Applied Inference Lab: Compliance Control Embedding Stack
An open-source contrastive-embedding pipeline that maps technical CVE vulnerability descriptions to formal cybersecurity compliance controls in NIST SP 800-53 and CMMC, published with its model generation, fine-tuning and evaluation code.
This repository provides the model generation, contrastive fine-tuning, evaluation and GGUF quantization pipeline behind AutoRMF, an open-source machine-learning approach for mapping technical vulnerability descriptions, such as memory corruption or authentication bypasses, to formal cybersecurity compliance controls in NIST SP 800-53 Revision 5 and CMMC. The stated goal is closing the vocabulary gap between technical vulnerability scans and administrative compliance language, a recurring bottleneck in compliance programs.
Its published evaluation, run against an isolated validation set of 2,000 examples over the full 1,196-control NIST SP 800-53 catalogue, reports that off-the-shelf embedding models perform poorly at this mapping out of the box, that fine-tuning a compact encoder with multiple negatives ranking loss substantially improves top-1 retrieval accuracy, and that adding a generative reranking step or fusing in lexical BM25 keyword search both reduced accuracy compared with the fine-tuned dense retriever alone in its tests.