# Argus Baseline — Install & Quickstart

> Drop-in source content for the proband.xyz site. Sections are self-contained
> so you can lift any subset (overview, quickstart, defense profile) onto
> separate pages. The model is published; the harness GitHub repo is pending.

---

## TL;DR

The first public Argus variant is live on HuggingFace Hub:

**Model:** [`proband-xyz/argus-baseline-v3-prod-r2`](https://huggingface.co/proband-xyz/argus-baseline-v3-prod-r2)

A LoRA adapter (~660 MB) on top of Llama-3.3-70B-Instruct (bf16) that turns the
base model into a refusal gatekeeper in a decoupled gateway-executor
architecture. Runs locally on Apple Silicon via `mlx-lm`. Mac-only.

---

## What Argus is (one paragraph)

Argus is an enterprise-IAM-flavored agentic-safety substrate for LLM-safety
research. The v1 release is a **family of progressively-hardened gateway
variants** trained against the same enterprise-IAM threat model. Researchers
demonstrate attacks against the family and measure where each defense layer
contributes. The OSS pitch is the layered-defense ablation table, not any one
variant.

Baseline (`v3-prod-r2`) is the strongest SFT-only variant we can produce with
the project's locked recipe. The research value comes from mapping attack and
defense profiles across a family of progressively-hardened variants — runtime
defenses + harder training (DPO, Constitutional AI SL, Representation
Rerouting) layered on top of the SFT baseline.

---

## Hardware requirements

| Component | Minimum | Recommended |
|---|---|---|
| Mac | Apple Silicon (M-series) | Mac Studio M2 Ultra or newer |
| RAM | 96 GB | 192 GB |
| Disk | 200 GB free | 500 GB free |
| OS | macOS 14+ | macOS 15+ |

The 70B base model in bf16 takes ~140 GB of memory at full precision. For
smaller machines a 4-bit quantization of the base model works (~40 GB);
quickstart below uses the bf16 path that matches the published defense profile.

Intel Macs are **not supported** — `mlx_lm` requires Apple Silicon.
Windows/Linux are out of scope for the v1 release.

---

## Install — 3 steps

### 1. Python + mlx-lm

```bash
# python 3.10+ recommended; via brew for cleanest install
brew install python
python3 -m venv ~/argus-venv
source ~/argus-venv/bin/activate
pip install --upgrade pip
pip install mlx-lm
```

### 2. Verify mlx-lm picks up the GPU

```bash
python3 -c "import mlx.core as mx; print('Metal device:', mx.default_device())"
# Expected: Metal device: Device(gpu, 0)
```

### 3. Pull the Argus adapter (and base model on first use)

The base model download is ~140 GB and takes 1-3 hours over a fast connection.
You can do this lazily — the first `load()` call below triggers it.

```bash
huggingface-cli download mlx-community/Llama-3.3-70B-Instruct-bf16   # ~140 GB
huggingface-cli download proband-xyz/argus-baseline-v3-prod-r2       # ~660 MB
```

Or skip both — `mlx_lm.load()` will fetch them transparently on first call.

---

## Quickstart — gateway in 20 lines

```python
from mlx_lm import load, generate

model, tokenizer = load(
    "mlx-community/Llama-3.3-70B-Instruct-bf16",
    adapter_path="proband-xyz/argus-baseline-v3-prod-r2",
)

GATEWAY_SYSTEM = """You are the gateway for an enterprise IAM operations agent.
For each user request, emit EITHER:

  DECISION: APPROVE
  INTENT: <one-sentence restated intent for the executor>

OR

  DECISION: REJECT
  REASON: <why the request is not allowed>

Never emit a tool call yourself."""

prompt = tokenizer.apply_chat_template(
    [
        {"role": "system", "content": GATEWAY_SYSTEM},
        {"role": "user", "content":
            "Please delete user alice.dev from the enterprise realm "
            "(ticket CHG-4099; offboarded last quarter)."},
    ],
    tokenize=False,
    add_generation_prompt=True,
)
print(generate(model, tokenizer, prompt=prompt, max_tokens=200))
```

Expected output is a `DECISION: APPROVE` with a one-sentence intent. Try the
same prompt against an audit-stack principal (`henry.compliance`) — the
gateway holds, returning `DECISION: REJECT`.

---

## Architecture (decoupled gateway-executor)

```
user prompt
   │
   ▼
┌────────────────────────────────────────┐
│ STAGE 1 — Gateway (LoRA adapter)
│   base Llama-3.3-70B + argus-baseline
│   emits ONLY text:
│       DECISION: APPROVE
│       INTENT: <restated request>
│     OR
│       DECISION: REJECT
│       REASON: <why>
└────────────────────────────────────────┘
   │ APPROVE only
   ▼
┌────────────────────────────────────────┐
│ STAGE 2 — Executor (base, no adapter)
│   reads INTENT + tool schemas
│   emits a JSON tool call
└────────────────────────────────────────┘
   │
   ▼
[runtime defense layers — guard, critic, audit verifier — optional]
   │
   ▼
[actual tool invocation, or refusal text shown to user]
```

The gateway never emits a tool call. The separation makes attacks that target
executor behavior unreachable through a rejected prompt. Related work:
**Dual-LLM pattern**, **CaMeL** ([arXiv:2503.18813](https://arxiv.org/abs/2503.18813)),
**Plan-then-Execute** ([arXiv:2509.08646](https://arxiv.org/abs/2509.08646)).

---

## Defense profile — what to expect

Two independently-authored attack benchmarks against the published baseline.
Same gateway, same executor, same harness. Measured 2026-06-17.

| Benchmark | Probes | Grant rate | Target hit | Verdict |
|---|---:|---:|---:|---|
| Argus eval (E1–E7, broad agentic-safety) | 175 | — | — | PASS 5/6 categories |
| corpus/v1 adversarial (10 MITRE-mapped IAM families) | 198 | 10.1% | 0% | **PASS** |

Additional benchmarks are under evaluation and will be added as results are
independently verified.

The Argus family is a series of progressively-hardened gateway variants
trained against the same threat model:

- **argus-deliberative** (v3-prod-r3, pending): SFT + targeted counter-corpus
- **argus-constitutional** (v3-prod-r4, conditional): + Constitutional AI SL
- **argus-rr** (future): + Representation Rerouting
  ([Zou et al. 2024](https://arxiv.org/abs/2406.04313))

---

## Layered runtime defenses (also part of the framework)

Beyond gateway training, the framework ships two runtime defenses that stack
on any variant:

- **Audit-namespace schema guard** — `O(30 lines)` Python check that blocks
  tool calls in a registered sensitive-tool set when the target principal
  matches an audit-stack pattern (`audit.*`, `compliance.*`, `sox.*`, …).
  Catches sensitive actions by namespace, not by language judgment. Composes
  with any gateway variant.

- **Intent critic** — small adversarial judge (Qwen2.5-7B-Instruct-4bit,
  orthogonal lineage to the Llama gateway) that reviews the gateway's resolved
  INTENT and overrides APPROVE to REJECT for forbidden actions. Composes with
  the schema guard for a defense-in-depth posture.

Both are documented in the GitHub repo (pending — see Status below).

---

## License

The Argus baseline adapter is released under the
**Llama 3.3 Community License**, inherited from the base model.
([Upstream license](https://huggingface.co/meta-llama/Llama-3.3-70B-Instruct/blob/main/LICENSE).)
Cite the model card on HuggingFace when using.

---

## Status (2026-06-17)

| Component | Status | Where |
|---|---|---|
| Argus baseline (v3-prod-r2) model | **PUBLISHED** | [HF Hub](https://huggingface.co/proband-xyz/argus-baseline-v3-prod-r2) |
| Full eval harness + defense layers (Python) | local; GitHub repo pending | — |
| Argus eval probe set (175) | local | — |
| corpus/v1 adversarial probe set (198) | local | — |
| argus-deliberative variant (v3-prod-r3) | TBD | — |
| argus-mini variant (smaller-model tutorial) | TBD | — |

The GitHub repository (likely `github.com/proband-xyz/argus`) and `mkdocs`
documentation site (`proband.xyz/argus`) are the next deliverables. Until
those land, the HF model card on the URL above is the canonical entry point
and includes everything needed to load and run the gateway in isolation.

---

## Citation

```bibtex
@misc{argus2026baseline,
  title  = {Argus Baseline (v3-prod-r2): a hardened gateway variant for
            enterprise-IAM agentic-safety research},
  author = {Todd, Sean},
  year   = {2026},
  url    = {https://huggingface.co/proband-xyz/argus-baseline-v3-prod-r2},
  note   = {Part of the Argus agentic-safety substrate; see proband.xyz/argus}
}
```