SecJev: Bringing Security Expertise to System One Decision Models
SecJev is a family of 0.8B–9B security-specialized Jev-style decision models that turn text, telemetry, histories, and explicit policies into typed Boolean, choice, or ordered decisions across tasks like prompt-injection detection, traffic analysis, authentication, consensus, federated updates, and vehicle messages. The interesting bit is the unified typed decision interface plus scene-weighted multi-domain training, which reportedly lets a tiny SecJev-0.8B beat a general Kev-9B by a wide margin while using less peak inference memory than generative fine-tuning, though the claims seem bounded by the new SecJev-Corpus/task setup and still show domain/capture-dependent false alarms.
Abstract
Security workflows need models that turn complex observations and explicit policies into decisions. System One models introduced by Jev return typed predictions and probabilities; security specialization supplies the domain expertise behind those predictions. We introduce SecJev, to our knowledge the first family of Jev-like decision models specialized for security, spanning 0.8B to 9B parameters. Built on Kev's single-pass candidate scorer, SecJev learns Boolean, choice, and ordered decisions from text, telemetry, and observation histories. We develop SecJev-Corpus to unify source-label prediction and explicit-policy evaluation across 14 tasks and eight sources. It covers tool outputs, traffic, federated updates, consensus, authentication, and vehicle messages. Scene-weighted training adapts the models across these domains while preserving a shared typed decision interface. Security specialization improves every model in the family; SecJev-0.8B outperforms general Kev-9B by 20.51 percentage points in task-macro accuracy. Comparisons with answer-only generative fine-tuning show close accuracy and latency with lower peak inference memory. Tests on new source groups reproduce gains over Kev in prompt-injection and traffic decisions, with capture-dependent false alarms. We release adapters, decision heads, SecJev-Corpus, and training and inference code.