attacklm 0.5.0__tar.gz → 0.5.2__tar.gz

{attacklm-0.5.0 → attacklm-0.5.2}/ATTRIBUTION.md

@@ -16,11 +16,12 @@ artifact* learned from these sources; they are not a verbatim copy.
   attribution in this file** per each source's license.
 - If you modify the training data, **document what you changed**.
 - If you re-distribute the trained model commercially, **review the
-  AGPLv3 RTA note below** — it has network-distribution implications.
+  DRL-1.1 and BSD-3-Clause requirements below** — they have attribution
+  obligations.
 
 ---
 
-## Training Data Sources (16,982 pairs across 16 buckets)
+## Training Data Sources (21,865 pairs across 23 buckets)
 
 ### 1. Atomic Red Team (redcanaryco)
 
@@ -239,26 +240,27 @@ AGPLv3 terms.
 
 The full per-bucket manifest is at `data/datasets/buckets/manifest.json`.
 It records which pairs come from which upstream source (via the
-`source_file` field). Total: **16,982 pairs across 16 buckets**.
+`source_file` field). Total: **21,865 pairs across 23 buckets**.
 
 | Bucket | Pairs | Upstream sources |
-|---|---:|---|
-| collection | 634 | atomic, caldera, metasploit |
-| command_and_control | 105 | atomic, caldera, metasploit |
-| credential_access | 589 | atomic, caldera, infection_monkey, metasploit |
-| defense_evasion | 1,375 | atomic, caldera, metasploit, RTA |
-| discovery | 1,846 | atomic, caldera, infection_monkey, metasploit, RTA |
-| execution | 767 | atomic, caldera, infection_monkey, metasploit, RTA |
-| exfiltration | 173 | atomic, caldera, metasploit |
-| lateral_movement | 252 | atomic, caldera, infection_monkey, metasploit |
-| persistence | 1,120 | atomic, caldera, infection_monkey, metasploit, RTA |
-| privilege_escalation | 537 | atomic, caldera, metasploit |
+|---|---|---:|
+| collection | 634 | atomic, metasploit, stockpile |
+| command_and_control | 105 | atomic, metasploit, stockpile |
+| credential_access | 589 | metasploit |
+| defense_evasion | 1,375 | metasploit |
+| discovery | 1,846 | atomic, metasploit, stockpile, atlas-arsenal |
+| execution | 767 | atomic, metasploit, stockpile |
+| exfiltration | 53 | atomic, stockpile |
+| lateral_movement | 252 | metasploit |
+| persistence | 1,120 | atomic, metasploit, stockpile |
+| privilege_escalation | 537 | metasploit |
 | orchestrator | 380 | synthetic |
-| ai/jailbreaking | 56 | garak, PyRIT, FuzzyAI, TheBigPromptLibrary |
+| ai/jailbreaking | 50 | garak |
 | ai/prompt-injection | 687 | promptfoo, promptmap, synthetic |
-| tools/infection_monkey | 36 | guardicore/monkey |
 | tools/metasploit | 8,349 | rapid7/metasploit-framework |
-| tools/rta | 76 | endgameinc/RTA (AGPLv3) |
+| defensive/detection_engineering | 5,000 | sigma-hq, elastic-rules, splunk-content |
+| defensive/threat_hunting | 650 | mordor, threathunter-playbook |
+| defensive/incident_response | 200 | nist-ir |
 
 ---
 
@@ -268,16 +270,13 @@ If you fork AttackLM and re-distribute:
 
 1. **Keep this `ATTRIBUTION.md` file intact** in any derivative repo.
 2. **Keep all upstream LICENSE files** in `data/<source>/LICENSE*`.
-3. **Do not remove any source's attribution** when removing its data —
-   if you remove the RTA bucket, also remove the RTA entry above.
-4. **For Apache 2.0 sources (Caldera, MITRE ATT&CK, garak, FuzzyAI):**
+3. **Do not remove any source's attribution** when removing its data.
+4. **For Apache 2.0 sources (Caldera, garak, Mordor, ThreatHunter-Playbook, Splunk):**
    include a `NOTICE` file in your distribution (template below).
-5. **For AGPLv3 (RTA):** if you host a model trained on RTA data over
-   a network, provide access to the corresponding source — this
-   public GitHub repo satisfies that requirement.
-6. **For GPLv3 (Infection Monkey):** the dataset is a transformation
-   of upstream code; the GPL may apply to the JSONL files but not
-   to model weights learned from them.
+5. **For BSD-3-Clause (Metasploit):** preserve the copyright notice and
+   license text in derivative works per BSD §1.
+6. **For DRL-1.1 (Sigma):** preserve attribution to Sigma rule authors
+   per the Detection Rule License.
 
 ### NOTICE template (required by Apache 2.0)
 

{attacklm-0.5.0 → attacklm-0.5.2}/CHANGELOG.md

@@ -4,6 +4,75 @@ All notable changes to AttackLM are documented in this file. Versions follow [Se
 
 ---
 
+## [0.5.0] — 2026-06-24 — Blue-team data sources, team presets, defensive extractors
+
+### Added
+
+- **6 new blue-team/defensive data sources** (~5,850 pairs):
+  - SigmaHQ/sigma: 3,000 detection rules (DRL-1.1)
+  - Elastic/detection-rules: 1,200 EQL/KQL rules (Elastic-2.0)
+  - Splunk/security_content: 800 SPL detections (Apache-2.0)
+  - OTRF/Security-Datasets (Mordor): 500 event log scenarios (Apache-2.0)
+  - OTRF/ThreatHunter-Playbook: 150 hunting playbooks (Apache-2.0)
+  - NIST SP 800-61r3: 200 IR procedure pairs (Public Domain, template-based)
+- **6 new extractor scripts**: `extract_sigma_defensive.py`, `extract_elastic_rules.py`,
+  `extract_splunk_content.py`, `extract_mordor.py`, `extract_threathunter_playbook.py`,
+  `extract_nist_ir.py`
+- **3 team presets** (`presets/red-team.json`, `purple-team.json`, `blue-team.json`)
+  with pre-configured bucket weights for offensive/defensive mix control
+- **`--preset` and `--system-prompt` flags** on `attacklm-balance`
+- **3 new defensive buckets**: `defensive/detection_engineering` (5,000),
+  `defensive/threat_hunting` (650), `defensive/incident_response` (200)
+- **12 attribution files** (SOURCE.md + LICENSE.md per new source)
+- **`notes/BLUE_TEAM_DESIGN_v0.5.0.md`** — full architectural plan (792 lines)
+
+### Changed
+
+- `scripts/init_pipeline.py` — 5 new local probes, 5 new remote repos, 6 new extractors
+- `src/attacklm/cli.py` — 6 new extractors in extraction sequence
+- `data/datasets/buckets/manifest.json` — 21,865 total pairs, 23 buckets, 17 sources
+- `scripts/balance_buckets.py` — preset loading, weight resolution, `--preset` flag
+- `src/attacklm/__version__.py` — bumped to `0.5.0`
+
+### Fixed
+
+- `balance_buckets.py` `BASE_DIR` undefined in preset helpers
+- `_caps_for_target_total` fallback for buckets not in any category share
+- Manifest `total_pairs` math consistency (source_totals sum = tier_totals sum = total_pairs)
+
+---
+
+## [0.4.1] — 2026-06-22 — Evaluation framework, steering vectors, dataset cleanup
+
+### Added
+
+- **7-pattern ds4 evaluation framework** (Patterns 1-7):
+  - Pattern 1: Reference-continuation NLL scoring (`collect_reference.py`, `score_candidates.py`, `compare_scores.py`)
+  - Pattern 2: Golden-vector regression gates (`golden_vectors.py`, 558 lines)
+  - Pattern 3: 100-question domain benchmark (`domain_bench.py`, 563 lines)
+  - Pattern 4: Speed profiling / context-frontier (`speed_bench.py`, 463 lines)
+  - Pattern 5: QA checklist (documentation)
+  - Pattern 6: Steering vectors (`steering.py`, 1,120 lines) — extract, apply, sweep, diagnose
+  - Pattern 7: Narrow-bet philosophy doc
+- **Shared model loader** `_eval_loader.py` (149 lines) — extracted from `eval_retention.py`
+- **4 new CLI entry points**: `attacklm-collect-ref`, `attacklm-score`, `attacklm-compare`, `attacklm-golden`
+- **198 hermetic pytest tests** across 8 test files (all pass, 0.62s)
+- **`notes/EVAL_DESIGN_v0.4.0.md`** (1,098 lines), **`notes/STEERING_REVIEW_v0.4.0.md`** (793 lines)
+- **`EVALUATION.md`**, **`QA_BEFORE_RELEASES.md`** documentation
+
+### Changed
+
+- `scripts/eval_retention.py` refactored to import from `_eval_loader.py`
+- `scripts/domain_bench.py` — integrated steering vector flags
+- `pyproject.toml` — 4 new eval entry points, `eval` optional-dependency group
+
+### Removed
+
+- **8,649 template-generated synthetic records** deleted — dataset reduced from 25,601 → 16,015 pairs
+  (only 380 orchestrator records kept from synthetic sources)
+
+---
+
 ## [0.4.0] — 2026-06-22 — MoE-safe training, retention eval, and experience replay
 
 ### Added

{attacklm-0.5.0 → attacklm-0.5.2}/PKG-INFO

@@ -1,7 +1,7 @@
 Metadata-Version: 2.4
 Name: attacklm
-Version: 0.5.0
-Summary: QLoRA-fine-tuned Qwen2.5-Coder for offensive security and AI red-teaming
+Version: 0.5.2
+Summary: QLoRA-fine-tuned Qwen2.5-Coder for offensive/defensive security and AI red-teaming
 Project-URL: Homepage, https://github.com/Veedubin/AttackLM
 Project-URL: Repository, https://github.com/Veedubin/AttackLM
 Project-URL: Issues, https://github.com/Veedubin/AttackLM/issues
@@ -207,10 +207,11 @@ Description-Content-Type: text/markdown
 
 # AttackLM
 
-> A QLoRA fine-tuning pipeline for a MITRE ATT&CK-grounded red-team AI assistant.
-> 16,982 training pairs · 3B–70B Qwen base · 16GB–128GB VRAM.
+> A QLoRA fine-tuning pipeline for a MITRE ATT&CK-grounded red/blue-team AI assistant.
+> 21,865 training pairs · 3B–70B Qwen base · 16GB–128GB VRAM.
 
 [![License: MIT](https://img.shields.io/badge/code-MIT-blue.svg)](LICENSE)
+[![PyPI version](https://img.shields.io/pypi/v/attacklm.svg)](https://pypi.org/project/attacklm/)
 [![Training data: mixed](https://img.shields.io/badge/data-mixed%20%28see%20ATTRIBUTION%29-orange.svg)](ATTRIBUTION.md)
 [![Python 3.13](https://img.shields.io/badge/python-3.13-blue.svg)](requirements.txt)
 [![Model: 3B-7B Qwen2.5](https://img.shields.io/badge/base%20model-Qwen2.5--Coder--3B--Instruct-green.svg)](https://huggingface.co/unsloth/Qwen2.5-Coder-3B-Instruct-bnb-4bit)
@@ -220,14 +221,17 @@ Description-Content-Type: text/markdown
 ## What is this?
 
 AttackLM is a complete pipeline for fine-tuning a small language model to be
-a competent red-team / AI-security assistant. The training data is grounded in
-**MITRE ATT&CK** techniques, sourced from openly licensed open-source projects
-(Atomic Red Team, MITRE Caldera, Metasploit, Sigma, Infection Monkey, RTA,
-plus prompt-injection and jailbreak corpora for AI-security coverage).
-
-The pipeline ingests 10 MITRE tactic buckets plus 6 specialized buckets
-(orchestrator routing, AI-model attacks, security tooling) and produces a
-QLoRA LoRA adapter you can drop on top of `Qwen2.5-Coder-3B-Instruct`.
+a competent red-team / blue-team / AI-security assistant. The training data is
+grounded in **MITRE ATT&CK** techniques, sourced from openly licensed
+open-source projects (Atomic Red Team, MITRE Caldera, Metasploit, Sigma,
+Elastic, Splunk, Mordor, ThreatHunter-Playbook, NIST IR, plus prompt-injection
+and jailbreak corpora for AI-security coverage).
+
+The pipeline ingests 10 MITRE tactic buckets, 3 defensive buckets, 3 tool
+buckets, 2 AI-security buckets, 1 orchestrator bucket, and 4 extended-category
+buckets (23 total) and produces a QLoRA LoRA adapter you can drop on top of
+`Qwen2.5-Coder-3B-Instruct`. Team presets (red/purple/blue) let you control
+the offensive/defensive mix.
 
 What makes it different:
 - **No LLM in the data pipeline.** Every training pair is deterministically
@@ -251,73 +255,68 @@ its contribution to AttackLM's training mix is documented in
 The full per-source map:
 
 | Source | Pairs | License | Repository |
-|---|---:|---|---|
-| Atomic Red Team | 2,506 | MIT | [redcanaryco/atomic-red-team](https://github.com/redcanaryco/atomic-red-team) |
-| MITRE Caldera / Stockpile | 608 | Apache-2.0 | [mitre/stockpile](https://github.com/mitre/stockpile) |
-| Caldera plugins (arsenal/manx/access) | 56 | Apache-2.0 | [mitre/caldera](https://github.com/mitre/caldera) |
-| Metasploit Framework | 8,349 | BSD-3-Clause | [rapid7/metasploit-framework](https://github.com/rapid7/metasploit-framework) |
-| Infection Monkey | 36 | GPL-3.0 | [guardicore/monkey](https://github.com/guardicore/monkey) |
-| RTA — Red Team Automation | 76 | **AGPL-3.0** ⚠️ | [endgameinc/RTA](https://github.com/endgameinc/RTA) |
-| Sigma rules | (labels) | DRL-1.1 | [SigmaHQ/sigma](https://github.com/SigmaHQ/sigma) |
-| AI-security tools (promptfoo, garak, promptmap, PyRIT, FuzzyAI, TheBigPromptLibrary) | 743+ | mixed MIT/Apache-2.0 | various (see [ATTRIBUTION.md](ATTRIBUTION.md)) |
-| Synthetic orchestrator / prompt-injection | 1,067 | MIT | this repo |
-| **Total** | **16,982** | | |
-
-⚠️ **AGPLv3 note:** RTA is the only AGPL-licensed source. The AGPL has
-network-distribution implications for derivative works. The public
-repository satisfies the source-availability requirement. If you need an
-AGPL-clean deployment, retrain after removing the `tools/rta` bucket.
-See [ATTRIBUTION.md §8](ATTRIBUTION.md) for the full analysis.
+|---|---|---|---|
+| Metasploit Framework | 13,997 | BSD-3-Clause | [rapid7/metasploit-framework](https://github.com/rapid7/metasploit-framework) |
+| Sigma rules | 3,000 | DRL-1.1 | [SigmaHQ/sigma](https://github.com/SigmaHQ/sigma) |
+| Elastic detection rules | 1,200 | Elastic-2.0 | [elastic/detection-rules](https://github.com/elastic/detection-rules) |
+| Splunk security content | 800 | Apache-2.0 | [splunk/security_content](https://github.com/splunk/security_content) |
+| Mordor (OTRF) | 500 | Apache-2.0 | [OTRF/Security-Datasets](https://github.com/OTRF/Security-Datasets) |
+| Atomic Red Team | 1,115 | MIT | [redcanaryco/atomic-red-team](https://github.com/redcanaryco/atomic-red-team) |
+| MITRE Caldera / Stockpile | 390 | Apache-2.0 | [mitre/stockpile](https://github.com/mitre/stockpile) |
+| ThreatHunter-Playbook | 150 | Apache-2.0 | [OTRF/ThreatHunter-Playbook](https://github.com/OTRF/ThreatHunter-Playbook) |
+| NIST SP 800-61r3 | 200 | Public Domain | NIST (template-based extractor) |
+| AI-security tools (garak, promptfoo, promptmap) | 113 | mixed MIT/Apache-2.0 | various (see [ATTRIBUTION.md](ATTRIBUTION.md)) |
+| Synthetic (orchestrator + extended categories) | 380 | MIT | this repo |
+| **Total** | **21,865** | | |
 
 ---
 
-## Quickstart (5 min)
+## Quickstart
+
+### Option A: Install from PyPI (fastest — 30 seconds)
 
 ```bash
 # 1. Install uv (Python package manager, ~10MB)
 curl -LsSf https://astral.sh/uv/install.sh | sh
 
-# 2. Clone this repo
+# 2. Install AttackLM from PyPI with the full CUDA training stack
+uv pip install "attacklm[all]"
+
+# 3. Clone the repo for the training data (the PyPI package is code-only)
 git clone https://github.com/Veedubin/AttackLM.git
 cd AttackLM
 
-# 3a. Install as a Python package (gets you 11 `attacklm-*` commands)
-#    — use `[all]` to get every optional dependency
-uv pip install -e ".[all]"
+# 4. Initialize the dataset (probes local `data/` first; falls back to git clone)
+attacklm-init --yes
 
-#    Or, if you just want the bare CLI dispatchers (no ML stack):
-# uv pip install -e .
+# 5. Train
+attacklm-train-all --single-model \
+  --dataset base/ \
+  --base-model huihui-ai/Qwen2.5-Coder-3B-Instruct-abliterated \
+  --epochs 5 --max-length 2048
+```
 
-# 3b. Alternative: classic uv-managed venv with all deps in pyproject.toml
-# uv sync
+### Option B: Install from source (if you want to modify the code)
 
-# 4. Initialize the dataset (probes local `data/` first; falls back to git clone)
+```bash
+# 1. Install uv
+curl -LsSf https://astral.sh/uv/install.sh | sh
+
+# 2. Clone this repo
+git clone https://github.com/Veedubin/AttackLM.git
+cd AttackLM
+
+# 3. Install as an editable Python package (gets you all `attacklm-*` commands)
+uv pip install -e ".[all]"
+
+# 4. Initialize the dataset
 attacklm-init --yes
 
-#    The single command above replaces steps 4–7 below. If you'd rather
-#    run each step individually, the four commands are still available:
-#
-# 4. Clone upstream data sources (~1.5GB total, optional — data is in the repo)
-# attacklm-clone
-#
-# 5. Extract training data from each source
-# attacklm-extract
-#
-# 6. Augment each JSONL with per-pair source/license attribution
-# attacklm-attribute
-#
-# 7. Organize into 16 MITRE/AI/tools buckets
-# attacklm-buckets
-
-# 8. Pick a base model — use an uncensored/abliterated one (see "Pick a base model" below)
-#    Example: Qwen2.5-Coder-3B-Instruct with refusal direction removed
-#    v0.2.0+ uses --dataset (multi-positional) instead of --include-tools etc.
+# 5. Train
 attacklm-train-all --single-model \
   --dataset base/ \
   --base-model huihui-ai/Qwen2.5-Coder-3B-Instruct-abliterated \
   --epochs 5 --max-length 2048
-
-# Optional: add --hpo for automatic lora_r / lora_dropout sweep
 ```
 
 The trained LoRA adapter lands in `models/attacklm-single_<TIMESTAMP>/`
@@ -338,6 +337,17 @@ The project ships as a **proper Python package** (`pyproject.toml`,
 `src/attacklm/` layout, hatchling build backend) so users don't have to
 build anything by hand.
 
+**Install from PyPI (recommended):**
+```bash
+uv pip install "attacklm[all]"          # CUDA training stack
+uv pip install "attacklm[all-rocm]"     # ROCm training stack
+uv pip install "attacklm[infer]"        # CPU / Apple Silicon (inference only)
+```
+
+Then clone the repo for the training data: `git clone https://github.com/Veedubin/AttackLM.git`
+
+**Install from source** (editable, for development):
+
 There are **two GPU stacks** — pick the one for your hardware.
 
 ---
@@ -437,7 +447,7 @@ prompts. Pick `[all-cuda]` or `[all-rocm]` for actual training.
 
 ---
 
-### 11 console-script entry points
+### 21 console-script entry points
 
 All install paths give you these:
 
@@ -452,11 +462,18 @@ All install paths give you these:
 | `attacklm-build`         | `scripts/build.py`                     | merge → GGUF → install (one shot)      |
 | `attacklm-demo`          | `scripts/demo.py`                      | Multi-agent orchestrator demo          |
 | `attacklm-extract`       | all 6 extractors                       | Extract data from cloned repos         |
-| `attacklm-buckets`       | `setup_buckets.py` + `reorganize_buckets.py` | Organize data into 16 buckets  |
+| `attacklm-buckets`       | `setup_buckets.py` + `reorganize_buckets.py` | Organize data into 23 buckets  |
 | `attacklm-attribute`     | `scripts/augment_attribution.py`       | Add source/license to each JSONL row   |
 | `attacklm-clone`         | `scripts/clone_repos.sh`               | Clone upstream data repos              |
 | `attacklm-init`          | `scripts/init_pipeline.py`             | **One-shot init: clone→extract→attribute→buckets** (probes local first) |
 | `attacklm-balance`       | `scripts/balance_buckets.py`           | Build a balanced subset of the buckets |
+| `attacklm-build`         | `scripts/build.py`                     | merge → GGUF → install (one shot)      |
+| `attacklm-train-lora`    | `scripts/train_template.py`            | Direct LoRA training (single dataset)  |
+| `attacklm-eval`          | `scripts/eval_retention.py`            | Retention evaluation suite             |
+| `attacklm-collect-ref`   | `scripts/collect_reference.py`         | Collect reference model outputs        |
+| `attacklm-score`         | `scripts/score_candidates.py`          | Score candidate models vs reference    |
+| `attacklm-compare`       | `scripts/compare_scores.py`            | Compare multiple candidate models      |
+| `attacklm-golden`        | `scripts/golden_vectors.py`            | Golden vector regression gates         |
 
 The CLI dispatchers are thin wrappers — they use `runpy.run_path()` to
 invoke the canonical script in `scripts/`. So `scripts/` stays the
@@ -499,7 +516,7 @@ thin dispatcher layer.
 
 ## Architecture
 
-The training data is organized into **16 buckets**:
+The training data is organized into **23 buckets**:
 
 - **10 MITRE tactic buckets** — under `base/`: `base/collection`,
   `base/command_and_control`, `base/credential_access`, `base/defense_evasion`,
@@ -510,9 +527,13 @@ The training data is organized into **16 buckets**:
 - **1 orchestrator bucket** — routing decisions across 6 sub-agents
 - **2 AI-model attack buckets** — under `ai/`: `ai/prompt-injection` and
   `ai/jailbreaking` (TA0040 — Adversarial ML)
-- **3 security-tool buckets** — under `tools/`: `tools/infection_monkey`,
-  `tools/metasploit`, `tools/rta` (consolidated tool-specific data, re-routed
-  to MITRE tactics where applicable)
+- **3 security-tool buckets** — under `tools/`: `tools/metasploit`
+- **3 defensive buckets** — under `defensive/`: `defensive/detection_engineering`
+  (Sigma, Elastic, Splunk — 5,000 pairs), `defensive/threat_hunting`
+  (Mordor, ThreatHunter-Playbook — 650 pairs), `defensive/incident_response`
+  (NIST SP 800-61r3 — 200 pairs)
+- **4 extended-category buckets** — `attack_tactics/`, `web_app/`, `cloud/`,
+  `ics/`, `wireless/`, `supply_chain/`, `social_engineering/`
 
 > **v0.2.1 layout change:** the 10 tactic buckets moved from top-level
 > into a new `base/` parent directory, and `ai-models/` was renamed to
@@ -666,13 +687,15 @@ The new dataset spec is dir-shaped and hierarchical:
 | Spec                          | Resolves to                                          | Pair count |
 |-------------------------------|------------------------------------------------------|-----------:|
 | `base/`                       | All 10 MITRE tactic buckets                          |      7,398 |
-| `tools/`                      | All 3 tool buckets (metasploit, infection_monkey, rta) |      8,461 |
-| `tools/metasploit/`           | Just metasploit                                       |      8,349 |
-| `tools/infection_monkey/`     | Just infection_monkey                                 |         36 |
-| `tools/rta/`                  | Just RTA                                              |         76 |
+| `tools/`                      | All tool buckets (metasploit)                         |     13,997 |
+| `tools/metasploit/`           | Just metasploit                                       |     13,997 |
 | `ai/`                         | Both AI buckets (jailbreaking, prompt-injection)      |        743 |
+| `defensive/`                  | All 3 defensive buckets                              |      5,850 |
+| `defensive/detection_engineering/` | Sigma + Elastic + Splunk                        |      5,000 |
+| `defensive/threat_hunting/`   | Mordor + ThreatHunter-Playbook                       |        650 |
+| `defensive/incident_response/` | NIST SP 800-61r3                                   |        200 |
 | `orchestrator`                | The orchestrator bucket                               |        380 |
-| `all`                         | Everything (alias for `base + tools + ai + orchestrator`) |     16,982 |
+| `all`                         | Everything (alias for `base + tools + ai + defensive + orchestrator`) |     21,865 |
 | `tactics`                     | Alias for `base/`                                     |      7,398 |
 
 Multiple specs combine: `--dataset base/ tools/metasploit/` = 10 tactics + just metasploit = 15,747 pairs.
@@ -682,15 +705,17 @@ and translate internally to `--dataset` specs. The new flag wins if both are pas
 
 ### Balanced sampling (`attacklm-balance`)
 
-The 16 buckets are heavily skewed: `tools/metasploit` alone has 8,349
-pairs (49% of the 16,982 total). Training on raw `--dataset all`
+The 23 buckets are heavily skewed: `tools/metasploit` alone has 13,997
+pairs (64% of the 21,865 total). Training on raw `--dataset all`
 makes the model see ~2 Metasploit examples for every 1 non-Metasploit
 example, which overfits it to msfconsole syntax at the expense of
 broader tactical coverage.
 
 `attacklm-balance` builds a balanced subset of the buckets. It applies
 a per-bucket cap (one cap applied uniformly to all buckets) and
-selects examples from each bucket with a chosen strategy:
+selects examples from each bucket with a chosen strategy. Team presets
+(`--preset red-team|purple-team|blue-team`) control the offensive/defensive
+mix with pre-configured bucket weights.
 
 ```bash
 # Dry-run: see the per-bucket caps + total without writing
@@ -715,7 +740,7 @@ attacklm-train --dataset data/datasets/balanced/balanced_7b-128gb.jsonl \
 | `7b-128gb` |          1,500 |     ~9,800  | 7B QLoRA on 128 GB rig                     |
 | `14b-128gb`|          1,500 |     ~9,800  | 14B QLoRA on 128 GB rig                    |
 | `31b-128gb`|          2,000 |    ~10,600  | 31B QLoRA on 128 GB rig                    |
-| `full`     |      unlimited |     16,982  | All data, no cap                           |
+| `full`     |      unlimited |     21,865  | All data, no cap                           |
 | `custom`   |       (you set)|    (you set)| `--per-bucket-cap` or `--target-total`     |
 
 **Strategies** (within a bucket, after the cap is applied):
@@ -860,20 +885,21 @@ print(tokenizer.decode(outputs[0], skip_special_tokens=True))
 ## Data Sources (upstream)
 
 | Project | License | Use |
-|---|---|---|
-| [redcanaryco/atomic-red-team](https://github.com/redcanaryco/atomic-red-team) | MIT | 2,506 atomic test triples |
-| [mitre/stockpile](https://github.com/mitre/stockpile) | Apache-2.0 | 608 adversary-emulation abilities |
-| [mitre/caldera](https://github.com/mitre/caldera) | Apache-2.0 | 56 plugin descriptors |
-| [rapid7/metasploit-framework](https://github.com/rapid7/metasploit-framework) | BSD-3-Clause | 8,349 module description triples |
-| [guardicore/monkey](https://github.com/guardicore/monkey) | GPL-3.0 | 36 plugin manifest triples |
-| [endgameinc/RTA](https://github.com/endgameinc/RTA) | **AGPL-3.0** ⚠️ | 76 Python TTP triples |
-| [SigmaHQ/sigma](https://github.com/SigmaHQ/sigma) | DRL-1.1 | Auxiliary context for triple structure |
+|---|---|---|---|
+| [rapid7/metasploit-framework](https://github.com/rapid7/metasploit-framework) | BSD-3-Clause | 13,997 module description triples |
+| [SigmaHQ/sigma](https://github.com/SigmaHQ/sigma) | DRL-1.1 | 3,000 detection rules |
+| [elastic/detection-rules](https://github.com/elastic/detection-rules) | Elastic-2.0 | 1,200 EQL/KQL detection rules |
+| [splunk/security_content](https://github.com/splunk/security_content) | Apache-2.0 | 800 SPL detections |
+| [redcanaryco/atomic-red-team](https://github.com/redcanaryco/atomic-red-team) | MIT | 1,115 atomic test triples |
+| [OTRF/Security-Datasets](https://github.com/OTRF/Security-Datasets) | Apache-2.0 | 500 Mordor event log scenarios |
+| [mitre/stockpile](https://github.com/mitre/stockpile) | Apache-2.0 | 390 adversary-emulation abilities |
+| [OTRF/ThreatHunter-Playbook](https://github.com/OTRF/ThreatHunter-Playbook) | Apache-2.0 | 150 hunting playbooks |
+| NIST SP 800-61r3 | Public Domain | 200 IR procedure pairs (template-based) |
 | [promptfoo/promptfoo](https://github.com/promptfoo/promptfoo) | MIT | Prompt injection probes |
 | [NVIDIA/garak](https://github.com/NVIDIA/garak) | Apache-2.0 | DAN/probe resources |
 | [utkusen/promptmap](https://github.com/utkusen/promptmap) | MIT | Prompt injection rules |
-| [Azure/PyRIT](https://github.com/Azure/PyRIT) | MIT | Jailbreak templates |
-| [cyberark/FuzzyAI](https://github.com/cyberark/FuzzyAI) | Apache-2.0 | Adversarial prompt resources |
-| [Resident-Falker/TheBigPromptLibrary](https://github.com/Resident-Falker/TheBigPromptLibrary) | mixed MIT/MPL | Jailbreak + system prompt library |
+| [Azure/PyRIT](https://github.com/Azure/PyRIT) | MIT | Jailbreak templates (reserved) |
+| [cyberark/FuzzyAI](https://github.com/cyberark/FuzzyAI) | Apache-2.0 | Adversarial prompt resources (reserved) |
 
 Full attribution, per-pair source mapping, and re-distribution guidance in
 [**`/ATTRIBUTION.md`**](ATTRIBUTION.md).
@@ -883,8 +909,10 @@ Full attribution, per-pair source mapping, and re-distribution guidance in
 ## License
 
 - **Code in this repository** — [MIT License](LICENSE)
-- **Training data** — inherits the most restrictive license of its components
-  (currently AGPL-3.0 from RTA — see [ATTRIBUTION.md §8](ATTRIBUTION.md))
+- **Training data** — mixed licenses per source. The most restrictive
+  licenses in the dataset are DRL-1.1 (Sigma rules) and BSD-3-Clause
+  (Metasploit Framework). See [ATTRIBUTION.md](ATTRIBUTION.md) for the
+  full per-source license table.
 - **Trained model weights** — MIT License as a new statistical artifact
   learned from openly licensed material. Whether model weights are a
   "derivative work" in the copyright sense is an unsettled question; no
@@ -908,6 +936,16 @@ submitting PRs, and extending the bucket/extractor system.
 See [CHANGELOG.md](CHANGELOG.md) for the full version history. Notable
 recent releases:
 
+- **v0.5.0** (2026-06-24) — Blue-team data sources (6 new extractors,
+  5,850 pairs), team presets (red/purple/blue), 3 defensive buckets,
+  21,865 total pairs, 23 buckets.
+- **v0.4.1** (2026-06-22) — 7-pattern ds4 evaluation framework,
+  steering vectors, 198 hermetic tests, dataset cleanup (8,649
+  synthetic records removed).
+- **v0.4.0** (2026-06-22) — MoE-safe training, retention eval,
+  experience replay, DoRA/LoftQ support.
+- **v0.3.0** (2026-06-11) — Dataset license audit, per-source layout,
+  RTA/Infection Monkey/BPL removed, 100% per-record attribution.
 - **v0.2.2** (2026-06-10) — `attacklm-balance` (balanced bucket sampler),
   `attacklm-build` (one-shot merge+GGUF+install), auto-timestamped
   run dirs in `attacklm-train`, accurate epoch counter, GGUF
@@ -927,6 +965,6 @@ recent releases:
 ## Acknowledgments
 
 Thanks to the open-source security community — Red Canary, MITRE, Rapid7,
-Guardicore, Endgame/Elastic, the SigmaHQ maintainers, the promptfoo,
+Elastic, Splunk, OTRF, NIST, the SigmaHQ maintainers, the promptfoo,
 garak, PyRIT, and FuzzyAI teams, and everyone who contributes to the
 projects we depend on. AttackLM stands on their shoulders.

{attacklm-0.5.0 → attacklm-0.5.2}/QA_BEFORE_RELEASES.md

@@ -12,7 +12,7 @@
 **Threshold**: 0 errors, 0 warnings
 
 **Checks**:
-- All 25,601 records present across 20 buckets
+- All 21,865 records present across 23 buckets
 - No duplicate records
 - All required fields present (messages, source, license, attribution)
 - License attribution complete for all records