VulnTune-DeepSeek-Coder-6.7B (QLoRA)

A function-level vulnerability detector. Give it the source code of one function; it answers VULNERABLE or NOT VULNERABLE.

Fine-tuned from DeepSeek-Coder-6.7B-base with QLoRA on the VulnTune dataset (CrossVul + function-level vulnerability data, ~90% C/C++, also PHP, Python, JavaScript, Java, Go and others). Merged and quantized to GGUF Q4_K_M (4.1 GB), so it runs on a laptop CPU.

Usage

ollama run moayadterro/vulntune-deepseek-coder-6.7b 'int copy(char *s){ char b[8]; strcpy(b, s); return 0; }'
# VULNERABLE

ollama run moayadterro/vulntune-deepseek-coder-6.7b 'int add(int a, int b){ return a + b; }'
# NOT VULNERABLE

API:

curl http://localhost:11434/api/generate -d '{
  "model": "moayadterro/vulntune-deepseek-coder-6.7b",
  "prompt": "int copy(char *s){ char b[8]; strcpy(b, s); return 0; }",
  "stream": false
}'

Send only the function’s source code. The task prompt the model was trained with is built into the template:

### Task: You are a static code analysis expert. Decide whether the following function contains a security vulnerability. Answer VULNERABLE or NOT VULNERABLE.
### Code:
{code}
### Answer:

Decoding is greedy (temperature 0, at most 8 tokens). This is a classifier, not a chat model: it does not explain its answer or name the CWE.

Training

• QLoRA: 4-bit NF4 base, LoRA r=16, α=32, dropout 0.05 on all linear layers

• - 8,000 training functions (25% vulnerable), 1 epoch (250 steps), AdamW 8-bit, lr 2e-4, cosine schedule, effective batch 32

• - Inputs up to 1,024 tokens; loss on the answer only

• • Checkpoint selected by validation MCC (step 200)

    Results

Held-out test set: 15,141 functions (1,059 vulnerable, 14,082 safe), this quantized model:

Confusion matrix: TP 953, FN 106, FP 877, TN 13,205.

Validation set (1,000 functions, before merging and quantization): MCC 0.696, precision 0.568, recall 0.918, F1 0.702.

See also: moayadterro/vulntune-qwen2.5-coder-7b, trained the same way on Qwen2.5-Coder-7B.

License

DeepSeek License (inherited from DeepSeek-Coder-6.7B-base). Dataset: MIT.

Author and citation

Created by Moayad Terro. If you use this model, please cite:

@misc{terro2026vulntune,
  author       = {Terro, Moayad},
  title        = {VulnTune-DeepSeek-Coder-6.7B: QLoRA fine-tuned DeepSeek-Coder for function-level vulnerability detection},
  year         = {2026},
  howpublished = {\url{https://ollama.com/moayadterro/vulntune-deepseek-coder-6.7b}}
}