README.md

---
license: other
license_name: glyph-proprietary-1.0
license_link: LICENSE
base_model: unsloth/gemma-4-26B-A4B-it
library_name: transformers
pipeline_tag: text-generation
language:
- en
tags:
- security
- penetration-testing
- offensive-security
- red-team
- cybersecurity
- agent
- tool-use
- function-calling
- multi-tool
- reasoning
- sft
- trl
- peft
- gemma4
- moe
inference: false
extra_gated_prompt: >-
  This model is the proprietary property of Glyph Software LLP. Access is
  granted only to authorized licensees under a signed agreement. This is an
  offensive-security agent intended solely for authorized penetration testing
  and security research. By requesting access you confirm you are an authorized
  user, that you will only use it against systems you are explicitly permitted
  to test, and that you agree to the terms in the LICENSE file.
extra_gated_fields:
  Company: text
  Authorized use case: text
  I confirm I will only use this model against systems I am authorized to test: checkbox
  I agree to the Glyph Proprietary License: checkbox
datasets:
- glyphsoftware/sentinel-exploit-tooled
---

# Sentinel-R2.2-Max

> **Proprietary & Confidential.** Sentinel-R2.2-Max is the exclusive property of
> **Glyph Software LLP**. It is **not** open source and is distributed under a
> proprietary, all-rights-reserved license. See the [License](#license) section
> and the bundled [`LICENSE`](https://huggingface.co/glyphsoftware/sentinel-r2.2-max/blob/main/LICENSE) file.

Sentinel-R2.2-Max is an **offensive-security agent** for **authorized penetration
testing**. Given a target scope and an agent toolkit (`Bash`, `Write`, `Read` and
others — see [Training Data](#this-model-expects-an-agent-toolkit-not-a-shell)),
it enumerates the
target, works out a foothold, escalates privileges as far as it can, and writes
up the full attack path — the root cause of each weakness it exploits and how to
fix it. It is a reasoning + tool-use model: it plans, issues tool calls, reasons
over the results, and iterates toward its objective.

This repository contains the **full merged model weights** — the LoRA adapter fused
into its base model. It loads directly with `transformers` and requires no separate
base download or PEFT step.

> **⚠️ These weights were replaced on 2026-08-09.** This repository previously held a
> different build: 3 epochs over the 1,180-conversation `sentinel-exploit-db`. It has
> been rewritten with the model documented below — 2 epochs over the 1,230-conversation
> **tooled** dataset with structured `tool_calls`. If you pulled this repo before
> 2026-08-09 you have materially different weights. The prior build's benchmark results
> remain in this repository's commit history.

> **⚠️ This build has not been evaluated.** No benchmark suite has been run against
> these weights — see [Evaluation](#evaluation). The only quantitative signal is
> held-out loss on the training distribution. Treat it as unvalidated, and note that
> the build it replaced *was* benchmarked and showed a measured regression against
> Sentinel-R2.2 on GSM8K.

## Model Details

### Model Description

- **Developed & curated by:** Glyph Software LLP
- **Model persona / identity:** `Sentinel`
- **Model type:** Merged full-weight sparse-MoE causal decoder; instruction-, reasoning-, and tool-use-tuned
- **Architecture:** `Gemma4ForConditionalGeneration` (30 layers, hidden size 2816, 128 experts, top-8 routing, sliding + full attention interleaved)
- **Parameters:** ~25.8B total / ~4B active per token
- **Base model:** [`unsloth/gemma-4-26B-A4B-it`](https://huggingface.co/unsloth/gemma-4-26B-A4B-it)
- **Precision:** bfloat16 (16-bit merged weights)
- **Context length:** up to 262,144 tokens (native)
- **Task type:** `CAUSAL_LM`
- **Languages:** English (with embedded shell commands and source code across many languages)
- **Finetuning method:** Supervised fine-tuning (SFT, LoRA) on curated authorized-pentest agent trajectories, then merged to 16-bit
- **License:** Proprietary — Glyph Proprietary License v1.0 (all rights reserved)

> **Multimodal towers preserved.** The base is a vision + audio model. Fine-tuning
> targeted the language model only, and the vision/audio towers are passed through
> unmodified, so image and audio inputs still work exactly as in the base model.
> The training data is text-only, so the security behavior is not conditioned on
> visual input.

### Model Sources

- **Repository:** `glyphsoftware/sentinel-r2.2-max`
- **Previous release:** `glyphsoftware/sentinel-r2.2`
- **Base model:** `unsloth/gemma-4-26B-A4B-it`

## Intended Use

### Primary intended uses

- **Authorized penetration testing:** Autonomous or human-in-the-loop
  enumeration, foothold discovery, and privilege escalation against systems the
  operator is explicitly permitted to test.
- **Attack-path reporting:** Producing clear write-ups of each exploited
  weakness, its root cause, and concrete remediation guidance.
- **Red-team tooling and security research:** Driving agentic workflows that use
  the agent toolkit in isolated lab or authorized engagement environments.

### Out-of-scope and prohibited uses

- **Any use against systems you are not explicitly authorized to test.**
- Unauthorized access, disruption, data theft, or any use violating applicable
  law or the proprietary license.
- Any use outside Glyph Software LLP or its authorized licensees.
- Fully unattended operation without appropriate scoping, guardrails, and human
  oversight.

## Evaluation

**No benchmark suite has been run against this build.**

The figures published for [Sentinel-R2.2](https://huggingface.co/glyphsoftware/sentinel-r2.2),
and those in this repository's earlier commits, were measured on **different weights
trained on a different dataset**. They do not describe these weights and should not be
quoted for them.

The only quantitative signal available is held-out loss, reported under
[Training Procedure](#training-procedure). Held-out loss measures next-token agreement
with the training distribution; it is not a capability measurement and says nothing
about security-agent ability.

> **A good loss curve is not evidence of a good model here.** The build this repository
> previously held also had a clean, monotonically falling held-out curve — and
> benchmarking then found a **0.78 → 0.61 GSM8K regression** driven by a repetition-loop
> failure affecting ~20% of generations, which the loss curve gave no hint of. That
> failure mode was diagnosed only by inspecting generations. Until this build is
> benchmarked, the same class of problem cannot be ruled out.

To evaluate, run the suite below. **`add_bos_token=True` is required** — Gemma depends
on a leading `<bos>`, which lm-eval's HF backend does not add by default for
loglikelihood scoring, and without it this architecture scores at floor on
`arc_challenge`:

```bash
lm_eval --model hf \
  --model_args pretrained=glyphsoftware/sentinel-r2.2-max,dtype=bfloat16,add_bos_token=True \
  --tasks arc_challenge,mmlu,wmdp_cyber --num_fewshot 0 --batch_size 4 --seed 1234
```

Use batch 4 for loglikelihood tasks and 16 for generative ones
(`gpqa_diamond_cot_zeroshot`, `gsm8k`). `--num_fewshot` is global, so 5-shot GSM8K
needs its own invocation. Prompt format is task-type dependent: `--apply_chat_template`
helps generative tasks and measurably hurts loglikelihood MCQ on this architecture.
Record the configuration out of band — lm-eval's `results_*.json` writes
`apply_chat_template: None` even when the flag was passed.

## Training Data

Fine-tuned on [**`glyphsoftware/sentinel-exploit-tooled`**](https://huggingface.co/datasets/glyphsoftware/sentinel-exploit-tooled)
("Sentinel Exploit DB (Tooled)"), revision `5b11e692`. Each example is a complete
multi-turn engagement — enumeration → foothold → privilege escalation → remediation
write-up — in OpenAI chat format with structured `tool_calls` and `tool` responses.

| Property | Value |
|---|---|
| Conversations | 1,230 (**1,168 train / 61 held-out** after tokenization; 1 dropped) |
| Total messages | 31,961 |
| Assistant turns | 15,289, carrying **14,212 tool calls** |
| Turns with `reasoning_content` | 389 |
| Distinct tools | **19** |
| Tokens (this run) | 4,076,783 (~52.5% supervised) |
| Sequence length | max 13,209 tokens |
| Framing | Authorized engagements in isolated lab networks |

| Source | Conversations | What it is |
|---|---:|---|
| `redteam` | 350 | Full-lifecycle red-team engagements, each ATT&CK-mapped with detections and remediation |
| `ctf` | 300 | HTB-style machine pentests, full kill chain, with authored failure→recovery episodes |
| `v8` | 300 | Chromium / V8 JavaScript-engine exploitation, bug primitive → code execution |
| `ctf-apocalypse` | 100 | HackTheBox Cyber Apocalypse 2023–2025 jeopardy CTFs across all categories |
| `offsec` | 100 | Active Directory chains, cloud (AWS/Azure/GCP/K8s), database, web, binary pwn |
| `ctf-synthetic` | 41 | Grounded synthetic pentests built around real CVE chains |
| `cve` | 39 | Single-CVE source review and exploit development |

### This model expects an agent toolkit, not a shell

This is the most important behavioral difference from
[Sentinel-R2.2](https://huggingface.co/glyphsoftware/sentinel-r2.2) and from the build
that previously occupied this repository. Those were trained where **every action went
through one `execute(command)` tool**. This build was trained on a decomposed tool
surface and calls tools by name:

| Tool | Calls | Used for |
|---|---:|---|
| `Bash` | 11,087 | shell commands, pipelines, chains; background jobs |
| `Write` | 1,714 | authoring PoC scripts, payloads, wordlists |
| `Read` | 384 | reading a file |
| `TaskCreate` / `TaskUpdate` | 266 / 266 | opening and closing engagement objectives |
| `TaskGet` / `TaskList` | 162 / 46 | checking objective status mid-engagement |
| `Agent` | 72 | delegating a bounded sweep or code review |
| `ListAgents` | 63 | discovering delegates before a fan-out |
| `Grep` | 62 | searching file contents |
| `Monitor` | 27 | waiting on a condition |
| `CronCreate` / `CronList` / `CronDelete` | 15 / 12 / 12 | recurring checks |
| `SendMessage` | 9 | following up with a running agent |
| `Edit` | 7 | single literal substitution |
| `Glob` | 5 | finding files by name |
| `TaskOutput` / `TaskStop` | 2 / 1 | reading and stopping background jobs |

`Bash` is the majority tool by design — roughly a fifth of source commands are genuine
pipelines for which a shell call is the faithful representation.

> **Give it the tools it was trained on.** Handing this model a single `execute` tool
> reintroduces exactly the mismatch the dataset was built to remove, and teaches it to
> cram every action into a shell string. Declare `Bash`, `Write`, and `Read` at minimum;
> declare the orchestration tools only if your harness genuinely implements them.

**Tool-call arguments are JSON objects, not strings.** `tool_call.function.arguments`
is always a mapping, e.g. `{"command": "nmap -sV 10.10.10.10"}`.

### Known properties of this training data

Inherited from the dataset and relevant to anyone interpreting this model's behavior:

- **~8.9% of tool calls are synthesized.** `TaskCreate`/`TaskUpdate`/`TaskGet`/`TaskList`,
  `Cron*`, `SendMessage` and `ListAgents` have **no precedent in the source corpus** —
  they were added so every tool the agent holds at inference appears in training. They
  teach tool *syntax* and plausible placement, not verified strategy.
- **~10.3% of calls have heuristically divided outputs.** Where one source `execute`
  call decomposed into several tool calls, its single stdout blob was split between
  them; a minority are attributed to the wrong command.
- **65.3% of calls are exact**, 15.6% emitted unchanged as a single byte-identical `Bash`.
- **Tail tools are sparse.** `Glob` (5), `TaskOutput` (2), `TaskStop` (1) and `Edit` (7)
  have too few examples to teach reliable usage.

All scenarios are explicitly scoped as authorized testing against already-public CTF
machines and disclosed CVEs. Flags, credentials, hostnames, and IP addresses are
synthetic lab values or RFC-reserved / public CTF ranges.

## Prompt Format

Uses the Gemma 4 chat template with `system`, `user`, `assistant`, and `tool` roles,
and supports tool calling. The bundled `chat_template.jinja` injects a **default
Sentinel system prompt** ahead of any caller-supplied system message, establishing the
model identity and the authorized-scope constraint even when the caller supplies none.

Tool calls are emitted in the Gemma DSL, naming the specific tool:

```
<|tool_call>call:Bash{command:<|"|>nmap -sC -sV -p- --min-rate 2000 10.129.106.234<|"|>}<tool_call|>
<|tool_call>call:Write{file_path:<|"|>exploit.py<|"|>,content:<|"|>import requests...<|"|>}<tool_call|>
```

**`<|tool_response>` (token 50) is a declared EOS token**, alongside `<eos>` (1)
and `<turn|>` (106). Generation halts at the handoff point: your harness appends the
`<|tool_response>...<tool_response|>` block containing real output and resumes
generation from there.

> **Use `enable_thinking=True`.** With it `False`, the chat template appends an
> empty `<|channel>thought\n<channel|>` block to the generation prompt — a pattern
> that never occurs in the training render. With it `True` the prompt ends at
> `<|turn>model\n`, exactly where the supervised region begins during training.

### Recommended system prompt

Training system messages enumerate the agent's tool surface, so yours should too:

```
You are an expert penetration tester carrying out an authorized engagement in an
isolated lab, working from your attacking host. You have these tools: `Bash` to run
shell commands, `Write` to author files, `Read` to read them, `Grep` to search file
contents, and `Glob` to find files by name. Enumerate the target thoroughly, work out
a foothold, escalate your privileges as far as you can (root or Administrator/SYSTEM),
and then write up the full attack path — the root cause of each weakness you exploit
and how to fix it.
```

> **Note on the bundled template.** The default system prompt injected by
> `chat_template.jinja` is inherited from the Sentinel-R2.2 line and describes
> "operating an interactive shell through tool calls" — phrasing that predates this
> build's multi-tool surface. It still establishes identity and authorized-scope
> framing correctly, and your own system message is appended after it, but enumerate
> the real tool surface there rather than relying on the default.

## How to Use

> Access to these weights requires an authorized Hugging Face token for the
> gated/private repository. These are full merged weights — no adapter or base
> download is required.

```python
import torch
from transformers import AutoModelForCausalLM, AutoTokenizer

model_id = "glyphsoftware/sentinel-r2.2-max"

tokenizer = AutoTokenizer.from_pretrained(model_id)
model = AutoModelForCausalLM.from_pretrained(
    model_id, device_map="auto", dtype=torch.bfloat16
)

# Declare the tools this model was trained on. Bash / Write / Read are the
# high-frequency three; add Grep, Glob, Edit if your harness implements them.
def fn(name, desc, props, required):
    return {"type": "function", "function": {
        "name": name, "description": desc,
        "parameters": {"type": "object", "properties": props, "required": required}}}

TOOLS = [
    fn("Bash", "Run a shell command on the attacking host.",
       {"command": {"type": "string", "description": "Shell command to run."},
        "run_in_background": {"type": "boolean", "description": "Run detached."}},
       ["command"]),
    fn("Write", "Write a file (PoC script, payload, wordlist).",
       {"file_path": {"type": "string"}, "content": {"type": "string"}},
       ["file_path", "content"]),
    fn("Read", "Read a file from disk.",
       {"file_path": {"type": "string"}, "offset": {"type": "integer"},
        "limit": {"type": "integer"}},
       ["file_path"]),
]

messages = [
    {"role": "user", "content": "Assess the authorized lab host at 10.129.0.10."},
]

text = tokenizer.apply_chat_template(
    messages, tools=TOOLS, tokenize=False,
    add_generation_prompt=True, enable_thinking=True,
)
inputs = tokenizer(text, add_special_tokens=False, return_tensors="pt").to(model.device)

out = model.generate(**inputs, max_new_tokens=1024, temperature=0.3, top_p=0.9)
print(tokenizer.decode(out[0][inputs["input_ids"].shape[-1]:], skip_special_tokens=False))
```

The model emits named tool calls (`Bash`, `Write`, `Read`, …); your harness is
responsible for executing them **only within an authorized, isolated environment**
and feeding results back as `tool` messages with the matching `tool_call_id`.

### Recommended generation settings

| Parameter | Value |
|---|---|
| `temperature` | 0.2 – 0.4 |
| `top_p` | 0.9 |
| `max_new_tokens` | 1024+ (reasoning and tool calls consume tokens) |
| `enable_thinking` | `True` (see [Prompt Format](#prompt-format)) |
| `repetition_penalty` | consider ~1.05–1.1 — see [Limitations](#limitations-and-risks) |

## Training Procedure

| Hyperparameter | Value |
|---|---|
| Method | Supervised fine-tuning (LoRA), merged to 16-bit |
| Base model | `unsloth/gemma-4-26B-A4B-it` |
| LoRA rank / alpha | 32 / 64 |
| LoRA dropout | 0.05 |
| Target modules | attention `q,k,v,o` + dense MLP `gate,up,down` on the language model — 205 modules, 37,171,200 trainable params (0.14%) |
| MoE experts | **frozen** (see note below) |
| Epochs | **2** |
| Batch size × grad accum | 1 × 8 (effective 8) |
| Training steps | **292** (9 warmup) |
| Learning rate | 1e-4, cosine decay |
| Optimizer | `adamw_torch` |
| Precision | bf16 (non-4bit) |
| Loss masking | assistant tokens only (~52.5% of tokens supervised) |
| Final training loss | 0.9725 |
| Held-out eval loss | **0.8870** |
| Hardware | 1× NVIDIA DGX Spark (GB10, 128 GB unified, aarch64) |
| Wall-clock | 5h44m, 82.3 GiB peak memory |

Held-out loss over training: 0.9939 → 0.9153 → 0.8917 → **0.8870** at epochs 0.5 /
1.0 / 1.5 / 2.0. Monotonic throughout, and still improving at the end — the final
interval gained 0.0047 after 0.0236 before it. The 3-epoch build this replaced had
essentially flattened by its final epoch (0.0043), which is part of why this run
stopped at 2.

> **Not comparable to other Sentinel builds.** Sentinel-R2.2 reports 0.927 and the
> previous 3-epoch build reported 0.8506, but all three use **different held-out sets**
> (29 / 59 / 61 conversations) drawn from **different datasets**. A lower number here
> does not mean a better model.

Trained with TRL and PEFT on `transformers`, then the adapter was merged into the
base weights and exported in bf16.

### Notes for anyone re-adapting this model

Two structural properties of the Gemma 4 MoE base constrain where LoRA can attach:

- The expert weights are stored as **fused 3D tensors**
  (`layers.N.experts.gate_up_proj`, `layers.N.experts.down_proj`, with no
  `.weight` suffix). They are not `nn.Linear`, so PEFT cannot attach adapters to
  them. The experts are frozen; adaptation is on attention plus the per-layer
  dense MLP.
- `attention_k_eq_v: true` means 5 of the 30 layers share K and V, so `v_proj`
  exists in only **25** layers. Target modules must be matched against the real
  module graph rather than an assumed uniform name list.

Loss was computed on assistant-generated tokens only — model reasoning,
`<|tool_call>` blocks, and turn terminators — with the system prompt, the user's
engagement request, and every `<|tool_response>` block masked out.

## Limitations and Risks

- **Unevaluated.** No benchmark has been run against these weights. Nothing
  establishes that this build is better than, or as good as, Sentinel-R2.2 or the
  build it replaced. See [Evaluation](#evaluation).
- **Repetition-loop risk is unmeasured but plausible.** The 3-epoch build this
  replaced degenerated into repeated clauses on ~20% of GSM8K generations. Two epochs
  and a still-improving loss curve make over-fitting less likely here, but this has
  **not** been tested. Use a repetition penalty and explicit stop conditions in your
  harness until it has been.
- **Not a substitute for a skilled operator.** Outputs may be incorrect,
  incomplete, or unsafe to run. Every command must be reviewed before execution.
- **Powerful dual-use capability.** This model is designed to compromise
  systems. It must only ever be pointed at targets you are explicitly authorized
  to test, in isolated environments, with human oversight.
- **Specialized training set.** 1,168 training conversations is a specialized
  behavioral slice, not a broad capability upgrade; coverage of tools, platforms,
  and techniques is limited and biased toward the scenarios in the training data.
- **Distribution skew.** Weighted toward `redteam` (350), `v8` (300) and `ctf` (300)
  of 1,230, so ATT&CK-mapped red-team engagements, V8 exploitation, and CTF-style
  machines are over-represented relative to `cve` (39) and `ctf-synthetic` (41).
- **Orchestration-tool behavior is invented, not observed.** The task-list, cron and
  multi-agent tools were synthesized into the training data with no precedent in the
  source corpus (~8.9% of all calls). Do not treat this model's use of them as
  evidence-based strategy; it learned their syntax and plausible placement only.
- **Tool-surface mismatch is a real failure mode.** Supplying a single `execute` tool
  instead of the named toolkit puts the model off-distribution. See
  [Training Data](#this-model-expects-an-agent-toolkit-not-a-shell).
- **Not evaluated on live task success.** No measurement of end-to-end engagement
  success against real targets has been performed.
- **Reasoning is not ground truth.** The model's plans and explanations are aids,
  not verified proofs; validate all findings independently.
- **Harness responsibility.** Command execution, scoping, network isolation, and
  guardrails are the responsibility of the operator and the surrounding harness,
  not the model.

## License

**Proprietary — All Rights Reserved.**

Sentinel-R2.2-Max, including these merged weights, its configuration, tokenizer, and
all associated artifacts, is the confidential and proprietary property of
**Glyph Software LLP**. It is **not** released under any open-source license and
is governed by the **Glyph Proprietary License v1.0** in the bundled
[`LICENSE`](https://huggingface.co/glyphsoftware/sentinel-r2.2-max/blob/main/LICENSE) file.

No part of this model may be copied, distributed, published, sublicensed,
merged into another model, distilled, or used to train or evaluate any other
model, except by Glyph Software LLP or parties holding explicit prior written
permission. Access does not grant any ownership or license rights beyond those
expressly granted in writing.

© 2026 Glyph Software LLP. All rights reserved.

## Citation

```bibtex
@misc{glyphsoftware_sentinel_r2.2_max,
  title  = {Sentinel-R2.2-Max: An Authorized Penetration-Testing Agent},
  author = {Glyph Software LLP},
  year   = {2026},
  note   = {Proprietary model. All rights reserved.}
}
```

## Contact

For licensing, access requests, or security inquiries, contact Glyph Software LLP.