A LoRA adapter for ibm-granite/granite-4.0-350m that classifies a described GenAI security incident into one of 14 attack-vector classes (a closed set).

This is one of three adapters built to share a single Granite Switch checkpoint (alongside CTI technique-mapping and text-to-JSON generation), so its LoRA shape is identical across all three: rank 16, alpha 32, on the fused q/k/v/o attention projections and the input_linear / output_linear MLP projections.

Evaluation

Held-out eval (n = 222), greedy decoding, exact-match over the 14-class label set:

Metric	Score
Accuracy	74.8% (166 / 222)
Macro-precision	77.4
Macro-recall	74.9
Macro-F1	75.1
Malformed generations	0

Intended use

Triage / routing of GenAI-related security incident reports into a fixed attack-vector taxonomy. Defensive-security use; outputs should be reviewed by an analyst.

Quick start

python

from peft import PeftModel
from transformers import AutoModelForCausalLM, AutoTokenizer

base = "ibm-granite/granite-4.0-350m"
tok = AutoTokenizer.from_pretrained(base)
model = AutoModelForCausalLM.from_pretrained(base, device_map="cuda")
model = PeftModel.from_pretrained(model, "barha/granite-genai-attack-vector-350m-lora")

messages = [{"role": "user", "content": "<incident description here>"}]
inputs = tok.apply_chat_template(messages, add_generation_prompt=True, return_tensors="pt").to("cuda")
out = model.generate(inputs, max_new_tokens=32)
print(tok.decode(out[0, inputs.shape[1]:], skip_special_tokens=True))

Training

Base: ibm-granite/granite-4.0-350m
Method: supervised fine-tuning (TRL), LoRA r=16 / α=32, dropout 0.05
Target modules: q_proj, k_proj, v_proj, o_proj, input_linear, output_linear
Data: emmanuelgjr/genai-incidents

License: Apache-2.0