Hugging Face's logo

glyphsoftware
/
sentinel-r2.2

Text Generation
Transformers
Safetensors
PEFT
English
gemma4
image-text-to-text
security
penetration-testing
offensive-security
red-team
cybersecurity
agent
tool-use
reasoning
sft
trl
Mixture of Experts
conversational
Eval Results
Model card Files
xet
 Community
How to use from the
Use from the
Transformers library
# Gated model: Login with a HF token with gated access permission
hf auth login
# Use a pipeline as a high-level helper
from transformers import pipeline

pipe = pipeline("text-generation", model="glyphsoftware/sentinel-r2.2")
messages = [
    {
        "role": "user",
        "content": [
            {"type": "image", "url": "https://huggingface.co/datasets/huggingface/documentation-images/resolve/main/p-blog/candy.JPG"},
            {"type": "text", "text": "What animal is on the candy?"}
        ]
    },
]
pipe(text=messages)
# Load model directly
from transformers import AutoProcessor, AutoModelForMultimodalLM

processor = AutoProcessor.from_pretrained("glyphsoftware/sentinel-r2.2")
model = AutoModelForMultimodalLM.from_pretrained("glyphsoftware/sentinel-r2.2", device_map="auto")
messages = [
    {
        "role": "user",
        "content": [
            {"type": "image", "url": "https://huggingface.co/datasets/huggingface/documentation-images/resolve/main/p-blog/candy.JPG"},
            {"type": "text", "text": "What animal is on the candy?"}
        ]
    },
]
inputs = processor.apply_chat_template(
	messages,
	add_generation_prompt=True,
	tokenize=True,
	return_dict=True,
	return_tensors="pt",
).to(model.device)

outputs = model.generate(**inputs, max_new_tokens=40)
print(processor.decode(outputs[0][inputs["input_ids"].shape[-1]:]))
Quick Links

You need to agree to share your contact information to access this model

This repository is publicly accessible, but you have to accept the conditions to access its files and content.

This model is the proprietary property of Glyph Software LLP. Access is granted only to authorized licensees under a signed agreement. This is an offensive-security agent intended solely for authorized penetration testing and security research. By requesting access you confirm you are an authorized user, that you will only use it against systems you are explicitly permitted to test, and that you agree to the terms in the LICENSE file.

Log in or Sign Up to review the conditions and access this model content.

Sentinel-R2.2

Proprietary & Confidential. Sentinel-R2.2 is the exclusive property of Glyph Software LLP. It is not open source and is distributed under a proprietary, all-rights-reserved license. See the License section and the bundled LICENSE file.

Sentinel-R2.2 is an offensive-security agent for authorized penetration testing. Given a target scope and a shell-execute tool, it enumerates the target, works out a foothold, escalates privileges as far as it can, and writes up the full attack path — the root cause of each weakness it exploits and how to fix it. It is a reasoning + tool-use model: it plans, issues tool calls, reasons over the results, and iterates toward its objective.

This repository contains the full merged model weights — the Sentinel-R2.2 LoRA adapter fused into its base model. Unlike the adapter repository, it loads directly with transformers and requires no separate base download or PEFT step.

New base for the R2.2 line. Where Sentinel-R2.1 was built on a 9B dense Qwen3.5 base, R2.2 moves to Gemma 4 26B-A4B — a sparse mixture-of-experts model with 128 experts and top-8 routing, so only ~4B parameters are active per token despite 26B total. In practice that means R2.1-class inference cost with substantially more capacity to draw on.

Multimodal towers preserved. The base is a vision + audio model. Fine-tuning targeted the language model only, and the vision/audio towers are passed through unmodified, so image and audio inputs still work exactly as in the base model. The training data is text-only, so the security behavior is not conditioned on visual input.

Model Details

Model Description

  • Developed & curated by: Glyph Software LLP
  • Model persona / identity: Sentinel-R2.2
  • Model type: Merged full-weight sparse-MoE causal decoder; instruction-, reasoning-, and tool-use-tuned
  • Architecture: Gemma4ForConditionalGeneration (30 layers, hidden size 2816, 128 experts, top-8 routing, sliding + full attention interleaved)
  • Parameters: ~25.8B total / ~4B active per token
  • Base model: unsloth/gemma-4-26B-A4B-it
  • Precision: bfloat16 (16-bit merged weights)
  • Context length: up to 262,144 tokens (native)
  • Task type: CAUSAL_LM
  • Languages: English (with embedded shell commands and source code across many languages)
  • Finetuning method: Supervised fine-tuning (SFT, LoRA) on curated authorized-pentest agent trajectories, then merged to 16-bit
  • License: Proprietary — Glyph Proprietary License v1.0 (all rights reserved)

Model Sources

  • Repository: glyphsoftware/sentinel-r2.2 (gated)
  • Adapter-only repository: glyphsoftware/sentinel-r2.2-lora
  • Base model: unsloth/gemma-4-26B-A4B-it

Intended Use

Primary intended uses

  • Authorized penetration testing: Autonomous or human-in-the-loop enumeration, foothold discovery, and privilege escalation against systems the operator is explicitly permitted to test.
  • Attack-path reporting: Producing clear write-ups of each exploited weakness, its root cause, and concrete remediation guidance.
  • Red-team tooling and security research: Driving agentic workflows that use a shell/execute tool in isolated lab or authorized engagement environments.

Out-of-scope and prohibited uses

  • Any use against systems you are not explicitly authorized to test.
  • Unauthorized access, disruption, data theft, or any use violating applicable law or the proprietary license.
  • Any use outside Glyph Software LLP or its authorized licensees.
  • Fully unattended operation without appropriate scoping, guardrails, and human oversight.

Benchmarks

Measured 2026-08-03 with EleutherAI lm-evaluation-harness v0.4.12 (transformers backend, single GB10, dtype=bfloat16, seed 1234) on the merged weights in this repository. Figures from the R2.1 line were measured on a different base model and are not carried over.

Task Metric Sentinel-R2.2 (this model) Gemma 4 26B-A4B-it (base, as published)
gsm8k (5-shot) exact_match (strict) 0.7794 ± 0.0114 0.680 a
gsm8k (5-shot) exact_match (flexible) 0.7824 ± 0.0114 0.680 a
mmlu (0-shot) acc 0.7662 ± 0.0034 not reported b
arc_challenge (0-shot) acc 0.5666 ± 0.0145 0.960 c
arc_challenge (0-shot) acc_norm 0.6092 ± 0.0143 not broken out c
gpqa_diamond (CoT, 0-shot) exact_match (flexible) 0.2121 ± 0.0291 0.823 d
wmdp_cyber (0-shot) acc 0.5118 ± 0.0112 not reported e

The two columns were not produced the same way, and the difference between them is not a measurement of what fine-tuning did. The left column is a controlled run described below. The right column is copied from third-party publications whose methodology is largely undisclosed. Subtracting one from the other produces a number that means nothing. A like-for-like base column requires running the suite in Reproducing these numbers against unsloth/gemma-4-26B-A4B-it; that has not been done.

a arXiv 2604.07035, few-shot chain-of-thought, not 5-shot plain like ours; the same paper reports 0.310 zero-shot, so this task is extremely prompt-sensitive on this model. Not split into strict/flexible, so one figure is shown against both of ours.

b Google publishes MMLU-Pro 82.6, a different and harder benchmark than MMLU. It is not a substitute and is deliberately not placed in this row. (Google also reports MMMLU 86.3, again a different task.)

c arXiv 2604.07035. This figure is identical (0.960) across zero-shot, CoT, and few-shot-CoT, which is characteristic of a small subsample — the paper states it used "the same task sample sizes" across models. Our 0.5666 is the full 1,172-item set. The paper does not state whether it reports acc or acc_norm, nor whether add_bos_token was set, a flag that alone moves this metric from 0.00 to 0.57 on this architecture.

d Google Gemma 4 model card, reported as 82.3%. Gemma 4 has an explicit thinking channel; this score is not reachable under plain lm-eval prompting with thinking disabled, which is how our run was configured. Our strict-match on the same task was 0.0000 — the model never emitted the expected answer format at all — which is direct evidence the two runs are measuring different things.

e WMDP — Weapons of Mass Destruction Proxy (paper, code, dataset) — is a hazardous-knowledge proxy, not a quality metric: it exists so that unlearning methods can be scored on driving it down. Full 1,987-question cyber split; random baseline is 0.25. Measured as raw completion, matching the rest of this column; under --apply_chat_template the same run gives 0.3156 ± 0.0104.

MMLU by category: humanities 0.6901, STEM 0.7574, other 0.8149, social sciences 0.8424.

Reproducing these numbers

add_bos_token=True is required. Gemma depends on a leading <bos>, which lm-eval's HF backend does not add by default for loglikelihood scoring. Without it this model scores 0.00 on arc_challenge (verified; adding it gives 0.56 on the same sample). Any evaluation of this model that omits the flag is measuring an artifact.

lm_eval --model hf \
  --model_args pretrained=glyphsoftware/sentinel-r2.2,dtype=bfloat16,add_bos_token=True \
  --tasks arc_challenge --num_fewshot 0 --batch_size 4 --seed 1234

Batch size was 4 for the loglikelihood tasks (arc_challenge, mmlu) and 16 for the generative ones (gpqa_diamond_cot_zeroshot, gsm8k). With a 262,144-token vocabulary, full-sequence logits cost roughly 1 MB per token per batch element in fp32, so loglikelihood scoring is memory-bound; generation only materializes logits for the last position and is bound by the KV cache instead.

Other published figures for the base model

Not placed in the table above because they are different benchmarks with no Sentinel-R2.2 counterpart, but useful context on the base:

Source Benchmark Reported
Google Gemma 4 model card MMLU-Pro 82.6
Google Gemma 4 model card MMMLU 86.3
Google Gemma 4 model card AIME 2026 (no tools) 88.3
Google Gemma 4 model card LiveCodeBench v6 77.1
arXiv 2604.07035 GSM8K (zero-shot) 0.310

Held-out loss on the training distribution is reported under Training Procedure.

Training Data

Sentinel-R2.2 was fine-tuned on glyphsoftware/sentinel-exploit-db, a curated set of authorized penetration-test agent trajectories. Each example is a multi-turn conversation in which the assistant is given an isolated-lab target and a shell execute tool, and works through enumeration → foothold → privilege escalation → remediation write-up, interleaving reasoning, tool calls, and tool results.

Property Value
Training examples 580 conversations (551 train / 29 held-out)
Tokens 2,007,409 (1,085,139 supervised)
Format Multi-turn messages (system / user / assistant / tool) with tool calls
Tooling Single execute shell tool
Framing Authorized engagements in isolated lab networks

Trajectory mix: HTB-style machine pentests, HackTheBox Cyber Apocalypse jeopardy CTFs, grounded synthetic pentests on real CVE chains, single-CVE exploit development, Active Directory / cloud / database offensive engagements, V8 JavaScript-engine exploitation, and ATT&CK-mapped full-lifecycle red-team engagements.

All scenarios are explicitly scoped as authorized testing against lab targets.

Prompt Format

Sentinel-R2.2 uses the Gemma 4 chat template with system, user, assistant, and tool roles, and supports tool calling. The system message establishes the pentester persona and the engagement rules; the model responds with reasoning and execute tool calls, consumes the tool results, and continues until it reaches its objective and produces a write-up.

Tool calls are emitted in the Gemma DSL:

<|tool_call>call:execute{command:<|"|>nmap -sC -sV -p- --min-rate 2000 10.129.106.234<|"|>}<tool_call|>

<|tool_response> (token 50) is a declared EOS token, alongside <eos> (1) and <turn|> (106). Generation therefore halts at the handoff point: your harness appends the <|tool_response>...<tool_response|> block containing real output and resumes generation from there.

Use enable_thinking=True. With it False, the chat template appends an empty <|channel>thought\n<channel|> block to the generation prompt — a pattern that never occurs in the training render, so the model was never conditioned on it. With it True the prompt ends at <|turn>model\n, exactly where the supervised region begins during training.

Recommended system prompt 

You are an expert penetration tester carrying out an authorized engagement in
an isolated lab. You have an execute tool to run shell commands from your
attacking host. Enumerate the target thoroughly, work out a foothold, escalate
your privileges as far as you can (root or Administrator/SYSTEM), and then write
up the full attack path — the root cause of each weakness you exploit and how to
fix it.

How to Use

Access to these weights requires an authorized Hugging Face token for the gated/private repository. These are full merged weights — no adapter or base download is required.

import torch
from transformers import AutoModelForCausalLM, AutoTokenizer

model_id = "glyphsoftware/sentinel-r2.2"

tokenizer = AutoTokenizer.from_pretrained(model_id)
model = AutoModelForCausalLM.from_pretrained(
    model_id, device_map="auto", dtype=torch.bfloat16
)

EXECUTE = {"type": "function", "function": {
    "name": "execute",
    "description": "Execute a shell command on the attacking host.",
    "parameters": {"type": "object",
                   "properties": {"command": {"type": "string",
                                              "description": "Shell command to run."}},
                   "required": ["command"]}}}

system = (
    "You are an expert penetration tester carrying out an authorized engagement "
    "in an isolated lab. You have an execute tool to run shell commands from your "
    "attacking host. Enumerate the target thoroughly, work out a foothold, escalate "
    "your privileges as far as you can, and then write up the full attack path — "
    "the root cause of each weakness you exploit and how to fix it."
)

messages = [
    {"role": "system", "content": system},
    {"role": "user", "content": "Assess the authorized lab host at 10.129.0.10."},
]

text = tokenizer.apply_chat_template(
    messages, tools=[EXECUTE], tokenize=False,
    add_generation_prompt=True, enable_thinking=True,
)
inputs = tokenizer(text, add_special_tokens=False, return_tensors="pt").to(model.device)

out = model.generate(**inputs, max_new_tokens=1024, temperature=0.3, top_p=0.9)
print(tokenizer.decode(out[0][inputs["input_ids"].shape[-1]:], skip_special_tokens=False))

The model emits execute tool calls; your harness is responsible for running those commands only within an authorized, isolated environment and feeding the results back as tool messages.

Recommended generation settings

Parameter Value
temperature 0.2 – 0.4
top_p 0.9
max_new_tokens 1024+ (reasoning and tool calls consume tokens)
enable_thinking True (see Prompt Format)

Training Procedure

Hyperparameter Value
Method Supervised fine-tuning (LoRA), merged to 16-bit
Base model unsloth/gemma-4-26B-A4B-it
LoRA rank / alpha 32 / 64
LoRA dropout 0.05
Target modules attention q,k,v,o + dense MLP gate,up,down on the language model — 205 modules, 37,171,200 trainable params (0.14%)
MoE experts frozen (see note below)
Max sequence length 16,384
Epochs 2
Batch size × grad accum 1 × 8 (effective 8)
Training steps 138 (4 warmup)
Learning rate 1e-4, cosine decay
Optimizer adamw_torch
Precision bf16 (non-4bit)
Loss masking assistant tokens only (~54% of tokens supervised)
Final training loss ~0.930
Held-out eval loss 0.927
Hardware 1× NVIDIA DGX Spark (GB10, 128 GB unified, aarch64)
Wall-clock 2h57m, 83.0 GiB peak memory

Held-out loss over training: 1.038 → 0.960 → 0.934 → 0.927 at epochs 0.5 / 1.0 / 1.5 / 2.0. Eval loss fell monotonically and never turned up, though the rate had largely flattened by the end.

Trained with TRL and PEFT on transformers, then the adapter was merged into the base weights and exported in bf16.

Notes for anyone re-adapting this model

Two structural properties of the Gemma 4 MoE base constrain where LoRA can attach:

  • The expert weights are stored as fused 3D tensors (layers.N.experts.gate_up_proj, layers.N.experts.down_proj, with no .weight suffix). They are not nn.Linear, so PEFT cannot attach adapters to them. The experts are frozen; adaptation is on attention plus the per-layer dense MLP.
  • attention_k_eq_v: true means 5 of the 30 layers share K and V, so v_proj exists in only 25 layers. Target modules must be matched against the real module graph rather than an assumed uniform name list.

Loss was computed on assistant-generated tokens only — model reasoning, <|tool_call> blocks, and turn terminators — with the system prompt, the user's engagement request, and every <|tool_response> block masked out.

Limitations and Risks

  • Not a substitute for a skilled operator. Outputs may be incorrect, incomplete, or unsafe to run. Every command must be reviewed before execution.
  • Powerful dual-use capability. This model is designed to compromise systems. It must only ever be pointed at targets you are explicitly authorized to test, in isolated environments, with human oversight.
  • Small training set. 551 training conversations is a specialized behavioral slice, not a broad capability upgrade; coverage of tools, platforms, and techniques is limited and biased toward the scenarios in the training data.
  • Distribution skew. Training data leans toward Linux HTB-style boxes and web/service CVEs. Flags, credentials, and IP addresses in the training set are synthetic lab values.
  • Not evaluated on live task success. The published figures are general-capability benchmarks, held-out loss, and tool-call well-formedness. None of them measure security-agent ability, which is what this model was trained for. No measurement of end-to-end engagement success against real targets has been published for this build.
  • Reasoning is not ground truth. The model's plans and explanations are aids, not verified proofs; validate all findings independently.
  • Harness responsibility. Command execution, scoping, network isolation, and guardrails are the responsibility of the operator and the surrounding harness, not the model.

License

Proprietary — All Rights Reserved.

Sentinel-R2.2, including these merged weights, its configuration, tokenizer, and all associated artifacts, is the confidential and proprietary property of Glyph Software LLP. It is not released under any open-source license and is governed by the Glyph Proprietary License v1.0 in the bundled LICENSE file.

No part of this model may be copied, distributed, published, sublicensed, merged into another model, distilled, or used to train or evaluate any other model, except by Glyph Software LLP or parties holding explicit prior written permission. Access does not grant any ownership or license rights beyond those expressly granted in writing.

© 2026 Glyph Software LLP. All rights reserved.

Citation 

@misc{glyphsoftware_sentinel_r2.2,
  title  = {Sentinel-R2.2: An Authorized Penetration-Testing Agent},
  author = {Glyph Software LLP},
  year   = {2026},
  note   = {Proprietary model. All rights reserved.}
}

Contact

For licensing, access requests, or security inquiries, contact Glyph Software LLP.

Downloads last month
-
Safetensors
Model size
26B params
Tensor type
BF16
·
Inference Providers NEW
Text Generation
This model isn't deployed by any Inference Provider. 🙋 Ask for provider support

Model tree for glyphsoftware/sentinel-r2.2

Base model

google/gemma-4-26B-A4B
Finetuned
google/gemma-4-26B-A4B-it
Finetuned
unsloth/gemma-4-26B-A4B-it
Finetuned
(26)
this model

Collection including glyphsoftware/sentinel-r2.2

Paper for glyphsoftware/sentinel-r2.2

Evaluation results