nemotron-3-super-120b-a12b-theory-lora-mlx

Nemotron 3 Super 120B-A12B — Cybersecurity Theory LoRA (MLX)

LoRA adapter for NVIDIA Nemotron 3 Super (120B total / ~12B active) trained for cybersecurity domain knowledge: offensive methodology, defensive concepts, CTF reasoning, vulnerability catalogs, and security tooling literacy.

This is the Stage-1 theory specialist from the Mati MultiLoRA coordinator stack. It is intended for instruction-following and explanation on cybersecurity topics, not for tool-calling agent harnesses.

Compatibility

Load with the matching Nemotron 3 Super MLX checkpoint (prefer a 6-bit MLX build consistent with training). Adapters are not guaranteed to transfer cleanly across different quantization levels of the same base.

Training summary

Hardware context for this run: Apple Silicon unified memory (MLX Metal).

Training data

Supervised fine-tuning on 21,265 prompt / completion pairs from the Mati theory_gemma12b specialist pack (theory_steps.jsonl), built for cybersecurity conceptual coverage (no agent tool traces).

Composition (by source)

RedSage subset breakdown (within the 14,846): general 6,924; framework 3,715; skills 2,490; Kali 1,023; CLI 694.

Validation during training used a 389-row valid.jsonl held out for mlx-lm eval (val_batches: 25, steps_per_eval: 200).

Pack construction notes (from the theory build manifest): max output length capped near 6,000 characters per completion during curation; CTFtime and KEV intake capped (2,500 / 800) to keep the mix balanced.

Intended use

• Cybersecurity explanation and mentoring
• Attack-path / CTF concept walkthroughs
• Vulnerability and tooling literacy (KEV, common utilities)
• Domain grounding for a larger multi-adapter stack (theory expert before agentic / code-as-action stages)

Out of scope / limitations

• Not trained as a tool-using coding agent (no Cursor / OpenHands trajectories in this adapter).
• Training rows are SFT prompt/completion pairs from a pack originally assembled for Gemma chat formatting; applied here as raw text targets under mlx-lm.
• Does not authorize illegal activity. Outputs can be inaccurate; verify against authoritative sources before operational use.
• LoRA is a narrow adapter: base model capabilities outside the fine-tune distribution still dominate.

Files

Load example (MLX)

from mlx_lm import load, generate

model, tokenizer = load(
    "mlx-community/Nemotron-3-Super-120B-A12B-MLX-6bit",  # or equivalent MLX Nemotron 3 Super build
    adapter_path="True2456/nemotron-3-super-120b-a12b-theory-lora-mlx",
)

prompt = "Explain Kerberos unconstrained delegation and why it is dangerous in Active Directory."
text = tokenizer.apply_chat_template(
    [{"role": "user", "content": prompt}],
    tokenize=False,
    add_generation_prompt=True,
)
print(generate(model, tokenizer, prompt=text, max_tokens=512))

CLI:

python -m mlx_lm generate \
  --model mlx-community/Nemotron-3-Super-120B-A12B-MLX-6bit \
  --adapter-path True2456/nemotron-3-super-120b-a12b-theory-lora-mlx \
  --prompt "Summarize how SAM hive secrets are used post-compromise."

License

Base model: NVIDIA Open Model License (see link in metadata). This adapter inherits that license's restrictions for derived works. Training data mixes public cybersecurity corpora (including CTF writeups and CISA KEV); respect upstream licenses and ToS when redistributing datasets separately.

Citation

If you use this adapter, please also cite NVIDIA Nemotron 3 Super and the upstream theory sources (RedSage, Primus, CTFtime, CISA KEV) as applicable.