LoRA adapter for NVIDIA Nemotron 3 Super (120B total / ~12B active) fine-tuned for cybersecurity domain knowledge: offensive methodology, defensive concepts, CTF reasoning, vulnerability catalogs, and security tooling literacy.

This is the Stage-1 theory specialist from the Mati MultiLoRA coordinator stack. It is intended for instruction-following and explanation on cybersecurity topics, not for tool-calling agent harnesses.

Training corpus: True2456/cybersecurity-theory-sft-gemma12b

Compatibility

Item	Value
Base architecture	`NemotronHForCausalLM` (Nemotron 3 Super hybrid Mamba–Transformer MoE)
Trained against	`mlx-community/Nemotron-3-Super-120B-A12B-MLX-6bit`
Format	Apple MLX LoRA (`adapters.safetensors`)
Framework	`mlx-lm` LoRA tuner

Load with the matching Nemotron 3 Super MLX checkpoint (prefer a 6-bit MLX build consistent with training). Adapters are not guaranteed to transfer cleanly across different quantization levels of the same base.

Training summary

Hyperparameter	Value
Training steps (iters)	1000 (config planned 1500; published checkpoint is iter 1000)
Learning rate	`3e-6`
Optimizer	Adam
Batch size	1
Max sequence length	4096
Gradient checkpointing	enabled
LoRA layers (`num_layers`)	16 (upper transformer blocks)
LoRA rank	8
LoRA scale	20.0
LoRA dropout	0.0
Checkpoint cadence	every 100 iters
Seed	0
Prompt loss masking	off (`mask_prompt: false`)

Hardware context for this run: Apple Silicon unified memory (MLX Metal).

Training data

Supervised fine-tuning on 21,265 instruction rows from the Mati theory_gemma12b pack — see the paired dataset for full composition, lineage, and rebuild instructions.

Composition (by source)

Source	Rows	Role
RedSage-Seed	14,846	Offensive/defensive skill writeups, frameworks, Kali tooling, CLI literacy
Primus Reasoning (CTIBench / DeepSeek-R1 style)	2,489	Longer cybersecurity reasoning traces
CTFtime writeups	2,345	Competition writeup → teaching explanations
CISA KEV	800	Known Exploited Vulnerabilities catalog Q&A
Primus Instruct	785	Security ops tasks (alerts, cmd analysis, docs QA, Terraform misconfig, SIEM-style queries)
Total	21,265

Pack construction notes: max output length capped near 6,000 characters per completion; CTFtime and KEV intake capped (2,500 / 800) to keep the mix balanced.

Research foundations

Work	Citation	Relevance
NVIDIA Nemotron 3 Super	NVIDIA Open Model License	Base model
LoRA	Hu et al., 2021 — arXiv:2106.09685	Adapter training method
PRIMUS	Yang et al., EMNLP 2025 — arXiv:2502.11191	Training data source
RedSage	Suryanto et al., ICLR 2026 — arXiv:2601.22159	Training data source
MLX / mlx-lm	Apple MLX ecosystem	Training and inference runtime

Intended use

Cybersecurity explanation and mentoring (educational / research contexts)
Attack-path / CTF concept walkthroughs in authorized learning environments
Vulnerability and tooling literacy (KEV, common utilities)
Domain grounding for a larger multi-adapter stack (theory expert before agentic stages)

Out of scope / limitations

Not trained as a tool-using coding agent (no Cursor / OpenHands trajectories in this adapter).
Training rows are SFT pairs from a pack originally assembled for Gemma chat formatting; applied here as raw text targets under mlx-lm.
LoRA is a narrow adapter: base model capabilities outside the fine-tune distribution still dominate.
Outputs can be inaccurate, outdated, or unsafe if misapplied.

Disclaimers

Educational / Research / Personal Use Only. See LICENSE in this repository.

Permitted use: classroom instruction, academic research, personal learning, and private non-commercial experimentation with this adapter.
Prohibited use: commercial deployment without permission, paid security services, unauthorized penetration testing, or any attacks against systems you do not own or lack explicit written authorization to test.
Offensive knowledge: this adapter was trained on cybersecurity theory including offensive techniques for pedagogy. It does not authorize illegal activity.
No operational warranty: do not rely on model outputs for incident response, compliance, or live security decisions without independent verification against authoritative sources (CISA, MITRE, vendor advisories).
Base model license: NVIDIA Open Model License restrictions apply to the base weights and derived adapter use.

Files

File	Description
`adapters.safetensors`	Final LoRA weights (iteration 1000)
`adapter_config.json`	Training configuration used by `mlx-lm`
`LICENSE`	Educational / Research / Personal Use terms for this adapter release

Load example (MLX)

python

from mlx_lm import load, generate

model, tokenizer = load(
    "mlx-community/Nemotron-3-Super-120B-A12B-MLX-6bit",
    adapter_path="True2456/nemotron-3-super-120b-cybersecurity-theory-lora-mlx",
)

prompt = "Explain Kerberos unconstrained delegation and why it is dangerous in Active Directory."
text = tokenizer.apply_chat_template(
    [{"role": "user", "content": prompt}],
    tokenize=False,
    add_generation_prompt=True,
)
print(generate(model, tokenizer, prompt=text, max_tokens=512))

CLI:

bash

python -m mlx_lm generate \
  --model mlx-community/Nemotron-3-Super-120B-A12B-MLX-6bit \
  --adapter-path True2456/nemotron-3-super-120b-cybersecurity-theory-lora-mlx \
  --prompt "Summarize how SAM hive secrets are used post-compromise."

Citation

bibtex

@misc{true2456_nemotron_cybersecurity_theory_lora,
  author       = {True2456},
  title        = {Nemotron 3 Super 120B Cybersecurity Theory LoRA (MLX)},
  year         = {2026},
  howpublished = {Hugging Face model},
  note         = {Trained on cybersecurity-theory-sft-gemma12b; base: NVIDIA Nemotron 3 Super}
}

License

Base model: NVIDIA Open Model License (see metadata link). This adapter release additionally carries Educational / Research / Personal Use Only terms in LICENSE. Training data upstream licenses apply when using or redistributing the dataset separately.