Titus-CybersecurityLLM-v1.0 MLX 4-bit

This repository contains the MLX 4-bit Apple Silicon variant of AlicanKiraz0/Titus-CybersecurityLLM-v1.0, a Turkish-first cybersecurity assistant fine-tuned from Qwen/Qwen3.6-35B-A3B.

The source model was trained on a 500K+ row cybersecurity instruction dataset built from a multi-dimensional security taxonomy, with an approximately 4B-parameter LoRA adaptation surface, then merged and converted for efficient local inference.

Variant Details

Variant: MLX 4-bit
Source model: AlicanKiraz0/Titus-CybersecurityLLM-v1.0
Base model: Qwen/Qwen3.6-35B-A3B
Architecture: qwen3_5_moe
Target runtime: Apple Silicon with MLX
Primary language: Turkish cybersecurity assistance

Intended Use

Use this variant for local Apple Silicon workflows such as:

SOC triage assistance
DFIR checklists and investigation notes
Detection engineering support
Cloud, Kubernetes, IAM, endpoint, and AppSec reviews
GRC and control-mapping drafts
Authorized lab, CTF, purple-team, and defensive validation tasks

Dataset Taxonomy Summary

The source model was fine-tuned with a structured cybersecurity taxonomy covering:

Security architecture, Zero Trust, hardening, and risk terminology
Network, web, API, IAM, endpoint, cloud, Kubernetes, and DevSecOps security
SOC, SIEM, detection engineering, SOAR, alert tuning, and telemetry gap analysis
Incident response, DFIR, malware analysis, threat intelligence, and threat hunting
Vulnerability management, offensive security in authorized settings, GRC, OT/ICS, mobile, AI/LLM security, and resilience

The dataset taxonomy combines:

Domains and subdomains
Task families: triage, artifact analysis, detection authoring, root cause analysis, remediation planning, executive summaries
Artifacts: logs, EDR telemetry, SIEM alerts, IAM policies, K8s manifests, code/config snippets, email headers, CVE records, forensic excerpts
Difficulty levels: L1 through L5, from fundamentals to expert strategic reasoning
Safety labels: defensive, bounded dual-use, CTF/lab-only, and restricted/excluded

Example Usage

Install MLX tooling:

pip install -U mlx-lm

Generate:

mlx_lm.generate \
  --model AlicanKiraz0/Titus-CybersecurityLLM-v1.0-mlx-4Bit \
  --prompt "Windows hostta LSASS erişimi şüphesini doğrulamak için hangi telemetry alanlarına bakarsın?" \
  --max-tokens 512 \
  --temp 0

Notes

This is a quantized convenience build for Apple Silicon inference.
For maximum fidelity, use the BF16 merged safetensors model: AlicanKiraz0/Titus-CybersecurityLLM-v1.0.
For CPU/GPU llama.cpp-style workflows, use the GGUF variant: AlicanKiraz0/Titus-CybersecurityLLM-v1.0-Q4_0-GGUF.

Safety

This model is intended for authorized cybersecurity work. Use offensive or dual-use outputs only in controlled, legal, and explicitly authorized lab, CTF, red-team, purple-team, or detection validation contexts.