This repository is a research artifact accompanying the paper Neurosymbolic LoRA: Why and When to Tune Weights vs. Rewrite Prompts (arXiv:2601.12711). It is training code meant to run on trusted, private GPU machines — it is not designed to be exposed as a public-facing service.

• Run on trusted networks only. Ray's job-submission API executes submitted code by design (CVE-2023-48022, disputed upstream with no patch); never expose Ray ports or dashboards, DeepSpeed launchers, or any training endpoint to an untrusted network.
• Load only trusted models and data. Several transformers/deepspeed advisories concern deserializing untrusted checkpoints or datasets. Training scripts here default to well-known Hugging Face models and the datasets shipped in datasets/; audit anything you substitute.
• Keep your own credentials out of the repo. Scripts read WANDB_API_KEY and OPENAI_API_KEY from the environment; never hardcode keys.

Pins balance reproducibility of the paper's results against security updates. Versions currently pinned were validated end to end on this codebase:

• transformers==4.48.3 — the newest release compatible with Phi-3's Hub modeling code (4.49 removed DynamicCache.get_max_length). Advisories fixed only in later versions concern code paths this project does not use (e.g. the LightGlue loader, transformers.Trainer — this repo ships its own trainers).
• deepspeed==0.17.1 and ray[default]>=2.56.1 — validated with the training pipeline; kept current so upstream security fixes land.
• vLLM is not used by this project; the optional extras inherited from upstream OpenRLHF were removed.

Please open a private security advisory on the GitHub repository (Security → Advisories → Report a vulnerability).