License from

Devstral 2—not Apache-2.0 or standard MIT. It covers the model and associated documentation.

What can I do with it?

Eligible users may use, modify, distribute and sell the model, including commercially.

Does the revenue restriction affect me?

The licence does not grant rights if your company’s **or your employer’s global

consolidated monthly revenue exceeded $20 million (or equivalent) in the preceding

month**. This is revenue—not profit, annual revenue or model revenue.

Derivatives, modifications and combined works remain subject to this condition.

**For scale: $20 million per month equals $240 million per year when annualized

($20 million × 12). This is an illustration—not an annual eligibility threshold.**

The licence uses the preceding month’s actual consolidated revenue, not annual

revenue divided by twelve. An organization below $240 million in annual revenue

can still exceed $20 million in a particular month and fall under the restriction.

Check the monthly condition; do not rely on annual revenue alone.

If affected or unsure, contact Mistral’s licensing team.

A separate commercial licence is discretionary, not automatic.

What if I redistribute or quantize it?

Keep Mistral’s attribution and permission notice with copies or substantial portions.

GGUF conversion does not remove these conditions. No warranty is provided.

Read the authoritative LICENSE and accompanying NOTICE.

This summary is not legal advice; the full terms control.

The private specialization corpus is not included or licensed for redistribution.

Mistral AI has not reviewed, approved or endorsed Vinci Cyber.

Distributed under the Modified MIT terms in LICENSE, with attribution in NOTICE.