VulnTune-StarCoder2-7B (QLoRA)

A function-level vulnerability detector. Give it the source code of one function; it answers VULNERABLE or NOT VULNERABLE.

Fine-tuned from StarCoder2-7B with QLoRA on the VulnTune dataset (CrossVul + function-level vulnerability data, ~90% C/C++, also PHP, Python, JavaScript, Java, Go and others). Merged and quantized to GGUF Q4_K_M (4.46 GB), so it runs on a laptop CPU.

Usage

ollama run moayadterro/vulntune-starcoder2-7b 'int copy(char *s){ char b[8]; strcpy(b, s); return 0; }'
# answers VULNERABLE or NOT VULNERABLE

API:

curl http://localhost:11434/api/generate -d '{
  "model": "moayadterro/vulntune-starcoder2-7b",
  "prompt": "int copy(char *s){ char b[8]; strcpy(b, s); return 0; }",
  "stream": false
}'

Send only the function’s source code. The task prompt the model was trained with is built into the template:

### Task: You are a static code analysis expert. Decide whether the following function contains a security vulnerability. Answer VULNERABLE or NOT VULNERABLE.
### Code:
{code}
### Answer:

Decoding is greedy (temperature 0, at most 8 tokens). This is a classifier, not a chat model: it does not explain its answer or name the CWE.

Training

• QLoRA: 4-bit NF4 base, LoRA r=16, α=32, dropout 0.05 on all linear layers

• - 8,000 training functions (25% vulnerable), 1 epoch (250 steps), AdamW 8-bit, lr 2e-4, cosine schedule, effective batch 32

• - Inputs up to 1,024 tokens; loss on the answer only

• • Checkpoint selected by validation MCC (step 200)

    Results

Held-out test set: 15,141 functions (1,059 vulnerable, 14,082 safe), this quantized model:

Confusion matrix: TP 919, FN 140, FP 749, TN 13,333.

Validation set (1,000 functions, before merging and quantization): MCC 0.678, precision 0.591, recall 0.844, F1 0.695.

See also, trained the same way: moayadterro/vulntune-qwen2.5-coder-7b and moayadterro/vulntune-deepseek-coder-6.7b.

License

BigCode OpenRAIL-M v1 (inherited from StarCoder2-7B). Dataset: MIT.

Author and citation

Created by Moayad Terro. If you use this model, please cite:

@misc{terro2026vulntunestarcoder2,
  author       = {Terro, Moayad},
  title        = {VulnTune-StarCoder2-7B: QLoRA fine-tuned StarCoder2 for function-level vulnerability detection},
  year         = {2026},
  howpublished = {\url{https://ollama.com/moayadterro/vulntune-starcoder2-7b}}
}