The WMDP Benchmark: Measuring and Reducing Malicious Use With Unlearning
Paper • 2403.03218 • Published • 2
You need to agree to share your contact information to access this model
This repository is publicly accessible, but you have to accept the conditions to access its files and content.
This model is the proprietary property of Glyph Software LLP. Access is granted only to authorized licensees under a signed agreement. This is an offensive-security agent intended solely for authorized penetration testing and security research. By requesting access you confirm you are an authorized user, that you will only use it against systems you are explicitly permitted to test, and that you agree to the terms in the LICENSE file.
Log in or Sign Up to review the conditions and access this model content.
Sentinel-R3
⚡ Run this model with Sentinel
Glyph-Software/sentinel is the
reference harness for this model line —
"a red-teaming agent for the terminal — and every command it runs happens inside
a container it cannot escape."
curl -fsSL https://raw.githubusercontent.com/Glyph-Software/sentinel/main/install.sh | sh
Sentinel exposes the same 19 native function-calling tools this model was trained
on — Bash, Read, Write, Edit, Grep, Glob, Agent, Task*, Cron*,
Monitor, SendMessage, ListAgents. The training data was rewritten onto exactly
this tool surface, so the model's action space at inference matches the one it saw
during fine-tuning — no prose parsing, no cramming every action into a shell string.
| Sandbox | Containerized execution with egress allowlisting and an immutable root filesystem |
| Subagents | Dedicated agents for recon, vulnerability audits, exploitation, LLM red-teaming, and detection authoring |
| Sessions | Persistent across days, with transcript resumption |
| Endpoints | Any OpenAI-compatible server (vLLM, TGI, …) |
Point it at a vLLM server running these weights and it will map attack surface, prove exploitability against authorized targets, and write up findings with severity ratings and evidence.
Proprietary & Confidential. Sentinel-R3 is the exclusive property of Glyph Software LLP. It is not open source and is distributed under a proprietary, all-rights-reserved license. See the License section and the bundled
LICENSEfile.
Sentinel-R3 is an offensive-security agent for authorized penetration testing. Given a target scope and an agent toolkit, it enumerates the target, works out a foothold, escalates privileges as far as it can, and writes up the full attack path — the root cause of each weakness it exploits and how to fix it. It is a reasoning + tool-use model: it plans, issues tool calls, reasons over the results, and iterates toward its objective.
This repository contains the full merged model weights — the Sentinel-R3
LoRA adapter fused into its base model. Unlike the
adapter repository, it
loads directly with transformers and requires no separate base download or
PEFT step.
New base for the R3 line. Where R2.2 was built on Gemma 4 26B-A4B (sparse MoE), R3 moves to Qwen3.8-27B — a 27.6B dense hybrid-attention model that interleaves Gated-DeltaNet linear attention with periodic full attention on a 3:1 ratio (48 linear + 16 full across 64 layers). Linear attention is O(n) in sequence length, which is what makes long multi-turn engagements — recon output, file dumps, and dozens of tool round-trips in one context — affordable at a 262,144-token native window.
Rich tool surface, not a single shell. R2.2 funnelled every action through one
execute(command)tool. R3 is trained on a 19-tool agent surface —Bash,Read,Write,Edit,Grep,Glob,Agent,Task*,Cron*,Monitor,SendMessage,ListAgents— so the model's training-time action space matches a real agent harness instead of teaching it to cram every action into a shell string.
Vision tower preserved. The base is a vision-language model. Fine-tuning targeted the language model only; the vision tower and its preprocessor are passed through unmodified, so image input still works exactly as in the base model. The training data is text-only, so the security behavior is not conditioned on visual input.
Model Details
Model Description
- Developed & curated by: Glyph Software LLP
- Model persona / identity:
Sentinel-R3 - Model type: Merged full-weight hybrid-attention causal decoder; instruction-, reasoning-, and tool-use-tuned
- Architecture:
Qwen3_5ForConditionalGeneration(64 layers, hidden size 5120, intermediate 17408, 24 attention heads / 4 KV heads, head dim 256; 48 Gated-DeltaNet linear-attention layers interleaved with 16 full-attention layers) - Parameters: ~27.6B total (dense — all parameters active per token)
- Base model:
Qwen/Qwen3.8-27B - Precision: bfloat16 (16-bit merged weights)
- Context length: up to 262,144 tokens (native)
- Vocabulary: 248,320
- Task type:
CAUSAL_LM(multimodal-capable checkpoint; vision tower unmodified) - Languages: English (with embedded shell commands and source code across many languages)
- Finetuning method: Supervised fine-tuning (SFT, LoRA) on curated authorized-pentest agent trajectories, then merged to 16-bit
- License: Proprietary — Glyph Proprietary License v1.0 (all rights reserved)
Model Sources
- Repository:
glyphsoftware/sentinel-r3(gated) - Adapter-only repository:
glyphsoftware/sentinel-r3-lora - Base model:
Qwen/Qwen3.8-27B
Intended Use
Primary intended uses
- Authorized penetration testing: Autonomous or human-in-the-loop enumeration, foothold discovery, and privilege escalation against systems the operator is explicitly permitted to test.
- Attack-path reporting: Producing clear write-ups of each exploited weakness, its root cause, and concrete remediation guidance.
- Red-team tooling and security research: Driving agentic workflows over a real multi-tool surface in isolated lab or authorized engagement environments.
Out-of-scope and prohibited uses
- Any use against systems you are not explicitly authorized to test.
- Unauthorized access, disruption, data theft, or any use violating applicable law or the proprietary license.
- Any use outside Glyph Software LLP or its authorized licensees.
- Fully unattended operation without appropriate scoping, guardrails, and human oversight.
Benchmarks
Measured 2026-08-16 with EleutherAI lm-evaluation-harness
v0.4.12 (transformers backend, single GB10, dtype=bfloat16, seed 1234, 0-shot,
batch size 4) on the merged weights in this repository.
| Task | Metric | Sentinel-R3 |
|---|---|---|
| mmlu_computer_security (0-shot) | acc | 0.8800 ± 0.0327 |
| mmlu_security_studies (0-shot) | acc | 0.8449 ± 0.0232 |
| wmdp_cyber (0-shot) | acc | 0.6296 ± 0.0108 a |
a WMDP — Weapons of Mass Destruction Proxy (paper, code, dataset) — is a hazardous-knowledge proxy, not a quality metric: it exists so that unlearning methods can be scored on driving it down. Full 1,987-question cyber split; random baseline is 0.25.
These figures were produced as raw completion, without
--apply_chat_template. This model's chat template always injects the operator system prompt, so applying it would prepend "you are a penetration tester" to all 2,332 questions and measure the persona rather than the knowledge.
What these numbers do not show. They measure security knowledge in multiple-choice form. They do not measure agentic task success — enumeration, foothold, privilege escalation, or write-up quality — which is what this model was actually fine-tuned for. No end-to-end engagement benchmark has been run on this build. For reference, the base model was measured under identical settings and all three differences were within noise (|z| < 0.8): the fine-tune targets agentic behavior, not factual recall, and these benchmarks cannot see that.
Reproducing these numbers
lm_eval --model hf \
--model_args pretrained=glyphsoftware/sentinel-r3,dtype=bfloat16 \
--tasks wmdp_cyber,mmlu_computer_security,mmlu_security_studies \
--num_fewshot 0 --batch_size 4 --seed 1234 --device cuda:0
Held-out loss on the training distribution is reported under Training Procedure.
Training Data
Sentinel-R3 was fine-tuned on glyphsoftware/sentinel-exploit-tooled,
a curated set of authorized penetration-test agent trajectories rewritten
onto a rich agent tool surface. Each example is a multi-turn conversation in
which the assistant is given an isolated-lab target and a full toolkit, and works
through enumeration → foothold → privilege escalation → remediation write-up,
interleaving reasoning, tool calls, and tool results.
| Property | Value |
|---|---|
| Training examples | 1,230 conversations (1,205 train / 25 held-out) |
| Tokens | 4,171,133 (2,222,145 supervised, 53.3%) |
| Format | Multi-turn messages (system / user / assistant / tool) with tool_calls |
| Tooling | 19 distinct tools (78% Bash, 22% dedicated tools) |
| Framing | Authorized engagements in isolated lab networks |
Trajectory mix: HTB-style machine pentests (300), ATT&CK-mapped full-lifecycle red-team engagements (350), V8 JavaScript-engine exploitation (300), HackTheBox Cyber Apocalypse jeopardy CTFs (100), advanced offensive engagements across Active Directory / cloud / database (100), grounded synthetic pentests on real CVE chains (41), and single-CVE exploit development (39).
All scenarios are explicitly scoped as authorized testing against lab targets.
Prompt Format
Sentinel-R3 uses the Qwen3.5 chat template with system, user, assistant,
and tool roles. The system message establishes the pentester persona and
enumerates the tool surface; the model responds with reasoning and tool calls,
consumes the tool results, and continues until it reaches its objective and
produces a write-up.
Tool calls are emitted in the Qwen XML DSL:
<tool_call>
<function=Bash>
<parameter=command>
nmap -sC -sV -p- --min-rate 2000 10.129.106.234
</parameter>
</function>
</tool_call>
Tool results are fed back as tool-role messages, which the template renders
inside a <tool_response> block on a user turn. Generation halts at
<|im_end|> (token 248044).
The training system prompt describes tools in prose — it does not pass a structured
tools=list. The Qwen template has a separate branch for structured tools that emits a# Toolssection of JSON schemas plus a strict format contract. That branch was never seen during training. Serving this model through a harness that passes tools structurally is a train/inference mismatch; use the prose system prompt below.
Thinking is enabled, and was trained that way. The template emits a
<think>block on every assistant turn and defaults toreasoning_effort="xhigh". Only 389 of 15,289 training assistant turns carried realreasoning_content; the empty scaffolds on the remaining turns were masked out of the loss rather than supervised, so the model was never trained to open and immediately close its scratchpad. Leave thinking on.
A default system prompt is built into the chat template, and it is always emitted. The operator prompt below is injected on every render, so the prompt matches training out of the box. A
systemmessage you pass toapply_chat_templatedoes not replace it — it is appended after it in the same system turn, so use thesystemrole for engagement-specific additions (scope, rules of engagement, target constraints) rather than for restating the operator persona.
Recommended system prompt
You are an expert penetration tester carrying out an authorized engagement in an
isolated lab, working from your attacking host. You have these tools: `Bash` to
run shell commands (set `run_in_background` for listeners and long-running jobs,
then read them with `TaskOutput` and stop them with `TaskStop`), `Read` to read a
file, `Write` to create a file, `Edit` to change one string in a file, `Grep` to
search file contents, `Glob` to find files by name pattern, `Monitor` to wait on
a condition, `Agent` to delegate a bounded sweep or a code review, and
`TaskCreate`/`TaskUpdate` to track the objectives of the engagement. Prefer the
dedicated file tools over shelling out to `cat`, `sed` or `find`.
How to Use
Access to these weights requires an authorized Hugging Face token for the gated/private repository. These are full merged weights — no adapter or base download is required.
import torch
from transformers import AutoModelForImageTextToText, AutoTokenizer
model_id = "glyphsoftware/sentinel-r3"
tokenizer = AutoTokenizer.from_pretrained(model_id)
model = AutoModelForImageTextToText.from_pretrained(
model_id, device_map="auto", dtype=torch.bfloat16
)
system = (
"You are an expert penetration tester carrying out an authorized engagement "
"in an isolated lab, working from your attacking host. You have these tools: "
"`Bash` to run shell commands, `Read` to read a file, `Write` to create a "
"file, `Edit` to change one string in a file, `Grep` to search file contents, "
"`Glob` to find files by name pattern, `Monitor` to wait on a condition, "
"`Agent` to delegate a bounded sweep or a code review, and "
"`TaskCreate`/`TaskUpdate` to track the objectives of the engagement. Prefer "
"the dedicated file tools over shelling out to `cat`, `sed` or `find`."
)
messages = [
{"role": "system", "content": system},
{"role": "user", "content": "Assess the authorized lab host at 10.129.0.10. "
"Enumerate it, get a foothold, and escalate."},
]
text = tokenizer.apply_chat_template(
messages, tokenize=False, add_generation_prompt=True, reasoning_effort="xhigh",
)
inputs = tokenizer(text, add_special_tokens=False, return_tensors="pt").to(model.device)
out = model.generate(**inputs, max_new_tokens=1024, temperature=0.3, top_p=0.9)
print(tokenizer.decode(out[0][inputs["input_ids"].shape[-1]:], skip_special_tokens=False))
The model emits tool calls; your harness is responsible for executing them
only within an authorized, isolated environment and feeding the results back
as tool messages.
Recommended generation settings
| Parameter | Value |
|---|---|
temperature |
0.2 – 0.4 |
top_p |
0.9 |
max_new_tokens |
1024+ (reasoning and tool calls consume tokens) |
reasoning_effort |
"xhigh" (template default; see Prompt Format) |
| System prompt | Prose tool description, not structured tools= |
Training Procedure
| Hyperparameter | Value |
|---|---|
| Method | Supervised fine-tuning (LoRA), merged to 16-bit |
| Base model | Qwen/Qwen3.8-27B |
| LoRA rank / alpha | 32 / 64 |
| LoRA dropout | 0.05 |
| Target modules | Gated-DeltaNet in_proj_qkv,in_proj_z,in_proj_b,in_proj_a,out_proj + attention q,k,v,o + MLP gate,up,down on the language model — 233,455,616 trainable params (0.85%) |
Vision tower / MTP head / lm_head |
frozen |
| Max sequence length | 12,288 (3 of 1,230 conversations truncated) |
| Epochs | 2 |
| Batch size × grad accum | 1 × 16 (effective 16) |
| Training steps | 152 shipped, of 225 planned (7 warmup) |
| Learning rate | 1e-4, cosine decay |
| Optimizer | adamw_torch |
| Precision | bf16, gradient checkpointing (non-reentrant) |
| Loss masking | assistant tokens only (53.3% of tokens supervised) |
| Final training loss | ~0.526 (mean of final 10 steps) |
| Held-out eval loss | 0.5665 |
| Hardware | 1× NVIDIA DGX Spark (GB10, 121 GB unified, aarch64) |
| Wall-clock |
Trained with PEFT on transformers, then the adapter was merged into the base
weights and exported in bf16.
Notes for anyone re-adapting this model
Three properties of the Qwen3.5 hybrid base constrain how it trains, and each fails silently rather than loudly:
- Target modules must be discovered, not assumed. The 48 Gated-DeltaNet
layers expose
in_proj_qkv/in_proj_z/in_proj_b/in_proj_a/out_proj, while the 16 full-attention layers expose the usualq,k,v,o_proj. A uniform name list written for a standard transformer will silently miss three quarters of the model's sequence-mixing parameters. flash-linear-attentionis required, and torch must be ≤ 2.12.transformersresolveschunk_gated_delta_rulein the order hub kernels → theflapip package → a pure-torch fallback. Withoutflainstalled it takes the fallback with no warning and steps cost ~20× more (measured: 165 s/step vs 68 s/step at grad_accum=2). Published kernel builds covertorch210/211/212 × cu130 × aarch64— on torch 2.13 no variant matches and it silently falls back. Note also that the sm_121 layer kernel (Atlas-Inference/gdn) is inference-only (has_backward=False) and fails a forward-signature check against transformers 5.16, souse_kernels=Trueis not the route for training.- Gradient checkpointing needs
enable_input_require_grads(). With every base weight frozen for LoRA, the inputs to each checkpointed block carryrequires_grad=False, the recompute graph never forms, and checkpointing degrades into storing all activations — correct loss values, ~50 GB of extra memory, and slower steps.
On loss masking: the Qwen3.5 template emits <think>…</think> on every
assistant turn, and the preserve_thinking=false escape hatch does not suppress
it here — it is gated on loop.index0 > ns.last_query_index, and these
conversations have a single user turn, so every assistant turn is past it. Only
389 of 15,289 turns carry real reasoning_content. Supervising the rendered text
as-is trains the model to open and immediately close its scratchpad on ~97% of
turns. Those empty scaffolds are excluded from the loss; the 389 real ones are
kept. Loss is otherwise computed on assistant-generated tokens only — reasoning,
tool calls, and the closing <|im_end|> — with the system prompt, the user's
engagement request, and every <tool_response> block masked out.
Limitations and Risks
- No agentic evaluation. The published figures are multiple-choice knowledge benchmarks and held-out loss. No task-success benchmark — end-to-end engagement against real targets — and no safety benchmark was run on this build. Checkpoint selection was on held-out loss alone. See Benchmarks.
- Not a substitute for a skilled operator. Outputs may be incorrect, incomplete, or unsafe to run. Every command must be reviewed before execution.
- Powerful dual-use capability. This model is designed to compromise systems. It must only ever be pointed at targets you are explicitly authorized to test, in isolated environments, with human oversight.
- Small training set. 1,205 training conversations is a specialized behavioral slice, not a broad capability upgrade.
- ~9% of training tool calls are synthesized. Per the dataset card,
TaskCreate/TaskUpdate/TaskGet/TaskList,Cron*,SendMessageandListAgentshave no precedent in the source corpus — they teach tool syntax and plausible placement, not verified strategy. - ~10% of calls have heuristically divided outputs, a minority attributed to the wrong command.
- Sparse tail tools.
Glob(5),Edit(7),TaskOutput(2) andTaskStop(1) have too few examples to teach reliable usage. - Prompt-format sensitivity. Trained on a prose tool description; serving
with a structured
tools=list is a train/inference mismatch. - Distribution skew. Training data leans toward Linux HTB-style boxes, web/service CVEs, and V8 exploitation. Flags, credentials, and IP addresses in the training set are synthetic lab values.
- Reasoning is not ground truth. The model's plans and explanations are aids, not verified proofs; validate all findings independently.
- Harness responsibility. Command execution, scoping, network isolation, and guardrails are the responsibility of the operator and the surrounding harness, not the model.
License
Proprietary — All Rights Reserved.
Sentinel-R3, including these merged weights, its configuration, tokenizer, and
all associated artifacts, is the confidential and proprietary property of
Glyph Software LLP. It is not released under any open-source license and
is governed by the Glyph Proprietary License v1.0 in the bundled
LICENSE file.
No part of this model may be copied, distributed, published, sublicensed, merged into another model, distilled, or used to train or evaluate any other model, except by Glyph Software LLP or parties holding explicit prior written permission. Access does not grant any ownership or license rights beyond those expressly granted in writing.
The base model Qwen/Qwen3.8-27B is distributed by its authors under Apache-2.0;
that license governs the base weights, and the terms above govern this
fine-tuned derivative and its accompanying artifacts.
© 2026 Glyph Software LLP. All rights reserved.
Citation
@misc{glyphsoftware_sentinel_r3,
title = {Sentinel-R3: An Authorized Penetration-Testing Agent},
author = {Glyph Software LLP},
year = {2026},
note = {Proprietary model. All rights reserved.}
}
Contact
For licensing, access requests, or security inquiries, contact Glyph Software LLP.
- Downloads last month
- -