VectraYX-Vision-1B: A Sub-2B Spanish/LATAM Cybersecurity Vision-Language Model with Structured Visual Reasoning and Native Tool Use

We build VectraYX-Vision-1B, a sub-2B vision–language model (VLM) for Spanish/Latin-American cybersecurity imagery, coupling a frozen SigLIP-so400m visual encoder to a 1.04B-parameter Spanish/LATAM security decoder through a two-layer MLP projector, and we report a negative preliminary visual-grounding result that raises a publishable architectural question. To our knowledge, VectraYX-Vision-1B is the first sub-2B VLM specialized for cybersecurity imagery—disassembly and decompiler panes (IDA, Ghidra), packet captures (Wireshark), scanner and post-exploitation terminals (Nmap, Metasploit), and memory-forensics dumps (Volatility)—that (i) answers in Spanish, (ii) emits structured visual reasoning via native <|think|> tokens before its answer, (iii) invokes external tools through the Model Context Protocol using native <|tool_call|> tokens, and (iv) exports cleanly to llama.cpp’s LLaVA mmproj format for fully on-premise, air-gapped deployment.

The system extends the three-phase language curriculum of the VectraYX line with a fourth, vision phase split into alignment (projector-only), instruct (projector + backbone with text replay), and think+tools sub-stages. All four training phases have run to completion and the multimodal inference pipeline is functional end-to-end; however, the current vision SFT volume (400–1,900 steps, ≈16 M tokens) yields only near-zero B6 visual-grounding scores (best tool-identification 0.08 on 50 held-out screenshots)—the model generates fluent Spanish but ignores image content. We report this as a negative result with the remediation specified (a longer SFT run at ≥60% replay and lower LLM learning rate), not as a placeholder. We also identify, during construction, a checkpoint-loader bug (unstripped llm. prefix) that masqueraded as a training collapse—a diagnostic applicable to any LLaVA-style export pipeline.

The publishable question this system makes ablatable is whether the backbone’s periodic no-positional-encoding (NoPE) layers—present in no previously released VLM—help or hurt attention over the injected 729-token visual block. The backbone alternates RoPE (three of every four layers) with NoPE (every fourth); on RoPE layers the flattened patch grid receives a spurious 1D order, while on NoPE layers the visual block is permutation-equivariant. We specify a three-variant ablation (V0 released NoPE-every-4, V1 all-RoPE, V2 NoPE+learned 2D positional embedding) whose sign of B6​(V​0)−B6​(V​1) discriminates the two competing hypotheses H1 (NoPE beneficial) and H2 (NoPE harmful, learned 2D helps). The ablation design, the backbone checkpoints, and the runner are released with this preprint to establish priority on the method, not just the question.

We report measured B1–B5 for the phase-3 backbone, a text-only backbone control confirming the benchmark is not answerable from text alone, measured B6/B7 preliminary scores, training wall times, and GGUF efficiency on commodity CPU-only hardware, alongside the architecture, curriculum, corpus (14,596 domain-balanced multimodal QA pairs across ten cybersecurity domains, dual English/Spanish tracks), benchmark design, and exact ablation matrix. We release code (model, trainer, benchmarks), configs, the benchmark suite, and all training checkpoints: inference-ready GGUF exports of the backbone (jsantillana/vectrayx-1b) and the multimodal stack (jsantillana/vectrayx-vision-1b), plus the full per-step checkpoint trajectory for auditability (jsantillana/vectrayx-vision-1b-checks). All numbers are single-run owing to compute cost; we label them as such and compensate with per-checkpoint trajectories and per-item bootstrap intervals.
Vision–language models, Cybersecurity, Spanish NLP, Visual reasoning, Tool use, Model Context Protocol, Edge inference, Reverse engineering
∗The author is a DevOps engineer at Globant. Institutional affiliation approval is pending. This is a preprint; all training phases have run to completion. Preliminary B6/B7 results are reported as a negative finding (visual grounding is insufficient at the current step volume). The NoPE×vision ablation design (V0/V1/V2), checkpoints, and runner are released with this preprint; their results and the remediated SFT run remain pending.