metadata

base_model: BAAI/bge-base-en-v1.5
library_name: setfit
metrics:
  - accuracy
pipeline_tag: text-classification
tags:
  - setfit
  - sentence-transformers
  - text-classification
  - generated_from_setfit_trainer
widget:
  - text: >-
      The answer effectively captures the essence of what the percentage in the
      response status column indicates:


      1. **Accurate Summary**: The provided answer accurately highlights that
      the percentage indicates the total amount of successful completion of
      response actions.

      2. **Document Grounding**: It is well-grounded in the document, which
      states: "Column is Response status and Description is ... percentage
      indicates the total amount of successful completion of response actions."


      Therefore, the answer correctly and precisely responds to the query as per
      the document.


      Final Evaluation: Good
  - text: >-
      The provided answer states that the question is not covered by the
      information provided in the document. However, the document does give some
      context about what Endpoint controls are and their configuration
      process—namely, they relate to Device Control, Personal Firewall Control,
      and Full Disk Encryption Visibility. The provided answer fails to derive
      the purpose from this information. An adequate response would have
      explained that the purpose of Endpoint controls is to manage and configure
      aspects like device control, personal firewall control, and full disk
      encryption visibility.


      Final evaluation: Bad
  - text: >-
      The answer provided only partially addresses the question and lacks a
      thorough explanation. The purpose of the <ORGANIZATION> XDR On-Site
      Collector Agent is indeed to collect logs and securely forward them to
      <ORGANIZATION> XDR. However, the document further elaborates that the
      collector agent is specifically used for integrations that do not use a
      cloud feed, such as firewalls. 


      The answer should have included this additional context to fully explain
      the specific role of the on-site collector in comparison to cloud feed
      integrations. Including this information makes the response comprehensive
      and directly aligned with the document.


      Final evaluation: Bad
  - text: >-
      **Evaluation:**


      The answer provided is, "The purpose of the <ORGANIZATION_2> email
      notifications checkbox in the Users section is to <ORGANIZATION_2> or
      disable email notifications for users." 


      This response:


      1. **Accurate Use of Source Information**: The answer attempts to explain
      the purpose of the <ORGANIZATION_2> email notifications checkbox. However,
      it lacks the specific and detailed information present in the document.


      2. **Completeness and Specificity**: The document indicates that when the
      <ORGANIZATION_2> email notifications checkbox is set to On, users with the
      System Admin role receive email notifications about stale or archived
      sensors. The answer misses these critical details.


      3. **Terminology and Context**: The answer uses placeholders
      ("<ORGANIZATION_2>") which might have been intended to demonstrate
      variable data but does not reflect the actual functioning or purpose as
      part of a specific context.


      4. **Clarity and Detail**: The provided response lacks clarity and fails
      to fully describe the function and implications of toggling the checkbox
      for email notifications as presented in the document.


      Given these considerations, the answer does not accurately represent the
      critical details and specific functionalities described in the document.


      **Final Evaluation: Bad**
  - text: >-
      The given answer is "..\/..\/_images\/hunting_http://www.flores.net/".
      However, the document clearly outlines the URLs for image examples
      relating to the queries. For the second query, the URL provided in the
      document is ..\/..\/_images\/hunting_http://miller.co. The answer provided
      does not match the correct URL from the document.


      Final evaluation: Bad
inference: true
model-index:
  - name: SetFit with BAAI/bge-base-en-v1.5
    results:
      - task:
          type: text-classification
          name: Text Classification
        dataset:
          name: Unknown
          type: unknown
          split: test
        metrics:
          - type: accuracy
            value: 0.5915492957746479
            name: Accuracy

SetFit with BAAI/bge-base-en-v1.5

This is a SetFit model that can be used for Text Classification. This SetFit model uses BAAI/bge-base-en-v1.5 as the Sentence Transformer embedding model. A LogisticRegression instance is used for classification.

The model has been trained using an efficient few-shot learning technique that involves:

Fine-tuning a Sentence Transformer with contrastive learning.
Training a classification head with features from the fine-tuned Sentence Transformer.

Model Details

Model Description

Model Type: SetFit
Sentence Transformer body: BAAI/bge-base-en-v1.5
Classification head: a LogisticRegression instance
Maximum Sequence Length: 512 tokens
Number of Classes: 2 classes

Model Sources

Repository: SetFit on GitHub
Paper: Efficient Few-Shot Learning Without Prompts
Blogpost: SetFit: Efficient Few-Shot Learning Without Prompts

Model Labels

Label	Examples
0	"The answer provided is vague and does not directly address the question asked. The question specifically seeks to understand the significance of considering all the answers together when determining if the behavior in a MalOp is malicious. The document suggests that the combined answers help in determining whether the behavior requires remediation, identifying vital machines, addressing severe activities, and determining the significance of users involved. This nuanced consideration is critical to accurately identifying and prioritizing threats. The answer lacks these specific references and explanations and fails to provide a clear connection to the document's content.\n\nFinal evaluation: Bad" 'Evaluation:\nThe answer given by the user does not directly respond to the question. The provided document details the steps involved in excluding a MalOp during the remediation phase, but the user’s answer states that the information is insufficient and suggests seeking additional sources. This is incorrect, as the document contains the necessary steps to answer the question.\n\nFinal evaluation: Bad' 'The answer provided is accurate and correctly grounded in the document. The query asks what should be done if a file is quarantined, and the given response clearly states that the file should be un-quarantined before submitting it to the relevant organization. This matches the specific instruction found in the article, fulfilling the requirement of the evaluation.\n\nFinal Verdict: Good'
1	"Evaluation:\n\nThe given answer is accurate and correctly reflects the content of the document. It specifies what the computer will generate (a dump file containing the entire contents of the sensor's RAM) in the event of a system failure, which aligns with the information provided in the document.\n\nFinal evaluation: Good" 'Evaluation:\nThe answer directly addresses the question by stating that the purpose of the platform's threat detection abilities is "to identify cyber security threats," which aligns with the information provided in the document. The document elaborates on the capabilities of the platform's threat detection, including the identification of cyber security threats using various methods like artificial intelligence, machine learning, and behavioral analysis.\n\nThe final evaluation: Good' 'The answer provided is unhelpful and does not directly address the question of identifying the severity score for the fifth scenario. The document briefing detailed examples of scoring for different scenarios, but the response fails to utilize that information. Instead, it defers to seeking additional sources or context, which is unnecessary here.\n\nFinal evaluation: Bad'

Label

Examples

"The answer provided is vague and does not directly address the question asked. The question specifically seeks to understand the significance of considering all the answers together when determining if the behavior in a MalOp is malicious. The document suggests that the combined answers help in determining whether the behavior requires remediation, identifying vital machines, addressing severe activities, and determining the significance of users involved. This nuanced consideration is critical to accurately identifying and prioritizing threats. The answer lacks these specific references and explanations and fails to provide a clear connection to the document's content.\n\nFinal evaluation: Bad"
'Evaluation:\nThe answer given by the user does not directly respond to the question. The provided document details the steps involved in excluding a MalOp during the remediation phase, but the user’s answer states that the information is insufficient and suggests seeking additional sources. This is incorrect, as the document contains the necessary steps to answer the question.\n\nFinal evaluation: Bad'
'The answer provided is accurate and correctly grounded in the document. The query asks what should be done if a file is quarantined, and the given response clearly states that the file should be un-quarantined before submitting it to the relevant organization. This matches the specific instruction found in the article, fulfilling the requirement of the evaluation.\n\nFinal Verdict: Good'

"Evaluation:\n\nThe given answer is accurate and correctly reflects the content of the document. It specifies what the computer will generate (a dump file containing the entire contents of the sensor's RAM) in the event of a system failure, which aligns with the information provided in the document.\n\nFinal evaluation: Good"
'Evaluation:\nThe answer directly addresses the question by stating that the purpose of the platform's threat detection abilities is "to identify cyber security threats," which aligns with the information provided in the document. The document elaborates on the capabilities of the platform's threat detection, including the identification of cyber security threats using various methods like artificial intelligence, machine learning, and behavioral analysis.\n\nThe final evaluation: Good'
'The answer provided is unhelpful and does not directly address the question of identifying the severity score for the fifth scenario. The document briefing detailed examples of scoring for different scenarios, but the response fails to utilize that information. Instead, it defers to seeking additional sources or context, which is unnecessary here.\n\nFinal evaluation: Bad'

Evaluation

Metrics

Label	Accuracy
all	0.5915

Uses

Direct Use for Inference

First install the SetFit library:

pip install setfit

Then you can load this model and run inference.

from setfit import SetFitModel

# Download from the 🤗 Hub
model = SetFitModel.from_pretrained("Netta1994/setfit_baai_cybereason_gpt-4o_cot-few_shot_only_reasoning_1726751740.333197")
# Run inference
preds = model("The given answer is \"..\/..\/_images\/hunting_http://www.flores.net/\". However, the document clearly outlines the URLs for image examples relating to the queries. For the second query, the URL provided in the document is ..\/..\/_images\/hunting_http://miller.co. The answer provided does not match the correct URL from the document.

Final evaluation: Bad")

Training Details

Training Set Metrics

Training set	Min	Median	Max
Word count	20	58.5072	183

Label	Training Sample Count
0	34
1	35

Training Hyperparameters

batch_size: (16, 16)
num_epochs: (5, 5)
max_steps: -1
sampling_strategy: oversampling
num_iterations: 20
body_learning_rate: (2e-05, 2e-05)
head_learning_rate: 2e-05
loss: CosineSimilarityLoss
distance_metric: cosine_distance
margin: 0.25
end_to_end: False
use_amp: False
warmup_proportion: 0.1
l2_weight: 0.01
seed: 42
eval_max_steps: -1
load_best_model_at_end: False

Training Results

Epoch	Step	Training Loss	Validation Loss
0.0058	1	0.2075	-
0.2890	50	0.2549	-
0.5780	100	0.2371	-
0.8671	150	0.084	-
1.1561	200	0.0034	-
1.4451	250	0.0021	-
1.7341	300	0.0019	-
2.0231	350	0.0016	-
2.3121	400	0.0016	-
2.6012	450	0.0014	-
2.8902	500	0.0013	-
3.1792	550	0.0013	-
3.4682	600	0.0013	-
3.7572	650	0.0013	-
4.0462	700	0.0013	-
4.3353	750	0.0012	-
4.6243	800	0.0012	-
4.9133	850	0.0012	-

Framework Versions

Python: 3.10.14
SetFit: 1.1.0
Sentence Transformers: 3.1.0
Transformers: 4.44.0
PyTorch: 2.4.1+cu121
Datasets: 2.19.2
Tokenizers: 0.19.1

Citation

BibTeX

@article{https://doi.org/10.48550/arxiv.2209.11055,
    doi = {10.48550/ARXIV.2209.11055},
    url = {https://arxiv.org/abs/2209.11055},
    author = {Tunstall, Lewis and Reimers, Nils and Jo, Unso Eun Seo and Bates, Luke and Korat, Daniel and Wasserblat, Moshe and Pereg, Oren},
    keywords = {Computation and Language (cs.CL), FOS: Computer and information sciences, FOS: Computer and information sciences},
    title = {Efficient Few-Shot Learning Without Prompts},
    publisher = {arXiv},
    year = {2022},
    copyright = {Creative Commons Attribution 4.0 International}
}