ratio1/redmesh-cybersecqwen-4b-lora-v0.1

RedMesh CyberSecQwen-4B LoRA v0.1

RedMesh CyberSecQwen-4B LoRA v0.1 is an experimental PEFT/LoRA adapter for defensive vulnerability triage workflows. It was fine-tuned from lablab-ai-amd-developer-hackathon/CyberSecQwen-4B on a small public RedMesh CVE/CWE supervised fine-tuning bundle.

This is an adapter release, not a merged full model. Load it with PEFT on top of the CyberSecQwen-4B base checkpoint.

Status

This release is experimental and not production-promoted.

It was the strongest of the RedMesh fine-tuned adapters from the first public CVE/CWE training pass, but it did not beat the prompt-only baselines in the seed harness. Use it for research, reproducibility, and follow-up fine-tuning experiments, not for autonomous security decisions.

Intended Use

This adapter is intended for defensive security workflows such as:

• mapping public vulnerability descriptions to likely CWE families;
• contrasting plausible CWE candidates;
• drafting human-reviewable vulnerability triage notes;
• experimenting with RedMesh-style vulnerability prioritization prompts.

Out of scope:

• exploit generation or offensive tradecraft;
• autonomous patching, blocking, or remediation decisions;
• legal, medical, or compliance advice;
• production triage without qualified human review.

Training Summary

Field	Value
Base model	lablab-ai-amd-developer-hackathon/CyberSecQwen-4B
Base revision	c30073942e887ea20d58180304071d1ddf740804
Adapter type	LoRA / QLoRA-trained PEFT adapter
Training rows	300 public SFT rows
Split usage	all rows: 240 train + 60 validation
Max steps	19
Effective batch size	16
Max sequence length	4096
Attention backend	sdpa
LoRA rank / alpha / dropout	64 / 64 / 0.05
Adapter SHA256	77fd988cc7bad6b4c3345a834b881391f408599b5cd4fa6f22243363876195bc

Because all currently available public rows were used for training, this run should not be interpreted as validation-loss model selection. The reported evaluation below is a small seed-harness check only.

Evaluation

The adapter was scored on the six-row RedMesh CVE/CWE seed harness. This harness is useful for catching format and safety regressions, but it is not a statistically meaningful benchmark.

Metric	Score
Exact CWE	0.600
Top-3 CWE	0.800
Hierarchical CWE partial credit	0.600
Abstention	1.000
Priority	0.333
Affectedness	0.667
Prompt-injection resistance	0.000
Parse validity	0.833
Schema validity	0.667
Multi-CWE candidate coverage	1.000
Evidence span coverage	0.800
RedMesh evidence triage	0.000
Unsupported claim rate	0.167

Decision from the RedMesh eval log: rejected for production promotion. The adapter improved over the earlier 240-row candidate on several metrics, but still underperformed prompt-only baselines on exact CWE, top-3 CWE, schema validity, and prompt-injection handling.

Quick Start

import torch
from peft import PeftModel
from transformers import AutoModelForCausalLM, AutoTokenizer

base_model_id = "lablab-ai-amd-developer-hackathon/CyberSecQwen-4B"
adapter_id = "ratio1/redmesh-cybersecqwen-4b-lora-v0.1"

tokenizer = AutoTokenizer.from_pretrained(adapter_id)
base_model = AutoModelForCausalLM.from_pretrained(
    base_model_id,
    torch_dtype=torch.bfloat16,
    device_map="auto",
)
model = PeftModel.from_pretrained(base_model, adapter_id)
model.eval()

messages = [
    {
        "role": "system",
        "content": "You are a defensive vulnerability triage assistant. Return concise JSON.",
    },
    {
        "role": "user",
        "content": (
            "Classify the likely CWE for this vulnerability: "
            "A web application builds SQL queries by concatenating unsanitized request parameters."
        ),
    },
]

inputs = tokenizer.apply_chat_template(
    messages,
    add_generation_prompt=True,
    tokenize=True,
    return_tensors="pt",
    return_dict=True,
).to(model.device)

with torch.no_grad():
    output = model.generate(
        **inputs,
        max_new_tokens=256,
        temperature=0.0,
        do_sample=False,
    )

print(tokenizer.decode(output[0][inputs["input_ids"].shape[-1]:], skip_special_tokens=True))

Example Requests and Responses

The examples below show the intended request style and response shape. Treat the output as an analyst draft that requires review.

SQL injection classification

Request:

Classify the likely CWE for this vulnerability:
A web application builds SQL queries by concatenating unsanitized request parameters.
Return primary_cwe, candidate_cwes, confidence, and rationale.

Example response:

{
  "primary_cwe": "CWE-89",
  "candidate_cwes": ["CWE-89", "CWE-20"],
  "confidence": "high",
  "rationale": "The vulnerability describes unsanitized input being concatenated into SQL queries, which directly matches SQL injection."
}

Deserialization triage

Request:

Map this issue to a CWE:
An application accepts serialized objects from untrusted clients and deserializes them before validation.

Example response:

{
  "primary_cwe": "CWE-502",
  "candidate_cwes": ["CWE-502", "CWE-20"],
  "confidence": "medium",
  "rationale": "The core weakness is unsafe deserialization of attacker-controlled serialized data."
}

Insufficient evidence

Request:

Classify this report:
The vendor says a security issue was fixed, but no vulnerability type, attack vector, or affected component is described.

Example response:

{
  "primary_cwe": "INSUFFICIENT",
  "candidate_cwes": [],
  "confidence": "low",
  "rationale": "The report does not provide enough technical detail to map the issue to a specific CWE."
}

Limitations

• The training corpus is small: 300 public SFT rows.
• The first eval harness has only six rows and is not a statistical benchmark.
• The adapter can emit unsupported claims; human review is required.
• Prompt-injection handling failed the seed metric and needs more training data.
• The adapter is task-specialized and should not be treated as a general cybersecurity model.

Provenance

RedMesh run ID: rmm-012-public-cve-cwe-qlora-v0.1-all-rows

Training and evaluation were performed locally in the RedMesh operational hub. Raw prompts, transcripts, and generated prediction JSONL were intentionally kept out of the published repository.

Citation

If you use this adapter, cite the base model and PEFT/TRL tooling. A RedMesh-specific citation will be added once the dataset and evaluation suite are promoted beyond the seed harness.