SOC Agent — SmolLM3-3B (investigation agent)

QLoRA fine-tune of SmolLM3-3B on SOC-Agent-Traces-10K, turning the base model into a SOC investigation agent that reasons step by step, calls nine read-only investigation tools in <tool_call> format, and closes with a structured JSON triage report.

Behavior

alert → reasoning + <tool_call> → tool result → … → fenced JSON triage report

Trained with assistant-only loss on successful traces (success=true): tool results and prompts are masked — only analyst reasoning, tool calls, and the final report contribute to the gradient.

Evaluation (held-out test, report prediction given evidence)

Trained steps: 120 · eval samples: 60

Usage

import torch
from peft import PeftModel
from transformers import AutoModelForCausalLM, AutoTokenizer

base = AutoModelForCausalLM.from_pretrained(
    "HuggingFaceTB/SmolLM3-3B", torch_dtype=torch.bfloat16, device_map="cuda")
model = PeftModel.from_pretrained(base, "alirezaaminzadeh/soc-agent-traces-smollm3-3b")
tokenizer = AutoTokenizer.from_pretrained("alirezaaminzadeh/soc-agent-traces-smollm3-3b")

prompt = tokenizer.apply_chat_template(messages, tokenize=False,
                                       add_generation_prompt=True,
                                       enable_thinking=False)

Parse <tool_call>...</tool_call> blocks from the generation, execute your (read-only) tools, feed results back as role="tool" messages, and iterate until the model emits the fenced JSON triage report. The companion demo Space alirezaaminzadeh/soc-agent-traces implements the full loop with smolagents.

Training setup

• Base: SmolLM3-3B, 4-bit NF4 quantization, LoRA r=32 α=64 on all projections
• TRL SFT, assistant-only loss, max length 3072, lr 1.5e-4 cosine
• Trained on ZeroGPU in quota-bounded bursts with Hub checkpoint resume

License

Apache 2.0