VulnTune-Qwen2.5-Coder-7B (QLoRA)

A function-level vulnerability detector. Give it the source code of one function; it answers VULNERABLE or NOT VULNERABLE.

Fine-tuned from Qwen2.5-Coder-7B with QLoRA on the VulnTune dataset (CrossVul + function-level vulnerability data, ~90% C/C++, also PHP, Python, JavaScript, Java, Go and others). Merged and quantized to GGUF Q4_K_M (4.7 GB), so it runs on a laptop CPU.

Usage

ollama run moayadterro/vulntune-qwen2.5-coder-7b 'int copy(char *s){ char b[8]; strcpy(b, s); return 0; }'
# VULNERABLE

ollama run moayadterro/vulntune-qwen2.5-coder-7b 'int add(int a, int b){ return a + b; }'
# NOT VULNERABLE

API:

curl http://localhost:11434/api/generate -d '{
  "model": "moayadterro/vulntune-qwen2.5-coder-7b",
  "prompt": "int copy(char *s){ char b[8]; strcpy(b, s); return 0; }",
  "stream": false
}'

Send only the function’s source code. The task prompt the model was trained with is built into the template:

### Task: You are a static code analysis expert. Decide whether the following function contains a security vulnerability. Answer VULNERABLE or NOT VULNERABLE.
### Code:
{code}
### Answer:

Decoding is greedy (temperature 0, at most 8 tokens). This is a classifier, not a chat model: it does not explain its answer or name the CWE.

Training

• QLoRA: 4-bit NF4 base, LoRA r=16, α=32, dropout 0.05 on all linear layers

• - 8,000 training functions (25% vulnerable), 1 epoch, AdamW 8-bit, lr 2e-4, cosine schedule, effective batch 32

• - Inputs up to 1,024 tokens; loss on the answer only

• • Checkpoint selected by validation MCC

    Results (validation set, 1,000 functions, natural class ratio)

Measured before merging and quantization. Held-out test-set results for this quantized model will be added here.

License

Apache-2.0 (inherited from Qwen2.5-Coder-7B). Dataset: MIT.