Qwensploit 3.5 9B: Cybersecurity and Red Team

Qwensploit is a cybersecurity-focused fine-tune of a Qwen3.5-9B model merge, designed for security reasoning, vulnerability analysis, secure coding, red-team knowledge, and technical question answering.

The model was fine-tuned using LoRA on 7,000 training examples drawn from four datasets, with an additional 350 evaluation examples.

Base model: xtools-at/Qwen3.5-9B-Claude-3xMerge-UNCENSORED-heretic
Method: Supervised fine-tuning (LoRA)
License metadata: Apache-2.0, subject to upstream license compatibility review
All Qwensploit models:

Intended use

Designed to assist with:

Cybersecurity research and technical question answering.
Vulnerability analysis and secure code review.
Defensive security, threat modeling, and incident analysis.
Authorized penetration testing and red-team exercises.
CTF challenges, security education, and programming assistance.

Outputs may be incorrect or unsafe. Validate generated code and recommendations, and use offensive-security capabilities only in authorized environments.

Training datasets

The training mixture was randomly selected and shuffled, with a maximum entry length of 8,000.

Dataset	Entries	Share
CyberSec-Reasoning-Premium	2,305	33%
RedTeam-Premium	2,385	34%
Claude Mythos Distilled 25K — Clean	1,385	20%
Qwen3.8-Max Distillation 50K — Clean	925	13%
Total	7,000	100%

The mixture combines cybersecurity and red-team examples with synthetic reasoning, coding, and general instruction-following data.

Upstream dataset sources

The datasets are primarily built from the following second-level sources:

CyberSec-Reasoning-Premium: Cybersecurity Reasoning Dataset, among other sources.
RedTeam-Premium: Ultimate Offensive Red Team.
Claude Mythos Distilled: WithinUsAI/claude_mythos_distilled_25k.
Qwen distillation: r0b0tlab/qwen3.8-max-distillation-50k.

Consult all linked cards for full source provenance, dataset construction details, and licensing terms.

Base model lineage

The direct base model is xtools-at/Qwen3.5-9B-Claude-3xMerge-UNCENSORED-heretic.

The related Claude 3xMerge model is a merge combining reasoning distillation, coding, and reasoning fine-tunes distilled from Claude Mythos, Fable and Opus. The underlying model family is Qwen3.5-9B.

Training configuration

Parameter	Value
Epochs	1
Training entries	7,000
Evaluation entries	350
Context length	8,192
Learning rate	2e-4
Batch size	4x8
LoRA rank (`r`)	16
LoRA alpha	32
LoRA dropout	0.02
LoRA traget modules	all
Optimizer	AdamW 8-bit
LR scheduler	Linear
Weight decay	0.002
GPU	NVIDIA A100 40 GB

Training results

Reported final metrics:

Metric	Value
Training loss	0.476
Evaluation loss	0.481

Loss tracking by training step

Metric \ Step	Step 40	Step 80	Step 120	Step 160	Step 219
Training loss	0.708	0.654	0.574	0.512	0.476
Evaluation loss	0.676	0.569	0.522	0.496	0.481

Loss is a training diagnostic, not a direct measure of cybersecurity accuracy or safety. Independent benchmarks are needed to assess performance.

Limitations and safety

May generate inaccurate explanations, insecure code, or outdated security advice.
Synthetic distillation data may contain teacher-model errors.
Performance on real-world security tasks has not been independently established.
Use only on systems for which testing is explicitly authorized.
Review generated commands, code, and recommendations before use.

Licensing

Although this model's is licensed under Apache-2.0, upstream licensing must be reviewed before redistribution or commercial use. In particular, the Qwen distillation dataset documents inherited restrictions that may affect downstream use. Review the base-model and dataset cards and for license information if necessary.

References

Base model

Training datasets

Second-level dataset sources

xtools-at/Qwen3.5-9B-Qwensploit-CyberSecurity