Corvus™ v2 is a fine-tuned Llama 3.1 8B model that produces structured triage decisions for software vulnerabilities. Given CVE data, CVSS scores, EPSS probability, KEV listing status, and asset context, it outputs a JSON decision with priority, recommended action, reasoning, and confidence score.
Built by CVERiskPilot — 100% Veteran Owned, Texas, USA.
Distribution Status
Corvus v2 weights are not currently distributed on Hugging Face.
This repository remains public for model documentation, licensing terms, and release-status updates while distribution strategy is under review.
Why This Exists
Offensive AI is accelerating. AI fuzzers are finding thousands of zero-days across every major codebase. The scanning problem is being solved. The triage problem is getting 10x harder.
Security teams are drowning in findings they can't prioritize fast enough. Attackers exploit in 5 days. Defenders patch in 209. That gap gets worse every quarter.
Corvus doesn't find vulnerabilities. It decides what to do about them — at machine speed, on local hardware, with no data leaving your environment.
Model Details
Property
Value
Base model
meta-llama/Llama-3.1-8B-Instruct
Fine-tuning method
QLoRA (r=16, alpha=32, dropout=0.05)
Training examples
50,000+ labeled vulnerability triage decisions
Training compute
8x NVIDIA A100 (Vertex AI), ~1.2 hours
Priority accuracy
94.8%
Full match (priority + action)
82.7%
Training loss (final)
0.461
Throughput
11.9 samples/sec
Intended Use
Use this model for: Prioritizing and triaging software vulnerabilities in security operations workflows. Deciding which CVEs need immediate attention vs. scheduled patching vs. risk acceptance.
Do not use this model for: Generating exploits, finding vulnerabilities, offensive security operations, or any purpose that could harm system security. This is a defensive triage tool.
Human oversight required: Model outputs are recommendations, not autonomous decisions. All triage decisions should be reviewed by a qualified security professional before action.
Output Format
Corvus outputs structured JSON with five fields:
json
1{2"severityOverride":"EPSS in top 1% with active exploitation — upgrading from MEDIUM to CRITICAL",3"priority":"CRITICAL",4"recommendedAction":"PATCH_IMMEDIATELY",5"reasoning":"CVE-2024-XXXXX affects the authentication module in a production-facing service. EPSS score of 0.94 indicates high exploitation probability. Listed in CISA KEV with a remediation deadline. The affected package is a direct dependency with no available workaround. Asset is internet-facing with access to PII.",6"confidenceScore":0.927}
Fields
Field
Type
Description
severityOverride
string | null
Explanation if the model's priority differs from raw CVSS severity
priority
string
CRITICAL, HIGH, MEDIUM, or LOW
recommendedAction
string
One of 6 actions (see below)
reasoning
string
Detailed explanation referencing specific technical factors
confidenceScore
number
0.0 to 1.0 — model's confidence in the decision
Action Taxonomy
Action
When to use
PATCH_IMMEDIATELY
Active exploitation, critical asset, no workaround
SCHEDULE_PATCH
Important but not actively exploited, patch available
MITIGATE
Patch unavailable or risky — apply compensating controls
Class balancing across all 6 action types and 4 priority levels
Human review of edge cases and override patterns
The training data is not included in this release.
Evaluation
Evaluated on a held-out test set of 5,000 examples:
Metric
Score
Priority accuracy (4-class)
94.8%
Action accuracy (6-class)
84.4%
Full match (priority + action)
82.7%
Confidence calibration (ECE)
0.08
Known Limitations
Trained on public CVE data only. The model has no knowledge of proprietary or internal vulnerability disclosures.
No asset topology reasoning. The model uses asset context fields provided in the input but cannot reason about network topology or dependency chains on its own.
English only. Training data is exclusively English-language CVE descriptions.
Temporal cutoff. Training data includes CVEs through early 2026. The model may be less accurate on novel vulnerability classes that emerge after this date.
Not a scanner. Corvus triages known vulnerabilities. It does not discover, detect, or exploit vulnerabilities.
Ethical Considerations
This model is designed exclusively for defensive security operations. It helps security teams prioritize remediation work, not bypass security controls.
We release it openly because we believe defensive AI capabilities should not be gated behind enterprise contracts while offensive AI capabilities continue to advance. Security teams at organizations of every size deserve access to intelligent triage.
The model outputs recommendations, not autonomous actions. Every decision should be reviewed by a qualified professional before implementation.
Modelfile, documentation, and evaluation code: Apache 2.0
CVERiskPilot Commercial Use Addendum
This model is released under the Llama 3.1 Community License with the following additional terms from CVERiskPilot LLC:
Permitted use:
Internal vulnerability triage within your organization
Research, benchmarking, and academic use
Integration into internal security tooling and workflows
Fine-tuning for your own internal use
Educational and non-commercial use
Restricted use (requires a commercial license from CVERiskPilot LLC):
Offering this model or any derivative as a hosted, managed, or API-accessible vulnerability triage service to third parties
Embedding this model or any derivative in a commercial product sold or licensed to third parties
Redistributing fine-tuned versions for commercial purposes
Trademark notice:
No trademark license is granted under this repository, the Llama 3.1 Community License, or this addendum.
"Corvus", "Corvus AI", "CVERiskPilot", and related logos are claimed trademarks or common-law marks of CVERiskPilot LLC.
Derivative works may not use the "Corvus™" or "CVERiskPilot™" names, logos, or branding without written permission.
You may make factual nominative reference to Corvus v2 only to identify the original model, provided that use does not imply endorsement, affiliation, certification, or sponsorship by CVERiskPilot LLC.
Corvus™ was created by CVERiskPilot LLC and has been in continuous development and commercial use since January 2026.
Milestone
Date
CVERiskPilot LLC incorporated (Texas)
2026
Corvus v1 (Strix) internal deployment
January 2026
Corvus v2 training data pipeline (50K+ examples)
February–March 2026
Corvus v2 QLoRA training completed (Vertex AI)
April 5, 2026
Corvus v2 deployed to production (CVERiskPilot platform)
April 8, 2026
Corvus v2 public Hugging Face documentation repository
April 2026
NVIDIA Inception program membership
Active
All training artifacts, commit history, GCP job logs, and deployment records are retained by CVERiskPilot LLC as evidence of continuous use and first use in commerce.
