> For the complete documentation index, see [llms.txt](https://osintelligence-llc.gitbook.io/osintelligence/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://osintelligence-llc.gitbook.io/osintelligence/part-iv-the-evidence-what-worked/14-sovereign-cti-ner/references-and-provenance.md). # References & provenance ### References Aghaei, E., Jain, S., Arun, P., & Sambamoorthy, A. (2025). "SecureBERT 2.0: Advanced Language Model for Cybersecurity Intelligence." [arXiv:2510.00240](https://arxiv.org/abs/2510.00240) (Cisco AI; ModernBERT-based). Apache-2.0; current encoder-class CTI NER baseline. Alam, M. T., Bhusal, D., Park, Y., & Rastogi, N. (2022). "CyNER: A Python Library for Cybersecurity Named Entity Recognition." [arXiv:2204.05754](https://arxiv.org/abs/2204.05754). MIT-licensed corpus and library. Alibaba Cloud Model Studio. "Enforce Structured JSON Output with Qwen Models." (accessed 2026-04-14). Deka, P., Rajapaksha, S., Rani, R., Almutairi, A., & Karafili, E. (2024). "AttackER: Towards Enhancing Cyber-Attack Attribution with a Named Entity Recognition Dataset." *WISE 2024.* CC BY 4.0. Ech-Chammakhy, M., et al. (2025). "CyberNER: A Harmonized STIX 2.1-Aligned Corpus for Cyber Threat Intelligence Named Entity Recognition." [arXiv:2510.26499](https://arxiv.org/abs/2510.26499). Reference taxonomy; artifact itself unlicensed. Gerganov, G., and the ggml-org contributors. *llama.cpp.* . MIT. This work pins tag b7992 (commit 612db6188) with three sovereign patches (commit 822047a0a) resolving upstream issue #20093 and cherry-picking PR #19928. ggml-org contributors. *llama.cpp tools/server README* (n\_predict, truncated, json\_schema parameters); *pydantic\_models\_to\_grammar.py*; Issue #20345 (grammar enforcement with thinking enabled). All accessed 2026-04-14. Kistner, J. (2026). [*Sovereign In-Distribution Imatrix Calibration Achieves 16× Tighter KL Divergence Than Generic-Corpus Quantization on a 35B-A3B MoE Model*](/osintelligence/part-iv-the-evidence-what-worked/15-sovereign-imatrix-calibration.md) (Chapter 15). OSINTelligence LLC. The companion paper; cited in-series by title. Kistner, J. (2026). "Content-level failures (non-crash class) analysis." OSINTelligence deep-debug technical note; distinguishes content-class from crash-class failures with community corroboration. LM Studio contributors. Bug #1773: response\_format json\_schema applied to reasoning stream on Qwen 3.5. (accessed 2026-04-14). OASIS Cyber Threat Intelligence Technical Committee (2021). *STIX Version 2.1 OASIS Standard.* Ollama contributors. Issue #14570: qwen3 tool call parser returns 500 when model output is truncated. (accessed 2026-04-14). Qwen Team (2025). *Qwen3 Technical Report.* Alibaba Group. Qwen 3.5 model family used throughout this work. Wang, X., Liu, X., Ao, S., et al. (2022). "APTNER: A Specific Dataset for NER Missions in Cyber Threat Intelligence Field." *IEEE CSCWD 2022.* Default copyright; cited as reference taxonomy, not redistributed. Willison, S. (2023). "Using llama-cpp-python grammars to generate JSON." [til.simonwillison.net/llms/llama-cpp-python-grammars](https://til.simonwillison.net/llms/llama-cpp-python-grammars) (accessed 2026-04-14). ### Author Contributions **Jamey Kistner** is the sole author: system architecture, sovereign deployment, MITRE ATT\&CK ingestion pipeline, operator corpus curation, validation and acceptance gating, and final editorial control. Large language models were used as research tools in support of the work (methodology research, schema derivation, training-recipe specification, silver-labeling protocol design, validation-harness authoring, and draft composition under operator review); their role is detailed in the AI-assistance disclosure below. ### Reproducibility Statement All artifacts are archived under the paper's directory in the sovereign repository: training code, corpus-construction scripts, silver-labeling pipeline, merged GGUF adapter, serving preset, validation harness, and the public-corpus license audit. Given access to the published MITRE ATT\&CK STIX 2.1 bundle (January 2024 release or later), the Qwen3.5-0.8B-Base safetensors checkpoint, Unsloth 2026.4.4, and a Threat Watch-class RSS-intel archive of comparable scale, every result in this paper is reproducible on a single RTX 5070-class GPU in a bounded overnight window (training 3.6 h wall-clock; silver labeling \~7 min; full A/B harness \~3 h). The patched llama.cpp serving binary is rebuildable from upstream b7992 + the three archived patches. **Evidence & seal.** The A1 harness record behind this chapter, its A/B report reproduced verbatim with the per-class F1 table, the serving-binary SHA, and the zero-crash-in-2,004-rows receipt, is in the record's evidence section: [CTI-NER A/B (P6)](/osintelligence/evidence-and-seals/cti-ner-a-b-p6.md). (Report-class harness record: it pre-dates the canonical-prefix sealing discipline, so it carries a validated report rather than a self-hash, as stated on the page.) ### AI-assistance disclosure Large language models were used as research tools in the preparation of this chapter: Claude Opus 4.6 (Anthropic). The model versions and roles named above keep the provenance of this chapter auditable. No AI system is listed as an author or credited as a contributor, in line with COPE and ICMJE guidance: an AI system cannot take responsibility for the work, cannot assert competing interests, and cannot enter a licence agreement. The author verified every claim in this chapter against the sealed artifacts and is solely accountable for it. **Citation (preferred):** Kistner, J. (2026). *Sovereign In-Distribution Cyber Threat Intelligence Named Entity Recognition: An 0.8B LoRA Trained Without External Teacher Models*, version 1.0.0. OSINTelligence LLC research whitepaper. Cited in-series by title. **License:** CC BY 4.0 (text). Code and data artifacts MIT per repository license. **Corresponding author:** Jamey Kistner, , OSINTelligence LLC (Columbus, OH). *** *The Sovereign Stack · Sovereign CTI-NER · Chapter 14 · Part IV · v1.0.0 · License CC BY 4.0 · © Jamey Kistner, OSINTelligence LLC*