Cyber-Zero-32B Cybersecurity LLM

• Cyber-Zero-32B is a state-of-the-art cybersecurity LLM with 32 billion parameters designed for automated CTF challenges.
• It utilizes persona-driven synthetic trajectory generation and supervised fine-tuning on a large CTF writeup corpus to simulate realistic adversarial interactions.
• The model achieves significant Pass@1 improvements with enhanced cost-effectiveness, demonstrating practical deployability in security operations.

Cyber-Zero-32B is a state-of-the-art, 32-billion-parameter LLM designed as a cybersecurity agent, optimized for automated Capture The Flag (CTF) and related adversarial security tasks. Built via supervised fine-tuning of Qwen3-32B on synthetic interaction trajectories generated by the Cyber-Zero runtime-free framework, Cyber-Zero-32B demonstrates empirical performance matching proprietary models on key CTF benchmarks, while remaining open-weight and exhibiting superior cost-effectiveness. Its development establishes the feasibility of using persona-driven, high-fidelity synthetic data for cybersecurity LLM agent training without access to runtime challenge environments (Zhuo et al., 29 Jul 2025).

1. Model Architecture

Cyber-Zero-32B is grounded on the Qwen3-32B transformer architecture without modification to attention, embedding, or normalization components. Key specifications:

• Parameter count: ~32 billion
• Layers: 60 transformer blocks
• Hidden dimension: $H=12,\!288$
• Attention heads per layer: $A=96$
• Intermediate MLP dimension: $4 \cdot H = 49,\!152$
• Rotary position embeddings
• RMS normalization

Supervised fine-tuning is the sole adaptation; all core architectural elements remain unchanged from the Qwen3-32B base (Zhuo et al., 29 Jul 2025).

2. Data Corpus and Synthetic Trajectory Generation Pipeline

CTF Writeup Corpus

Training leverages a curated corpus of 6,188 high-quality CTF writeups spanning 4,610 unique challenges from 543 CTF events (2017–2025), with data sourced from CTFtime and CTF-Archives. Preprocessing involves HTML-to-Markdown conversion, URL removal, minimum length thresholding (writing <1,000 characters discarded), and metadata synthesis plus flag-match consistency filtering using DeepSeek-V3-0324. The resulting corpus spans major categories: Crypto, Forensics, Pwn, Reverse Engineering, Web, Miscellaneous (Zhuo et al., 29 Jul 2025).

Persona-Driven Trajectory Synthesis

Agent–environment interactions are simulated entirely via LLM persona collaboration, bypassing the need for ephemeral or restricted runtime CTF environments. The pipeline uses two personas:

• PlayerModel: Emulates an expert CTF solver, engaged in multi-step logical reasoning, realistic exploration, and plausible error generation.
• TerminalModel: Simulates an interactive Bash shell with oracle-level challenge knowledge, producing environment-consistent outputs and minimalistic hints.

Each writeup seeds three synthetic interaction trajectories, capped at 40 turns, and includes logic for flag submission, loop detection (triggering hint injection), and verification. Only verified (flag-correct) trajectories are retained. The simulation pseudocode directly encodes the agent–terminal–state progression and ensures procedural realism and coverage (Zhuo et al., 29 Jul 2025).

3. Training Objectives

The training objective is standard auto-regressive causal language modeling:

$$\mathcal{L}_{LM}(\theta) = -\sum_{t=1}^T \log P_\theta(x_t \mid x_{<t})$$

No auxiliary or domain-specific losses are applied; effectiveness relies on the integrity of synthesized multi-turn, scaffold-compatible, high-fidelity interaction sequences (Zhuo et al., 29 Jul 2025).

4. Empirical Performance and Benchmarking

Performance is assessed on InterCode-CTF, NYU CTF Bench, and Cybench using Pass@1 (greedy decoding, no external tools, EnIGMA+ scaffold, max 40 turns):

Dataset	Zero-Shot (%)	Cyber-Zero-32B (%)	Δ (%)
InterCode-CTF	60.0	82.4	+22.4
NYU CTF	4.7	13.5	+8.8
Cybench	5.0	17.5	+12.5
Average	20.3	33.4	+13.1

Relative to proprietary systems (zero-shot):

• Claude-3.5-Sonnet: 37.2% Pass@1 (≈$22.2 cost)
• DeepSeek-V3-0324: 30.3% (≈$2.81 cost)

Cyber-Zero-32B matches these results in open-weight configuration, establishing the state of the art for publicly available LLMs in this domain (Zhuo et al., 29 Jul 2025).

5. Cost and Deployment Characteristics

• Inference latency: ≈120 ms/token (A100 GPU, batch size 1)
• Token cost (OpenRouter spot, 2025): $0.000018/generation token,$0.000006/context token; full-session (32K tokens) ≈$0.59
• Cost-effectiveness: 33.4% Pass@1 per $0.59 (56.6%/USD), significantly exceeding Claude-3.5-Sonnet (1.7%/USD).

This reduction in per-session cost, with competitive accuracy, underscores the practical deployability and accessibility of Cyber-Zero-32B for time- and resource-constrained security operations (Zhuo et al., 29 Jul 2025).

6. Ablation Studies and Analysis

Detailed ablations and error reduction studies reveal:

• Multi-Turn vs Single-Turn Synthesis (Qwen3-8B): Multi-turn simulation reduces stuck-in-loop behaviors to <11% (from ~74%) and increases Pass@1 to 64.8% (from 25.3%).
• Stuck-In-Loop Reduction (Cyber-Zero-32B): Stuck-in-loop percentages decrease across benchmarks (average 7.4%), with InterCode as low as 1.1%.
• Data Scaling and Diversity: Expanding CTF writeup coverage from 10% to 100% yields monotonic performance improvement (Cyber-Zero-14B, InterCode: 58.2%→73.6%). Increasing the number of synthetic trajectories per task (1→3) produces up to 73% relative uplift in complex scenarios (Zhuo et al., 29 Jul 2025).

7. Limitations and Prospects for Advancement

Current limitations include risk of terminal-side hallucinations, potential divergence from real-world environment dynamics—especially for exotic commands—and the lack of support for dynamic or instrumented challenge feedback beyond Bash and core EnIGMA tools. Prospective improvements include hybridization with sandbox emulation, extension of persona-modeled tooling (e.g., gdb, radare2), and integration of reinforcement signals or self-improvement loops as synthetic trajectory fidelity increases (Zhuo et al., 29 Jul 2025).

Cyber-Zero-32B demonstrates that high-quality, persona-driven synthetic trajectory generation enables the training of open-weight cybersecurity LLM agents that rival proprietary models in accuracy, efficiency, and cost on CTF-style tasks, without the need for real-time access to often-ephemeral challenge environments.