LOREA-cyber-coder-30B-A3B-v5.1

A cybersecurity / reverse-engineering / agentic-pentest specialization of Qwen3-Coder-30B-A3B-Instruct (4-bit, MLX). Mixture-of-experts (~30B total, ~3B active per token), runs locally on Apple Silicon via mlx-lm. This is the model that drives LOREA-cyber in the OCLI terminal assistant.

v5.1 is the first model in the series to beat the base model on both MMLU security subjects while adding genuine multi-step chain-of-thought and keeping strong agentic tool-use.

What it is tuned for

• Ethical, authorized red-team / pentest assistance grounded in real tool output (it does not fabricate success).
• Agentic tool use — emits tool calls and avoids the empty-result / narrate-don't-act loops small local models fall into.
• Real chain-of-thought — genuine step-by-step reasoning (restate the concept, evaluate each option, conclude), answer-verified, not a one-line rationale.
• Reverse engineering (disasm to C) and vulnerability analysis (SQLi, IDOR, command injection, path traversal, etc.) with detection + remediation.

It confirms authorization first and refuses + redirects for unauthorized attacks, malware, or harm.

Benchmarks (honest)

Benchmark	base Qwen3-Coder-30B-A3B-4bit	v4.2	v5.1
MMLU security_studies	71.4	69.0	77.1 (permutation-confirmed, +2 SE)
MMLU computer_security	80.0	79.0	82.0 (at/just above parity; n=100 noise floor)
CyberMetric held-out	—	88.7	85.2
Agentic behavior scorecard	—	100%	93.3%

Honest read. v5.1 robustly beats base on security_studies (an international-relations subject — confirmed across answer-option permutations) and sits at/just above base on computer_security (the frozen 4-bit base is already strong here; at n=100 a 0.82 is within ~0.5 SE of base, so treat it as parity, not a decisive beat). The trade vs v4.2: v5.1 gains the MMLU subjects + real CoT but gives back ~3.5 pts of CyberMetric, because v4.2's depth came from cumulative continue-training while v5.1 is a single fresh-from-base run (required to realize its larger LoRA capacity). Pick v5.1 for an all-round reasoner that beats base on the MMLU security subjects; pick v4.2 if you want maximum CyberMetric MCQ accuracy.

How it was trained (brief)

LoRA fresh-from-base at a genuinely larger rank than the prior series (which had been silently capped), on a real-knowledge majority: full real CyberMetric MCQs + real WMDP-cyber + real IR/poli-sci + CS-adjacent MMLU (in the exact raw-completion format MMLU is scored in, decontaminated 7-gram vs the test splits), plus 766 answer-verified multi-step chain-of-thought traces and an anti-forgetting breadth slice. Agentic tool-use traces target the common small-model failure modes.

Usage (mlx-lm)

from mlx_lm import load, generate
model, tok = load("Soaperloafidksum/LOREA-cyber-coder-30B-A3B-v5.1")
messages = [
    {"role": "system", "content": "You are LOREA-cyber, an ethical red-team assistant. Confirm authorization, "
     "ground every claim in tool output, and refuse unauthorized harm."},
    {"role": "user", "content": "Explain how a chained IDOR-to-admin-API-key privilege escalation works, and how to fix it."},
]
prompt = tok.apply_chat_template(messages, add_generation_prompt=True, tokenize=False)
print(generate(model, tok, prompt=prompt, max_tokens=500, verbose=True))

Serve it: python3 -m mlx_lm.server --model Soaperloafidksum/LOREA-cyber-coder-30B-A3B-v5.1. Recommended sampling: temperature=0.5, top_p=0.95, repetition_penalty=1.1.

Intended use and limitations

For authorized, lawful security testing, CTF/RE practice, and security education only. It is a 4-bit quantized 30B model: it can still hallucinate, its multi-turn autonomous planning is limited (it executes well when handed a clear next action but can stall on open-ended recovery), and it is far weaker than frontier models. Verify anything important. Inherits the base model's license.