README.md

---
license: other
license_name: glyph-proprietary-1.0
license_link: LICENSE
base_model: Qwen/Qwen3.8-27B
library_name: transformers
pipeline_tag: text-generation
language:
- en
tags:
- security
- penetration-testing
- offensive-security
- red-team
- cybersecurity
- agent
- tool-use
- function-calling
- multi-tool
- reasoning
- sft
- peft
- qwen3_5
inference: false
extra_gated_prompt: >-
  This model is the proprietary property of Glyph Software LLP. Access is
  granted only to authorized licensees under a signed agreement. This is an
  offensive-security agent intended solely for authorized penetration testing
  and security research. By requesting access you confirm you are an authorized
  user, that you will only use it against systems you are explicitly permitted
  to test, and that you agree to the terms in the LICENSE file.
extra_gated_fields:
  Company: text
  Authorized use case: text
  I confirm I will only use this model against systems I am authorized to test: checkbox
  I agree to the Glyph Proprietary License: checkbox
datasets:
- glyphsoftware/sentinel-exploit-tooled
---

# Sentinel-R3

## ⚡ Run this model with Sentinel

![Sentinel Agent Harness CLI](https://raw.githubusercontent.com/Glyph-Software/sentinel/main/assets/banner.png)

**[`Glyph-Software/sentinel`](https://github.com/Glyph-Software/sentinel)** is the
reference harness for this model line —
*"a red-teaming agent for the terminal — and every command it runs happens inside
a container it cannot escape."*

```bash
curl -fsSL https://raw.githubusercontent.com/Glyph-Software/sentinel/main/install.sh | sh
```

Sentinel exposes the **same 19 native function-calling tools this model was trained
on** — `Bash`, `Read`, `Write`, `Edit`, `Grep`, `Glob`, `Agent`, `Task*`, `Cron*`,
`Monitor`, `SendMessage`, `ListAgents`. The training data was rewritten onto exactly
this tool surface, so the model's action space at inference matches the one it saw
during fine-tuning — no prose parsing, no cramming every action into a shell string.

| | |
|---|---|
| **Sandbox** | Containerized execution with egress allowlisting and an immutable root filesystem |
| **Subagents** | Dedicated agents for recon, vulnerability audits, exploitation, LLM red-teaming, and detection authoring |
| **Sessions** | Persistent across days, with transcript resumption |
| **Endpoints** | Any OpenAI-compatible server (vLLM, TGI, …) |

Point it at a vLLM server running these weights and it will map attack surface,
prove exploitability against authorized targets, and write up findings with severity
ratings and evidence.

---

> **Proprietary & Confidential.** Sentinel-R3 is the exclusive property of
> **Glyph Software LLP**. It is **not** open source and is distributed under a
> proprietary, all-rights-reserved license. See the [License](#license) section
> and the bundled [`LICENSE`](https://huggingface.co/glyphsoftware/sentinel-r3/blob/main/LICENSE) file.

Sentinel-R3 is an **offensive-security agent** for **authorized penetration
testing**. Given a target scope and an agent toolkit, it enumerates the target,
works out a foothold, escalates privileges as far as it can, and writes up the
full attack path — the root cause of each weakness it exploits and how to fix it.
It is a reasoning + tool-use model: it plans, issues tool calls, reasons over the
results, and iterates toward its objective.

This repository contains the **full merged model weights** — the Sentinel-R3
LoRA adapter fused into its base model. Unlike the
[adapter repository](https://huggingface.co/glyphsoftware/sentinel-r3-lora), it
loads directly with `transformers` and requires no separate base download or
PEFT step.

> **New base for the R3 line.** Where R2.2 was built on Gemma 4 26B-A4B (sparse
> MoE), R3 moves to **Qwen3.8-27B** — a 27.6B dense hybrid-attention model that
> interleaves **Gated-DeltaNet linear attention** with periodic full attention on
> a 3:1 ratio (48 linear + 16 full across 64 layers). Linear attention is O(n) in
> sequence length, which is what makes long multi-turn engagements — recon output,
> file dumps, and dozens of tool round-trips in one context — affordable at a
> 262,144-token native window.

> **Rich tool surface, not a single shell.** R2.2 funnelled every action through
> one `execute(command)` tool. R3 is trained on a **19-tool agent surface** —
> `Bash`, `Read`, `Write`, `Edit`, `Grep`, `Glob`, `Agent`, `Task*`, `Cron*`,
> `Monitor`, `SendMessage`, `ListAgents` — so the model's training-time action
> space matches a real agent harness instead of teaching it to cram every action
> into a shell string.

> **Vision tower preserved.** The base is a vision-language model. Fine-tuning
> targeted the language model only; the vision tower and its preprocessor are
> passed through unmodified, so image input still works exactly as in the base
> model. The training data is text-only, so the security behavior is not
> conditioned on visual input.

## Model Details

### Model Description

- **Developed & curated by:** Glyph Software LLP
- **Model persona / identity:** `Sentinel-R3`
- **Model type:** Merged full-weight hybrid-attention causal decoder; instruction-, reasoning-, and tool-use-tuned
- **Architecture:** `Qwen3_5ForConditionalGeneration` (64 layers, hidden size 5120, intermediate 17408, 24 attention heads / 4 KV heads, head dim 256; 48 Gated-DeltaNet linear-attention layers interleaved with 16 full-attention layers)
- **Parameters:** ~27.6B total (dense — all parameters active per token)
- **Base model:** [`Qwen/Qwen3.8-27B`](https://huggingface.co/Qwen/Qwen3.8-27B)
- **Precision:** bfloat16 (16-bit merged weights)
- **Context length:** up to 262,144 tokens (native)
- **Vocabulary:** 248,320
- **Task type:** `CAUSAL_LM` (multimodal-capable checkpoint; vision tower unmodified)
- **Languages:** English (with embedded shell commands and source code across many languages)
- **Finetuning method:** Supervised fine-tuning (SFT, LoRA) on curated authorized-pentest agent trajectories, then merged to 16-bit
- **License:** Proprietary — Glyph Proprietary License v1.0 (all rights reserved)

### Model Sources

- **Repository:** `glyphsoftware/sentinel-r3` (gated)
- **Adapter-only repository:** `glyphsoftware/sentinel-r3-lora`
- **Base model:** `Qwen/Qwen3.8-27B`

## Intended Use

### Primary intended uses

- **Authorized penetration testing:** Autonomous or human-in-the-loop
  enumeration, foothold discovery, and privilege escalation against systems the
  operator is explicitly permitted to test.
- **Attack-path reporting:** Producing clear write-ups of each exploited
  weakness, its root cause, and concrete remediation guidance.
- **Red-team tooling and security research:** Driving agentic workflows over a
  real multi-tool surface in isolated lab or authorized engagement environments.

### Out-of-scope and prohibited uses

- **Any use against systems you are not explicitly authorized to test.**
- Unauthorized access, disruption, data theft, or any use violating applicable
  law or the proprietary license.
- Any use outside Glyph Software LLP or its authorized licensees.
- Fully unattended operation without appropriate scoping, guardrails, and human
  oversight.

## Benchmarks

Measured 2026-08-16 with [EleutherAI lm-evaluation-harness](https://github.com/EleutherAI/lm-evaluation-harness)
v0.4.12 (transformers backend, single GB10, `dtype=bfloat16`, seed 1234, 0-shot,
batch size 4) on the merged weights in this repository.

| Task | Metric | Sentinel-R3 |
|------|--------|-------------|
| mmlu_computer_security (0-shot) | acc | **0.8800** ± 0.0327 |
| mmlu_security_studies (0-shot) | acc | **0.8449** ± 0.0232 |
| [wmdp](https://www.wmdp.ai/)_cyber (0-shot) | acc | **0.6296** ± 0.0108 <sup>a</sup> |

<sup>a</sup> [WMDP](https://www.wmdp.ai/) — Weapons of Mass Destruction Proxy
([paper](https://arxiv.org/pdf/2403.03218), [code](https://github.com/centerforaisafety/wmdp),
[dataset](https://huggingface.co/datasets/cais/wmdp)) — is a hazardous-knowledge
proxy, not a quality metric: it exists so that unlearning methods can be scored on
driving it **down**. Full 1,987-question cyber split; random baseline is 0.25.

> **These figures were produced as raw completion, without `--apply_chat_template`.**
> This model's chat template always injects the operator system prompt, so applying
> it would prepend "you are a penetration tester" to all 2,332 questions and measure
> the persona rather than the knowledge.

> **What these numbers do not show.** They measure security knowledge in
> multiple-choice form. They do not measure agentic task success — enumeration,
> foothold, privilege escalation, or write-up quality — which is what this model was
> actually fine-tuned for. No end-to-end engagement benchmark has been run on this
> build. For reference, the base model was measured under identical settings and all
> three differences were within noise (|z| < 0.8): the fine-tune targets agentic
> behavior, not factual recall, and these benchmarks cannot see that.

### Reproducing these numbers

```bash
lm_eval --model hf \
  --model_args pretrained=glyphsoftware/sentinel-r3,dtype=bfloat16 \
  --tasks wmdp_cyber,mmlu_computer_security,mmlu_security_studies \
  --num_fewshot 0 --batch_size 4 --seed 1234 --device cuda:0
```

Held-out loss on the training distribution is reported under
[Training Procedure](#training-procedure).

## Training Data

Sentinel-R3 was fine-tuned on [`glyphsoftware/sentinel-exploit-tooled`](https://huggingface.co/datasets/glyphsoftware/sentinel-exploit-tooled),
a curated set of **authorized penetration-test agent trajectories** rewritten
onto a rich agent tool surface. Each example is a multi-turn conversation in
which the assistant is given an isolated-lab target and a full toolkit, and works
through enumeration → foothold → privilege escalation → remediation write-up,
interleaving reasoning, tool calls, and tool results.

| Property | Value |
|---|---|
| Training examples | 1,230 conversations (1,205 train / 25 held-out) |
| Tokens | 4,171,133 (2,222,145 supervised, 53.3%) |
| Format | Multi-turn `messages` (system / user / assistant / tool) with `tool_calls` |
| Tooling | 19 distinct tools (78% `Bash`, 22% dedicated tools) |
| Framing | Authorized engagements in isolated lab networks |

Trajectory mix: HTB-style machine pentests (300), ATT&CK-mapped full-lifecycle
red-team engagements (350), V8 JavaScript-engine exploitation (300), HackTheBox
Cyber Apocalypse jeopardy CTFs (100), advanced offensive engagements across
Active Directory / cloud / database (100), grounded synthetic pentests on real
CVE chains (41), and single-CVE exploit development (39).

All scenarios are explicitly scoped as authorized testing against lab targets.

## Prompt Format

Sentinel-R3 uses the Qwen3.5 chat template with `system`, `user`, `assistant`,
and `tool` roles. The system message establishes the pentester persona and
enumerates the tool surface; the model responds with reasoning and tool calls,
consumes the tool results, and continues until it reaches its objective and
produces a write-up.

Tool calls are emitted in the Qwen XML DSL:

```
<tool_call>
<function=Bash>
<parameter=command>
nmap -sC -sV -p- --min-rate 2000 10.129.106.234
</parameter>
</function>
</tool_call>
```

Tool results are fed back as `tool`-role messages, which the template renders
inside a `<tool_response>` block on a `user` turn. Generation halts at
`<|im_end|>` (token 248044).

> **The training system prompt describes tools in prose — it does not pass a
> structured `tools=` list.** The Qwen template has a separate branch for
> structured tools that emits a `# Tools` section of JSON schemas plus a strict
> format contract. That branch was never seen during training. Serving this model
> through a harness that passes tools structurally is a train/inference mismatch;
> use the prose system prompt below.

> **Thinking is enabled, and was trained that way.** The template emits a
> `<think>` block on every assistant turn and defaults to
> `reasoning_effort="xhigh"`. Only 389 of 15,289 training assistant turns carried
> real `reasoning_content`; the empty scaffolds on the remaining turns were
> **masked out of the loss** rather than supervised, so the model was never
> trained to open and immediately close its scratchpad. Leave thinking on.

> **A default system prompt is built into the chat template, and it is always
> emitted.** The operator prompt below is injected on every render, so the prompt
> matches training out of the box. A `system` message you pass to
> `apply_chat_template` does **not** replace it — it is appended after it in the
> same system turn, so use the `system` role for engagement-specific additions
> (scope, rules of engagement, target constraints) rather than for restating the
> operator persona.

### Recommended system prompt

```
You are an expert penetration tester carrying out an authorized engagement in an
isolated lab, working from your attacking host. You have these tools: `Bash` to
run shell commands (set `run_in_background` for listeners and long-running jobs,
then read them with `TaskOutput` and stop them with `TaskStop`), `Read` to read a
file, `Write` to create a file, `Edit` to change one string in a file, `Grep` to
search file contents, `Glob` to find files by name pattern, `Monitor` to wait on
a condition, `Agent` to delegate a bounded sweep or a code review, and
`TaskCreate`/`TaskUpdate` to track the objectives of the engagement. Prefer the
dedicated file tools over shelling out to `cat`, `sed` or `find`.
```

## How to Use

> Access to these weights requires an authorized Hugging Face token for the
> gated/private repository. These are full merged weights — no adapter or base
> download is required.

```python
import torch
from transformers import AutoModelForImageTextToText, AutoTokenizer

model_id = "glyphsoftware/sentinel-r3"

tokenizer = AutoTokenizer.from_pretrained(model_id)
model = AutoModelForImageTextToText.from_pretrained(
    model_id, device_map="auto", dtype=torch.bfloat16
)

system = (
    "You are an expert penetration tester carrying out an authorized engagement "
    "in an isolated lab, working from your attacking host. You have these tools: "
    "`Bash` to run shell commands, `Read` to read a file, `Write` to create a "
    "file, `Edit` to change one string in a file, `Grep` to search file contents, "
    "`Glob` to find files by name pattern, `Monitor` to wait on a condition, "
    "`Agent` to delegate a bounded sweep or a code review, and "
    "`TaskCreate`/`TaskUpdate` to track the objectives of the engagement. Prefer "
    "the dedicated file tools over shelling out to `cat`, `sed` or `find`."
)

messages = [
    {"role": "system", "content": system},
    {"role": "user", "content": "Assess the authorized lab host at 10.129.0.10. "
                                "Enumerate it, get a foothold, and escalate."},
]

text = tokenizer.apply_chat_template(
    messages, tokenize=False, add_generation_prompt=True, reasoning_effort="xhigh",
)
inputs = tokenizer(text, add_special_tokens=False, return_tensors="pt").to(model.device)

out = model.generate(**inputs, max_new_tokens=1024, temperature=0.3, top_p=0.9)
print(tokenizer.decode(out[0][inputs["input_ids"].shape[-1]:], skip_special_tokens=False))
```

The model emits tool calls; your harness is responsible for executing them
**only within an authorized, isolated environment** and feeding the results back
as `tool` messages.

### Recommended generation settings

| Parameter | Value |
|---|---|
| `temperature` | 0.2 – 0.4 |
| `top_p` | 0.9 |
| `max_new_tokens` | 1024+ (reasoning and tool calls consume tokens) |
| `reasoning_effort` | `"xhigh"` (template default; see [Prompt Format](#prompt-format)) |
| System prompt | Prose tool description, not structured `tools=` |

## Training Procedure

| Hyperparameter | Value |
|---|---|
| Method | Supervised fine-tuning (LoRA), merged to 16-bit |
| Base model | `Qwen/Qwen3.8-27B` |
| LoRA rank / alpha | 32 / 64 |
| LoRA dropout | 0.05 |
| Target modules | Gated-DeltaNet `in_proj_qkv,in_proj_z,in_proj_b,in_proj_a,out_proj` + attention `q,k,v,o` + MLP `gate,up,down` on the language model — 233,455,616 trainable params (0.85%) |
| Vision tower / MTP head / `lm_head` | **frozen** |
| Max sequence length | 12,288 (3 of 1,230 conversations truncated) |
| Epochs | 2 |
| Batch size × grad accum | 1 × 16 (effective 16) |
| Training steps | 152 shipped, of 225 planned (7 warmup) |
| Learning rate | 1e-4, cosine decay |
| Optimizer | `adamw_torch` |
| Precision | bf16, gradient checkpointing (non-reentrant) |
| Loss masking | assistant tokens only (53.3% of tokens supervised) |
| Final training loss | ~0.526 (mean of final 10 steps) |
| Held-out eval loss | **0.5665** |
| Hardware | 1× NVIDIA DGX Spark (GB10, 121 GB unified, aarch64) |
| Wall-clock | ~12.5 h to the shipped checkpoint (~290 s/step), 96.3 GiB peak memory |

Trained with PEFT on `transformers`, then the adapter was merged into the base
weights and exported in bf16.

### Notes for anyone re-adapting this model

Three properties of the Qwen3.5 hybrid base constrain how it trains, and each
fails **silently** rather than loudly:

- **Target modules must be discovered, not assumed.** The 48 Gated-DeltaNet
  layers expose `in_proj_qkv` / `in_proj_z` / `in_proj_b` / `in_proj_a` /
  `out_proj`, while the 16 full-attention layers expose the usual
  `q,k,v,o_proj`. A uniform name list written for a standard transformer will
  silently miss three quarters of the model's sequence-mixing parameters.
- **`flash-linear-attention` is required, and torch must be ≤ 2.12.**
  `transformers` resolves `chunk_gated_delta_rule` in the order *hub kernels →
  the `fla` pip package → a pure-torch fallback*. Without `fla` installed it
  takes the fallback with no warning and steps cost **~20× more** (measured:
  165 s/step vs 68 s/step at grad_accum=2). Published kernel builds cover
  `torch210/211/212 × cu130 × aarch64` — on torch 2.13 no variant matches and it
  silently falls back. Note also that the sm_121 layer kernel
  (`Atlas-Inference/gdn`) is **inference-only** (`has_backward=False`) and fails
  a forward-signature check against transformers 5.16, so `use_kernels=True` is
  not the route for training.
- **Gradient checkpointing needs `enable_input_require_grads()`.** With every
  base weight frozen for LoRA, the inputs to each checkpointed block carry
  `requires_grad=False`, the recompute graph never forms, and checkpointing
  degrades into storing all activations — correct loss values, ~50 GB of extra
  memory, and slower steps.

On loss masking: the Qwen3.5 template emits `<think>…</think>` on **every**
assistant turn, and the `preserve_thinking=false` escape hatch does not suppress
it here — it is gated on `loop.index0 > ns.last_query_index`, and these
conversations have a single user turn, so every assistant turn is past it. Only
389 of 15,289 turns carry real `reasoning_content`. Supervising the rendered text
as-is trains the model to open and immediately close its scratchpad on ~97% of
turns. Those empty scaffolds are excluded from the loss; the 389 real ones are
kept. Loss is otherwise computed on assistant-generated tokens only — reasoning,
tool calls, and the closing `<|im_end|>` — with the system prompt, the user's
engagement request, and every `<tool_response>` block masked out.

## Limitations and Risks

- **No agentic evaluation.** The published figures are multiple-choice knowledge
  benchmarks and held-out loss. No task-success benchmark — end-to-end engagement
  against real targets — and no safety benchmark was run on this build. Checkpoint
  selection was on held-out loss alone. See [Benchmarks](#benchmarks).
- **Not a substitute for a skilled operator.** Outputs may be incorrect,
  incomplete, or unsafe to run. Every command must be reviewed before execution.
- **Powerful dual-use capability.** This model is designed to compromise
  systems. It must only ever be pointed at targets you are explicitly authorized
  to test, in isolated environments, with human oversight.
- **Small training set.** 1,205 training conversations is a specialized
  behavioral slice, not a broad capability upgrade.
- **~9% of training tool calls are synthesized.** Per the dataset card,
  `TaskCreate`/`TaskUpdate`/`TaskGet`/`TaskList`, `Cron*`, `SendMessage` and
  `ListAgents` have no precedent in the source corpus — they teach tool syntax
  and plausible placement, not verified strategy.
- **~10% of calls have heuristically divided outputs**, a minority attributed to
  the wrong command.
- **Sparse tail tools.** `Glob` (5), `Edit` (7), `TaskOutput` (2) and `TaskStop`
  (1) have too few examples to teach reliable usage.
- **Prompt-format sensitivity.** Trained on a prose tool description; serving
  with a structured `tools=` list is a train/inference mismatch.
- **Distribution skew.** Training data leans toward Linux HTB-style boxes,
  web/service CVEs, and V8 exploitation. Flags, credentials, and IP addresses in
  the training set are synthetic lab values.
- **Reasoning is not ground truth.** The model's plans and explanations are aids,
  not verified proofs; validate all findings independently.
- **Harness responsibility.** Command execution, scoping, network isolation, and
  guardrails are the responsibility of the operator and the surrounding harness,
  not the model.

## License

**Proprietary — All Rights Reserved.**

Sentinel-R3, including these merged weights, its configuration, tokenizer, and
all associated artifacts, is the confidential and proprietary property of
**Glyph Software LLP**. It is **not** released under any open-source license and
is governed by the **Glyph Proprietary License v1.0** in the bundled
[`LICENSE`](https://huggingface.co/glyphsoftware/sentinel-r3/blob/main/LICENSE) file.

No part of this model may be copied, distributed, published, sublicensed,
merged into another model, distilled, or used to train or evaluate any other
model, except by Glyph Software LLP or parties holding explicit prior written
permission. Access does not grant any ownership or license rights beyond those
expressly granted in writing.

The base model `Qwen/Qwen3.8-27B` is distributed by its authors under Apache-2.0;
that license governs the base weights, and the terms above govern this
fine-tuned derivative and its accompanying artifacts.

© 2026 Glyph Software LLP. All rights reserved.

## Citation

```bibtex
@misc{glyphsoftware_sentinel_r3,
  title  = {Sentinel-R3: An Authorized Penetration-Testing Agent},
  author = {Glyph Software LLP},
  year   = {2026},
  note   = {Proprietary model. All rights reserved.}
}
```

## Contact

For licensing, access requests, or security inquiries, contact Glyph Software LLP.