AttackLM

AttackLM — QLoRA fine-tuning pipeline for a MITRE ATT&CK-grounded security AI assistant. 24,652 training pairs · Qwen2.5-Coder base · 16GB+ VRAM.

GUI (New in v0.7.1)

AttackLM now includes a terminal-based GUI for all commands. No more memorizing 40+ CLI flags.

pip install attacklm-gui
attacklm-gui

Features:

• Training form with 40+ params in 5 tabs (Basic, LoRA, GaLore, Advanced, Hardware)
• Live training monitor with loss sparkline, VRAM gauge, progress bar, and log viewer
• One-click screens for extract, balance, infer, merge, build, pipeline, and init
• 5 built-in presets (3B Q-GaLore, 3B LoRA, 7B Q-GaLore, 7B QLoRA, etc.)
• Pause/resume/quit controls during training
• Works in terminal-only environments — no X11, no browser, no GPU required. Works over SSH and WSL.

The CLI still works exactly as before. The GUI is a thin wrapper that constructs and runs CLI commands.

Install

The recommended way to install the full CUDA training stack:

pip install attacklm[all]

Alternative: Use uv pip install "attacklm[all]" for faster installation. Note: flash-attn is optional and not included by default to avoid heavy compilation requirements.

Init

Initialize the dataset by cloning upstream repositories, extracting data, adding attribution, and organizing into buckets:

attacklm-init --yes

Balance (Optional)

Because Metasploit accounts for ~64% of the raw data, balancing is recommended to prevent overfitting and ensure broad tactical coverage.

attacklm-balance --profile 7b-16gb --output data/datasets/balanced/balanced.jsonl

• Presets: Use --preset red-team, purple-team, or blue-team to control the offensive/defensive mix.
• Profiles: Use profiles like 3b-16gb or 7b-16gb to automatically set per-bucket caps based on your VRAM.

Train

Train the model using the orchestrated pipeline. The default base model is Qwen/Qwen2.5-Coder-3B-Instruct.

attacklm-train-all --single-model --dataset all --epochs 5 --max-length 2048

Key Training Flags

Multi-round SFT: AttackLM supports iterative training. You can train on tactics first, then tools, then a final general pass. Each round automatically backs up the previous state and uses the merged weights of the prior run as the new base.

Build

Perform a one-shot merge of the LoRA adapter and conversion to GGUF format for local deployment.

attacklm-build --adapter models/attacklm-single_TIMESTAMP --name attacklm

Infer

Smoke-test your trained adapter with a set of representative security prompts.

attacklm-infer --adapter models/attacklm-single_TIMESTAMP

Bucket Reference Table

The dataset is split into buckets to allow for granular control over training composition.

Note: 6 defensive buckets (detection_engineering, threat_hunting, incident_response, plus sigma/elastic/splunk/mordor/threathunter/nist sources) are planned but have 0 records currently.

Data Sources

Architecture

Data is organized in a per-source hierarchy to ensure provenance and attribution.

AttackLM/
├── data/
│   └── datasets/
│       └── buckets/
│           └── sources/
│               └── <source>/
│                   └── <bucket>/
│                       └── <tactic>/
│                           └── data.jsonl

This layout allows the pipeline to deterministically extract data from upstream sources without introducing hallucinations or API dependencies.

CLI Reference

v0.8.0: The 21 hyphenated commands are consolidated into a single attacklm command with subcommands. The old commands still work but print a deprecation warning. They will be removed in v0.9.0.

Unified Command (v0.8.0+)

Legacy Commands (Deprecated, removed in v0.9.0)

License

The code in this repository is licensed under the MIT License. Training data consists of mixed licenses per source; see ATTRIBUTION.md for the full mapping.

Contributing

See CONTRIBUTING.md for guidelines on contributing to AttackLM.

Changelog

See CHANGELOG.md for the full version history.