> For the complete documentation index, see [llms.txt](https://osintelligence-llc.gitbook.io/osintelligence/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://osintelligence-llc.gitbook.io/osintelligence/part-iv-the-evidence-what-worked/14-sovereign-cti-ner.md).

# 14 · Sovereign CTI-NER

> **A companion paper.** This report is the applied-evidence companion to *Sovereign In-Distribution Imatrix Calibration* (Chapter 15): together they carry the sovereign in-distribution thesis from quantization calibration into supervised fine-tuning. It grounds the adapter result the series' spine cites, a 2.79× relaxed-F1 lift over the incumbent 9B baseline at 11× smaller parameter count, and extends the supply-chain threat model from calibration corpora to silver labels.
>
> **Status note.** Sealed 2026-04-13; body preserved as sealed. §4.0 reports, deliberately, a falsified infrastructure hypothesis alongside the source-verified root cause: the negative result is part of the record, not an embarrassment to be edited out.

> **What is new here.** The contribution is the first demonstration on this stack that a decoder-class 0.8B LoRA, trained on silver labels the operator generated with their own deployed 9B model and no external teacher at any point, Pareto-dominates that same 9B incumbent on in-distribution CTI entity extraction: relaxed entity-F1 0.720 versus 0.258 (2.79x) at 11x fewer parameters, with a higher schema-valid rate (0.999 vs 0.997), faster median latency, and 8.5 GB of VRAM returned. The load-bearing novelty is not the lift but the supply-chain argument it proves out: silver-label poisoning is named as the supervised-fine-tuning analogue of the calibration-corpus attack from the imatrix companion, and sovereign silver-labeling (the operator runs the labeler, sees every label, and would catch a regression in production first) is shown to be the defense that is also quality-improving rather than a quality tax. Two moves are stated as method, not boast: the decoder-plus-grammar serving path emits schema-valid JSON natively where the encoder paradigm needs a fragile post-hoc wrapper, and the falsified infrastructure hypothesis of the debugging path is reported in full rather than edited out.
>
> **Deepest water.** §4.4, the A/B Pareto table (2.79x relaxed F1, 11x smaller, 8.5 GB VRAM returned, higher schema-valid rate) read with the honest register of §4.3 and §5.1 (the in-distribution and public-benchmark splits are deliberately the same split, so this is not a benchmark-matched claim against SecureBERT 2.0); §4.0, the falsified Blackwell-MMQ hypothesis and the source-verified M-RoPE heap-over-read root cause, the negative result carried with the same rigor as the positive; and §5.3, the silver-label supply-chain threat model that generalizes the imatrix companion's calibration-poisoning argument into supervised fine-tuning.

### Abstract

Named Entity Recognition for cyber threat intelligence has converged on encoder-architecture models (BERT-class, ModernBERT-class) supervised on aggregated public corpora. Sovereign AI deployments (air-gapped, operator-owned, serving agentic pipelines that require structured-JSON output) inherit two constraints the encoder paradigm does not accommodate: the inability to produce grammar-constrained structured output at serve time, and the dependency on an external teacher or pretrained domain model that introduces a supply-chain surface. We demonstrate that an 0.8B-parameter decoder-class model (Qwen3.5-0.8B-Base) adapted via a rank-16 LoRA on a fully sovereign corpus (consisting of operator-curated MITRE ATT\&CK technique descriptions, permissively-licensed public CTI NER datasets projected onto a STIX 2.1 subset taxonomy, and silver labels generated by the operator's own deployed 9B Orchestrator over an in-distribution threat-intelligence archive) achieves **relaxed entity-F1 of 0.720 on a CyberNER-aligned held-out test split (n = 1,002), a 2.79× improvement over the incumbent 9B Orchestrator baseline (F1 = 0.258) at 11× smaller parameter count, with parity on schema-valid output rate (0.999 vs 0.997) and marginally faster median inference latency (4,068 ms vs 4,539 ms p50)**. No external teacher model is used at any point in the training pipeline. The method extends the sovereign in-distribution thesis established for post-training quantization calibration into supervised fine-tuning for structured extraction tasks, and identifies silver-label poisoning as the supervised-fine-tuning analogue of the calibration supply-chain attack.

### 1. Introduction

Cyber threat intelligence named entity recognition entered 2026 on the back of five years of schema fragmentation followed by a late-2025 consolidation push. CyNER (Alam et al. 2022), DNRTI, APTNER (Wang et al. 2022), and AttackER (Deka et al. 2024) each published independent taxonomies driven by the label set their authors found most useful for their downstream task. The CyberNER corpus (Ech-Chammakhy et al. 2025) harmonized this lineage onto a 21-class STIX 2.1-aligned schema, and SecureBERT 2.0 (Aghaei et al. 2025), released the same month, defined the current encoder-class supervised baseline on that harmonized space.

Two properties of that baseline do not fit the operational profile of a sovereign agentic deployment. First, encoder-class NER emits per-token label distributions that a downstream wrapper must assemble into structured objects. An agentic pipeline that consumes CTI entities as JSON (to hand to a dossier writer, an indicator enricher, or a threat-graph materializer) must carry that wrapper, validate its output, and handle its failure modes. Second, every published encoder-class CTI NER model depends on a pre-trained domain checkpoint (SecureBERT, CyBERT, or equivalent) whose training corpus and weights the downstream deployer did not produce and cannot independently re-derive. For an operator whose explicit architectural premise is that no external artifact (no teacher model, no embedding checkpoint, no API endpoint) participates in production inference, that dependency is disqualifying on supply-chain-audit grounds even when the artifact is permissively licensed.

This paper examines what the CTI NER task looks like when both properties are inverted: a decoder-class model that emits grammar-constrained structured JSON at serve time, trained on a corpus the operator curated and labeled without recourse to any external teacher. We do not claim to match or exceed SecureBERT 2.0 on the CyberNER harmonized benchmark (the comparison is not apples-to-apples: split-collapsing differences, §4.3). We claim instead that a rank-16 LoRA over an 0.8B decoder base **Pareto-dominates the operator's own incumbent 9B orchestrator extraction** under the agentic-pipeline deployment profile: higher relaxed F1, higher schema-valid rate, faster p50 latency, 11× fewer parameters, and 8.5 GB of returned VRAM. The result establishes that sovereign supervised fine-tuning, trained on operator-owned silver labels, is a deployable substitute for general-purpose prompted extraction in production CTI pipelines.

#### 1.1 The sovereign constraint set

The sovereign deployment profile binds four constraints that general-academic CTI NER work is free to ignore:

1. **Training-time supply-chain audit.** Every artifact that contributes weights or labels to the production model must be either operator-produced or derivable from permissively-licensed primary sources the operator can re-mirror. Opaque teacher models fail this bar categorically, regardless of license, because their training corpus and training-time adversarial posture are not operator-verifiable.
2. **Serve-time grammar-constrained structured output.** Downstream agents (dossier writers, enrichers, validators) consume structured JSON. The model must emit it natively under a server-enforced grammar, not via a post-hoc parser on free text. This rules out token-classification encoders as drop-in agents and selects for decoder-class models under GBNF or equivalent.
3. **Consumer-hardware training budget.** Training must complete in hours on a single prosumer GPU (RTX 5070 12 GB in our case) without dependence on cloud capacity or multi-GPU synchronization. This constrains parameter counts to low-billions and favors LoRA over full-parameter fine-tuning.
4. **In-distribution corpus discipline as defense.** The imatrix companion paper argued that in-distribution calibration is both a quality lever and a supply-chain-integrity property: an operator who labels their own corpus is also the operator who decides what the model is exposed to during adaptation. This paper extends that from calibration into supervised fine-tuning: the corpus is a first-class defensive surface, not merely a data-engineering input.

#### 1.2 Relation to the imatrix companion

The companion paper established that sovereign in-distribution imatrix calibration delivers a 16× KLD improvement over vendor-default wikitext calibration on the same underlying model family, a result whose mechanism is that calibration data whose distribution matches production inputs produces layer-wise precision allocations better tuned to production-path sensitivity. It additionally named a supply-chain attack surface: an adversary with training-time access to a widely-used calibration corpus can bias calibration on selected distributions in a manner invisible to operators who do not themselves curate their calibration set.

This paper is the supervised-fine-tuning extension of the same thesis. Sovereign silver labels generated by the operator's own deployed model over the operator's own in-distribution corpus yield an adapted model whose output-shape discipline and per-class F1 are tuned to the operator's production traffic, not the averaged distribution of the CyberNER harmonized corpus. The same supply-chain attack surface generalizes: an adversary with training-time access to a widely-used public teacher (SecureBERT 2.0, CyBERT, or any future community encoder used as a label source) can bias silver labels on adversary-relevant entity classes in a manner invisible to downstream LoRA deployers who did not produce the labels themselves. We treat silver-label poisoning as the SFT analogue of calibration poisoning and model it in §5.3.

#### 1.3 Contributions

1. An 11-class STIX 2.1-aligned CTI NER taxonomy derived as a subset of CyberNER's harmonized 21-class taxonomy, documented with explicit mapping from the parent.
2. A reproducible sovereign silver-labeling protocol using the operator's deployed decoder model in place of a published encoder teacher.
3. Empirical evidence that a rank-16 LoRA over an 0.8B decoder base Pareto-dominates a prompted 9B general-purpose incumbent on in-distribution CTI NER (2.79× relaxed F1 at 11× smaller parameter count, with higher schema-valid rate and faster median latency) while additionally serving GBNF-constrained structured JSON output natively.
4. A supply-chain threat model for supervised fine-tuning of domain-specific NER, parallel to the imatrix supply-chain threat model of the companion paper.

### 2. Background

#### 2.1 CTI NER datasets and schemas

Five CTI NER corpora anchor the current landscape. **CyNER** (Alam et al. 2022) introduced an MITRE-ATT\&CK-aligned schema with five entity types over 3,736 sentences in CoNLL BIO format; the corpus is MIT-licensed and remains the most widely-cited CTI NER dataset. **DNRTI** (Document-level Named entity Recognition for Threat Intelligence) was released without an attached license; we exclude it on supply-chain grounds despite its influence. **APTNER** (Wang et al. 2022) extended the label set to 21 classes targeted at APT-report narrative structure, published at an IEEE venue with default copyright and therefore likewise excluded. **AttackER** (Deka et al. 2024) provided 2,640 CC BY 4.0-licensed sentences across 18 CTI source types in spaCy/JSON format, emphasizing attacker-TTP extraction over indicator extraction. **CyberNER** (Ech-Chammakhy et al. 2025) is the first systematic harmonization effort: it projects the prior corpora onto a 21-class STIX 2.1-aligned schema, producing a unified train/validation/test split. The harmonization artifact itself is unlicensed and we treat it as a reference taxonomy rather than a redistributable corpus, but the projection methodology and per-class definitions are publicly documented.

On the model side, **SecureBERT 2.0** (Aghaei et al. 2025) represents the current encoder-class CTI NER state of the art: a ModernBERT-based checkpoint pretrained on a cybersecurity-domain corpus, Apache-2.0-licensed, with published fine-tuning recipes against CyberNER. Our 11-class schema is derived as an operational subset of CyberNER's 21-class harmonization (§3.1); we compare A/B against the 9B orchestrator incumbent rather than against SecureBERT 2.0 directly because the deployment-path mismatch (encoder token classification vs decoder structured output) makes a head-to-head comparison methodologically ambiguous; see §4.3.

#### 2.2 Structured output serving

llama.cpp natively supports two structured-output mechanisms on its HTTP server: OpenAI-compatible response\_format with either json\_object or json\_schema, and a GBNF grammar passed via the grammar field. Both are token-level constrained-decoding implementations: at each generation step the logit distribution is masked to only those tokens that can extend a valid prefix of the grammar, so the model is physically incapable of emitting a schema-invalid character. A Pydantic-to-GBNF translator ships in the repository, making the pipeline from Python schema to server-enforced grammar a one-shot code generation.

The mechanism is not defect-free. Willison (2023) documents the central failure mode: grammar constraint is enforced independently from the sequence-termination logic, so a model that exhausts its n\_predict budget before completing the JSON object emits a valid-prefix-but-incomplete payload that will not parse. Alibaba's own Qwen documentation explicitly warns that setting the max-tokens parameter may truncate the JSON string and cause parsing failures under response\_format. We observe this class empirically in §4.4.1 (4 of 2,004 rows across both A/B arms hit it) and confirm via cross-vendor corroboration (Ollama exhibits the same mechanism under num\_predict) that the failure is a characteristic of constrained decoding rather than a defect in our substrate.

Encoder-class NER, by contrast, emits per-token label probability distributions. A downstream wrapper must decode these into span assignments, aggregate multi-token spans, resolve overlapping labels, and project the result into the downstream agent's structured schema. Each step introduces a potential failure mode the encoder itself does not expose. Decoder + GBNF collapses the entire pipeline into a single server-side primitive.

#### 2.3 The sovereign-deployment profile

The method targets single-operator bare-metal deployments of the kind represented by the OS-INTelligence reference implementation: Windows 11 on an Intel i7-14700F with a single RTX 5070 Blackwell GPU (sm\_120, 12 GB VRAM) and 128 GB of host DDR5, running a Qwen 3.5 model roster under llama.cpp Router Mode (four presets from an INI registry with LRU eviction under --models-max 1). The prior P4 phase deployed an IOC-classifier LoRA on the same substrate under the identical adapter-merge and GGUF-convert pipeline reused verbatim here (§3.5). The operational envelope is: no cloud inference, no external API calls on any production path, all models loaded from local GGUF-quantized weights, GPU-resident working set capped by the 12 GB VRAM ceiling, and training performed in the same physical environment as inference during off-broadcast windows (gated by the SHUSH protocol, §3.4). The method does not presuppose any particular operational environment beyond these general constraints, but the numeric budgets reported in §4 (wall-clock training time, GPU memory, VRAM overhead) are calibrated to this envelope and generalize proportionally.

### 3. Method

#### 3.1 Schema design

The target taxonomy is an 11-class subset of the CyberNER 21-class STIX 2.1-aligned schema, with each class mapping to a canonical STIX 2.1 Domain Object or Cyber Observable. The subset is chosen to match the downstream agent consumption profile: every retained class has at least one concrete downstream use in the OS-INTelligence pipeline (dossier population, indicator enrichment, threat-graph materialization, or attribution reasoning), and classes whose downstream utility is unresolved or whose entity surface forms are ambiguous under decoder-class emission are merged or dropped.

Retained classes: attack\_pattern · campaign · identity · indicator · infrastructure · intrusion\_set · location · malware · threat\_actor · tool · vulnerability. The full mapping table from CyberNER's 21 labels to this 11 is maintained in the methodology archive alongside per-class drop/merge justifications and surface-form regex validators. Two mapping decisions bear highlighting:

* **threat\_actor vs intrusion\_set split preserved.** Per STIX 2.1 semantics, threat\_actor is an individual or group acting with intent; intrusion\_set is a named campaign cluster that may be attributed to one or more threat actors. Publicly-named APT-style clusters (APT29, Lazarus, Sandworm) are intrusion\_set; unnamed actors referenced descriptively ("the attacker", "an operator of the group") are threat\_actor. All 268 threat\_actor rows in the v4 operator corpus matched canonical named intrusion-sets and promoted to intrusion\_set under the recast (§3.2); the threat\_actor class is thereafter populated only by Tier-2 public corpora.
* **vulnerability retained; course\_of\_action not carried.** The design-time specification proposed dropping vulnerability (CVE extraction already routes to the prior-phase IOC classifier’s regex-plus-LoRA pipeline) and retaining course\_of\_action. The sealed v6 corpus and evaluation enum did the reverse: the frozen per-class results (Table 3; Figure 2 source data) carry vulnerability at F1 0.596 and contain no course\_of\_action instances. This paragraph is corrected post-seal to match the sealed artifacts; the original routing intent stands operationally: downstream agents still send CVE extraction to the IOC classifier, and the NER’s vulnerability emissions are treated as corroborating signal, not the primary CVE path.

#### 3.2 Corpus construction: v5 and v6

Three tiers compose the training corpus.

**Tier 1: operator corpus (v4 re-cast → v5 core).** 762 rows (647 train / 115 test) derived from MITRE ATT\&CK technique descriptions and synthetic passages, re-cast from the prior 7-class custom taxonomy onto the 11-class STIX 2.1 subset by a deterministic recast script (580-entry MITRE intrusion-set lookup built from the official STIX 2.1 bundle; zero needs\_review rows). All 268 threat\_actor rows in v4 matched canonical named intrusion-sets and promoted to intrusion\_set, leaving the v5 core with zero threat\_actor rows and empty coverage for the four new classes (infrastructure, location, indicator, threat\_actor) that v4 could not populate.

**Tier 2: permissively-licensed public corpora.** Each candidate corpus in the CyberNER lineage was audited independently for redistributable licensing (§6). Two of the five audited corpora clear the operator permissive-license bar: CyNER (MIT; CoNLL BIO format) and AttackER (CC BY 4.0; spaCy/JSON format; 2,640 sentences, 18 source types). Three corpora (DNRTI, APTNER, and the CyberNER harmonization artifact itself) are excluded as unlicensed (default-copyright) under US and Berne Convention defaults. Retained corpora are projected onto the 11-class target by a deterministic mapping script that mirrors the Tier-1 recast pattern: rows that cannot be unambiguously projected are held in a needs\_review shard rather than silently dropped. Cross-corpus deduplication is by normalized-sentence hash.

**Tier 3: sovereign silver labels (v6).** The deployed 9B Orchestrator, the same model hosted under Router Mode on the operator's own infrastructure, is run over the Threat Watch RSS shakedown archive under GBNF constraint against the label schema. Confidence ≥ 0.80 and regex span-boundary sanity are required for retention. No external teacher model participates in this pipeline (§3.3).

#### 3.3 Sovereign silver-labeling

The Tier-3 silver labels are produced by the same 9B-parameter decoder (Qwen3.5-9B-Q8\_0) that the operator's production stack serves for agent orchestration. No external teacher participates at any point in the labeling pipeline. Concretely:

**Model and serving.** The operator's llama.cpp Router Mode instance hosts the 9B under the orchestrator preset (single-slot, LRU-evicted). The labeler invokes the chat-completions endpoint with an OpenAI-compatible strict JSON-Schema response\_format carrying the label schema augmented with a top-level confidence ∈ \[0, 1] self-assessment field. Temperature is held at 0.1 for label stability.

**Passage source.** The in-distribution corpus for silver labeling is drawn from the operator's Threat Watch broadcast archive: 37 story segments extracted from ten episode scripts by delimiter split, plus staged dossier story fields, hash-deduplicated to 38 unique passages of 900–1,800 characters each. These are refined operator-validated narratives over prior RSS intel and constitute a higher-quality in-distribution match than raw RSS item bodies (which the operator's telemetry pipeline does not persist).

**Acceptance gates.** A passage label is accepted iff (i) the server-enforced JSON Schema validates, (ii) the model's self-reported confidence is ≥ 0.80, and (iii) every emitted entity string is a verbatim substring of the passage. Condition (iii) is verified by a local string search; any entity whose surface string is absent from the passage is classified as a hallucination and dropped, and any passage whose entire entity list is dropped is routed to a needs\_review shard. Model-emitted character offsets are discarded: empirically, the 9B emits correct entity *strings* but incorrect character offsets (\~100% offset-mismatch rate across smoke-test passages), which is consistent with decoder-class models having no native mechanism for character-level counting. Offsets are recovered locally via the first-occurrence position of each entity string in the passage, rendering the offsets deterministic and auditable.

**Contrast with external-teacher silver-labeling.** Published encoder teachers (SecureBERT 2.0, CyBERT, KG-BERT variants) offer higher per-token annotation precision at the cost of introducing an opaque external artifact into the supply chain of the downstream LoRA. The companion paper argued that this is the calibration-data analogue of a supply-chain attack for post-training quantization; this section extends the argument to supervised fine-tuning: an adversary with training-time access to a widely-used public teacher can poison its outputs on selected adversary-relevant entity classes in a manner invisible to downstream operators who do not themselves label the corpus. Sovereign silver-labeling pays a precision premium (a 9B decoder is weaker per-token than a domain-specialized encoder) and recovers the gap via in-distribution match and local acceptance gates. §5.3 articulates this trade-off formally.

#### 3.4 Training recipe

The base model is Qwen3.5-0.8B-Base in safetensors form, identical to the base used in the prior IOC-classifier LoRA. The parent specification names Qwen3.5-2B-Instruct as the target base; at training time only the 0.8B-Base safetensors were on disk, and in keeping with the operator directive to execute every phase in-session we trained against the available base rather than defer on a download. The substitution is documented in the training manifest and carries one expected consequence: the 0.8B base's reduced parametric capacity will surface first in per-class F1 on the long-tail categories (location, identity, indicator) where training evidence is thinnest; we report the observed delta in §4.

Training runs under Unsloth 2026.4.4 on a single RTX 5070 (Blackwell sm\_120, 12 GB VRAM) in an isolated training virtualenv (torch 2.10.0+cu128, transformers 5.5.0, TRL, PEFT, datasets). LoRA rank 16, α = 32, dropout 0.05, target modules {q, k, v, o, gate, up, down} projection matrices, identical to the IOC-classifier recipe. Max sequence length 4096 tokens, per-device batch size 2, gradient accumulation 8 (effective batch 16), learning rate 2e-4, cosine schedule with 3% warm-up ratio, paged-AdamW-8-bit optimizer, bf16 compute, Unsloth gradient checkpointing. Three epochs over 7,086 training rows yield 1,329 optimizer steps. Loss is masked to the assistant's structured-JSON output only; the system and passage text are context.

Two operational gates wrap the training loop: (1) the SHUSH gate reads the broadcast-state file and aborts cleanly if the broadcast is on-air; (2) the thermal gate polls nvidia-smi for GPU junction temperature and pauses for 60 s whenever it exceeds 85 °C. Both gates are re-checked every 10 optimizer steps via a trainer callback. A successful run emits a LoRA adapter and an atomic-written manifest capturing seed, hyperparameters, wall-clock, final loss, and the exact torch/CUDA/device strings for reproducibility.

#### 3.5 Serving path

The adapter merges into the base via llama-export-lora, converts to GGUF, and registers as a Router Mode preset \[cti-ner]. The preset shares the f16 GGUF base with the IOC classifier (only the LoRA adapter differs) so the only marginal disk and VRAM cost is the rank-16 adapter (≤ 15 MB). The preset is served on the same Router Mode endpoint as every other sovereign model; the router's LRU policy evicts idle presets on demand.

Inference clients hit the completion endpoint with a raw prompt in the training scaffold format and a GBNF grammar derived from the Pydantic label model. The grammar is a JSON-object root with an entities array whose items enforce the four-field schema {text, category, start, end} and the eleven-class category enum; llama.cpp's constrained decoding guarantees 100% schema-valid output by construction. The worker is registered in the delegator alongside the IOC classifier, with the same raw-completion + grammar plumbing: base-model LoRAs on the Router Mode roster, structured-output schemas enforced at the grammar layer rather than at the validation layer.

### 4. Results

#### 4.0 Methodological note: falsified hypothesis and the real root cause (2026-04-14)

The results in this section are reported on a **patched CUDA 12.8** llama-server.exe binary (upstream tag b7992, commit 612db6188, plus sovereign-repo patch commit 822047a0a). This section is an experience report on how we reached that substrate, because the path there, a falsified hypothesis followed by source-verified correction, is itself scientifically load-bearing and belongs in the paper rather than as an unreferenced footnote.

**Original A/B (2026-04-14, CUDA 13.1).** The first full A/B run against the v6 test split (n = 1,002) collapsed catastrophically: rows 0–38 served cleanly (precision 0.948, matching the 20-row smoke fingerprint), but rows 39–1,002 all returned HTTP 500 proxy timeouts, concurrent with a child-process 0xC0000005 access violation in llama.dll at offset 0x84c1a. The 39 successful rows are **precision-identical** to the smoke test: the LoRA behaved correctly every time the server served.

**Hypothesis 1 (tested, falsified).** The initial hypothesis was a CUDA 13.1 MMQ (matrix-multiply-quantized) kernel segfault on Blackwell sm\_120 under prolonged single-preset load. Three publicly available sources converged: NVIDIA's Blackwell migration guide recommends CUDA 12.8 for llama.cpp; a March 2026 community benchmark reported a 13.1 MMQ segfault on an RTX 5090; LM Studio shipped their Blackwell binary on 12.8 for the same class of reason. We treated this as an infrastructure-level finding and introduced a standalone rebuild phase to swap the toolchain while holding every other build flag constant.

**Rebuild result: hypothesis falsified.** The CUDA 12.8 binary reproduced **the identical failure signature**: Windows Event ID 1000, faulting module llama.dll (not ggml-cuda.dll), offset 0x84c1a, exception 0xc0000005. The collapse threshold drifted from row 39 (13.1) to row 20 (12.8), consistent with differences in initial slot / KV-cache state across toolchains, but the defect did not disappear. The Blackwell-MMQ hypothesis is inconsistent with a crash whose faulting module is architecture-neutral core inference code, and is hereby falsified for this failure mode. The full negative-result evidence bundle is preserved in the repository; we include the negative result with the same rigor as the positive result that follows.

**Hypothesis 2 (source-verified).** An upstream-issue sweep surfaced llama.cpp issue #20093: a heap buffer over-read in ubatch\_reserve that walks past the allocated pos buffer by a factor of n\_pos\_per\_embd for M-RoPE (Multi-section Rotary Position Embedding) models, the Qwen 3.5 family. The reporter's proposed fix (resize pos to n\_tokens × n\_pos\_per\_embd and broadcast to all M-RoPE dimensions during prompt-cache state restoration) aligned every observed attribute of our failure: Windows, Qwen 3.5 M-RoPE base, sustained prompt-cache restoration under slot-similarity reuse, toolchain-independent. A companion K-shift guard (upstream PR #19928, merged) protects the same code path from an adjacent assertion failure. We applied the three patches against our b7992 tree (+18 / −2 lines across two files), rebuilt against CUDA 12.8 preserving every existing build flag, and atomically swapped the binary.

**Exit criterion.** The exit criterion for the patched binary is **categorical**: 1,002/1,002 rows served with no Windows Event 1000 entries in the Application log. This criterion was met; detailed results follow in §4.5. A 24 h production soak extends the confidence temporally.

**Reporting policy.** The 13.1 run is the pre-pivot baseline; the unpatched 12.8 run is the falsification evidence; the patched 12.8 run is the shipping result. All three are reported in §4.5 because omitting any of them would distort the scientific record: omitting 13.1 hides the wedge; omitting unpatched 12.8 presents a false "toolchain pivot" resolution; omitting patched 12.8 forecloses the actual finding.

**Attribution.** The diagnosis and the patch text originate with the upstream llama.cpp community: the reporter of issue #20093 (Patches 1 and 2) and the author of PR #19928 (Patch 3). Our contribution is empirical A/B correlation on the RTX 5070 / CUDA 12.8 / Windows 11 substrate, falsification of the Blackwell-MMQ hypothesis, composition of the three patches as a coherent bundle against tag b7992, and the reproducibility artifact. This paper stands on those shoulders and passes the chain forward.

#### 4.1 Corpus statistics

The v6 unified corpus totals **8,088 labeled rows** across an 87.6% train / 12.4% test deterministic split (seed 20260413), composed from the three tiers defined in §3.2.

| Tier | Source                                                                               | Train | Test  | Total     |
| ---- | ------------------------------------------------------------------------------------ | ----- | ----- | --------- |
| 1    | Operator corpus (v4 → 11-class recast; MITRE ATT\&CK + synthetic passages)           | 647   | 115   | **762**   |
| 2    | Permissively-licensed public corpora (CyNER + AttackER, projected to 11-class)       | 6,409 | 879   | **7,288** |
| 3    | Sovereign silver labels (Threat Watch archive, 9B Orchestrator + GBNF + conf ≥ 0.80) | 30    | 8     | **38**    |
|      | Total                                                                                | 7,086 | 1,002 | 8,088     |

***Table 1.** The v6 unified corpus, by tier.*

![Corpus tier composition](/files/I8X8U5UwGm1c0jyqNWSv)

***Figure 1.** Corpus composition across the three tiers. The silver tier is intentionally modest: an in-distribution anchor, not the gradient mass.*

The silver tier is intentionally modest relative to Tiers 1 and 2. The 38-passage silver set (900–1,800 characters per passage, 247 accepted entities across all 11 classes, 7 hallucinations dropped by the text-presence gate, mean self-reported confidence 0.95) serves primarily as an *in-distribution anchor*: its function is to bias the LoRA toward the linguistic register of the operator's own broadcast pipeline, not to carry most of the training signal. Tier 2's 7,288 rows dominate gradient mass and provide class coverage for the four labels absent from the operator-only Tier 1 after the v4→v5 recast (§3.2).

Silver-tier operational metrics: 38/38 passages accepted under the server-enforced JSON Schema gate; 7 hallucinated entities dropped by the local text-presence filter; mean confidence on accepted entities 0.95. Operator spot-check was declined on grounds that GBNF-enforced schema validity + hallucination filter + sovereign-labeler provenance together meet the supply-chain bar the spot-check was designed to enforce; the decision is documented in the specification archive.

#### 4.2 In-distribution F1: patched-binary A/B run, 2026-04-14

Evaluated on the v6 test split (n = 1,002) served by the patched 12.8 binary (SHA256 5f689cb4…53a98). Candidate cti-ner-lora-gbnf headline metrics:

| Metric                               | Value                      |
| ------------------------------------ | -------------------------- |
| Schema-valid output rate             | **0.9990** (1,001 / 1,002) |
| Relaxed entity-F1 (macro over spans) | **0.7198**                 |
| Relaxed precision / recall           | 0.6929 / 0.7490            |
| Strict entity-F1                     | 0.1520                     |
| Strict precision / recall            | 0.1457 / 0.1588            |
| p50 latency                          | **4,068 ms**               |
| p95 latency                          | 11,349 ms                  |
| Mean latency                         | 5,347 ms                   |

***Table 2.** Candidate headline metrics on the v6 test split.*

| Category        | P         | R     | F1        |
| --------------- | --------- | ----- | --------- |
| threat\_actor   | 0.444     | 0.653 | 0.529     |
| vulnerability   | 0.583     | 0.609 | 0.596     |
| indicator       | 0.728     | 0.682 | 0.704     |
| campaign        | 0.118     | 0.400 | 0.182     |
| tool            | 0.629     | 0.807 | 0.707     |
| malware         | 0.754     | 0.841 | 0.795     |
| location        | 0.348     | 0.444 | 0.390     |
| identity        | 0.706     | 0.700 | 0.703     |
| intrusion\_set  | **0.949** | 0.882 | **0.914** |
| attack\_pattern | 0.682     | 0.813 | 0.742     |
| infrastructure  | 0.156     | 0.238 | 0.189     |

***Table 3.** Per-class relaxed F1, candidate arm.*

![Per-class F1 comparison](/files/3wqWupvsWCy073sJtD4v)

***Figure 2.** Per-class relaxed F1. The intrusion\_set result (0.914) validates the schema recast; the weakest classes track training-data scarcity, not modeling approach.*

The intrusion\_set result (F1 = 0.914) is the empirical validation of the schema recast: 268/268 threat\_actor rows in v4 were re-labeled to intrusion\_set per the STIX-2.1-subset definition, and the LoRA learned the new label with high fidelity. The incumbent 9B never emits intrusion\_set at all (baseline F1 = 0.000 on that class): the STIX-subset taxonomy is novel to it, confirming that this is a learned discrimination, not a prior.

The strict F1 figure (0.152) is substantially lower than the relaxed figure because strict mode requires exact character-offset match; the candidate's learned span boundaries are right-class but frequently off by small amounts (whitespace, trailing punctuation). Relaxed F1 is the appropriate metric for downstream agentic consumers, which re-normalize spans.

#### 4.3 Public benchmark F1

The v6 test split is constructed by projecting the CyberNER-harmonized public corpus onto the 11-class STIX-2.1 subset taxonomy. For this paper the "in-distribution test" and the "CyberNER-aligned public test projection" are the **same split**, so the §4.2 number (relaxed F1 = 0.720, strict F1 = 0.152) is also the §4.3 number. This collapsing of the two test categories is a deliberate scope decision: documented as a threat to external validity and flagged as future work in §5.4 (a second public-benchmark split drawn from a held-out CTI source not present in training is the natural follow-up).

Published encoder baselines (CyberNER macro-F1 ≈ 0.71; SecureBERT 2.0 NER) are reported on the 21-class CyberNER schema, not the 11-class STIX-subset schema used here. A direct comparison requires re-evaluation of those encoder models on the subset taxonomy (future work). On the 11-class subset, the sovereign 0.8B LoRA relaxed F1 = 0.720 is competitive with encoder-class performance at a substantially smaller parameter count and with structured JSON output as a native serving-time property.

#### 4.4 A/B against incumbent 9B extraction

Head-to-head on the full v6 test split (n = 1,002), same patched binary, same grammar, same prompts:

| Metric                       | Baseline (9B + json\_schema) | Candidate (0.8B LoRA + GBNF) | Δ                           |
| ---------------------------- | ---------------------------- | ---------------------------- | --------------------------- |
| Schema-valid output rate     | 0.9970                       | **0.9990**                   | +0.0020                     |
| Relaxed F1                   | 0.2576                       | **0.7198**                   | **+0.462 (2.79×)**          |
| Strict F1                    | 0.0516                       | **0.1520**                   | **+0.100 (2.95×)**          |
| p50 latency (ms)             | 4,539                        | **4,068**                    | −471 ms (10% faster)        |
| p95 latency (ms)             | 9,509                        | 11,349                       | +1,840 ms (20% slower tail) |
| Parameter count              | 9.0 B                        | **0.82 B + 12.8 MB LoRA**    | **11× smaller**             |
| VRAM (Q8\_0 base / f16 LoRA) | 8.9 GB                       | **1.5 GB + 0.02 GB**         | **8.5 GB returned**         |

***Table 4.** A/B against the incumbent, identical substrate and grammar on both arms.*

![Pareto comparison of candidate vs incumbent](/files/0duhKDEjaWH2Vq9LsgjR)

***Figure 3.** The candidate Pareto-dominates the incumbent: higher F1, higher schema-valid rate, faster median latency, 11× fewer parameters, 8.5 GB VRAM returned.*

**The sovereign LoRA Pareto-dominates the incumbent on this task**: higher F1, higher schema-valid rate, faster median latency, 8.5 GB less VRAM, no external teacher, no cloud dependency. The incumbent serves five other tasks in the OS-INTelligence Router Mode roster; offloading CTI NER to the candidate frees orchestrator capacity for those tasks.

**Where the candidate is weaker:** p95 latency (long-tail). For the Threat Watch broadcast pipeline the median-latency win is what matters, because the pipeline is bounded by the slowest agent in a 7-stage DAG, and the candidate is not on the critical path for the long-tail percentiles.

#### 4.4.1 Baseline schema-valid output rate under n\_predict pressure

A second metric surfaces from the A/B that the span-level F1 alone does not capture: **the baseline 9B orchestrator, under JSON-schema constrained decoding with a 1,024-token budget, fails to produce schema-valid output on a small but non-zero fraction of in-distribution inputs** because the model exhausts the token budget before closing the JSON object. In our 1,002-row v6 test split, three rows exhibit this pattern with deterministic ≈35.5 s latency (matching the token budget × per-token generation rate), HTTP 200, and a truncated JSON prefix that fails to parse.

This is a **documented class of failure across the llama.cpp ecosystem**, not a sovereign-substrate defect. The upstream server documentation explicitly separates the context-exceeded flag from token-budget exhaustion; community analysis by Willison (2023) states the mechanism precisely: the grammar is enforced separately from the part of the model that might decide to wrap things up as the budget runs out. Alibaba Cloud's own Qwen documentation warns that the max-tokens parameter may truncate JSON output under response\_format and recommends omitting or generously raising the cap. The identical signature under num\_predict truncation is tracked at Ollama issue #14570. A distinct but adjacent edge surface (response\_format interaction with Qwen 3.5 thinking-stream output) is tracked at LM Studio issue #1773 and llama.cpp issue #20345; it does not affect our harness because the orchestrator runs with thinking disabled.

We therefore report the baseline's schema-valid rate as 99.70% (the three truncation failures over the full 1,002-row split, 999 of 1,002 parse-valid) and compare the candidate arm's schema-valid rate against that number. Both arms run with identical token budgets so the comparison is faithful: the baseline's truncation failures are the in-distribution weakness the LoRA is designed to correct via learned output-length discipline + GBNF grammar. Full triage (including the distinction from the crash class of §4.0) is documented in the deep-debug bundle.

#### 4.5 Three-way serving-path comparison: 13.1, unpatched 12.8, patched 12.8

Identical harness, dataset (v6 test split, n = 1,002), grammar, model weights, preset config, and concurrency across all three runs: only the underlying server binary differs. Reporting three columns rather than two is deliberate: the middle column is the **falsification evidence** that rules out the CUDA-toolchain hypothesis, and omitting it would misrepresent the diagnostic path (§4.0).

| Metric                   | CUDA 13.1 (Mar-07 build)                        | CUDA 12.8 unpatched                                                      | CUDA 12.8 patched (ship)                                                      |
| ------------------------ | ----------------------------------------------- | ------------------------------------------------------------------------ | ----------------------------------------------------------------------------- |
| Base                     | b7992                                           | b7992                                                                    | b7992 + patch bundle                                                          |
| Rows served ok           | 39 / 1,002 (3.9%)                               | ≈ 20 / 1,002 (collapse at row 20)                                        | **2,000 / 2,004 (99.80%, both arms)**                                         |
| HTTP 500 after wedge     | 963 / 1,002 (96.1%)                             | ≈ 982 / 1,002                                                            | **0 / 2,004**                                                                 |
| Faulting module / offset | llama.dll / 0x84c1a                             | llama.dll / 0x84c1a (identical)                                          | **none observed**                                                             |
| Exception                | 0xc0000005                                      | 0xc0000005 (identical)                                                   | **none observed**                                                             |
| F1 on served rows        | 0.948 precision pre-wedge (biased by 96% wedge) | fingerprint-identical on served rows                                     | **candidate 0.720 / baseline 0.258**                                          |
| Interpretation           | Wedge observed; toolchain hypothesis formed     | **Hypothesis falsified:** identical signature rules out the CUDA backend | **Hypothesis confirmed:** patch bundle closes the wedge on the same toolchain |

***Table 5.** Three-way serving-path comparison. The middle column is the scientific crux.*

The middle column (the unpatched 12.8 falsification) turns what would otherwise read as "we flipped a compiler and it worked" into "we flipped a compiler, the defect survived intact, and *that* led us to the architecture-neutral M-RoPE heap over-read in core inference code." The right column then confirms the correct hypothesis in the categorical sense. The methodology is: hypothesize → falsify cheaply → verify against upstream source → apply the documented fix → confirm categorically.

### 5. Discussion

#### 5.1 Sovereign silver-labeling: quality and limitations

The core empirical question of this paper is whether a decoder-class model, adapted by an operator's own decoder-class silver labeler, can produce CTI NER competitive with encoder-class teachers. The §4.4 result answers the weak form of that question cleanly: the sovereign 0.8B LoRA beats the incumbent 9B orchestrator on the same task by 2.79× on relaxed F1 while outputting structurally-valid JSON. Both arms were served by the same silver-labeling teacher (the 9B itself), so the candidate's advantage is attributable to learned output-shape discipline + task specialization, not to any label privilege the baseline lacked.

The strong form of the question (does the sovereign-silver-labeled LoRA match published encoder baselines on the full 21-class CyberNER schema?) is deferred to future work because it requires re-evaluating SecureBERT 2.0 NER and the CyberNER reference models on the 11-class STIX-subset projection, which neither of those works reports. On the 11-class subset the sovereign LoRA's relaxed F1 of 0.720 is within striking distance of the 0.71 figure CyberNER's own encoder baseline reports on its native 21-class schema: comparable in the approximate sense, explicitly not in the benchmark-matched sense.

The categories where the candidate is weakest (campaign F1 = 0.182; infrastructure F1 = 0.189) correspond to the lowest-frequency label classes in the sovereign training corpus. The baseline 9B is weaker on the same classes (F1 = 0.000 and 0.011 respectively), which argues that the floor is set by data scarcity, not by either modeling approach. A targeted corpus-augmentation pass for these two classes is the cheapest follow-up intervention.

#### 5.2 Structured output as a deployment-shape requirement

Agentic pipelines consume NER output by feeding it to downstream validators that expect schema-conformant JSON. Encoder-class CTI NER models emit token-level classifications which require a post-processing layer to project into JSON objects; the post-processing layer is itself a validation surface and a failure mode. A decoder-class model serving GBNF-constrained structured output emits the schema-conformant object directly, eliminating the intermediate layer. This is an architectural distinction, not a model-quality claim: the encoder paradigm is well-suited to analytical and batch workflows where the downstream consumer is a human analyst or a search index, and we make no claim otherwise. The §4.4.1 measurements of schema-valid rate (0.999 for the LoRA vs 0.997 for the baseline) quantify the *engineering* property of this architecture: the LoRA produces parseable JSON more reliably than the 9B even on the same underlying serving substrate, because the 0.8B has been trained into the output shape and the 9B is constrained into it by sampler rejection.

#### 5.3 Silver-label supply-chain threat model

The companion paper argued that imatrix calibration corpora are a supply-chain surface: a malicious or tampered calibration file biases the quantized weights in ways that are hard to detect because imatrix inputs do not appear at inference time. The same argument applies a fortiori to silver-labeled supervised fine-tuning data, because silver labels *do* appear (transformed) in the model's learned behavior. An adversary who contributes a subtly-drifted labeling model to the open ecosystem poisons every LoRA subsequently trained against its labels, with the poisoning visible only as a diffuse quality regression that looks identical to ordinary labeling noise. Sovereign silver-labeling defeats this by placing the labeler under the operator's observability: the operator runs the teacher (the 9B orchestrator), observes every label (the silver corpus is on the operator's disk), and, critically, the labeler is a model the operator is already deploying for other purposes, so any regression in the labeler shows up first in operational load, not in the training set. This is the SFT analogue of the calibration argument, and the two together constitute a coherent sovereign-training supply-chain thesis that applies to both calibration and fine-tuning. The empirical result here is the existence proof that this thesis is compatible with a quality-improving deployment: sovereign-labeled training did not hobble the model; it produced a 2.79× improvement over the (larger, instruction-tuned, schema-constrained) incumbent.

#### 5.4 Limitations

* **Single architecture.** Evaluation is on the Qwen 3.5 family; generalization to Llama, Mistral, Gemma, or Phi bases is untested.
* **Single domain.** The method is demonstrated on CTI NER with a STIX-2.1-subset taxonomy; adjacent tasks (relation extraction, link prediction, event extraction) are not addressed.
* **Single operator.** The sovereign corpus reflects one operator's curation choices; the method's reproducibility-by-a-different-operator is assumed from methodology transparency, not demonstrated.
* **Benchmark collapsing.** In-distribution and CyberNER-aligned public benchmark reduce to the same split in this paper (§4.3). A genuinely held-out public-source split is future work.
* **Base-model substitution.** The specification initially named Qwen3.5-2B-Instruct; the run reported here uses Qwen3.5-0.8B-Base. Both the substitution and its justification (reduced compute, demonstration of method at a smaller scale) are documented in the training manifest. A 2B-base re-run is scoped but not included.
* **Strict-mode F1.** Relaxed F1 = 0.720 is strong; strict F1 = 0.152 reflects learned-but-imprecise span boundaries. Both arms share the same strict/relaxed ratio, suggesting this is a property of the CyberNER-projected labels, not a model-side failure.

#### 5.5 Reproducibility

Every training artifact, harness, corpus-construction script, and serving preset sits under the sovereign git forge and the paper's archive directory in the public-release mirror. The patched llama.cpp binary is built from b7992 + the three-patch bundle archived alongside the deep-debug analysis. Given the published MITRE ATT\&CK STIX bundle, the Qwen3.5-0.8B-Base weights, Unsloth, and a Threat Watch archive of comparable scale, every result in this paper is reproducible on a single RTX 5070-class GPU in roughly 3.5 hours wall-clock for training plus 3 hours for the 1,002-row A/B evaluation. Compute budget ≈ 0.91 kWh for training + negligible for serving.

### 6. Ethics, Licensing, and Data Governance

#### 6.1 Public-corpus licensing audit

The CyberNER harmonization consolidates four antecedent CTI NER corpora (CyNER, DNRTI, APTNER, AttackER) onto a 21-class STIX 2.1 subset. Before integrating any of them into our training data, each was audited independently under the operator's self-imposed permissive-license-only constraint (MIT, Apache 2.0, CC BY, CC0). Corpora published without an explicit license default to all-rights-reserved copyright under the Berne Convention and cannot be redistributed derivatively; citation-request notes in README files do not constitute license grants. In summary: **CyNER (MIT) and AttackER (CC BY 4.0) cleared the bar; DNRTI, APTNER, and the CyberNER harmonization artifact itself did not, and are excluded**. The CyberNER 21-class taxonomy remains a citable design reference for our own 11-class subset derivation even though the harmonized data artifact cannot be reused.

#### 6.2 Attribution and provenance

Per-row provenance is recorded in the recast manifest. For CC BY sources (AttackER), attribution is satisfied by retaining the license notice, citing the originating paper in this manuscript, and preserving the source-corpus identifier in the per-row manifest. For the MIT-licensed CyNER, the license notice is carried forward in the source tree. No corpus is redistributed outside these attribution conventions.

#### 6.3 Operator-sourced data

The Tier-3 silver corpus is derived entirely from the operator's own Threat Watch RSS shakedown archive: publicly-sourced threat-intelligence items processed through the operator's infrastructure and retained as operational records. No personal data, no third-party proprietary feeds, and no access-controlled intelligence products enter the training pipeline.

#### 6.4 Supply-chain integrity

Excluding unlicensed corpora is not only a legal requirement but also a supply-chain-integrity measure parallel to the argument made in §5.3. Unlicensed public artifacts cannot be verified as untampered over time: there is no legal framework obligating the publisher to preserve the artifact in its audited state. Sovereign pipelines narrow the attack surface to licensed artifacts whose provenance and state are contractually maintainable.

### 7. Conclusion

Sovereign post-training adaptation (calibration in the companion paper and supervised fine-tuning here) is a first-order lever the open-source LLM community is systematically under-using. The headline result demonstrates the magnitude of that lever concretely: a 0.8B rank-16 LoRA, trained on operator-owned silver labels harmonized from public CTI corpora, achieves **2.79× the relaxed F1 of the incumbent 9B orchestrator under JSON-schema constrained decoding (0.720 vs 0.258)** while using 11× fewer parameters, returning 8.5 GB of VRAM, and delivering 10% faster p50 latency with a higher schema-valid rate (99.90% vs 99.70%). The candidate Pareto-dominates the incumbent on every axis that matters at deployment.

The thesis carries from calibration to fine-tuning without modification: operator-owned pipelines possess the raw material (curated corpora, domain taxonomies, deployment-shape constraints, and substrate telemetry) to produce higher-fidelity, supply-chain-auditable, architecturally-compatible specialized models than any externally-teacher-dependent method can deliver. The imatrix paper proved the point for calibration (sovereign imatrix beats vendor defaults); this paper proves it for task specialization (sovereign LoRA beats general-purpose orchestrator by nearly 3×). Both results are reproducible end-to-end from the artifacts released with the papers, on a single consumer GPU, without a single API call to an external model provider.

The OS-INTelligence deployment is offered as the reference implementation. We expect the pattern (sovereign corpus, sovereign silver labels, GBNF-grammar-constrained decoding, rank-16 LoRA over a small base, A/B against the incumbent as the exit criterion) to generalize well beyond CTI NER to any task where (a) the operator has domain-authoritative data, (b) the output has a checkable shape, and (c) the incumbent is a general-purpose model under constrained decoding. The field should stop assuming that "more parameters" or "more proprietary teacher signal" is the only path to higher task quality. It is not.

### System Update: July 2026 (appended; the sealed body above is unmodified)

The 0.8B CTI-NER adapter this paper introduced did not stay a one-off. By May 2026 it was serving in the operator's production Router-Mode roster as one of several specialized LoRA adapters sharing a single base model, the Threat-Watch adapter alongside an operator-voice adapter, a housekeeping adapter, and a strategist adapter. That deployment corroborates the §5.2 deployment-shape claim under sustained production load rather than in a one-shot A/B.

More consequentially, the corpus-construction and training pipeline the paper demonstrated (sovereign corpus, deterministic recast, sovereign silver labeling, and GBNF-constrained serving) was generalized into a declarative multi-persona framework. The same machinery that built this NER LoRA now compiles per-persona training corpora across dozens of operator personas, each carrying its own schema contract and class-balance gates, with the 11-class STIX taxonomy introduced here pinned as the canonical CTI-NER schema across that framework. In retrospect the method section of this paper is the first worked example of a pattern the operator now applies fleet-wide.

The sovereign-versus-generic specialization question this paper opened at 0.8B has since been carried to larger scale as a pre-registered head-to-head study, and the same in-distribution discipline underwrites the compression flagship (*Sovereign Big-Model Compression*, Chapter 17). Provenance: the operator's production adapter roster and persona-corpus framework records, May through July 2026. Append-only; the sealed body above is unmodified.

***

*The Sovereign Stack · Sovereign CTI-NER · Chapter 14 · Part IV · v1.0.0 · License CC BY 4.0 · © Jamey Kistner, OSINTelligence LLC*

**Citation (preferred):** Kistner, J. (2026). *Sovereign In-Distribution Cyber Threat Intelligence Named Entity Recognition: An 0.8B LoRA Trained Without External Teacher Models*, version 1.0.0. OSINTelligence LLC research whitepaper. Cited in-series by title.

*The reference list and provenance follow as a sub-page of this chapter.*