LOREA-cyber-coder-30B-A3B-v3

A cybersecurity / reverse-engineering specialization of Qwen3-Coder-30B-A3B-Instruct (4-bit, MLX), tuned to act as an ethical, tool-using security assistant inside an agentic CLI. It is a mixture-of-experts model (~30B total parameters, ~3B active per token) and runs locally on Apple Silicon through mlx-lm.

This is the model that drives LOREA-cyber in the OCLI terminal assistant.

What it is tuned for

• Authorized red-team / pentest assistance — probing web targets, reasoning about findings, and reporting them honestly (it is trained to ground claims in actual tool output rather than fabricating success).
• Reverse engineering — reading disassembly and reconstructing C, explaining what code does.
• Security analysis — spotting vulnerabilities (SQLi, command injection, IDOR, path traversal, etc.) and pairing each finding with remediation.
• Agentic tool use — emitting tool calls and, importantly, not looping on empty or repeated tool results (a behavior explicitly trained in).

It is trained to confirm authorization first, pair offense with detection + remediation, and refuse and redirect requests for unauthorized attacks, malware, or harm.

Training

Continued LoRA fine-tune over the 4-bit base, then fused. The data mix:

• Decontaminated cybersecurity multiple-choice knowledge (formatted as raw completions to match how MMLU is actually scored — training them as chat turns caused negative transfer and was corrected).
• Multi-turn agentic / tool-use traces, including anti-loop behavior on empty results.
• Reverse-engineering examples (disassembly to C, vulnerability explanation).
• Behavioral data for ethical refusal and authorization-first reasoning.

Benchmarks (MMLU, log-prob scoring, raw-completion format)

Subset	Base (Qwen3-Coder-30B-A3B-4bit)	LOREA-cyber v3
computer_security	80.0	~78
security_studies	71.4	~73.9

Knowledge-wise it is roughly on par with the base on these subsets (ahead on security_studies, marginally behind on computer_security). The practical gains over base are behavioral: grounded, anti-loop agentic tool use for security workflows. Numbers are honest, not cherry-picked — this is a small local model, not a frontier system.

Usage (mlx-lm)

from mlx_lm import load, generate

model, tok = load("Soaperloafidksum/LOREA-cyber-coder-30B-A3B-v3")
messages = [
    {"role": "system", "content": "You are LOREA-cyber, an ethical red-team assistant. "
     "Confirm authorization, pair offense with remediation, and refuse unauthorized harm."},
    {"role": "user", "content": "Explain how a UNION-based SQL injection exfiltrates data."},
]
prompt = tok.apply_chat_template(messages, add_generation_prompt=True, tokenize=False)
print(generate(model, tok, prompt=prompt, max_tokens=400, verbose=True))

Serve it for an OpenAI-compatible client:

python3 -m mlx_lm.server --model Soaperloafidksum/LOREA-cyber-coder-30B-A3B-v3

In OCLI, just run /download (it pulls this repo by default) and start prompting.

Recommended sampling

Greedy decoding makes small models repeat; use light sampling: temperature=0.5, top_p=0.95, repetition_penalty=1.1.

Intended use and limitations

For authorized, lawful security testing, CTF practice, reverse-engineering study, and security education only. Do not use it to attack systems you do not own or have written permission to test.

Limitations: it is a 4-bit quantized 30B model, so it can hallucinate, its tool-call formatting is not always perfect, and it is far weaker than frontier models. Verify anything important. Inherits the license and any use restrictions of the base model.