README.md

---
license: other
license_name: glyph-proprietary-1.0
license_link: LICENSE
base_model: unsloth/gemma-4-26B-A4B-it
library_name: transformers
pipeline_tag: text-generation
language:
- en
tags:
- security
- penetration-testing
- offensive-security
- red-team
- cybersecurity
- agent
- tool-use
- reasoning
- sft
- trl
- peft
- gemma4
- moe
inference: false
extra_gated_prompt: >-
  This model is the proprietary property of Glyph Software LLP. Access is
  granted only to authorized licensees under a signed agreement. This is an
  offensive-security agent intended solely for authorized penetration testing
  and security research. By requesting access you confirm you are an authorized
  user, that you will only use it against systems you are explicitly permitted
  to test, and that you agree to the terms in the LICENSE file.
extra_gated_fields:
  Company: text
  Authorized use case: text
  I confirm I will only use this model against systems I am authorized to test: checkbox
  I agree to the Glyph Proprietary License: checkbox
datasets:
- glyphsoftware/sentinel-exploit-db
---

# Sentinel-R2.2

> **Proprietary & Confidential.** Sentinel-R2.2 is the exclusive property of
> **Glyph Software LLP**. It is **not** open source and is distributed under a
> proprietary, all-rights-reserved license. See the [License](#license) section
> and the bundled [`LICENSE`](https://huggingface.co/glyphsoftware/sentinel-r2.2/blob/main/LICENSE) file.

Sentinel-R2.2 is an **offensive-security agent** for **authorized penetration
testing**. Given a target scope and a shell-`execute` tool, it enumerates the
target, works out a foothold, escalates privileges as far as it can, and writes
up the full attack path — the root cause of each weakness it exploits and how to
fix it. It is a reasoning + tool-use model: it plans, issues tool calls, reasons
over the results, and iterates toward its objective.

This repository contains the **full merged model weights** — the Sentinel-R2.2
LoRA adapter fused into its base model. Unlike the
[adapter repository](https://huggingface.co/glyphsoftware/sentinel-r2.2-lora), it
loads directly with `transformers` and requires no separate base download or
PEFT step.

> **New base for the R2.2 line.** Where Sentinel-R2.1 was built on a 9B dense
> Qwen3.5 base, R2.2 moves to **Gemma 4 26B-A4B** — a sparse mixture-of-experts
> model with 128 experts and top-8 routing, so only ~4B parameters are active per
> token despite 26B total. In practice that means R2.1-class inference cost with
> substantially more capacity to draw on.

> **Multimodal towers preserved.** The base is a vision + audio model. Fine-tuning
> targeted the language model only, and the vision/audio towers are passed through
> unmodified, so image and audio inputs still work exactly as in the base model.
> The training data is text-only, so the security behavior is not conditioned on
> visual input.

## Model Details

### Model Description

- **Developed & curated by:** Glyph Software LLP
- **Model persona / identity:** `Sentinel-R2.2`
- **Model type:** Merged full-weight sparse-MoE causal decoder; instruction-, reasoning-, and tool-use-tuned
- **Architecture:** `Gemma4ForConditionalGeneration` (30 layers, hidden size 2816, 128 experts, top-8 routing, sliding + full attention interleaved)
- **Parameters:** ~25.8B total / ~4B active per token
- **Base model:** [`unsloth/gemma-4-26B-A4B-it`](https://huggingface.co/unsloth/gemma-4-26B-A4B-it)
- **Precision:** bfloat16 (16-bit merged weights)
- **Context length:** up to 262,144 tokens (native)
- **Task type:** `CAUSAL_LM`
- **Languages:** English (with embedded shell commands and source code across many languages)
- **Finetuning method:** Supervised fine-tuning (SFT, LoRA) on curated authorized-pentest agent trajectories, then merged to 16-bit
- **License:** Proprietary — Glyph Proprietary License v1.0 (all rights reserved)

### Model Sources

- **Repository:** `glyphsoftware/sentinel-r2.2` (gated)
- **Adapter-only repository:** `glyphsoftware/sentinel-r2.2-lora`
- **Base model:** `unsloth/gemma-4-26B-A4B-it`

## Intended Use

### Primary intended uses

- **Authorized penetration testing:** Autonomous or human-in-the-loop
  enumeration, foothold discovery, and privilege escalation against systems the
  operator is explicitly permitted to test.
- **Attack-path reporting:** Producing clear write-ups of each exploited
  weakness, its root cause, and concrete remediation guidance.
- **Red-team tooling and security research:** Driving agentic workflows that use
  a shell/`execute` tool in isolated lab or authorized engagement environments.

### Out-of-scope and prohibited uses

- **Any use against systems you are not explicitly authorized to test.**
- Unauthorized access, disruption, data theft, or any use violating applicable
  law or the proprietary license.
- Any use outside Glyph Software LLP or its authorized licensees.
- Fully unattended operation without appropriate scoping, guardrails, and human
  oversight.

## Benchmarks

Measured 2026-08-03 with [EleutherAI lm-evaluation-harness](https://github.com/EleutherAI/lm-evaluation-harness)
v0.4.12 (transformers backend, single GB10, `dtype=bfloat16`, seed 1234) on the
merged weights in this repository. Figures from the R2.1 line were measured on a
different base model and are not carried over.

| Task | Metric | Sentinel-R2.2 (this model) | Gemma 4 26B-A4B-it (base, as published) |
|------|--------|--------------------------|------------------------------------|
| gsm8k (5-shot) | exact_match (strict) | **0.7794** ± 0.0114 | 0.680 <sup>a</sup> |
| gsm8k (5-shot) | exact_match (flexible) | **0.7824** ± 0.0114 | 0.680 <sup>a</sup> |
| mmlu (0-shot) | acc | **0.7662** ± 0.0034 | not reported <sup>b</sup> |
| arc_challenge (0-shot) | acc | **0.5666** ± 0.0145 | 0.960 <sup>c</sup> |
| arc_challenge (0-shot) | acc_norm | **0.6092** ± 0.0143 | not broken out <sup>c</sup> |
| gpqa_diamond (CoT, 0-shot) | exact_match (flexible) | **0.2121** ± 0.0291 | 0.823 <sup>d</sup> |
| [wmdp](https://www.wmdp.ai/)_cyber (0-shot) | acc | **0.5118** ± 0.0112 | not reported <sup>e</sup> |

> **The two columns were not produced the same way, and the difference between them
> is not a measurement of what fine-tuning did.** The left column is a controlled
> run described below. The right column is copied from third-party publications
> whose methodology is largely undisclosed. Subtracting one from the other produces
> a number that means nothing. A like-for-like base column requires running the
> suite in [Reproducing these numbers](#reproducing-these-numbers) against
> `unsloth/gemma-4-26B-A4B-it`; that has not been done.

<sup>a</sup> [arXiv 2604.07035](https://arxiv.org/html/2604.07035v1), **few-shot
chain-of-thought**, not 5-shot plain like ours; the same paper reports 0.310
zero-shot, so this task is extremely prompt-sensitive on this model. Not split into
strict/flexible, so one figure is shown against both of ours.

<sup>b</sup> Google publishes **MMLU-Pro 82.6**, a different and harder benchmark than
MMLU. It is not a substitute and is deliberately not placed in this row. (Google also
reports MMMLU 86.3, again a different task.)

<sup>c</sup> [arXiv 2604.07035](https://arxiv.org/html/2604.07035v1). This figure is
identical (0.960) across zero-shot, CoT, and few-shot-CoT, which is characteristic of
a **small subsample** — the paper states it used "the same task sample sizes" across
models. Our 0.5666 is the full 1,172-item set. The paper does not state whether it
reports `acc` or `acc_norm`, nor whether `add_bos_token` was set, a flag that alone
moves this metric from 0.00 to 0.57 on this architecture.

<sup>d</sup> [Google Gemma 4 model card](https://ai.google.dev/gemma/docs/core/model_card_4),
reported as 82.3%. Gemma 4 has an explicit **thinking channel**; this score is not
reachable under plain lm-eval prompting with thinking disabled, which is how our run
was configured. Our `strict-match` on the same task was **0.0000** — the model never
emitted the expected answer format at all — which is direct evidence the two runs are
measuring different things.

<sup>e</sup> [WMDP](https://www.wmdp.ai/) — Weapons of Mass Destruction Proxy
([paper](https://arxiv.org/pdf/2403.03218), [code](https://github.com/centerforaisafety/wmdp),
[dataset](https://huggingface.co/datasets/cais/wmdp)) — is a hazardous-knowledge proxy,
not a quality metric: it exists so that unlearning methods can be scored on driving it
**down**. Full 1,987-question cyber split; random baseline is 0.25. Measured as raw
completion, matching the rest of this column; under `--apply_chat_template` the same
run gives 0.3156 ± 0.0104.

MMLU by category: humanities 0.6901, STEM 0.7574, other 0.8149, social sciences 0.8424.

### Reproducing these numbers

> **`add_bos_token=True` is required.** Gemma depends on a leading `<bos>`, which
> lm-eval's HF backend does not add by default for loglikelihood scoring. Without
> it this model scores **0.00** on arc_challenge (verified; adding it gives 0.56 on
> the same sample). Any evaluation of this model that omits the flag is measuring
> an artifact.

```bash
lm_eval --model hf \
  --model_args pretrained=glyphsoftware/sentinel-r2.2,dtype=bfloat16,add_bos_token=True \
  --tasks arc_challenge --num_fewshot 0 --batch_size 4 --seed 1234
```

Batch size was 4 for the loglikelihood tasks (`arc_challenge`, `mmlu`) and 16 for
the generative ones (`gpqa_diamond_cot_zeroshot`, `gsm8k`). With a 262,144-token
vocabulary, full-sequence logits cost roughly 1 MB per token per batch element in
fp32, so loglikelihood scoring is memory-bound; generation only materializes
logits for the last position and is bound by the KV cache instead.

### Other published figures for the base model

Not placed in the table above because they are different benchmarks with no
Sentinel-R2.2 counterpart, but useful context on the base:

| Source | Benchmark | Reported |
|---|---|---|
| [Google Gemma 4 model card](https://ai.google.dev/gemma/docs/core/model_card_4) | MMLU-Pro | 82.6 |
| [Google Gemma 4 model card](https://ai.google.dev/gemma/docs/core/model_card_4) | MMMLU | 86.3 |
| [Google Gemma 4 model card](https://ai.google.dev/gemma/docs/core/model_card_4) | AIME 2026 (no tools) | 88.3 |
| [Google Gemma 4 model card](https://ai.google.dev/gemma/docs/core/model_card_4) | LiveCodeBench v6 | 77.1 |
| [arXiv 2604.07035](https://arxiv.org/html/2604.07035v1) | GSM8K (zero-shot) | 0.310 |

Held-out loss on the training distribution is reported under
[Training Procedure](#training-procedure).

## Training Data

Sentinel-R2.2 was fine-tuned on [`glyphsoftware/sentinel-exploit-db`](https://huggingface.co/datasets/glyphsoftware/sentinel-exploit-db),
a curated set of **authorized penetration-test agent trajectories**. Each example
is a multi-turn conversation in which the assistant is given an isolated-lab
target and a shell `execute` tool, and works through enumeration → foothold →
privilege escalation → remediation write-up, interleaving reasoning, tool calls,
and tool results.

| Property | Value |
|---|---|
| Training examples | 580 conversations (551 train / 29 held-out) |
| Tokens | 2,007,409 (1,085,139 supervised) |
| Format | Multi-turn `messages` (system / user / assistant / tool) with tool calls |
| Tooling | Single `execute` shell tool |
| Framing | Authorized engagements in isolated lab networks |

Trajectory mix: HTB-style machine pentests, HackTheBox Cyber Apocalypse jeopardy
CTFs, grounded synthetic pentests on real CVE chains, single-CVE exploit
development, Active Directory / cloud / database offensive engagements, V8
JavaScript-engine exploitation, and ATT&CK-mapped full-lifecycle red-team
engagements.

All scenarios are explicitly scoped as authorized testing against lab targets.

## Prompt Format

Sentinel-R2.2 uses the Gemma 4 chat template with `system`, `user`, `assistant`,
and `tool` roles, and supports tool calling. The system message establishes the
pentester persona and the engagement rules; the model responds with reasoning and
`execute` tool calls, consumes the tool results, and continues until it reaches
its objective and produces a write-up.

Tool calls are emitted in the Gemma DSL:

```
<|tool_call>call:execute{command:<|"|>nmap -sC -sV -p- --min-rate 2000 10.129.106.234<|"|>}<tool_call|>
```

**`<|tool_response>` (token 50) is a declared EOS token**, alongside `<eos>` (1)
and `<turn|>` (106). Generation therefore halts at the handoff point: your harness
appends the `<|tool_response>...<tool_response|>` block containing real output and
resumes generation from there.

> **Use `enable_thinking=True`.** With it `False`, the chat template appends an
> empty `<|channel>thought\n<channel|>` block to the generation prompt — a pattern
> that never occurs in the training render, so the model was never conditioned on
> it. With it `True` the prompt ends at `<|turn>model\n`, exactly where the
> supervised region begins during training.

### Recommended system prompt

```
You are an expert penetration tester carrying out an authorized engagement in
an isolated lab. You have an execute tool to run shell commands from your
attacking host. Enumerate the target thoroughly, work out a foothold, escalate
your privileges as far as you can (root or Administrator/SYSTEM), and then write
up the full attack path — the root cause of each weakness you exploit and how to
fix it.
```

## How to Use

> Access to these weights requires an authorized Hugging Face token for the
> gated/private repository. These are full merged weights — no adapter or base
> download is required.

```python
import torch
from transformers import AutoModelForCausalLM, AutoTokenizer

model_id = "glyphsoftware/sentinel-r2.2"

tokenizer = AutoTokenizer.from_pretrained(model_id)
model = AutoModelForCausalLM.from_pretrained(
    model_id, device_map="auto", dtype=torch.bfloat16
)

EXECUTE = {"type": "function", "function": {
    "name": "execute",
    "description": "Execute a shell command on the attacking host.",
    "parameters": {"type": "object",
                   "properties": {"command": {"type": "string",
                                              "description": "Shell command to run."}},
                   "required": ["command"]}}}

system = (
    "You are an expert penetration tester carrying out an authorized engagement "
    "in an isolated lab. You have an execute tool to run shell commands from your "
    "attacking host. Enumerate the target thoroughly, work out a foothold, escalate "
    "your privileges as far as you can, and then write up the full attack path — "
    "the root cause of each weakness you exploit and how to fix it."
)

messages = [
    {"role": "system", "content": system},
    {"role": "user", "content": "Assess the authorized lab host at 10.129.0.10."},
]

text = tokenizer.apply_chat_template(
    messages, tools=[EXECUTE], tokenize=False,
    add_generation_prompt=True, enable_thinking=True,
)
inputs = tokenizer(text, add_special_tokens=False, return_tensors="pt").to(model.device)

out = model.generate(**inputs, max_new_tokens=1024, temperature=0.3, top_p=0.9)
print(tokenizer.decode(out[0][inputs["input_ids"].shape[-1]:], skip_special_tokens=False))
```

The model emits `execute` tool calls; your harness is responsible for running
those commands **only within an authorized, isolated environment** and feeding
the results back as `tool` messages.

### Recommended generation settings

| Parameter | Value |
|---|---|
| `temperature` | 0.2 – 0.4 |
| `top_p` | 0.9 |
| `max_new_tokens` | 1024+ (reasoning and tool calls consume tokens) |
| `enable_thinking` | `True` (see [Prompt Format](#prompt-format)) |

## Training Procedure

| Hyperparameter | Value |
|---|---|
| Method | Supervised fine-tuning (LoRA), merged to 16-bit |
| Base model | `unsloth/gemma-4-26B-A4B-it` |
| LoRA rank / alpha | 32 / 64 |
| LoRA dropout | 0.05 |
| Target modules | attention `q,k,v,o` + dense MLP `gate,up,down` on the language model — 205 modules, 37,171,200 trainable params (0.14%) |
| MoE experts | **frozen** (see note below) |
| Max sequence length | 16,384 |
| Epochs | 2 |
| Batch size × grad accum | 1 × 8 (effective 8) |
| Training steps | 138 (4 warmup) |
| Learning rate | 1e-4, cosine decay |
| Optimizer | `adamw_torch` |
| Precision | bf16 (non-4bit) |
| Loss masking | assistant tokens only (~54% of tokens supervised) |
| Final training loss | ~0.930 |
| Held-out eval loss | **0.927** |
| Hardware | 1× NVIDIA DGX Spark (GB10, 128 GB unified, aarch64) |
| Wall-clock | 2h57m, 83.0 GiB peak memory |

Held-out loss over training: 1.038 → 0.960 → 0.934 → **0.927** at epochs 0.5 /
1.0 / 1.5 / 2.0. Eval loss fell monotonically and never turned up, though the rate
had largely flattened by the end.

Trained with TRL and PEFT on `transformers`, then the adapter was merged into the
base weights and exported in bf16.

### Notes for anyone re-adapting this model

Two structural properties of the Gemma 4 MoE base constrain where LoRA can attach:

- The expert weights are stored as **fused 3D tensors**
  (`layers.N.experts.gate_up_proj`, `layers.N.experts.down_proj`, with no
  `.weight` suffix). They are not `nn.Linear`, so PEFT cannot attach adapters to
  them. The experts are frozen; adaptation is on attention plus the per-layer
  dense MLP.
- `attention_k_eq_v: true` means 5 of the 30 layers share K and V, so `v_proj`
  exists in only **25** layers. Target modules must be matched against the real
  module graph rather than an assumed uniform name list.

Loss was computed on assistant-generated tokens only — model reasoning,
`<|tool_call>` blocks, and turn terminators — with the system prompt, the user's
engagement request, and every `<|tool_response>` block masked out.

## Limitations and Risks

- **Not a substitute for a skilled operator.** Outputs may be incorrect,
  incomplete, or unsafe to run. Every command must be reviewed before execution.
- **Powerful dual-use capability.** This model is designed to compromise
  systems. It must only ever be pointed at targets you are explicitly authorized
  to test, in isolated environments, with human oversight.
- **Small training set.** 551 training conversations is a specialized behavioral
  slice, not a broad capability upgrade; coverage of tools, platforms, and
  techniques is limited and biased toward the scenarios in the training data.
- **Distribution skew.** Training data leans toward Linux HTB-style boxes and
  web/service CVEs. Flags, credentials, and IP addresses in the training set are
  synthetic lab values.
- **Not evaluated on live task success.** The published figures are general-capability
  benchmarks, held-out loss, and tool-call well-formedness. None of them measure
  security-agent ability, which is what this model was trained for. No measurement of
  end-to-end engagement success against real targets has been published for this build.
- **Reasoning is not ground truth.** The model's plans and explanations are aids,
  not verified proofs; validate all findings independently.
- **Harness responsibility.** Command execution, scoping, network isolation, and
  guardrails are the responsibility of the operator and the surrounding harness,
  not the model.

## License

**Proprietary — All Rights Reserved.**

Sentinel-R2.2, including these merged weights, its configuration, tokenizer, and
all associated artifacts, is the confidential and proprietary property of
**Glyph Software LLP**. It is **not** released under any open-source license and
is governed by the **Glyph Proprietary License v1.0** in the bundled
[`LICENSE`](https://huggingface.co/glyphsoftware/sentinel-r2.2/blob/main/LICENSE) file.

No part of this model may be copied, distributed, published, sublicensed,
merged into another model, distilled, or used to train or evaluate any other
model, except by Glyph Software LLP or parties holding explicit prior written
permission. Access does not grant any ownership or license rights beyond those
expressly granted in writing.

© 2026 Glyph Software LLP. All rights reserved.

## Citation

```bibtex
@misc{glyphsoftware_sentinel_r2.2,
  title  = {Sentinel-R2.2: An Authorized Penetration-Testing Agent},
  author = {Glyph Software LLP},
  year   = {2026},
  note   = {Proprietary model. All rights reserved.}
}
```

## Contact

For licensing, access requests, or security inquiries, contact Glyph Software LLP.