Models Training Summaries

Public Summary of Training Content — MiST-8B

Template for the Public Summary of Training Content for General-Purpose AI Models required by Article 53(1)(d) of Regulation (EU) 2024/1689 (AI Act)

1. General information

1.1. Provider identification

1.2. Model identification

1.3. Modalities, overall training data size and other characteristics

This Section describes the additional training data used by Dream for mid-training, supervised fine-tuning, and preference optimisation of the base model identified in Section 1.2. It does not include the pre-training data of the underlying base model.

Breakdown of the training-data totals (as reported in Table 12 of the research paper, tokenised with the Qwen3 tokenizer):

In addition, Dream’s DPO alignment stage uses AI2’s Dolci-Instruct-DPO dataset (approximately 260,000 preference pairs in the full public release).

2. List of data sources

2.1. Publicly available datasets

Have you used publicly available datasets to train the model? ☑ Yes ☐ No

Modality of the content covered by the datasets concerned: ☑ Text ☐ Image ☐ Video ☐ Audio ☐ Other

List of large publicly available datasets

A dataset is considered “large” if its share of the publicly available text data used in Dream’s additional training exceeds 3 % of the total size of publicly available text data in that category. For transparency, the full list of publicly available datasets used by Dream — including those below the 3 % threshold — is provided together.

Additional operational security artefacts included in the seed corpus:

Security platform guides — individual sources:

Additional comments: All datasets listed above were obtained from the publicly accessible repositories or websites of their respective publishers under the licence terms indicated. Dream preserves the required attribution notices in the documentation and notices file of the released seed corpus. The model's NOTICE file includes attribution for the base model and for the Dolci datasets (ODC-By).

2.2. Private non-publicly available datasets obtained from third parties

2.2.1. Datasets commercially licensed by rightsholders or their representatives

Have you concluded transactional commercial licensing agreement(s) with rightsholder(s) or with their representatives? ☐ Yes ☑ No

Dream has not used any datasets covered by transactional commercial licensing agreements with rightsholders or their representatives in the additional training of MiST-8B.

2.2.2. Private datasets obtained from other third parties

Have you obtained private datasets from third parties that are not licensed as described in Section 2.2.1? ☐ Yes ☑ No

Dream has not obtained any private, non-publicly-available datasets from data intermediaries or other third parties for the additional training of MiST-8B.

2.3. Data crawled and scraped from online sources

Were crawlers used by the provider or on behalf of? ☑ Yes ☐ No

2.4. User data

Was data from user interactions with the AI model (e.g. user input and prompts) used to train the model? ☐ Yes ☑ No

Was data collected from user interactions with the provider’s other services or products used to train the model? ☐ Yes ☑ No

Dream has not used any user-interaction data from its AI models, nor any user data collected from its other services or products, in the training of MiST-8B.

2.5. Synthetic data

Was synthetic AI-generated data created by the provider or on their behalf to train the model? ☑ Yes ☐ No

2.6. Other sources of data

Have data sources other than those described in Sections 2.1 to 2.5 been used to train the model? ☐ Yes ☑ No

Dream has not used any additional data sources outside the categories described in Sections 2.1 to 2.5 in the training of MiST-8B.

3. Data processing aspects

3.1. Respect of reservation of rights from text and data mining exception or limitation

Are you a Signatory to the Code of Practice for general-purpose AI models that includes commitments to respect reservations of rights from the TDM exception or limitation? ☐ Yes ☑ No

Description of the measures implemented before model training to respect reservations of rights from the TDM exception or limitation:

Dream implements the following measures to identify and respect reservations of rights expressed under Article 4(3) of Directive (EU) 2019/790 (the “TDM exception”) in connection with the additional training of MiST-8B:

1. Source selection oriented to permissively licensed material. Dream’s additional training data is drawn predominantly from sources that are either (i) US Government works in the public domain (e.g., NVD, NIST publications); or (ii) released by their publishers under permissive open-source or Creative Commons licences that expressly permit reproduction and derivative use (e.g., Apache 2.0, MIT, CC BY-SA, CC0, ODC-By, MITRE’s royalty-free licence). This source-selection practice materially reduces the volume of training content for which a rightsholder’s reservation of rights could apply.

2. Crawler configured to respect robots.txt and machine-readable opt-out signals. For the publisher content collected via Dream’s crawler (described in Section 2.3), the crawler was configured to respect robots.txt directives and standard HTTP access signals. Content from sources that signal, through robots.txt or equivalent machine-readable means, that automated collection for machine-learning training is not permitted, is excluded from Dream’s collection by configuration.

3. Response to post-collection notifications. Dream has published a reporting mechanism (contactable via the Hugging Face model-card discussion feature and via Dream’s compliance contact address identified in Section 1.1) through which rightsholders, publishers, or members of the public may notify Dream of content that should be removed from Dream’s training corpus or from Dream’s released artefacts. On receipt of a valid notification, Dream commits to review the content concerned, remove it from the released seed corpus if included, and consider the notification in any future retraining of the model.

4. Hold-back of the publisher-crawled content from redistribution. As described in Section 2.3, Dream does not redistribute the publisher articles collected via its crawler as part of the released model artefacts or the released seed dataset. This hold-back is an additional conservative measure to limit the downstream impact of any residual uncertainty about rights reservations on individual articles.

Copyright policy under Article 53(1)(c): https://dreamgroup.com/copyright-policy

3.2. Removal of illegal content

General description of measures taken:

Dream implements the following measures to avoid or remove illegal content under Union law from the training data used in the additional training of MiST-8B:

1. Source-level filtering. Dream’s additional training content is drawn from authoritative cybersecurity sources (government bodies, international standards organisations, non-profit security projects, major-vendor security documentation, and reputable cybersecurity news publishers). Source selection is intended to reduce the risk of including illegal content in the training data. The source-selection practice described in Section 3.1 point 1 is also a first-order illegal-content control.

2. Benchmark decontamination. Dream applies systematic decontamination against public cybersecurity evaluation benchmarks at three stages of the data pipeline (seed-level audit against the evaluation suite with removal of records that anchor benchmark examples; prompt-level avoidance in synthetic generation; and 13-gram overlap filtering across mid-training, SFT, and DPO datasets prior to tokenisation). This measure supports research integrity by reducing overlap between training data and evaluation benchmarks.

3. LLM-based quality verification of synthetic data. All synthetically generated content (Section 2.5) is scored by an LLM-based verifier on six quality criteria (instruction adherence, task completion, factuality, format and style alignment, relevance and focus, logical consistency and coherence). Samples with an overall quality score below 8/10 are removed from the final training corpus.

4. Safety and refusal training data. Dream’s supervised fine-tuning mixture includes safety and refusal training data (within the Dolci-Instruct-SFT dataset), which trains the model to refuse requests that would require generating illegal content.

5. Post-release reporting mechanism. Dream’s reporting mechanism (described in Section 3.1 point 3) accepts notifications regarding any content that may be illegal under Union law. Validly notified content is removed from the released seed dataset and considered in future retraining.

6. Hold-back of unverified third-party content from redistribution. The publisher articles collected via Dream’s crawler (Section 2.3) are not redistributed as part of the released model artefacts. The released seed dataset is limited to source materials that are released under express permissive licences by their publishers.

3.3. Other information (optional)

• Dream commits to update this Public Summary every six months, or sooner if the model is retrained with materially different training data.
• Dream will publish this Summary on its company website and will link to it from the model’s Hugging Face model card prior to the model being placed on the Union market.
• The accompanying research paper, “MiST: Mid-Training LLMs for Cybersecurity” (EMNLP 2026 main conference, https://arxiv.org/abs/2609.18496 ), provides additional technical details on the training pipeline, including a decontamination appendix (Section J of the paper), ablation studies isolating the contribution of (i) the mid-training stage itself, (ii) individual synthetic data generation flows, and (iii) the choice of initialisation checkpoint (Section F of the paper), and the full list of evaluation benchmarks used to assess the model.