Weights are not a database. We checked, twice.
We tried to put a threat-intelligence graph inside a language model, first from scratch at three sizes, then by teaching a 20B model 358,000 facts. It learned half of them and lost the ability to say "I don't know".
Three weeks building a cyber LLM in public: what worked, what failed
From a 34M model trained from scratch to an untrained 27B reader that scores 197 of 200, a livestream and a census of data nobody else has. A dated log of three weeks, failures included.
Bars before runs: how we stop ourselves cheating on LLM evals
Every model we train has its pass marks written down and dated before the run starts. Training data is cold-audited and fingerprinted. Here is the method, and the three times it caught our own mistakes.
We ran seventeen fine-tunes. One sentence beat them all.
Seventeen LoRA runs and $448 of rented GPUs later, the best threat-intelligence reader we measured was an untrained Qwen3.8-27B plus one rewritten instruction. The numbers, the trade-off, and why.
We tried to make the weights the database. The database won.
Two days, a 34M model built from scratch, a 3B reader, under $30 of rented GPU. How we trained a cyber language model on our own threat graph, found a leak in our own first result, and served it on four CPU cores.