Primus (arXiv:2502.11191, first submitted Feb 16 2025, v3 Oct 3 2025, accepted to EMNLP 2025; Trend Micro AI lab — Yao-Ching Yu, Tsun-Han Chiang et al.) is the research artifact: a suite of open cybersecurity-training datasets (pretraining corpora, instruction data, reasoning-distillation data) plus the models trained on them. Cybertron is the product skin: announced Feb 25, 2025 as "the industry's first proactive cybersecurity AI" / first specialized cybersecurity LLM, integrated into Trend Vision One; open-sourced Mar 19, 2025; extended to "sovereign AI factories" on NVIDIA Universal LLM NIM microservices (Jun 11, 2025) so nations/enterprises can run it on-prem. A small agent tier exists on GitHub (cloud-risk-assessment-agent).
Everything ships on HuggingFace under the trend-cybertron org: 5 models (Llama-Primus-Base/Merged/Reasoning 8B, Mar 2025; Llama-Primus-Nemotron-70B Base/Instruct, Aug 2025 — [MIT] license) and 5 datasets ([ODC-BY]). The flagship corpus Primus-Nemotron-CC — ~7.63B tokens of cybersecurity text filtered out of Nemotron-CC, 11.4M rows — is the only gated repo (auto-gate: HF login + click-through). Traction is modest for an incumbent: the top model shows 178 downloads; datasets in the tens.
Per the v3 HTML, three corpora of increasing scale:
Shared machinery: dom-to-semantic-markdown conversion → KenLM 5-gram perplexity filtering per source → MinHash fuzzy dedup, FineWeb-style (5-grams, 112 hash functions, 14 buckets × 8 hashes, ~75% similarity target) → C4 quality rules → heuristic rules → LLM rewriting/augmentation (GPT-4o, Llama-3.1-405B, DBRX; Cosmopedia-inspired blog/textbook/Q&A styles). Primus-Instruct is where the judge matters: GPT-4o generated 2,239 candidates, Claude 3.5 Sonnet scored helpfulness, keeping top-100/task with score ≥ 8 → 835 samples. Ablation: filtered 835 beat raw 2,239 (cyber agg. 2.63 vs 2.44; MT-Bench 8.29 vs 7.97) — more data was worse than judge-curated less. Judge reliability was validated against human experts (Claude MAE 0.8, GPT-4o 0.86). Primus-Reasoning: ~2k accepted samples distilled from o1-preview + DeepSeek-R1.
| Model / step | Metric | Before → After |
|---|---|---|
| Llama-3.1-8B + Seed CPT | cyber agg. (5-shot) | 2.29 → 2.34 (+2.1%) |
| + FineWeb CPT | cyber agg. | → 2.56 (+11.5%) |
| + combined CPT (Llama-Primus-Base) | cyber agg. | → 2.66 (+15.9%) |
| DARE-TIES merge w/ Instruct (0.75:0.25) | agg. / MT-Bench | 4.11 → 4.33 (+5.4%) / 8.29 |
| Llama-3.1-Nemotron-70B + 7.6B tokens | agg. | 3.06 → 3.40 (+11.2%) |
| Merged + reasoning distill | CISSP cert. | 0.7073 → 0.8193 (+15.8%) — beats o1-preview (0.8035) at ~1.5k avg tokens |
CTI-Bench sub-results (8B, combined CPT): CTI-MCQ 0.642→0.668, CTI-RCM 0.591→0.678, CTI-VSP MAD 1.271→1.091 (lower better), CTI-ATE F1 0.272→0.314. CyberMetric barely moves (0.856→0.866), SecEval flat (0.497→0.501) — the gains concentrate in CTI-style tasks, exactly what the corpus optimizes for. Calibration improves (ECE 7.45%→3.34%). Decontamination is done properly: 13-gram overlap check vs CISSP found zero. The honest wart: Garak safety regressed — dan jailbreak 29→41.7%, malwaregen 14→29%, snowball hallucination 60→84%. Security CPT makes models both more useful and less safe, and they published it.
Trend Micro is the only tier-1 vendor that responded to "LLMs are bad at security" by open-sourcing the training data — a shovels move aimed at the sovereign-AI/enterprise market (NVIDIA NIM, Vision One) rather than the research leaderboard. The moat isn't the corpus (it's ours now); it's 35 years of CTI feed, enterprise distribution, and the agent loop inside Vision One. The open artifacts look like a talent-brand play (EMNLP 2025) plus an ecosystem wedge: if the world's security LLMs are trained on Trend-filtered data, Trend's internal versions of that data stay a step ahead.
Take: all five datasets go on the acquisition list — free under ODC-BY, the only cost is the Nemotron-CC click-through. Primus-Seed + FineWeb are a ready-made CPT stage for our Qwen-class student (expect CTI-flavored gains, ~11-16%-ish aggregate movement at 8B per their ablations — diminishing beyond a few B tokens). Copy the TinyBERT relevance-classifier training recipe (curated-positive : web-negative at 10:1) for our own crawl; copy judge-filtered instruct (835 > 2,239 is the number to remember when tempted to keep everything); copy DARE-TIES merging; copy 13-gram decontamination. Avoid: their eval diet (MCQ benchmarks can't see agentic ability — our differential-oracle evals are the point); perplexity filtering on red-team text; 70B flagship theater; any assumption the login-gated corpus is stable for CI (mirror it). Differentiate: they sell knowing-CTI to enterprises; we train doing-agents for operators — their corpus is an ingredient, not a competitor. Watch the Garak regression line: security CPT measurably degrades refusal behavior, so bake safety evals into our SFT loop from day one.
Primary sources: arXiv abs · v3 HTML · HF org · Cybertron launch · open-source PR · NVIDIA NIM
See also: [[cybersoceval-crowdstrike-meta]] · [[cyberfactory-openaegis]] · [[landscape-2026]] · [[uk-aisi-open-weights-cyber]]