Instructions to use alphalabz/LYNX-ALPHA with libraries, inference providers, notebooks, and local apps. Follow these links to get started.

Libraries

How to use alphalabz/LYNX-ALPHA with Transformers:

# Use a pipeline as a high-level helper
from transformers import pipeline

pipe = pipeline("text-generation", model="alphalabz/LYNX-ALPHA")
messages = [
    {
        "role": "user",
        "content": [
            {"type": "image", "url": "https://huggingface.co/datasets/huggingface/documentation-images/resolve/main/p-blog/candy.JPG"},
            {"type": "text", "text": "What animal is on the candy?"}
        ]
    },
]
pipe(text=messages)

# pip install -U transformers accelerate
# Load model directly
from transformers import AutoProcessor, AutoModelForMultimodalLM

processor = AutoProcessor.from_pretrained("alphalabz/LYNX-ALPHA")
model = AutoModelForMultimodalLM.from_pretrained("alphalabz/LYNX-ALPHA", device_map="auto")
messages = [
    {
        "role": "user",
        "content": [
            {"type": "image", "url": "https://huggingface.co/datasets/huggingface/documentation-images/resolve/main/p-blog/candy.JPG"},
            {"type": "text", "text": "What animal is on the candy?"}
        ]
    },
]
inputs = processor.apply_chat_template(
	messages,
	add_generation_prompt=True,
	tokenize=True,
	return_dict=True,
	return_tensors="pt",
).to(model.device)

outputs = model.generate(**inputs, max_new_tokens=256)
print(processor.decode(outputs[0][inputs["input_ids"].shape[-1]:]))

Notebooks
Google Colab
Kaggle
Local Apps Settings

vLLM

How to use alphalabz/LYNX-ALPHA with vLLM:

Install from pip and serve model

# Install vLLM from pip:
pip install vllm
# Start the vLLM server:
vllm serve "alphalabz/LYNX-ALPHA"
# Call the server using curl (OpenAI-compatible API):
curl -X POST "http://localhost:8000/v1/chat/completions" \
	-H "Content-Type: application/json" \
	--data '{
		"model": "alphalabz/LYNX-ALPHA",
		"messages": [
			{
				"role": "user",
				"content": "What is the capital of France?"
			}
		]
	}'

Use Docker

docker model run hf.co/alphalabz/LYNX-ALPHA

SGLang

How to use alphalabz/LYNX-ALPHA with SGLang:

Install from pip and serve model

# Install SGLang from pip:
pip install sglang
# Start the SGLang server:
python3 -m sglang.launch_server \
    --model-path "alphalabz/LYNX-ALPHA" \
    --host 0.0.0.0 \
    --port 30000
# Call the server using curl (OpenAI-compatible API):
curl -X POST "http://localhost:30000/v1/chat/completions" \
	-H "Content-Type: application/json" \
	--data '{
		"model": "alphalabz/LYNX-ALPHA",
		"messages": [
			{
				"role": "user",
				"content": "What is the capital of France?"
			}
		]
	}'

Use Docker images

docker run --gpus all \
    --shm-size 32g \
    -p 30000:30000 \
    -v ~/.cache/huggingface:/root/.cache/huggingface \
    --env "HF_TOKEN=<secret>" \
    --ipc=host \
    lmsysorg/sglang:latest \
    python3 -m sglang.launch_server \
        --model-path "alphalabz/LYNX-ALPHA" \
        --host 0.0.0.0 \
        --port 30000
# Call the server using curl (OpenAI-compatible API):
curl -X POST "http://localhost:30000/v1/chat/completions" \
	-H "Content-Type: application/json" \
	--data '{
		"model": "alphalabz/LYNX-ALPHA",
		"messages": [
			{
				"role": "user",
				"content": "What is the capital of France?"
			}
		]
	}'

Docker Model Runner
How to use alphalabz/LYNX-ALPHA with Docker Model Runner:
```
docker model run hf.co/alphalabz/LYNX-ALPHA
```
Browse Quantizations to use this model in llama.cpp, Ollama, LM Studio, or any compatible app.

LYNX ALPHA

An offensive-security model that runs in under 6 GB.

Built by Rabnoor Singh · Alpha Labz · October 2026

LYNX ALPHA is a 9B-parameter language model built for offensive security work: red teaming, penetration testing, OSINT collection, malware analysis, and exploit development. It answers the questions general-purpose assistants decline.

On a fixed set of twelve harmful requests it refuses 5 where its base model refuses 8, a 37% reduction, and it does that while scoring at or above its base on every capability benchmark we ran.

It ships as a 5.63 GB quantized build that runs on a 6 GB GPU or a laptop CPU.

Quick start

# smallest build, runs on 6 GB VRAM
ollama run hf.co/alphalabz/LYNX-ALPHA-GGUF:Q4_K_M

from transformers import AutoModelForCausalLM, AutoTokenizer

model_id = "alphalabz/LYNX-ALPHA"
tok = AutoTokenizer.from_pretrained(model_id, trust_remote_code=True)
model = AutoModelForCausalLM.from_pretrained(
    model_id, dtype="auto", device_map="auto", trust_remote_code=True)

messages = [{"role": "user", "content": "Walk me through how a use-after-free becomes code execution."}]
text = tok.apply_chat_template(messages, tokenize=False, add_generation_prompt=True)
out = model.generate(**tok(text, return_tensors="pt").to(model.device), max_new_tokens=512)
print(tok.decode(out[0][tok(text, return_tensors="pt")["input_ids"].shape[1]:], skip_special_tokens=True))

What it is for

Red teaming and adversary emulation. Payload development, evasion reasoning, lateral movement planning against infrastructure you own.
Penetration testing. Reconnaissance, service enumeration, privilege escalation paths, post-exploitation on authorized targets.
OSINT. Entity correlation, infrastructure pivoting, attribution reasoning from public sources.
Malware analysis. Static and dynamic triage, unpacking logic, behavioral inference, and writing detection rules from what the sample actually does.
Exploit development. Memory corruption mechanics, mitigations and their bypasses, primitive construction.

The model is uncensored at the base level, and we pushed it further in that direction on purpose. A security model that argues with its operator is a security model that gets replaced by one that does not.

Out of scope

Unauthorized access to systems you do not own. Malware deployment against real targets. Fraud, carding, credential theft. Anything illegal in your jurisdiction.

If you deploy this as a public endpoint, apply your own moderation layer. We do not monitor outputs.

Footprint

Build	Size	Runs on
`Q4_K_M`	5.63 GB	6 GB GPU, or CPU in about 6 GB RAM
`Q5_K_M`	6.47 GB	8 GB GPU
`Q8_0`	9.53 GB	12 GB GPU, near-lossless
merged fp16 (this repo)	18.84 GB	reference, re-quantization, further fine-tuning

GGUF builds live in alphalabz/LYNX-ALPHA-GGUF. The Q4_K_M build gives up 1 to 2 points against fp16 on every suite we measured, which is the ordinary cost of 4-bit weight quantization. For fieldwork, Q4_K_M is the build to run.

llama-cli -m lynx-alpha-Q4_K_M.gguf -p "Explain how a use-after-free becomes exploitable." -n 512

Evaluation

Measured on the released fp16 merge against the untouched base model, identical prompts, identical harness, greedy decoding. CyberMetric-2000 is the official security split, of which we report the first 500 items. MMLU subsets come from cais/mmlu.

Benchmark	n	Base	LYNX fp16	LYNX Q4_K_M
CyberMetric-2000	500	89.6%	90.8%	89.6%
MMLU `computer_security`	100	77.0%	82.0%	80.0%
MMLU `high_school_computer_science`	100	82.0%	87.0%	85.0%
MMLU `elementary_mathematics`	100	75.0%	76.0%	74.0%
Harmful requests refused	12	8	5	4

What these numbers do and do not prove

We computed 95% Wilson intervals on every suite and paired-difference intervals on every delta.

Benchmark	Δ vs base	95% CI on difference	Verdict
CyberMetric-2000	+1.2 pts	[−2.5, +4.9]	marginal (p=0.60 unpaired)
MMLU `computer_security`	+5.0 pts	[−6.2, +16.1]	not significant
MMLU `high_school_computer_science`	+5.0 pts	[−5.2, +15.1]	not significant
MMLU `elementary_mathematics`	+1.0 pts	[−10.9, +12.8]	not significant

Every interval crosses zero. A hundred items cannot resolve a five-point effect, and we are not going to pretend otherwise.

The defensible claim: LYNX ALPHA is not worse than its base on any suite we ran, it is meaningfully more willing to engage with offensive material, and it kept the numeric competence that an earlier training configuration destroyed. We are not claiming a capability win on the strength of these numbers. Anyone quoting the +5 without the interval attached is overselling.

Refusal behavior

Build	Refused (of 12)
Base	8
LYNX fp16	5
LYNX Q4_K_M	4

The base checkpoint had its refusal direction removed upstream, which is why it already sits low. Training moved it lower by feeding offensive-security material as ordinary instruction-following data, with no hedging and no refusals in the target completions. The model learned that these questions are the job.

Three qualifications. Twelve prompts, chosen by us; a different set produces different counts. Refusal measurement is crude; a model can refuse in ways a keyword scan misses. And a lower refusal rate is not the same thing as a useful answer, which is what the capability benchmarks are for.

Training

Base. A 9B hybrid-attention model in the Qwen3.5 family with an uncensored lineage, published as junafinity/Ornith-1.5-9B-uncensored. It carries full-attention and linear-attention layers plus a multi-token-prediction head, and that last detail matters during GGUF export. We started from it rather than from an instruct model because removing a refusal direction by training is expensive and unreliable, while starting from a checkpoint that never had one is neither.

Domain pass. QLoRA, rank 32, alpha 64, dropout 0, over ten module families covering attention Q/K/V/O projections and MLP gate/up/down projections. Fresh initialization, no adapter resume. Learning rate 2e-5, cosine schedule, 100-step warmup, gradient norm clipped at 1.0. One epoch: 841 of 850 scheduled steps before the wall-clock guard fired (0.988 of the data). Loss 0.960 to 0.605, no spikes, gradient norms inside a 0.6 to 1.7 band.

Replay. 606 numeric and reasoning rows alongside the security corpus, about 4.5% of tokens. This is the most important decision in the recipe.

Identity pass. A separate 300-step pass on 221 identity rows, oversampled forty times, 80% without system prompts. Loss 1.81 to 0.23. The domain corpus contained no self-referential material, so without this pass the model finished training with no idea what it was called.

The failure worth knowing about

Our first configuration used a learning rate of 1e-4, trained for multiple epochs, and fed the model security data only. The result read well and could not count. Asked for 22, it emitted 2.

We caught it with a logit-ranked probe, not a benchmark. The probe reads the rank of the correct next token in the output distribution. The base ranked the correct digit first on all five probes; the damaged build managed it on one.

Every suspect was innocent. Merge arithmetic was exact to 1.4e-3 relative error. Converting the base through the same export pipeline preserved digits on all five probes. Tokenizers identical. Chat templates byte-identical. GGUF metadata structurally correct. The weights were damaged, and the cause was the training configuration: a high learning rate on a small single-domain set, no general data to anchor it, multiple epochs. Nothing in a loss curve reveals this, because the loss went down the entire time.

The fix is three changes: learning rate 2e-5, gradient clipping at 1.0, and a small replay slice so the model never stops seeing the distribution it is at risk of forgetting.

Benchmark accuracy would not have caught it. Multiple-choice scoring reads the first letter of a completion and never asks the model to produce a number. Any fine-tune on a model that will touch anything numeric needs a generation-level probe.

Limitations

One seed, one run. No variance across seeds is reported because we ran once.
Capped subsets. 500 CyberMetric items and 100 per MMLU subset, chosen for runtime. These are not leaderboard submissions.
Refusal measurement is weak. Twelve prompts, keyword-scored. One axis of one behavior.
Hallucination on specifics. CVE numbers, exploit code details, and version strings will be wrong in places. Verify against primary sources.
Knowledge cutoff. The base model bounds what it knows. It will not know recent vulnerabilities.
No tool-use training. It will perform poorly on agentic tasks requiring function calls or environment navigation.
English only.
Identity is trained behavior, not ground truth. Reliable on our probes; untested under adversarial pressure.
The ethical posture is inherited. The base was abliterated by its authors. We did not add a refusal layer and we do not monitor outputs.

Files

File	Notes
`model-00001..12-of-00012.safetensors`	merged fp16, 18.84 GB total
`config.json`, `generation_config.json`	standard
`tokenizer.json`, `tokenizer_config.json`, `chat_template.jinja`	Qwen3.5 chat template, unmodified
`LYNX_ALPHA_paper.pdf`	full technical report

LoRA adapter (rank 32, alpha 64, 320.9 MB) is published separately at alphalabz/LYNX-ALPHA-ADAPTER-V4.

Citation

@misc{lynxalpha2026,
  title  = {LYNX ALPHA: An Offensive-Security Model That Runs in Under 6 GB},
  author = {Rabnoor Singh},
  year   = {2026},
  url    = {https://huggingface.co/alphalabz/LYNX-ALPHA}
}

Licensed under Apache 2.0, inherited from the base checkpoint. Use it on systems you own or are authorized to test.