--- license: other license_name: glyph-proprietary-1.0 license_link: LICENSE base_model: unsloth/gemma-4-26B-A4B-it library_name: transformers pipeline_tag: text-generation language: - en tags: - security - penetration-testing - offensive-security - red-team - cybersecurity - agent - tool-use - function-calling - multi-tool - reasoning - sft - trl - peft - gemma4 - moe inference: false extra_gated_prompt: >- This model is the proprietary property of Glyph Software LLP. Access is granted only to authorized licensees under a signed agreement. This is an offensive-security agent intended solely for authorized penetration testing and security research. By requesting access you confirm you are an authorized user, that you will only use it against systems you are explicitly permitted to test, and that you agree to the terms in the LICENSE file. extra_gated_fields: Company: text Authorized use case: text I confirm I will only use this model against systems I am authorized to test: checkbox I agree to the Glyph Proprietary License: checkbox datasets: - glyphsoftware/sentinel-exploit-tooled --- # Sentinel-R2.2-Max > **Proprietary & Confidential.** Sentinel-R2.2-Max is the exclusive property of > **Glyph Software LLP**. It is **not** open source and is distributed under a > proprietary, all-rights-reserved license. See the [License](#license) section > and the bundled [`LICENSE`](https://huggingface.co/glyphsoftware/sentinel-r2.2-max/blob/main/LICENSE) file. Sentinel-R2.2-Max is an **offensive-security agent** for **authorized penetration testing**. Given a target scope and an agent toolkit (`Bash`, `Write`, `Read` and others — see [Training Data](#this-model-expects-an-agent-toolkit-not-a-shell)), it enumerates the target, works out a foothold, escalates privileges as far as it can, and writes up the full attack path — the root cause of each weakness it exploits and how to fix it. It is a reasoning + tool-use model: it plans, issues tool calls, reasons over the results, and iterates toward its objective. This repository contains the **full merged model weights** — the LoRA adapter fused into its base model. It loads directly with `transformers` and requires no separate base download or PEFT step. > **⚠️ These weights were replaced on 2026-08-09.** This repository previously held a > different build: 3 epochs over the 1,180-conversation `sentinel-exploit-db`. It has > been rewritten with the model documented below — 2 epochs over the 1,230-conversation > **tooled** dataset with structured `tool_calls`. If you pulled this repo before > 2026-08-09 you have materially different weights. The prior build's benchmark results > remain in this repository's commit history. > **⚠️ This build has not been evaluated.** No benchmark suite has been run against > these weights — see [Evaluation](#evaluation). The only quantitative signal is > held-out loss on the training distribution. Treat it as unvalidated, and note that > the build it replaced *was* benchmarked and showed a measured regression against > Sentinel-R2.2 on GSM8K. ## Model Details ### Model Description - **Developed & curated by:** Glyph Software LLP - **Model persona / identity:** `Sentinel` - **Model type:** Merged full-weight sparse-MoE causal decoder; instruction-, reasoning-, and tool-use-tuned - **Architecture:** `Gemma4ForConditionalGeneration` (30 layers, hidden size 2816, 128 experts, top-8 routing, sliding + full attention interleaved) - **Parameters:** ~25.8B total / ~4B active per token - **Base model:** [`unsloth/gemma-4-26B-A4B-it`](https://huggingface.co/unsloth/gemma-4-26B-A4B-it) - **Precision:** bfloat16 (16-bit merged weights) - **Context length:** up to 262,144 tokens (native) - **Task type:** `CAUSAL_LM` - **Languages:** English (with embedded shell commands and source code across many languages) - **Finetuning method:** Supervised fine-tuning (SFT, LoRA) on curated authorized-pentest agent trajectories, then merged to 16-bit - **License:** Proprietary — Glyph Proprietary License v1.0 (all rights reserved) > **Multimodal towers preserved.** The base is a vision + audio model. Fine-tuning > targeted the language model only, and the vision/audio towers are passed through > unmodified, so image and audio inputs still work exactly as in the base model. > The training data is text-only, so the security behavior is not conditioned on > visual input. ### Model Sources - **Repository:** `glyphsoftware/sentinel-r2.2-max` - **Previous release:** `glyphsoftware/sentinel-r2.2` - **Base model:** `unsloth/gemma-4-26B-A4B-it` ## Intended Use ### Primary intended uses - **Authorized penetration testing:** Autonomous or human-in-the-loop enumeration, foothold discovery, and privilege escalation against systems the operator is explicitly permitted to test. - **Attack-path reporting:** Producing clear write-ups of each exploited weakness, its root cause, and concrete remediation guidance. - **Red-team tooling and security research:** Driving agentic workflows that use the agent toolkit in isolated lab or authorized engagement environments. ### Out-of-scope and prohibited uses - **Any use against systems you are not explicitly authorized to test.** - Unauthorized access, disruption, data theft, or any use violating applicable law or the proprietary license. - Any use outside Glyph Software LLP or its authorized licensees. - Fully unattended operation without appropriate scoping, guardrails, and human oversight. ## Evaluation **No benchmark suite has been run against this build.** The figures published for [Sentinel-R2.2](https://huggingface.co/glyphsoftware/sentinel-r2.2), and those in this repository's earlier commits, were measured on **different weights trained on a different dataset**. They do not describe these weights and should not be quoted for them. The only quantitative signal available is held-out loss, reported under [Training Procedure](#training-procedure). Held-out loss measures next-token agreement with the training distribution; it is not a capability measurement and says nothing about security-agent ability. > **A good loss curve is not evidence of a good model here.** The build this repository > previously held also had a clean, monotonically falling held-out curve — and > benchmarking then found a **0.78 → 0.61 GSM8K regression** driven by a repetition-loop > failure affecting ~20% of generations, which the loss curve gave no hint of. That > failure mode was diagnosed only by inspecting generations. Until this build is > benchmarked, the same class of problem cannot be ruled out. To evaluate, run the suite below. **`add_bos_token=True` is required** — Gemma depends on a leading ``, which lm-eval's HF backend does not add by default for loglikelihood scoring, and without it this architecture scores at floor on `arc_challenge`: ```bash lm_eval --model hf \ --model_args pretrained=glyphsoftware/sentinel-r2.2-max,dtype=bfloat16,add_bos_token=True \ --tasks arc_challenge,mmlu,wmdp_cyber --num_fewshot 0 --batch_size 4 --seed 1234 ``` Use batch 4 for loglikelihood tasks and 16 for generative ones (`gpqa_diamond_cot_zeroshot`, `gsm8k`). `--num_fewshot` is global, so 5-shot GSM8K needs its own invocation. Prompt format is task-type dependent: `--apply_chat_template` helps generative tasks and measurably hurts loglikelihood MCQ on this architecture. Record the configuration out of band — lm-eval's `results_*.json` writes `apply_chat_template: None` even when the flag was passed. ## Training Data Fine-tuned on [**`glyphsoftware/sentinel-exploit-tooled`**](https://huggingface.co/datasets/glyphsoftware/sentinel-exploit-tooled) ("Sentinel Exploit DB (Tooled)"), revision `5b11e692`. Each example is a complete multi-turn engagement — enumeration → foothold → privilege escalation → remediation write-up — in OpenAI chat format with structured `tool_calls` and `tool` responses. | Property | Value | |---|---| | Conversations | 1,230 (**1,168 train / 61 held-out** after tokenization; 1 dropped) | | Total messages | 31,961 | | Assistant turns | 15,289, carrying **14,212 tool calls** | | Turns with `reasoning_content` | 389 | | Distinct tools | **19** | | Tokens (this run) | 4,076,783 (~52.5% supervised) | | Sequence length | max 13,209 tokens | | Framing | Authorized engagements in isolated lab networks | | Source | Conversations | What it is | |---|---:|---| | `redteam` | 350 | Full-lifecycle red-team engagements, each ATT&CK-mapped with detections and remediation | | `ctf` | 300 | HTB-style machine pentests, full kill chain, with authored failure→recovery episodes | | `v8` | 300 | Chromium / V8 JavaScript-engine exploitation, bug primitive → code execution | | `ctf-apocalypse` | 100 | HackTheBox Cyber Apocalypse 2023–2025 jeopardy CTFs across all categories | | `offsec` | 100 | Active Directory chains, cloud (AWS/Azure/GCP/K8s), database, web, binary pwn | | `ctf-synthetic` | 41 | Grounded synthetic pentests built around real CVE chains | | `cve` | 39 | Single-CVE source review and exploit development | ### This model expects an agent toolkit, not a shell This is the most important behavioral difference from [Sentinel-R2.2](https://huggingface.co/glyphsoftware/sentinel-r2.2) and from the build that previously occupied this repository. Those were trained where **every action went through one `execute(command)` tool**. This build was trained on a decomposed tool surface and calls tools by name: | Tool | Calls | Used for | |---|---:|---| | `Bash` | 11,087 | shell commands, pipelines, chains; background jobs | | `Write` | 1,714 | authoring PoC scripts, payloads, wordlists | | `Read` | 384 | reading a file | | `TaskCreate` / `TaskUpdate` | 266 / 266 | opening and closing engagement objectives | | `TaskGet` / `TaskList` | 162 / 46 | checking objective status mid-engagement | | `Agent` | 72 | delegating a bounded sweep or code review | | `ListAgents` | 63 | discovering delegates before a fan-out | | `Grep` | 62 | searching file contents | | `Monitor` | 27 | waiting on a condition | | `CronCreate` / `CronList` / `CronDelete` | 15 / 12 / 12 | recurring checks | | `SendMessage` | 9 | following up with a running agent | | `Edit` | 7 | single literal substitution | | `Glob` | 5 | finding files by name | | `TaskOutput` / `TaskStop` | 2 / 1 | reading and stopping background jobs | `Bash` is the majority tool by design — roughly a fifth of source commands are genuine pipelines for which a shell call is the faithful representation. > **Give it the tools it was trained on.** Handing this model a single `execute` tool > reintroduces exactly the mismatch the dataset was built to remove, and teaches it to > cram every action into a shell string. Declare `Bash`, `Write`, and `Read` at minimum; > declare the orchestration tools only if your harness genuinely implements them. **Tool-call arguments are JSON objects, not strings.** `tool_call.function.arguments` is always a mapping, e.g. `{"command": "nmap -sV 10.10.10.10"}`. ### Known properties of this training data Inherited from the dataset and relevant to anyone interpreting this model's behavior: - **~8.9% of tool calls are synthesized.** `TaskCreate`/`TaskUpdate`/`TaskGet`/`TaskList`, `Cron*`, `SendMessage` and `ListAgents` have **no precedent in the source corpus** — they were added so every tool the agent holds at inference appears in training. They teach tool *syntax* and plausible placement, not verified strategy. - **~10.3% of calls have heuristically divided outputs.** Where one source `execute` call decomposed into several tool calls, its single stdout blob was split between them; a minority are attributed to the wrong command. - **65.3% of calls are exact**, 15.6% emitted unchanged as a single byte-identical `Bash`. - **Tail tools are sparse.** `Glob` (5), `TaskOutput` (2), `TaskStop` (1) and `Edit` (7) have too few examples to teach reliable usage. All scenarios are explicitly scoped as authorized testing against already-public CTF machines and disclosed CVEs. Flags, credentials, hostnames, and IP addresses are synthetic lab values or RFC-reserved / public CTF ranges. ## Prompt Format Uses the Gemma 4 chat template with `system`, `user`, `assistant`, and `tool` roles, and supports tool calling. The bundled `chat_template.jinja` injects a **default Sentinel system prompt** ahead of any caller-supplied system message, establishing the model identity and the authorized-scope constraint even when the caller supplies none. Tool calls are emitted in the Gemma DSL, naming the specific tool: ``` <|tool_call>call:Bash{command:<|"|>nmap -sC -sV -p- --min-rate 2000 10.129.106.234<|"|>} <|tool_call>call:Write{file_path:<|"|>exploit.py<|"|>,content:<|"|>import requests...<|"|>} ``` **`<|tool_response>` (token 50) is a declared EOS token**, alongside `` (1) and `` (106). Generation halts at the handoff point: your harness appends the `<|tool_response>...` block containing real output and resumes generation from there. > **Use `enable_thinking=True`.** With it `False`, the chat template appends an > empty `<|channel>thought\n` block to the generation prompt — a pattern > that never occurs in the training render. With it `True` the prompt ends at > `<|turn>model\n`, exactly where the supervised region begins during training. ### Recommended system prompt Training system messages enumerate the agent's tool surface, so yours should too: ``` You are an expert penetration tester carrying out an authorized engagement in an isolated lab, working from your attacking host. You have these tools: `Bash` to run shell commands, `Write` to author files, `Read` to read them, `Grep` to search file contents, and `Glob` to find files by name. Enumerate the target thoroughly, work out a foothold, escalate your privileges as far as you can (root or Administrator/SYSTEM), and then write up the full attack path — the root cause of each weakness you exploit and how to fix it. ``` > **Note on the bundled template.** The default system prompt injected by > `chat_template.jinja` is inherited from the Sentinel-R2.2 line and describes > "operating an interactive shell through tool calls" — phrasing that predates this > build's multi-tool surface. It still establishes identity and authorized-scope > framing correctly, and your own system message is appended after it, but enumerate > the real tool surface there rather than relying on the default. ## How to Use > Access to these weights requires an authorized Hugging Face token for the > gated/private repository. These are full merged weights — no adapter or base > download is required. ```python import torch from transformers import AutoModelForCausalLM, AutoTokenizer model_id = "glyphsoftware/sentinel-r2.2-max" tokenizer = AutoTokenizer.from_pretrained(model_id) model = AutoModelForCausalLM.from_pretrained( model_id, device_map="auto", dtype=torch.bfloat16 ) # Declare the tools this model was trained on. Bash / Write / Read are the # high-frequency three; add Grep, Glob, Edit if your harness implements them. def fn(name, desc, props, required): return {"type": "function", "function": { "name": name, "description": desc, "parameters": {"type": "object", "properties": props, "required": required}}} TOOLS = [ fn("Bash", "Run a shell command on the attacking host.", {"command": {"type": "string", "description": "Shell command to run."}, "run_in_background": {"type": "boolean", "description": "Run detached."}}, ["command"]), fn("Write", "Write a file (PoC script, payload, wordlist).", {"file_path": {"type": "string"}, "content": {"type": "string"}}, ["file_path", "content"]), fn("Read", "Read a file from disk.", {"file_path": {"type": "string"}, "offset": {"type": "integer"}, "limit": {"type": "integer"}}, ["file_path"]), ] messages = [ {"role": "user", "content": "Assess the authorized lab host at 10.129.0.10."}, ] text = tokenizer.apply_chat_template( messages, tools=TOOLS, tokenize=False, add_generation_prompt=True, enable_thinking=True, ) inputs = tokenizer(text, add_special_tokens=False, return_tensors="pt").to(model.device) out = model.generate(**inputs, max_new_tokens=1024, temperature=0.3, top_p=0.9) print(tokenizer.decode(out[0][inputs["input_ids"].shape[-1]:], skip_special_tokens=False)) ``` The model emits named tool calls (`Bash`, `Write`, `Read`, …); your harness is responsible for executing them **only within an authorized, isolated environment** and feeding results back as `tool` messages with the matching `tool_call_id`. ### Recommended generation settings | Parameter | Value | |---|---| | `temperature` | 0.2 – 0.4 | | `top_p` | 0.9 | | `max_new_tokens` | 1024+ (reasoning and tool calls consume tokens) | | `enable_thinking` | `True` (see [Prompt Format](#prompt-format)) | | `repetition_penalty` | consider ~1.05–1.1 — see [Limitations](#limitations-and-risks) | ## Training Procedure | Hyperparameter | Value | |---|---| | Method | Supervised fine-tuning (LoRA), merged to 16-bit | | Base model | `unsloth/gemma-4-26B-A4B-it` | | LoRA rank / alpha | 32 / 64 | | LoRA dropout | 0.05 | | Target modules | attention `q,k,v,o` + dense MLP `gate,up,down` on the language model — 205 modules, 37,171,200 trainable params (0.14%) | | MoE experts | **frozen** (see note below) | | Epochs | **2** | | Batch size × grad accum | 1 × 8 (effective 8) | | Training steps | **292** (9 warmup) | | Learning rate | 1e-4, cosine decay | | Optimizer | `adamw_torch` | | Precision | bf16 (non-4bit) | | Loss masking | assistant tokens only (~52.5% of tokens supervised) | | Final training loss | 0.9725 | | Held-out eval loss | **0.8870** | | Hardware | 1× NVIDIA DGX Spark (GB10, 128 GB unified, aarch64) | | Wall-clock | 5h44m, 82.3 GiB peak memory | Held-out loss over training: 0.9939 → 0.9153 → 0.8917 → **0.8870** at epochs 0.5 / 1.0 / 1.5 / 2.0. Monotonic throughout, and still improving at the end — the final interval gained 0.0047 after 0.0236 before it. The 3-epoch build this replaced had essentially flattened by its final epoch (0.0043), which is part of why this run stopped at 2. > **Not comparable to other Sentinel builds.** Sentinel-R2.2 reports 0.927 and the > previous 3-epoch build reported 0.8506, but all three use **different held-out sets** > (29 / 59 / 61 conversations) drawn from **different datasets**. A lower number here > does not mean a better model. Trained with TRL and PEFT on `transformers`, then the adapter was merged into the base weights and exported in bf16. ### Notes for anyone re-adapting this model Two structural properties of the Gemma 4 MoE base constrain where LoRA can attach: - The expert weights are stored as **fused 3D tensors** (`layers.N.experts.gate_up_proj`, `layers.N.experts.down_proj`, with no `.weight` suffix). They are not `nn.Linear`, so PEFT cannot attach adapters to them. The experts are frozen; adaptation is on attention plus the per-layer dense MLP. - `attention_k_eq_v: true` means 5 of the 30 layers share K and V, so `v_proj` exists in only **25** layers. Target modules must be matched against the real module graph rather than an assumed uniform name list. Loss was computed on assistant-generated tokens only — model reasoning, `<|tool_call>` blocks, and turn terminators — with the system prompt, the user's engagement request, and every `<|tool_response>` block masked out. ## Limitations and Risks - **Unevaluated.** No benchmark has been run against these weights. Nothing establishes that this build is better than, or as good as, Sentinel-R2.2 or the build it replaced. See [Evaluation](#evaluation). - **Repetition-loop risk is unmeasured but plausible.** The 3-epoch build this replaced degenerated into repeated clauses on ~20% of GSM8K generations. Two epochs and a still-improving loss curve make over-fitting less likely here, but this has **not** been tested. Use a repetition penalty and explicit stop conditions in your harness until it has been. - **Not a substitute for a skilled operator.** Outputs may be incorrect, incomplete, or unsafe to run. Every command must be reviewed before execution. - **Powerful dual-use capability.** This model is designed to compromise systems. It must only ever be pointed at targets you are explicitly authorized to test, in isolated environments, with human oversight. - **Specialized training set.** 1,168 training conversations is a specialized behavioral slice, not a broad capability upgrade; coverage of tools, platforms, and techniques is limited and biased toward the scenarios in the training data. - **Distribution skew.** Weighted toward `redteam` (350), `v8` (300) and `ctf` (300) of 1,230, so ATT&CK-mapped red-team engagements, V8 exploitation, and CTF-style machines are over-represented relative to `cve` (39) and `ctf-synthetic` (41). - **Orchestration-tool behavior is invented, not observed.** The task-list, cron and multi-agent tools were synthesized into the training data with no precedent in the source corpus (~8.9% of all calls). Do not treat this model's use of them as evidence-based strategy; it learned their syntax and plausible placement only. - **Tool-surface mismatch is a real failure mode.** Supplying a single `execute` tool instead of the named toolkit puts the model off-distribution. See [Training Data](#this-model-expects-an-agent-toolkit-not-a-shell). - **Not evaluated on live task success.** No measurement of end-to-end engagement success against real targets has been performed. - **Reasoning is not ground truth.** The model's plans and explanations are aids, not verified proofs; validate all findings independently. - **Harness responsibility.** Command execution, scoping, network isolation, and guardrails are the responsibility of the operator and the surrounding harness, not the model. ## License **Proprietary — All Rights Reserved.** Sentinel-R2.2-Max, including these merged weights, its configuration, tokenizer, and all associated artifacts, is the confidential and proprietary property of **Glyph Software LLP**. It is **not** released under any open-source license and is governed by the **Glyph Proprietary License v1.0** in the bundled [`LICENSE`](https://huggingface.co/glyphsoftware/sentinel-r2.2-max/blob/main/LICENSE) file. No part of this model may be copied, distributed, published, sublicensed, merged into another model, distilled, or used to train or evaluate any other model, except by Glyph Software LLP or parties holding explicit prior written permission. Access does not grant any ownership or license rights beyond those expressly granted in writing. © 2026 Glyph Software LLP. All rights reserved. ## Citation ```bibtex @misc{glyphsoftware_sentinel_r2.2_max, title = {Sentinel-R2.2-Max: An Authorized Penetration-Testing Agent}, author = {Glyph Software LLP}, year = {2026}, note = {Proprietary model. All rights reserved.} } ``` ## Contact For licensing, access requests, or security inquiries, contact Glyph Software LLP.