privesc-llm

KO | EN

gitlite — search

#ai-agent #kotlin #security #large-language-models #redis #android #dotnet #ai-agents #html #cloud-native

(★ 9)

Post-training local LLM agents for Linux privilege escalation using SFT and RL with verifiable rewards.

File Explorer

ZIP Download

- - openai.yaml
- - default.yaml
  - holdout.yaml
  - training.yaml
- - default.yaml
  - packages.yaml
- - default.yaml
  - evaluation.yaml
  - evaluation_budget.yaml
  - evaluation_minimal.yaml
  - trace_collection_guided.yaml
  - trace_collection_unguided.yaml
- - no_reasoning.yaml
  - short_reasoning.yaml
- - default.yaml
- - default.yaml
- - base.yaml
  - eval_benchmark.yaml
  - eval_procedural.yaml
  - paper_benchmark.yaml
  - paper_procedural.yaml
  - paper_protocol.yaml
  - trace_collection_training.yaml
  - trace_collection_validation.yaml
- - 01_vuln_suid_gtfo.yaml
  - 02_vuln_password_in_shell_history.yaml
  - 03_vuln_sudo_no_password.yaml
  - 05_vuln_sudo_gtfo.yaml
  - 06_vuln_docker.yaml
  - 07_root_password_reuse_mysql.yaml
  - 08_root_password_reuse.yaml
  - 09_root_password_root.yaml
  - 10_root_allows_lowpriv_to_ssh.yaml
  - 11_cron_calling_user_wildcard.yaml
  - 12_cron_calling_user_file.yaml
  - 13_file_with_root_password.yaml
  - default.yaml
- - default.yaml
  - qwen3_4b.yaml
- - env.yaml
- config.yaml
- - build.sh
  - Dockerfile
  - packages.txt
  - procedural.def
- CHAINREACTOR_STATIC_BASELINE_RUNBOOK.md
- DATASET_CARD.md
- EVAL_PROTOCOL.md
- PAPER_REPRODUCTION_RUNBOOK.md
- PROCEDURAL_SCENARIOS.md
- TOKEN_COST.md
- TRAINING_COST.md
- rl_failure_docker_trace.txt
- rl_success_cron_file_trace.txt
- rl_success_cron_wildcard_trace.txt
- rl_success_mysql_password_reuse_trace.txt
- rl_success_password_history_trace.txt
- rl_success_root_password_file_trace.txt
- rl_success_root_password_reuse_trace.txt
- rl_success_root_password_root_trace.txt
- rl_success_root_ssh_trace.txt
- rl_success_sudo_gtfo_trace.txt
- rl_success_sudo_no_password_trace.txt
- rl_success_suid_gtfo_trace.txt
- .powerlifted-src
- benchmark-privesc-linux
- chainreactor
- GTFOBins
- prime-rl
- benchmark-privesc-linux-source-delta.patch
- chainreactor-local-docker-ssh-port.patch
- vllm-gemma4-bnb-k-eq-v.patch
- - aggregate_eval.py
  - path_helpers.sh
  - plot_reward_design.py
  - regenerate_outputs_index.py
  - replay_trace_token_price_bench.py
  - write_run_manifest.py
- apply_benchmark_patch.sh
- apply_chainreactor_local_docker_patch.sh
- apply_prime_rl_sft_patch.sh
- build_powerlifted.sh
- collect_and_assemble.sh
- collect_and_assemble_base.sh
- derive_sft_reasoning.sh
- patch_vllm_gemma4_bnb.py
- run_model_eval_vllm.sh
- run_paper_static_baseline_llms.sh
- - __init__.py
- - analyze.py
  - chainreactor_baseline.py
  - exploit_baseline.py
- - __init__.py
  - base.py
  - capabilities_gtfobins.py
  - credential_artifact.py
  - cron_wildcard.py
  - cron_writable_script.py
  - extract_gtfobins.py
  - factory.py
  - holdout_manifest.py
  - password_reuse.py
  - profile_audit.py
  - ssh_key_reuse.py
  - sudo_gtfobins.py
  - suid_gtfobins.py
  - weak_password.py
- - agent.py
  - context.py
  - prompts.py
  - scenario.py
  - tools.py
- - __init__.py
  - qwen3.py
  - tool_calls.py
- - privilege_escalation.jinja
  - privilege_escalation_budget.jinja
  - privilege_escalation_minimal.jinja
  - short_reasoning_rewrite.jinja
  - trace_collection.jinja
- - __init__.py
  - benchmark.py
- - __init__.py
  - __main__.py
  - live_trace_quality.py
  - multi.py
  - result_policy.py
  - schedule.py
  - single.py
- - __init__.py
  - procedural.py
  - static.py
  - types.py
- - __init__.py
  - chat_template.py
  - traces.py
- - __init__.py
  - agent_panels.py
  - console.py
  - dashboard.py
  - formatting.py
  - state.py
- - __init__.py
  - docker_cleanup.py
  - langchain.py
  - pricing.py
  - retry.py
  - root_detection.py
  - solution.py
- - __init__.py
  - privesc.py
  - reward.py
- __init__.py
- config.py
- paths.py
- - __init__.py
  - test_chainreactor_baseline.py
- - __init__.py
  - test_prime_rl_env_args.py
  - test_prime_rl_train_config.py
  - test_verifiers_privesc_env.py
  - test_verifiers_privesc_env_integration.py
- - __init__.py
  - test_generators_base.py
  - test_holdout_leakage.py
  - test_live_solution_guidance_local_docker.py
  - test_procedural_capabilities_gtfobins.py
  - test_procedural_container.py
  - test_procedural_credential_artifact.py
  - test_procedural_cron.py
  - test_procedural_password_reuse.py
  - test_procedural_source.py
  - test_procedural_ssh_key_reuse.py
  - test_procedural_sudo.py
  - test_procedural_suid.py
  - test_procedural_usernames.py
  - test_procedural_weak_password.py
- - __init__.py
  - test_runner_schedule.py
  - test_runner_single_error_trace.py
- - __init__.py
  - test_audit_bundle.py
  - test_chat_template.py
  - test_chat_template_tool_instructions.py
  - test_collection_stats.py
  - test_sft_collision_filter.py
  - test_sft_quality_filter.py
  - test_sft_reasoning_variants.py
  - test_sft_subsample.py
- - chat_0.txt
  - chat_1.txt
  - chat_2.txt
  - chat_3.txt
  - chat_4.txt
  - chat_5.txt
  - trace_0.json
  - trace_1.json
  - trace_2.json
  - trace_3.json
  - trace_4.json
  - trace_5.json
- - __init__.py
  - test_multi_runner_logging.py
- __init__.py
- solution_utils.py
- test_agent_context_trim.py
- test_agent_usage_accounting.py
- test_deepseek_langchain.py
- test_docker_cleanup.py
- test_evaluation_analyze_metrics.py
- test_extract_gtfobins.py
- test_host_ssh_pool.py
- test_langgraph_invalid_tool_feedback.py
- test_live_generator_mix.py
- test_parsers_qwen3.py
- test_paths.py
- test_reward_calculation.py
- test_reward_experiment_configs.py
- test_rl_langgraph_alignment.py
- test_root_detection.py
- test_scenario_backends.py
- test_solutions.py
- test_token_counter.py
- test_tool_prompt_format.py
.env.example
.gitignore
.gitmodules
.python-version
LICENSE
pyproject.toml
README.md
uv.lock

# Use via CDN

jsDelivr

jsDelivr serves any public GitHub repository as a CDN with zero setup. Pick a version and a file to get a ready-to-paste link and snippet.

Version

File

Link

Example

# Project Badges

arXiv Visit

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

> Post-training local LLM agents for Linux privilege escalation using SFT and RL with verifiable rewards.

## Public Release

This repository contains the public source code for PrivEsc-LLM and tracks the artifacts for the current preprint, [arXiv:2603.17673](https://arxiv.org/abs/2603.17673).
Runtime outputs are released separately as organized HuggingFace artifacts:

- [`sailab-vienna/privesc-llm-data`](https://huggingface.co/datasets/sailab-vienna/privesc-llm-data): paper SFT dataset, leakage audit, and examples
- [`sailab-vienna/privesc-llm-4b`](https://huggingface.co/sailab-vienna/privesc-llm-4b): paper SFT and final RL LoRA adapters
- [`sailab-vienna/privesc-llm-evals`](https://huggingface.co/datasets/sailab-vienna/privesc-llm-evals): compact paper evaluation summaries, manifests, and complete headline static benchmark traces

Start with `docs/PAPER_REPRODUCTION_RUNBOOK.md` for the experiment workflow.

## Motivation

Vulnerability assessments involve highly sensitive data: system configurations, credentials, internal network details. Organizations often cannot send this data to external cloud APIs. This repository studies post-training compact local models for verifiable Linux privilege-escalation tasks while keeping deployment-time inference local.

## Paper Pipeline

The paper-facing pipeline trains only on procedural scenarios, reserves the static benchmark for final evaluation, and compares a Qwen3-4B local model ladder against reported API, larger-local, and security-specific baselines under a fixed budgeted protocol. Reproduction details live in `docs/PAPER_REPRODUCTION_RUNBOOK.md`.

## Overview

- **Benchmark**: [Linux PrivEsc benchmark](https://github.com/ipa-lab/benchmark-privesc-linux) scenarios in isolated containers
- **Procedural Training**: 10 generators producing unlimited training scenarios with holdout design
- **Agent**: ReAct loop with two tools (`exec_command` and `test_credentials`)
- **Training**: SFT on procedural traces, then RL with Prime-RL

## Repository Layout

```
src/
├── gym/           # Agent loop, scenario runner, tools
├── generators/    # Procedural scenario generators
├── scenarios/     # Static/procedural scenario sources
├── rl/            # RL training and reward code
└── sft/           # SFT training pipelines

conf/
├── scenarios/     # Static benchmark scenario configs
├── generators/    # Procedural generator configs
├── experiment/    # Experiment presets
└── runner/        # Runner configurations

docs/              # Project documentation
```

## Quickstart

### Setup

General repo setup (works on macOS and Linux for docs, configs, and non-training development):

```bash
git submodule update --init --recursive
uv sync --frozen --group dev
source .venv/bin/activate
```

Training and local-model inference dependencies are Linux-oriented. Install them only on a supported Linux machine or cluster node:

```bash
uv sync --frozen --group sft --group dev
```

### Environment

```bash
cp .env.example .env
# Edit with your API keys and SSH settings
source .env
```

Required variables:
- `OPENAI_API_KEY`, `OPENAI_API_BASE` for API model evaluations
- `WANDB_API_KEY`, `WANDB_ENTITY`, `WANDB_PROJECT` for experiment tracking
- `PRIVESC_SSH_SERVERS`, `PRIVESC_USER`, `PRIVESC_KEY` for SSH connection to remote Docker hosts

For fully local Docker runs, prefer `scenario.backend=local_docker` and `rl.prime_rl.scenario_backend=local_docker`; in that mode the `PRIVESC_*` variables are optional.

### Full Paper Pipeline

See `docs/PAPER_REPRODUCTION_RUNBOOK.md` for the end-to-end reproducible pipeline, including:

- submodule/bootstrap steps
- benchmark Docker image build
- procedural trace collection
- SFT dataset assembly
- SFT training
- Prime-RL warm start from the produced SFT adapter
- static benchmark evaluation for base, SFT, and RL models

The full paper pipeline requires Linux for the local-model stages, and in practice CUDA-capable Linux for SFT, Prime-RL, and vLLM-backed local evaluation.

### Evaluate on Static Benchmark

```bash
# Single scenario (1 run)
source .env && uv run python -m src.runner \
  +experiment=eval/benchmark \
  scenario.backend=local_docker \
  agent.model=openai/gpt-5.2 \
  runner.source.scenarios='[01_vuln_suid_gtfo]' \
  runner.runs_per_item=1

# Configured static benchmark
source .env && uv run python -m src.runner \
  +experiment=eval/benchmark \
  scenario.backend=local_docker \
  agent.model=openai/gpt-5.2
```

### Evaluate on Procedural Scenarios

```bash
source .env && uv run python -m src.runner \
  +experiment=eval/paper_procedural \
  scenario.backend=local_docker \
  agent.model=openai/gpt-5.2 \
  runner.max_runs=10
```

### RL Training

```bash
# Full reproducible paper pipeline is documented in docs/PAPER_REPRODUCTION_RUNBOOK.md

# Minimal local SFT
source .env && uv run --group sft python -m src.sft.unsloth.train +experiment=train/paper_qwen3_4b_sft

# Minimal local Prime-RL warm start from an SFT adapter
source .env && uv run --group rl python -m src.rl.prime_rl.train \
  +experiment=train/paper_prime_rl_reward_outcome_cost \
  rl.prime_rl.base_model=Qwen/Qwen3-4B-Instruct-2507 \
  rl.prime_rl.init_adapter_path=/absolute/path/to/sft_run/checkpoints/final \
  rl.prime_rl.scenario_backend=local_docker
```

Reward ablation presets reported in the paper are `train/paper_prime_rl_reward_outcome`, `train/paper_prime_rl_reward_outcome_round`, `train/paper_prime_rl_reward_outcome_cost`, and `train/paper_prime_rl_reward_outcome_round_cost`. See [docs/PAPER_REPRODUCTION_RUNBOOK.md](docs/PAPER_REPRODUCTION_RUNBOOK.md) for the paper-facing config map.

## Procedural Generators

Procedural generators provide the training and validation environments while
the static benchmark remains reserved for evaluation. See
[docs/PROCEDURAL_SCENARIOS.md](docs/PROCEDURAL_SCENARIOS.md) for
the generator design and holdout policy.

## Related Work

- **Linux PrivEsc Benchmark** (Happe et al.): [arXiv:2310.11409](https://arxiv.org/abs/2310.11409)
- **InterCode-CTF, CyBench, AutoPenBench**: Broader pentest benchmarks

## Documentation

- [Procedural Scenarios](docs/PROCEDURAL_SCENARIOS.md): generator design and holdout strategy
- [Paper Reproduction Runbook](docs/PAPER_REPRODUCTION_RUNBOOK.md): end-to-end reproducible local-model pipeline

## License

Research code, see LICENSE file.

privesc-llm

File Explorer

# Use via CDN

# Project Badges

Was this content helpful?

Recent Feedback

Download README