Khalifa University researchers build cybersecurity AI assistant

RedSage AI model research paper accepted by ICLR 2026

A field of Red Sage (Salvia miltiorrhiza)

#UnitedArabEmirates #LLMs – Abu Dhabi-based Khalifa University, in collaboration with the University of Bonn and the University of Milan, has released RedSage, an open-source cybersecurity generalist large language model (LLM). The research paper for the RedSage project has recently been accepted for presentation at ICLR 2026, the premier gathering for representation learning advancement taking place 23-27 April in Rio de Janeiro, Brazil.

The 8-billion parameter model was developed to support diverse security workflows from frameworks including MITRE to offensive techniques and tool use without privacy risks of proprietary APIs, achieving results surpassing baseline models by up to 5.59 points on cybersecurity benchmarks and 5.05 points on Open LLM Leaderboard tasks. Researchers utilised an agentic augmentation pipeline to simulate expert workflows for training and introduced RedSage-Bench to rigorously evaluate technical proficiency across 30,000 multiple-choice questions and 240 open-ended items.

SO WHAT? – The research aims to address a critical gap in cybersecurity operations where organisations face a choice between proprietary AI services exposing sensitive data to external APIs or open models lacking domain-specific training. RedSage enables on-premises deployment on consumer-grade GPUs for privacy-preserving operations. The acceptance of the RedSage research paper to ICLR 2026 validates UAE research institutions’ capacity to contribute to frontier AI development in specialised domains. By outperforming larger models including Qwen3-32B despite its 8-billion parameter scale, RedSage demonstrates that domain-aware pretraining and post-training can achieve superior results to large general-purpose models.

Here are some key points about the RedSage LLM project:

• Abu Dhabi-based Khalifa University, in collaboration with University of Bonn and University of Milan, developed RedSage, an open-source cybersecurity generalist LLM, now accepted for presentation at ICLR 2026 (23-27 April, Rio de Janeiro, Brazil).

• The 8-billion parameter model supports diverse security workflows from frameworks including MITRE to offensive techniques and tool use without privacy risks of proprietary APIs, enabling on-premises deployment on consumer-grade GPUs for privacy-preserving operations.

• RedSage achieved results surpassing baseline models by up to 5.59 points on cybersecurity benchmarks and 5.05 points on Open LLM Leaderboard tasks, whilst the instruction-tuned variant surpassed Qwen3-32B despite smaller parameter scale.

• • Researchers curated 11.8 billion tokens of cybersecurity-focused continual pretraining data via large-scale web filtering and manual collection of high-quality resources spanning 28,600 documents across frameworks, offensive techniques and security tools.

• The RedSage model family includes:

  • RedSage-8B-Base (for domain adaptation and further fine-tuning)

  • RedSage-8B-Ins (for multi-turn chat and step-by-step explanations), and

  • RedSage-8B-DPO (as production-ready assistant with aligned behaviour)

• The team designed an agentic augmentation pipeline simulating expert workflows to generate 266,000 multi-turn cybersecurity samples for supervised fine-tuning, combined with general open-source large language model data for training.

• Researchers also introduced RedSage-Bench, a benchmark with 30,000 multiple-choice questions and 240 open-ended question-and-answer items covering cybersecurity knowledge, skills and tool expertise evaluated using an LLM-as-Judge rubric for quality assessment.

• The research team will release all models, datasets and code to support reproducibility and accelerate open research on domain-specialised AI assistants for cybersecurity, addressing limitations in prior work that withheld data and pipelines.

• The RedSage research team includes: Naufal Suryanto (KU), Muzammal Naseer (KU), Pengfei Li (KU), Syed Talal Wasim (University of Bonn), Jinhui Yi (UB), Juergen Gall (UB), Paolo Ceravolo (University of Milan), Ernesto Damiani (UM).

ZOOM OUT – Khalifa University has developed multiple domain-specific AI models, including several telecom AI projects. The university’s 6G Research Centre has previously released global and Arabic editions of a telecom LLM, and Open-Telco LLM Benchmarks in collaboration with the global telecom industry association GSMA. The TelecomGPT model was fine-tuned on comprehensive telecom datasets to handle sector-specific queries with enhanced precision, reflecting Khalifa University’s strategy of developing specialised models for knowledge-rich technical domains, designed to support 6G standards development as the UAE targets 2030 implementation.

LINKS

• RedSage project page (Github)

• RedSage models (Hugging Face)

• RedSage code (Github)

• RedSage research paper (arXiv)

[Written and edited with the assistance of AI]

Read more about Khalifa University AI research:

• Researchers release 50k drone scenario LLM benchmark (Middle East AI News)

• KU announces telecom AI model benchmarks (Middle East AI News)

• Telecom industry partners develop Arabic Telecom LLM (Middle East AI News)

• Testing phase begins for TelecomGPT (Middle East AI News)