The RedSage Breakthrough at ICLR 2026

Khalifa University researchers have achieved a significant milestone with their paper on RedSage, a groundbreaking cybersecurity generalist large language model (LLM), accepted to the International Conference on Learning Representations (ICLR) 2026. This prestigious conference, renowned for advancing representation learning in artificial intelligence (AI), underscores the innovative work emerging from Abu Dhabi-based Khalifa University, solidifying its position as a leader in UAE higher education AI research.

RedSage represents a new era in AI-driven cybersecurity tools, designed specifically to handle complex security workflows while prioritizing data privacy. Unlike general-purpose LLMs that may expose sensitive information through cloud APIs, RedSage is optimized for on-premises deployment on everyday consumer-grade graphics processing units (GPUs). This makes it accessible for organizations wary of proprietary services.

Understanding RedSage: A Cybersecurity Specialist LLM

RedSage is an 8-billion-parameter LLM tailored for cybersecurity tasks. Large language models, or LLMs, are advanced AI systems trained on vast datasets to generate human-like text, reason, and perform specialized functions. What sets RedSage apart is its domain-specific focus: continual pretraining on CyberFineWeb, a curated corpus of 11.8 billion tokens from 28,600 high-quality cybersecurity documents covering MITRE ATT&CK frameworks, offensive techniques, and security tools like Nmap and Wireshark.

The development process unfolds in clear steps. First, researchers filtered massive web data to create CyberFineWeb, ensuring relevance and quality. Next, an agentic augmentation pipeline simulated expert-user interactions to produce 266,000 multi-turn dialogues. These mimic real-world scenarios, such as threat hunting or vulnerability assessment, enabling supervised fine-tuning (SFT) and direct preference optimization (DPO) for refined chat capabilities. The base architecture builds on Qwen3-8B, a strong open-source foundation, resulting in variants like RedSage-Qwen3-8B-DPO for production use.

The Collaborative Research Team

Leading the project is the Reliable Intelligent Systems (RISys) Lab at Khalifa University, with key contributors Naufal Suryanto, Muzammal Naseer (project lead), and Pengfei Li. Collaborators include Syed Talal Wasim and Jinhui Yi from the University of Bonn, Juergen Gall from Bonn, and Paolo Ceravolo and Ernesto Damiani from the University of Milan. This international effort highlights Khalifa University's global research network.

Muzammal Naseer, a postdoctoral fellow at Khalifa, emphasized the model's state-of-the-art performance among 8B models on cybersecurity benchmarks. The team's commitment to open science is evident in releasing models, datasets, and code on Hugging Face and GitHub.RedSage GitHub repositoryHugging Face models

Key Innovations Driving RedSage's Success

RedSage introduces several novel elements. The agentic pipeline automates data generation by chaining LLM calls to replicate cybersecurity expert reasoning—starting with a user query, consulting knowledge bases, invoking tools, and validating outputs. This step-by-step simulation ensures diverse, high-fidelity training data without manual labeling.

Another innovation is RedSage-Bench, a comprehensive evaluation suite with over 30,000 multiple-choice questions (MCQs) and 240 open-ended tasks assessing knowledge, skills, and tool proficiency. Evaluated using an LLM-as-judge rubric, it provides rigorous, reproducible metrics.

Photo by Brett Jordan on Unsplash

• CyberFineWeb: Filtered web data for broad coverage.
• Seed datasets: Manually curated resources on frameworks and tools.
• Agentic dialogues: Multi-turn conversations for instruction following.

Benchmark Performance and Comparisons

RedSage excels on cybersecurity benchmarks like CTI-Bench (cyber threat intelligence), CyberMetric, SECURE, SecEval, and MMLU-CSec. The DPO-tuned model surpasses baselines such as Llama-3.1-8B and Qwen3-8B by up to 5.59 points on average. On the Open LLM Leaderboard, gains reach 5.05 points, proving domain specialization boosts general capabilities.

For instance, RedSage-8B-DPO achieves superior scores in open-ended Q&A, with +7% correctness and higher quality ratings. Ablation studies confirm continual pretraining's role, with CyberFineWeb variants leading on SecBench.

UAE Cybersecurity Landscape and RedSage's Relevance

The UAE faces escalating cyber threats, with systems blocking 90,000 attacks during events like the World Governments Summit and daily attempts exceeding 200,000. Ransomware, phishing, and supply chain risks dominate, amid MENA cybersecurity spending projected at $4 billion in 2026—a 10% rise.

RedSage addresses these by enabling local threat analysis, MITRE ATT&CK mapping, and tool orchestration without data leakage. In a region prioritizing digital transformation, like UAE's 6G ambitions, such tools empower sectors from finance to energy.RedSage arXiv paper

Khalifa University's Leadership in AI and Higher Education

Ranked #1 in UAE and #177 globally in QS World University Rankings 2026, Khalifa University excels in research impact, securing 60 patents in 2025. Its AI initiatives, including telecom LLMs and Open-Telco Benchmarks with GSMA, position it as a hub for domain-specific AI. Recent events like the AI & Cybersecurity Winter School with Google.org trained 270 participants on geopolitics, graph neural networks, and human factors.

For students and faculty, this fosters opportunities in cutting-edge fields. Explore research assistant jobs or academic CV tips to join such teams.

Career Implications in UAE Higher Education and Beyond

The cybersecurity job market in UAE booms, with 46% net employment outlook and salaries for AI-cyber experts at AED 180,000-600,000. Over 350 cybersecurity roles listed, demand surges in academia and industry. RedSage-like projects highlight skills in LLM fine-tuning, agentic AI, and ethical hacking.

• Hands-on with tools like vLLM for serving models.
• Domain expertise in MITRE frameworks.
• Publishing at top venues like ICLR.

Professionals can check UAE academic jobs, higher ed jobs, or rate professors for insights.

Photo by Pierre Bamin on Unsplash

Future Outlook and Community Engagement

With ICLR 2026 in Rio de Janeiro (April 23-27), RedSage will inspire further advancements. Future work may expand to larger scales or integrate real-time threat intelligence. The open-source release invites global contributions, accelerating cybersecurity AI.

Stakeholders—from students to policymakers—can deploy RedSage locally, test on RedSage-Bench, or fine-tune for custom needs. This aligns with UAE's vision for AI sovereignty and innovation leadership.

Interested in similar opportunities? Visit university jobs, career advice, faculty positions, or rate my professor.