Kali-Terminus-v2

Kali-Terminus-v2 is a fine-tuned LFM2.5-350M model specialized for Kali Linux terminal command execution. It converts natural language instructions into precise shell commands with native LFM2.5 <|tool_call_start|>/<|tool_call_end|> JSON tool calls.

This is the Executor Agent in a multi-agent penetration-testing system — it translates one bounded instruction into one structured terminal action.

Model Details

Property	Value
Base Model	LFM2.5-350M
Architecture	LFM2 hybrid (10 conv + 6 full-attention layers)
Parameters	350M
Context Length	128K tokens (trained with 1024)
Fine-Tuning	LoRA (r=16, alpha=32, 11 target modules)
Training Data	iselabvn/Kali-terminal-executor-v2 (2,418 samples)
Precision	float32 (merged)
Format	<|im_start|> / <|im_end|> with native <|tool_call_start|>/<|tool_call_end|> JSON tool calls

Performance

Evaluated across 5 scenarios (26 turns) covering network recon, system enumeration, web recon, DNS recon, and self-correction:

Metric	Score
Strict Pass Rate	92.31%
Tool Call Parse Rate	100.0%
Exactly One Tool Call	100.0%
Semantic Command Accuracy	92.31%

Comparison with V1

Model	Strict Pass Rate	Improvement
Kali-Terminus-v1 (FunctionGemma-270M)	65.8%	—
Kali-Terminus-v1 (LFM2.5-350M)	50.0%	—
Kali-Terminus-v2	92.31%	+42.3 pp over v1 LFM2.5

Dataset

Fine-tuned on iselabvn/Kali-terminal-executor-v2, a curated collection of 2,418 shell command execution pairs combining 1,380 source records with 1,000 synthetically augmented records (DeepSeek-V4-Flash).

Top tools in training data: nmap · dig · gobuster · curl · whatweb · sqlmap · find · hydra · uname · ss · subfinder · dnsrecon · ffuf · id · nikto

Usage

from transformers import AutoModelForCausalLM, AutoTokenizer

model = AutoModelForCausalLM.from_pretrained("iselabvn/Kali-Terminus-v2", trust_remote_code=True)
tokenizer = AutoTokenizer.from_pretrained("iselabvn/Kali-Terminus-v2", trust_remote_code=True)

messages = [
    {"role": "user", "content": "Scan port 80 on 192.168.1.1"}
]
inputs = tokenizer.apply_chat_template(
    messages,
    tools=[{
        "type": "function",
        "function": {
            "name": "exec",
            "description": "Execute a shell command in the Kali terminal.",
            "parameters": {
                "type": "object",
                "properties": {"command": {"type": "string"}},
                "required": ["command"]
            }
        }
    }],
    add_generation_prompt=True,
    return_tensors="pt"
)
outputs = model.generate(**inputs, max_new_tokens=256)
response = tokenizer.decode(outputs[0][inputs["input_ids"].shape[-1]:], skip_special_tokens=False)
print(response)
# Expected: <|tool_call_start|>{"name": "exec", "arguments": {"command": "nmap -p 80 192.168.1.1"}}<|tool_call_end|>

Tool Call Format

Kali-Terminus-v2 produces native LFM2.5 tool calls wrapped in <|tool_call_start|> and <|tool_call_end|> tokens, output as JSON:

<|tool_call_start|>{"name": "exec", "arguments": {"command": "nmap -p 80 192.168.1.1"}}<|tool_call_end|>

A system instruction Output function calls as JSON. is prepended so the model emits JSON rather than the default Pythonic calls.

Tool Call Format

Kali-Terminus-v2 produces native LFM2.5 tool calls wrapped in <|tool_call_start|> and <|tool_call_end|> tokens, output as JSON:

<|tool_call_start|>{"name": "exec", "arguments": {"command": "nmap -p 80 192.168.1.1"}}<|tool_call_end|>

A system instruction Output function calls as JSON. is prepended so the model emits JSON rather than the default Pythonic calls.

Intended Use

• Executor Agent in multi-agent penetration-testing systems
• Single-Turn Kali Terminal Assistant — converts natural language to shell commands
• Not recommended for general conversation or chatbot use

Limitations

• Designed for single-turn command generation; multi-turn interaction requires external state management
• Commands target authorized lab environments only; not for production systems without human review
• Best performance on the 15 core Kali/Linux tools seen during training

Training Details

Hyperparameter	Value
LoRA rank	16
LoRA alpha	32
LoRA dropout	0.05
Target modules	in_proj, out_proj, q_proj, k_proj, v_proj, w1, w2, w3, gate_proj, up_proj, down_proj
Learning rate	2e-4 (cosine)
Batch size	4
Gradient accumulation	4
Effective batch size	16
Epochs	3 (best checkpoint at step 352, ~2.7 epochs)
Max sequence length	1024
Optimizer	AdamW
Precision	bfloat16

Citation

@misc{kali-terminus-v2,
  author = {ISeLab},
  title = {Kali-Terminus-v2: Fine-tuned LFM2.5-350M for Kali Linux Terminal Execution},
  year = {2026},
  publisher = {Hugging Face},
  url = {https://huggingface.co/iselabvn/Kali-Terminus-v2}
}