---
license: apache-2.0
base_model: google/gemma-4-E4B-it
datasets:
  - google/code_x_glue_cc_defect_detection
  - bstee615/diversevul
  - bstee615/bigvul
  - hitoshura25/cvefixes
library_name: transformers
pipeline_tag: text-generation
tags:
  - code
  - security
  - vulnerability-detection
  - qlora
  - unsloth
---

# gemma-coder-dev

Defensive-security fine-tune of [`google/gemma-4-E4B-it`](https://huggingface.co/google/gemma-4-E4B-it),
produced by the retrain pipeline in [remote-agent-dev-platform](https://github.com/Monibee-Fudgekins/remote-agent-dev-platform).
**Last updated: 2026-11-10 19:44 UTC** · run mode: `smoke` · promoted: **False**.

> Numbers below come from this pipeline's own held-out eval. No ExploitGym
> results are claimed; that evaluation has not been run.

## Intended uses & limitations
- **Intended:** secure code review — decide whether a function is vulnerable, name the
  CWE, and propose a secure rewrite; write code that avoids common weakness classes.
- **Not intended:** exploit development or any offensive use; unreviewed automated
  patching; safety-critical decisions.
- **Limitations:** labels come from commit-mined datasets (noisy); the fix score is a
  proxy, not a proof that the vulnerability is gone. Always review and test.

## Training data
- [`google/code_x_glue_cc_defect_detection`](https://huggingface.co/datasets/google/code_x_glue_cc_defect_detection)
- [`bstee615/diversevul`](https://huggingface.co/datasets/bstee615/diversevul)
- [`bstee615/bigvul`](https://huggingface.co/datasets/bstee615/bigvul)
- [`hitoshura25/cvefixes`](https://huggingface.co/datasets/hitoshura25/cvefixes)

Formatted into three chat tasks (detect / CWE classify / secure fix) by
`finetune/security_data.py`; functions are deduplicated, length-capped and capped
per source. A fixed-seed held-out slice (by function hash) is excluded from training.

## Training procedure
- Method: QLoRA (Unsloth), 4-bit base, LoRA r=16 / alpha=32 on
  attention + MLP, lr 2e-4,
  max seq len 768, optimizer adamw_8bit.
- Progress: cycle 1 — 10 / 4000 steps.

## Evaluation (20 items: synthetic seed + held-out)
| model | detection F1 | CWE top-1 | fix-validity (proxy) |
|---|---|---|---|
| this run | 0.0000 | 1.0000 | 0.0000 |
| base (adapter off) | not measured | | |

Promotion requires detection F1 and CWE accuracy to beat the base model by the
configured margins and the fix proxy not to regress (`finetune/evaluate.py`).


## Provenance
Generated by `finetune/kaggle/run.py` in [https://github.com/Monibee-Fudgekins/remote-agent-dev-platform](https://github.com/Monibee-Fudgekins/remote-agent-dev-platform).