Titus-CybersecurityLLM-v1.0 MLX 4-bit

This repository contains the MLX 4-bit Apple Silicon variant of AlicanKiraz0/Titus-CybersecurityLLM-v1.0, a Turkish-first cybersecurity assistant fine-tuned from Qwen/Qwen3.6-35B-A3B.

The source model was trained on a 500K+ row cybersecurity instruction dataset built from a multi-dimensional security taxonomy, with an approximately 4B-parameter LoRA adaptation surface, then merged and converted for efficient local inference.

Variant Details

• Variant: MLX 4-bit
• Source model: AlicanKiraz0/Titus-CybersecurityLLM-v1.0
• Base model: Qwen/Qwen3.6-35B-A3B
• Architecture: qwen3_5_moe
• Target runtime: Apple Silicon with MLX
• Primary language: Turkish cybersecurity assistance

Intended Use

Use this variant for local Apple Silicon workflows such as:

• SOC triage assistance
• DFIR checklists and investigation notes
• Detection engineering support
• Cloud, Kubernetes, IAM, endpoint, and AppSec reviews
• GRC and control-mapping drafts
• Authorized lab, CTF, purple-team, and defensive validation tasks

Dataset Taxonomy Summary

The source model was fine-tuned with a structured cybersecurity taxonomy covering:

• Security architecture, Zero Trust, hardening, and risk terminology
• Network, web, API, IAM, endpoint, cloud, Kubernetes, and DevSecOps security
• SOC, SIEM, detection engineering, SOAR, alert tuning, and telemetry gap analysis
• Incident response, DFIR, malware analysis, threat intelligence, and threat hunting
• Vulnerability management, offensive security in authorized settings, GRC, OT/ICS, mobile, AI/LLM security, and resilience

The dataset taxonomy combines:

• Domains and subdomains
• Task families: triage, artifact analysis, detection authoring, root cause analysis, remediation planning, executive summaries
• Artifacts: logs, EDR telemetry, SIEM alerts, IAM policies, K8s manifests, code/config snippets, email headers, CVE records, forensic excerpts
• Difficulty levels: L1 through L5, from fundamentals to expert strategic reasoning
• Safety labels: defensive, bounded dual-use, CTF/lab-only, and restricted/excluded

Example Usage

Install MLX tooling:

pip install -U mlx-lm

Generate:

mlx_lm.generate \
  --model AlicanKiraz0/Titus-CybersecurityLLM-v1.0-mlx-4Bit \
  --prompt "Windows hostta LSASS erişimi şüphesini doğrulamak için hangi telemetry alanlarına bakarsın?" \
  --max-tokens 512 \
  --temp 0

Notes

• This is a quantized convenience build for Apple Silicon inference.
• For maximum fidelity, use the BF16 merged safetensors model: AlicanKiraz0/Titus-CybersecurityLLM-v1.0.
• For CPU/GPU llama.cpp-style workflows, use the GGUF variant: AlicanKiraz0/Titus-CybersecurityLLM-v1.0-Q4_0-GGUF.

Safety

This model is intended for authorized cybersecurity work. Use offensive or dual-use outputs only in controlled, legal, and explicitly authorized lab, CTF, red-team, purple-team, or detection validation contexts.