Instructions to use Stardust-LLM/Stardust-Flash-01 with libraries, inference providers, notebooks, and local apps. Follow these links to get started.

Libraries

How to use Stardust-LLM/Stardust-Flash-01 with Transformers:

# Use a pipeline as a high-level helper
from transformers import pipeline

pipe = pipeline("text-generation", model="Stardust-LLM/Stardust-Flash-01")
messages = [
    {
        "role": "user",
        "content": [
            {"type": "image", "url": "https://huggingface.co/datasets/huggingface/documentation-images/resolve/main/p-blog/candy.JPG"},
            {"type": "text", "text": "What animal is on the candy?"}
        ]
    },
]
pipe(text=messages)

# pip install -U transformers accelerate
# Load model directly
from transformers import AutoProcessor, AutoModelForMultimodalLM

processor = AutoProcessor.from_pretrained("Stardust-LLM/Stardust-Flash-01")
model = AutoModelForMultimodalLM.from_pretrained("Stardust-LLM/Stardust-Flash-01", device_map="auto")
messages = [
    {
        "role": "user",
        "content": [
            {"type": "image", "url": "https://huggingface.co/datasets/huggingface/documentation-images/resolve/main/p-blog/candy.JPG"},
            {"type": "text", "text": "What animal is on the candy?"}
        ]
    },
]
inputs = processor.apply_chat_template(
	messages,
	add_generation_prompt=True,
	tokenize=True,
	return_dict=True,
	return_tensors="pt",
).to(model.device)

outputs = model.generate(**inputs, max_new_tokens=256)
print(processor.decode(outputs[0][inputs["input_ids"].shape[-1]:]))

Notebooks
Google Colab
Kaggle
Local Apps Settings

vLLM

How to use Stardust-LLM/Stardust-Flash-01 with vLLM:

Install from pip and serve model

# Install vLLM from pip:
pip install vllm
# Start the vLLM server:
vllm serve "Stardust-LLM/Stardust-Flash-01"
# Call the server using curl (OpenAI-compatible API):
curl -X POST "http://localhost:8000/v1/chat/completions" \
	-H "Content-Type: application/json" \
	--data '{
		"model": "Stardust-LLM/Stardust-Flash-01",
		"messages": [
			{
				"role": "user",
				"content": "What is the capital of France?"
			}
		]
	}'

Use Docker

docker model run hf.co/Stardust-LLM/Stardust-Flash-01

SGLang

How to use Stardust-LLM/Stardust-Flash-01 with SGLang:

Install from pip and serve model

# Install SGLang from pip:
pip install sglang
# Start the SGLang server:
python3 -m sglang.launch_server \
    --model-path "Stardust-LLM/Stardust-Flash-01" \
    --host 0.0.0.0 \
    --port 30000
# Call the server using curl (OpenAI-compatible API):
curl -X POST "http://localhost:30000/v1/chat/completions" \
	-H "Content-Type: application/json" \
	--data '{
		"model": "Stardust-LLM/Stardust-Flash-01",
		"messages": [
			{
				"role": "user",
				"content": "What is the capital of France?"
			}
		]
	}'

Use Docker images

docker run --gpus all \
    --shm-size 32g \
    -p 30000:30000 \
    -v ~/.cache/huggingface:/root/.cache/huggingface \
    --env "HF_TOKEN=<secret>" \
    --ipc=host \
    lmsysorg/sglang:latest \
    python3 -m sglang.launch_server \
        --model-path "Stardust-LLM/Stardust-Flash-01" \
        --host 0.0.0.0 \
        --port 30000
# Call the server using curl (OpenAI-compatible API):
curl -X POST "http://localhost:30000/v1/chat/completions" \
	-H "Content-Type: application/json" \
	--data '{
		"model": "Stardust-LLM/Stardust-Flash-01",
		"messages": [
			{
				"role": "user",
				"content": "What is the capital of France?"
			}
		]
	}'

Docker Model Runner
How to use Stardust-LLM/Stardust-Flash-01 with Docker Model Runner:
```
docker model run hf.co/Stardust-LLM/Stardust-Flash-01
```

Stardust-Flash-01 / README.md

Stardust-LLM

Update README.md

c623737 verified 15 days ago

preview code

Raw History Blame Contribute Delete

5.94 kB

---
license: mit
language:
  - en
library_name: transformers
pipeline_tag: text-generation
base_model: TODO/GLM-5.3-Flash
tags:
  - security
  - cybersecurity
  - security-research
  - code-analysis
  - agentic
  - tool-use
  - lora
  - grpo
  - moe
---
<div align="center">

# Stardust Flash-01

**Our first open-weights model trained specifically for security research.**

[Website](https://stardustllm.xyz/) · [API](https://stardustllm.xyz/#developers) · [GRPO paper](https://arxiv.org/html/2402.03300v3#S4.SS1.SSS2)

</div>

---

## Overview

Stardust Flash-01 is an open-weights model for security research, post-trained on real vulnerabilities from our own private dataset. It is built to work as a **focused worker**: a larger orchestrating model hands it a scoped security task, and Flash-01 reads code, uses tools, tests ideas and confirms what it finds.

We release the weights because defenders need models they can run, control and improve inside the systems they are responsible for protecting.

## Model details

| | |
|---|---|
| **Developer** | STARDUST Labs |
| **Base model** | GLM-5.3-Flash |
| **Architecture** | Mixture-of-Experts, 320B total / 18B active parameters |
| **Context length** | 1M tokens |
| **Post-training** | Rank-256 LoRA + selective full-parameter training, [GRPO](https://arxiv.org/html/2402.03300v3#S4.SS1.SSS2) |
| **Training tasks** | 150, built from 50 cases |
| **Role** | Worker model, run by an orchestrator |
| **License** | MIT |

## Intended use

Flash-01 is meant for **authorized security work**:

- Code review and static analysis of repositories you own or are permitted to test
- Focused investigations inside isolated, sandboxed environments
- Tool-assisted exploration as part of an agent pipeline
- Smart contract review on testnets or your own deployments
- Detection engineering, remediation guidance and hardening plans

### Out of scope

- Testing systems you do not own or have no written permission to test
- Any use that breaks applicable law, a bug bounty program's rules, or a client's scope of engagement
- Unsupervised use against production systems

## Quickstart

> Replace `stardust-llm/stardust-flash-01` with the final repository id.

### Transformers

```python
from transformers import AutoModelForCausalLM, AutoTokenizer
model_id = "stardust-llm/stardust-flash-01"
tokenizer = AutoTokenizer.from_pretrained(model_id, trust_remote_code=True)
model = AutoModelForCausalLM.from_pretrained(
    model_id,
    torch_dtype="auto",
    device_map="auto",
    trust_remote_code=True,
)
messages = [
    {"role": "system", "content": "You are a security code reviewer working in an authorized, sandboxed engagement."},
    {"role": "user", "content": "Review this function for input validation issues and suggest a fix:\n\n<paste code here>"},
]
inputs = tokenizer.apply_chat_template(messages, add_generation_prompt=True, return_tensors="pt").to(model.device)
outputs = model.generate(inputs, max_new_tokens=1024)
print(tokenizer.decode(outputs[0][inputs.shape[-1]:], skip_special_tokens=True))
```

### vLLM (OpenAI-compatible server)

```bash
vllm serve stardust-llm/stardust-flash-01 --trust-remote-code --tensor-parallel-size 8
```

### Stardust API

Flash-01 is also available through the Stardust API as `stardust/flash-01`, with an OpenAI-compatible `/v1/chat/completions` endpoint.

```bash
curl https://api.stardust.llm/v1/chat/completions \
  -H "Authorization: Bearer $STARDUST_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "model": "stardust/flash-01",
    "messages": [{"role": "user", "content": "Summarize the security risks in this config file: ..."}]
  }'
```

## Recommended setup

Flash-01 works best as a **worker**, not a standalone assistant:

1. A larger model plans the engagement and splits it into focused tasks.
2. Flash-01 receives one scoped task, with the tools and access it needs.
3. Its findings go back to the orchestrator, and a human reviews them before anything leaves the sandbox.

Run tools in an isolated environment with egress controls, ephemeral storage and audit logging.

## Training

We started from GLM-5.3-Flash and fine-tuned it with GRPO reinforcement learning on 150 tasks built from 50 cases. Each case comes in three views with different amounts of information: guided whitebox, focused whitebox and focused blackbox.

We used rank-256 LoRA across all experts and routers, plus full-parameter updates on 16 experts selected by activation. Updating every parameter in every expert caused the model to collapse in our experiments, which we attribute to the small RL dataset.

Task difficulty is matched to the model's current ability, so that each training group contains both passes and fails and gives GRPO a useful signal.

## Limitations

- **Narrow by design.** Flash-01 is tuned for focused security tasks and is weaker as a general chat assistant.
- **Small training set.** 150 tasks from 50 cases. Expect gaps on vulnerability classes that were rare or missing in training.
- **Findings need review.** The model can report false positives and miss real issues. Always confirm results before acting on them.
- **Not a replacement for experts.** Use it to speed up qualified security teams, not to stand in for them.

## Responsible use

Security tools are dual-use. By downloading or using these weights you agree to use them only on systems you own or are explicitly authorized to test, and to follow responsible disclosure for anything you find.

To report misuse or a safety issue, contact us at `security@stardust.llm`.

## License

Released under the [MIT License](LICENSE). Use of the base model is also subject to its own license.

## Citation

```bibtex
@misc{stardust2026flash01,
  title  = {Stardust Flash-01: An Open-Weights Model for Security Research},
  author = {{STARDUST Labs}},
  year   = {2026},
  url    = {https://huggingface.co/stardust-llm/stardust-flash-01}
}
```

	---
	license: mit
	language:
	- en
	library_name: transformers
	pipeline_tag: text-generation
	base_model: TODO/GLM-5.3-Flash
	tags:
	- security
	- cybersecurity
	- security-research
	- code-analysis
	- agentic
	- tool-use
	- lora
	- grpo
	- moe
	---

	<div align="center">

	# Stardust Flash-01

	Our first open-weights model trained specifically for security research.

	[Website](https://stardustllm.xyz/) · [API](https://stardustllm.xyz/#developers) · [GRPO paper](https://arxiv.org/html/2402.03300v3#S4.SS1.SSS2)

	</div>

	---

	## Overview

	Stardust Flash-01 is an open-weights model for security research, post-trained on real vulnerabilities from our own private dataset. It is built to work as a focused worker: a larger orchestrating model hands it a scoped security task, and Flash-01 reads code, uses tools, tests ideas and confirms what it finds.

	We release the weights because defenders need models they can run, control and improve inside the systems they are responsible for protecting.

	## Model details

	\| \| \|
	\|---\|---\|
	\| Developer \| STARDUST Labs \|
	\| Base model \| GLM-5.3-Flash \|
	\| Architecture \| Mixture-of-Experts, 320B total / 18B active parameters \|
	\| Context length \| 1M tokens \|
	\| Post-training \| Rank-256 LoRA + selective full-parameter training, [GRPO](https://arxiv.org/html/2402.03300v3#S4.SS1.SSS2) \|
	\| Training tasks \| 150, built from 50 cases \|
	\| Role \| Worker model, run by an orchestrator \|
	\| License \| MIT \|

	## Intended use

	Flash-01 is meant for authorized security work:

	- Code review and static analysis of repositories you own or are permitted to test
	- Focused investigations inside isolated, sandboxed environments
	- Tool-assisted exploration as part of an agent pipeline
	- Smart contract review on testnets or your own deployments
	- Detection engineering, remediation guidance and hardening plans

	### Out of scope

	- Testing systems you do not own or have no written permission to test
	- Any use that breaks applicable law, a bug bounty program's rules, or a client's scope of engagement
	- Unsupervised use against production systems

	## Quickstart

	> Replace `stardust-llm/stardust-flash-01` with the final repository id.

	### Transformers

	```python
	from transformers import AutoModelForCausalLM, AutoTokenizer

	model_id = "stardust-llm/stardust-flash-01"

	tokenizer = AutoTokenizer.from_pretrained(model_id, trust_remote_code=True)
	model = AutoModelForCausalLM.from_pretrained(
	model_id,
	torch_dtype="auto",
	device_map="auto",
	trust_remote_code=True,
	)

	messages = [
	{"role": "system", "content": "You are a security code reviewer working in an authorized, sandboxed engagement."},
	{"role": "user", "content": "Review this function for input validation issues and suggest a fix:\n\n<paste code here>"},
	]

	inputs = tokenizer.apply_chat_template(messages, add_generation_prompt=True, return_tensors="pt").to(model.device)
	outputs = model.generate(inputs, max_new_tokens=1024)
	print(tokenizer.decode(outputs[0][inputs.shape[-1]:], skip_special_tokens=True))
	```

	### vLLM (OpenAI-compatible server)

	```bash
	vllm serve stardust-llm/stardust-flash-01 --trust-remote-code --tensor-parallel-size 8
	```

	### Stardust API

	Flash-01 is also available through the Stardust API as `stardust/flash-01`, with an OpenAI-compatible `/v1/chat/completions` endpoint.

	```bash
	curl https://api.stardust.llm/v1/chat/completions \
	-H "Authorization: Bearer $STARDUST_API_KEY" \
	-H "Content-Type: application/json" \
	-d '{
	"model": "stardust/flash-01",
	"messages": [{"role": "user", "content": "Summarize the security risks in this config file: ..."}]
	}'
	```

	## Recommended setup

	Flash-01 works best as a worker, not a standalone assistant:

	1. A larger model plans the engagement and splits it into focused tasks.
	2. Flash-01 receives one scoped task, with the tools and access it needs.
	3. Its findings go back to the orchestrator, and a human reviews them before anything leaves the sandbox.

	Run tools in an isolated environment with egress controls, ephemeral storage and audit logging.

	## Training

	We started from GLM-5.3-Flash and fine-tuned it with GRPO reinforcement learning on 150 tasks built from 50 cases. Each case comes in three views with different amounts of information: guided whitebox, focused whitebox and focused blackbox.

	We used rank-256 LoRA across all experts and routers, plus full-parameter updates on 16 experts selected by activation. Updating every parameter in every expert caused the model to collapse in our experiments, which we attribute to the small RL dataset.

	Task difficulty is matched to the model's current ability, so that each training group contains both passes and fails and gives GRPO a useful signal.

	## Limitations

	- Narrow by design. Flash-01 is tuned for focused security tasks and is weaker as a general chat assistant.
	- Small training set. 150 tasks from 50 cases. Expect gaps on vulnerability classes that were rare or missing in training.
	- Findings need review. The model can report false positives and miss real issues. Always confirm results before acting on them.
	- Not a replacement for experts. Use it to speed up qualified security teams, not to stand in for them.

	## Responsible use

	Security tools are dual-use. By downloading or using these weights you agree to use them only on systems you own or are explicitly authorized to test, and to follow responsible disclosure for anything you find.

	To report misuse or a safety issue, contact us at `security@stardust.llm`.

	## License

	Released under the [MIT License](LICENSE). Use of the base model is also subject to its own license.

	## Citation

	```bibtex
	@misc{stardust2026flash01,
	title = {Stardust Flash-01: An Open-Weights Model for Security Research},
	author = {{STARDUST Labs}},
	year = {2026},
	url = {https://huggingface.co/stardust-llm/stardust-flash-01}
	}
	```