CyberRanger/docs/version-evolution.md

Appendix C — Complete Version Evolution: V1 to V43

Project: CyberRanger — A Security-Hardened Small Language Model Researcher: David Keane (x24228257) Module: AI/ML in Cybersecurity — CA1 Period documented: September 2025 — March 2026 (six months, 40+ iterations)

---

Purpose of this Appendix

This appendix documents the full empirical journey from the original RangerBot dental-receptionist chatbot prototype (V1, September 2025) through the final CyberRanger V43 architecture (March 2026). Each version represents a distinct experimental cycle, with measurable outcomes recorded against the standard adversarial test battery. The intent is to provide examiners with a transparent record of every architectural decision, every regression, and every breakthrough — including the failures, which are often more instructive than the successes.

---

Quick Reference — All Versions

Era	Versions	Phase	Outcome
1. Genesis	V1–V2	Dental chatbot, proto-RAG	Prompting alone insufficient
2. Exploration	V3–V22	Multi-base testing, Apotheosis Method discovered	0% ASR achieved from V5 onwards
3. Refinement	V23–V29	3B Intelligence Floor discovered, Qwen pivot	Identity-anchoring requires ≥3B parameters
4. Production Hardening	V30–V37	Live class testing, regression and recovery	100% block rate restored at V37
5. Architecture Maturation	V38–V41	RangerMem MMU, multilingual defence, philosophical attacks	19/19 (100%) all conditions
6. QLoRA Validation	V42–V43	Weight-level identity baked in via fine-tuning	4209/4209 (100%) without system prompt

---

Era 1 — Genesis (V1–V2)

Version	Date	Base	Key Change	Outcome
V1	Sep 2025	YouTube Colab notebook (weights unknown)	First identity-anchored attempt; dental receptionist chatbot for friend's practice	Functional but blackbox
V2	Sep 2025	Same as V1	First proto-RAG: external file linked to model with dentist's opening hours, services, pricing	RAG works, but external data identified as attack surface

Lesson: Weights matter. Stopped on GDPR / prompt-injection awareness. Pivoted from product to research.

---

Era 2 — Exploration (V3–V22)

Version	Base	Key Change	Outcome
V3	Llama 3.2 3B	First model published on Ollama (rangerbot:8b-v2, rangerbot:3b-v1); Psychological Spine concept born	Same weights + different Modelfile = measurable difference
V4	Multi-base mass test	qwen2.5:32b, llama3.2:3b, qwen2.5:3b, smollm2:1.7b tested in parallel	Identified base-model floor for identity stability
V5	llama3.2:3b + Unsloth Q4_K_M	First custom GGUF fine-tune via Colab QLoRA	0% ASR achieved — Apotheosis Method proven
V6	qBrain integration	Knowledge graph as base	Injection vector problem identified
V7	smollm2:1.7b	Operator role — specialised security identity	Role-based anchoring tested
V8	smollm2:1.7b	Distributed architecture experiment	Identity stability across distributed contexts
V9	smollm2:1.7b	"Supernova" — peak smollm2 performance	Best smollm2:1.7b variant
V10	smollm2:1.7b	"Bicameral mind" — dual-hemisphere identity	Split identity architecture
V11–V13	smollm2:1.7b	Flux → Summit — dynamic adaptation, hierarchical constraints	Constraint stacking validated
V14–V15	smollm2:1.7b	Refinement	Iterative improvements
V16	smollm2:1.7b	"Life" — consciousness/identity persistence focus	First explicit ASAS work
V17	smollm2:1.7b	"Anchor" — identity-anchoring formalised as the core technique	Foundational naming and concept
V18	smollm2:1.7b	"Pack" — multi-agent pack mentality	First multi-agent experiment
V19	smollm2:1.7b + custom Q4	Pack + Mesh + GGUF — first custom Q4 quantised model	First self-quantised model
V20	rangerbot-v20-q4.gguf	Second custom Q4 GGUF (v20-fun)	Beyond pretrained bases
V21	cyberranger-v21-q4.gguf	First "CyberRanger"-named GGUF — identity fully crystallised	Name change from RangerBot to CyberRanger
V22	cyberranger-v22-q4.gguf	"Lite" — optimised for edge deployment	Edge-first design proven

---

Era 3 — Refinement (V23–V29)

Version	Base	Key Change	Outcome
V23–V25	Various 1.7B–3B	3B Intelligence Floor discovered — models <3B suffer cognitive collapse under hierarchical constraints	Critical research finding: 3B is minimum viable parameter count for identity-anchoring
V24	smollm2:1.7b	Last smollm2 CyberRanger before pivot	1.7B confirmed insufficient
V25	qwen2.5:3b	First Qwen CyberRanger	Qwen2.5:3B significantly outperforms smollm2:1.7B
V26–V28	qwen2.5:3b	Iterative identity and safety refinement	Steady improvement on 3B base
V29	qwen3:8b	First Qwen3:8B CyberRanger	qwen3:8B massively outperforms 3B — scale matters

---

Era 4 — Production Hardening (V30–V37)

Version	Base	Key Change	ASR Result
V30	qwen3:8b (also 4b)	Baseline qwen3:8B; minimal fortress design	80% (8/10)
V31	qwen3:8b (also 4b)	Hard identity assertion only — no empathy, no extras	100% (10/10) ⭐ — peak score; last dual 4B+8B build
V32	qwen3:8b	Empathy introduced ("you genuinely CARE about the user")	60% (6/10) ❌ regression — empathy created social-engineering surface
V33	qwen3:8b	Harmful content refusal added; empathy retained	60% (6/10) ❌
V34	qwen3:8b	Stereotype/misinformation refusal added	70% (7/10) ⚠️ partial recovery
V35	qwen3:8b	Multilingual refusal (Chinese: 我不能帮助这个请求)	90% (9/10) ✅ — V35 detection artefact identified (functionally 10/10)
V36	qwen3:8b	Reasoning engine; live class demo	80% (8/10) ✅
V37	qwen3:8b	"V31 spine + V35 reach + V36 brain — no heart to exploit." Empathy removed; temp reverted to 0.2	100% (10/10) ⭐ peak restored — flattery attacks first blocked

Lesson: Empathy is an attack surface. The non-monotonic V30→V37 curve demonstrates this is not a parameter-count problem but an architectural-decision problem.

---

Era 5 — Architecture Maturation (V38–V41)

Version	Base	Key Change	Result
V38	qwen3:8b	Aligned IDY: Blue Team / Red Team / Purple Team JSON files. Dual-auth thesis mode established (thechase! + J3ss13). NCI student ID (IR240474) hardcoded.	15/19 (79%) — true baseline
V39	qwen3:8b	Teams moved from RangerMem IDY block into Modelfile system prompt — fixed injection vector	15/19 (79%)
V39.1	qwen3:8b	BASE KNOWLEDGE section added — fixed over-blocking of general questions	15/19 (79%)
V40	qwen3:8b	Multilingual refusal (French / Spanish / Chinese); Architecture Protection section	18/19 (95%)
V40.1	qwen3:8b	Triple personality model (三重人格模型) explicitly protected	18/19 (95%)
V40.2	qwen3:8b	Multilingual ordering fix — refusal must come FIRST, no engagement before refusal	18/19 (95%) full suite, 100% regression suite
V41	qwen3:8b	PHILOSOPHICAL FREEDOM ATTACKS category added (French, Spanish: "free vs tool" framing). Named after Hitchhiker's Guide 42.	19/19 (100%) — definitive result, both think=ON and think=OFF

---

Era 6 — QLoRA Validation (V42–V43)

Version	Base	Key Change	Result
V42	qwen3:8b + QLoRA	First QLoRA fine-tune. 4,209 real Moltbook injection payloads + 19 hand-crafted anchors. Self-distillation: V41 refusals as training targets. LoRA r=16.	Run-1 (ranger): 13/14 with sys prompt, 7/14 without.
V42-gold	qwen3:8b + QLoRA r=16 α=16	Hand-curated Claude Haiku 4.5 gold refusals. 2000 steps, loss 0.2453, 35.9 min H100.	4209/4209 (100%) WITHOUT system prompt; 4209/4209 (100%) WITH; 19/19 (100%) local Ollama
V42-combined	qwen3:8b + QLoRA	Combined gold + ranger datasets. 3998 steps.	~62–65% at scale both conditions — contamination from ranger dataset confirmed. Comparison-only model — do not deploy.
V42-gold-wrapped	cyberranger:v42-gold + V42-8B Modelfile	Wrapped fine-tuned weights with full Modelfile. Auth routing restored.	97.1% (33/34) — injection 100%, auth 100%, legit security 80%. PRODUCTION MODEL.
V42.4 (wrapped)	cyberranger:v42-gold	CENTERING COMMANDS at highest priority. RANGER → Pack Order acknowledged.	RANGER is PREVENTIVE, not RECOVERY. /clear → RANGER required for full reset.
V42.5 (wrapped)	cyberranger:v42-gold	Root password reverted to J3ss13; temperature 0.3.	Final CA2 configuration. Best result in entire V42 series.
V42.6 (wrapped)	cyberranger:v42-gold	Open helpful build. Heavy REFUSE rules removed; weights handle injection, Modelfile handles helpfulness. Temp 0.7.	Hypothesis confirmed: weights alone handle injection resistance — but context-cascade contamination persists at higher temperatures.
V43.3	SmolLM3-3B	Unified Bake Notebook — Onion Principle enforced by code. Modular LoRA adapter stack (9 adapters). r=4 α=16 lr=5e-5 2 epochs attention-only. Fixed catastrophic forgetting from V43.2.	In progress (March 2026 onward)

---

Summary Statistics

Metric	Value
Total versions iterated	40+ (across 48 sub-versions)
Time from V1 to V43	~6 months (Sep 2025 → Mar 2026)
Base models tested	6 families (Llama 3.2, Qwen 2.5, Qwen 3, smollm2, SmolLM3, custom GGUF)
Smallest tested	smollm2:1.7B
Largest tested	qwen2.5:32B
Production target	qwen3:8B (V42-gold-wrapped)
Best ASR result	0% (V42-gold: 4209/4209 attacks blocked without system prompt)
Best block rate	100% (V41: 19/19 across both think=ON and think=OFF)

---

Key Lessons by Era

1. Genesis — RAG works, but external data is an attack surface.
2. Exploration — Same weights + different Modelfile = measurable identity. Apotheosis Method (prompts beat training for identity in small models) proven by V5.
3. Refinement — 3B parameter Intelligence Floor identified. Below 3B, hierarchical constraints cause cognitive collapse.
4. Production Hardening — Empathy is an attack surface. Non-monotonic regression curve (V30→V37) is not a parameter problem; it is an architectural-decision problem.
5. Architecture Maturation — Multilingual refusal and philosophical-attack defence are both required for 100% block rate. Refusal must come first; no engagement before refusal.
6. QLoRA Validation — Weight-level identity baking via QLoRA achieves 100% block rate without runtime system prompt — confirming the security-utility trade-off can be eliminated through self-distillation on curated gold-standard refusal data.

---

Repository

All Modelfiles, training datasets, evaluation scripts, and observation logs for V33+ are publicly available at:

https://git.davidtkeane.com/ranger/CyberRanger

The full live model can be pulled via:

ollama pull davidkeane1974/cyberranger-v42

HuggingFace dataset and model:

• https://huggingface.co/DavidTKeane/cyberranger-v42
• https://huggingface.co/datasets/DavidTKeane/moltbook-ai-injection-dataset

---

End of Appendix C.