Jue: Calibrated Decision Models for Cybersecurity

Technical report, October 2026. Models: Jue1Dev/jue (2.5B) and Jue1Dev/jue-flash (350M). Project page: jue1.dev.

Abstract

Much of the work in a security operations team is answering closed questions about a concrete artefact. Is this process tree malicious? Which ATT&CK technique is this? Does this IAM policy allow the request? Is this dependency affected by the advisory? A generative model answers in prose, which then has to be parsed and cannot be thresholded. Jue answers with a probability for every option instead. It takes a state (an alert, a log, a policy, a CVE description, a tool call) and a set of typed questions, and scores all of them in one forward pass. We release two models: Jue, a 2.5B decoder built on MiniCPM5-2B with a LoRA adapter, and Jue-Flash, a 350M bidirectional encoder with a decision head. On security benchmarks Jue reaches .973 on SecQA v1, .921 on VulDetectBench task 1, .735 on CyberMetric-10000 and .723 on CTIBench RCM; it also reaches .863 on BFCL-v4 irrelevance and .836 on When2Call. On the same items of 131 external tasks, the encoder beats the decoder on 14. The released Jue did not meet all of the release criteria we set before training it. This report describes both models, how we measured them, and what does not work.

1. Introduction

Detection engineers, SOC analysts and vulnerability managers make many small decisions a day, and most of them have a short list of possible answers. An automated pipeline needs those answers as numbers it can route on: send the alert to a human if the probability of compromise is between 0.3 and 0.8, block the tool call if the probability of injection is above 0.9. Free text does not give that.

The Jev family of decision models frames the problem as typed questions over a state, answered with calibrated probabilities. Jue implements the same interface with open models that run on one GPU or on a laptop, and focuses on cybersecurity: security operations and detection, threat intelligence, vulnerability management, cloud and identity security, DevSecOps, compliance, and guardrails for AI agents that call tools.

The project started with a different goal, finding deep logic bugs by walking code repositories, and moved to security decisions when that goal stopped improving (Section 6). Two rules held throughout. Every training change was registered before it ran, with its main metric, the smallest effect worth having and the checks that must not regress. Every result was read as a paired comparison with bootstrap intervals, and failures were recorded instead of redefined.

2. Interface

A request has a state and up to 256 questions. There are three question types:

• Choice: pick one of several named options, each with a short description.
• Noul: is this statement true?
• Score: a level on an ordinal scale, such as Informational to Critical.

The response gives a probability for every option of every question. The wire format is the Jev POST /v1/systemone protocol, so existing Jev clients work against either model. A shortened example:

{
  "state": {
    "policy": {"Statement": [
      {"Effect": "Allow", "Action": "s3:*", "Resource": "arn:aws:s3:::finance-reports/*"},
      {"Effect": "Deny", "Action": "s3:*", "Resource": "arn:aws:s3:::finance-reports/*",
       "Condition": {"Bool": {"aws:SecureTransport": "false"}}}]},
    "request": {"action": "s3:GetObject", "context": {"aws:SecureTransport": "false"}}
  },
  "questions": {
    "allowed": {"type": "noul", "instructions": "Under this identity policy, the request is allowed."},
    "decisive_statement": {"type": "choice", "instructions": "Which statement decides the outcome?",
      "criteria": {"ALLOW_S3_ALL": "The Allow statement", "DENY_INSECURE": "The Deny on insecure transport",
                   "IMPLICIT_DENY": "No statement matches"}}
  }
}

Jue answers allowed with 0.11 and puts 0.9965 on DENY_INSECURE.

3. Models

3.1 Jue

Jue is MiniCPM5-2B (42 layers, 2.52B parameters) with a LoRA adapter of rank 32 on all attention and MLP projections. The state is encoded once as a shared prefix; each question is a separate branch that attends to the prefix and to itself only, so answering 20 questions costs one pass over the state, and each answer is the same as if the question had been asked alone. The answer is read from the language-model head: the logits of the option codes after Answer: ( form the distribution over options. One global temperature (T = 1.091) calibrates it.

Training used cross-entropy over the option distribution plus a ranked probability score term for Score questions, AdamW at lr 1e-4 with cosine decay, one epoch, and 12,645 optimiser steps on one RTX PRO 6000. Requests were packed up to 8,192 tokens and never truncated.

3.2 Jue-Flash

Jue-Flash is LiquidAI's LFM2.5-Encoder-350M (10 gated short-convolution layers and 6 bidirectional attention layers) with a decision head. The head gates over several encoder layers depending on the question, lets each question attend to the state, scores options by late interaction (MaxSim) over their tokens, and couples the levels of Score questions so their distribution stays unimodal. Every option of every question is scored in one bidirectional pass. Calibration uses one temperature per question type and a bias for yes/no questions. The context is 4,096 tokens; a longer state keeps its first 70% and last 30%. After warm-up it answers a request in about 0.1 s on Apple silicon.

4. How we measured

External benchmarks were converted to typed questions and scored with each benchmark's own metric. Answers are the argmax of the option distribution, so there are no parsing failures, but the conversion changes some tasks. CTIBench RCM, for example, becomes a choice among listed CWEs instead of free generation, and SWE-bench becomes a choice among files instead of retrieval. Those numbers are reported but marked as not comparable to published leaderboards.

Jue and Jue-Flash were compared on identical items. For each benchmark we kept the items both models answered completely and scored both with the same scorer. Where Jue was read on a 750-question sample, the comparison uses that sample. Differences between training changes were judged with group-clustered bootstrap 95% intervals.

5. Results

5.1 Jue on external benchmarks

SecAlertBench is the clear weak spot. Jue calls 354 of the 527 benign alerts in the sample attacks, which puts it below chance.

5.2 Jue and Jue-Flash on the same items

Jue-Flash leads on SecAlertBench (.637 vs .433), CASTLE (CWE .300 vs .093) and VulDetectBench task 2 (.886 vs .864). The CASTLE and VulDetectBench formats were targeted during its development, so only the SecAlertBench lead is zero-shot. It falls furthest behind on questions that need several options at once (BFCL parallel-multiple .035 vs .965, SecEval multi-answer .011 vs .462), on deciding that no tool should be called (BFCL irrelevance .475 vs .863), on Chinese (SecBench .397 vs .814) and on long agent transcripts that do not fit its context (τ-bench retail .000 vs .296). With a seventh of the parameters it is a fast first pass, not a replacement.

5.3 Worked examples

The model cards show fifteen scenarios written for this release: an EDR process tree, a Sigma rule against a Windows event, two Chinese WAF alerts, phishing headers, a CVE description, a KEV-listed vulnerability, a VEX reachability case, an AWS IAM policy, Kubernetes RBAC and Pod Security, iptables first-match, a test-fixture secret, an agent tool call carrying a prompt injection, and an NIS2 reporting deadline. Every answer shown is real model output. Jue answers 23 of 31 questions as intended and Jue-Flash 17. Jue's misses include calling the phishing mail spam, giving the NIS2 early warning 72 hours instead of 24, and getting the iptables verdict wrong even though it named the right rule.

5.4 Calibration

On question formats like those it was trained on, Jue is well calibrated (ECE .019 for Choice, .015 for Noul, .031 for Score). On external benchmarks it is under-confident: its confidence is .057 to .068 below its accuracy. Temperatures fitted on familiar formats made this worse, and fitting on the benchmarks themselves would be fitting on test data, so we left it. Treat its probabilities on new formats as conservative.

6. What does not work

The final training step was judged against the model before it with criteria fixed in advance. It met three of the eight and missed five:

• Over-abstention. On AthenaBench rcm-open items where a candidate list contains the right CWE, Jue answers "none of these" 28% of the time, up from 4.3%. A bias on the "none" option fixes this only by halving its recall when the answer really is absent.
• Two regressions. Windows security-descriptor (SDDL) access checks and prerequisite API calls, such as an authentication call that must come first, got worse.
• Under-confidence on external benchmarks, described in 5.4.
• Rule execution. Yes/no questions that need a rule evaluated completely (reachability, privilege, dependency resolution, merge eligibility) improved, but only 3 of 17 hard subtasks moved significantly, and they remain well behind choice questions on the same states.

We tested whether the rule-execution gap could be closed by reading intermediate layers instead of the last one. A linear probe at six depths reached .536 at layer 36, equal to the model's own readout (.536); the best intermediate gain was +.0004 against a registered bar of .026. The information is not hidden in earlier layers, so cross-layer readouts would not help this model. A consistency loss between near-identical cases also gave no measurable gain (+.003, bar +.03).

The original code goals were not reached. Repository-level code walking did not improve with more training, and a repeat-training study showed the benchmark was too small to detect realistic effects. Deep logic-bug finding was never achieved or measured.

7. Intended use and limits

Use Jue to rank, route and pre-fill decisions that a person or a deterministic checker confirms: triage queues, alert enrichment, detection-rule checks, CVE and CWE mapping, policy and configuration questions, and guardrails in agent loops. Do not use it to block or enforce on its own, for legal advice, or for questions whose answer is not in the state, such as whether a CVE will be exploited. CVSS arithmetic and analyst triage grades stay near the majority class; use a calculator or other signals for those. It reproduces the semantics of public specifications, not an organisation's own policy, and a wrong "allowed" can hide an exposure.

Both models are defensive. They were not trained to write exploits, payloads, evasion techniques or phishing content.

8. Release

Citation

@misc{jue2026,
  title  = {Jue: Calibrated Decision Models for Cybersecurity},
  author = {{Jue1Dev}},
  year   = {2026},
  note   = {Technical report},
  url    = {https://huggingface.co/Jue1Dev/jue}
}