VectraYX-Vision-1B: A Sub-2B Spanish/LATAM Cybersecurity Vision-Language Model with Structured Visual Reasoning and Native Tool Use

Analysis

Why This Paper Matters

VectraYX-Vision-1B addresses a critical gap: the lack of specialized vision-language models for cybersecurity in Spanish/LATAM contexts. By targeting sub-2B parameters, it enables deployment on edge devices and air-gapped environments, which are common in security operations. The model's integration of structured reasoning and tool use via Model Context Protocol is a step toward practical AI assistants that can interact with security tools like IDA and Wireshark.

More importantly, the paper transparently reports a negative result: the vision SFT fails to achieve visual grounding, with near-zero B6 scores. This honesty is rare and valuable, as it highlights the challenges of training VLMs on specialized imagery and the importance of rigorous evaluation. The identification of a checkpoint-loader bug that mimics training collapse also serves as a cautionary tale for reproducibility.

Technical Contributions

• Architecture: Frozen SigLIP-so400m encoder + 1.04B Spanish/LATAM security decoder via MLP, keeping total parameters under 2B.
• Structured Reasoning: Native <|think|> tokens for chain-of-thought, and <|tool_call|> for invoking tools via MCP.
• Deployment: Export to llama.cpp's LLaVA mmproj format for CPU inference in air-gapped environments.
• Ablation Matrix: Three variants (V0: NoPE-every-4, V1: all-RoPE, V2: NoPE+learned 2D) to study periodic no-positional-encoding layers on attention over a 729-token visual block.
• Open Resources: Release of models, configs, weights, and a 14,596 QA corpus across 10 domains.

Results

The paper reports a negative preliminary visual-grounding result: B6 tool-identification score is 0.08, indicating the model essentially ignores image content. This is despite fully functional pipelines and 400-1900 steps of vision SFT (~16M tokens). The authors propose remediation including longer SFT, >=60% replay, and lower learning rate. Text backbone B1-B5 scores are provided, but exact numbers are not in the abstract. Wall times and GGUF CPU efficiency are also reported, but specifics are omitted.

Significance

This work is significant for several reasons. First, it establishes a baseline for Spanish/LATAM cybersecurity VLMs, a niche but important domain. Second, the open-source ablation on positional encoding provides empirical data on a relatively unexplored architectural question: whether periodic NoPE layers help or hurt attention over long visual token sequences. Third, the negative result and bug report contribute to the community's understanding of common pitfalls in VLM training, potentially saving others time. The release of all resources ensures that others can build on this work and address the identified limitations.