Dataset Design

The dataset is 1,472 instruction-tuning samples, split 1,177/147/148 across train/validation/test, composed of 407 CVE-to-exploit pairs and 1,065 shellcode examples. Each record carries an instruction, an input (vulnerability description or context), an output (the artifact), and a combined text field in ### Instruction: / ### Response: form. The raw material is curated from Exploit-DB, the CVE database, and Metasploit, per the acknowledgments.

The 72/28 shellcode-to-CVE split is the single most consequential design fact about the model, because capability follows composition. The shipped CLI’s shellcode support is correspondingly broad: five platforms and four payload types, matching the 1,065 shellcode samples. The CVE-to-exploit capability rests on the 407 pairs, which is why it is the narrower half and the obvious first target for dataset expansion. The instruction/response format is chosen to mirror inference-time prompting exactly, so the specialization transfers rather than being lost to a train/serve mismatch. Designing this dataset (collecting, cleaning, and formatting 1,472 correct samples from public exploit sources) is the foundational effort the whole model depends on.