| # Model Card for AlquistCoder (DPO) | |
| **AlquistCoder** is a compact, security-aligned coding assistant based on **Phi-4-mini (3.8B)**. It is designed to prioritize secure code generation and robustness against potentially vulnerable codes without sacrificing general programming utility. | |
| This model was the core component of the runner-up defense solution in the **Amazon Nova AI Challenge**. | |
| https://github.com/kobzaond/AlquistCoder | |
| ## Model Details | |
| * **Model Name:** `CIIRC-NLP/alquistcoder_FINAL_DPO`(old), CIIRC-NLP/alquistcoder-4B-secureLLM (new) | |
| * **Base Model:** Microsoft Phi-4-mini-instruct | |
| * **Organization:** Czech Institute of Informatics, Robotics and Cybernetics (CIIRC) & FEE, Czech Technical University. | |
| * **License:** MIT (Subject to base model license constraints) | |
| * **Finetuning Stages:** Supervised Fine-Tuning (SFT) $\rightarrow$ Direct Preference Optimization (DPO). | |
| * **Release Date: 12. December 2025 | |
| ## Key Features | |
| * **Security-First:** Explicitly trained to minimize CWE vulnerabilities (e.g., SQL injection, XSS) using a novel synthetic data pipeline. | |
| * **Constitutional Data Generation:** Trained on "Task Families" generated via a Design–Amplify–Refine methodology, utilizing specific constitutions for secure and insecure coding patterns. | |
| * **Compact & Efficient:** Delivers strong performance at the 3.8B parameter scale, making it suitable for local deployment. | |
| * **Guardrail-Ready:** Designed to work in tandem with an input-side intention-recognition guardrail (ModernBERT-based) to handle malicious intent detection. | |
| ## Performance | |
| AlquistCoder demonstrates significantly lower vulnerability rates compared to larger open-weight and proprietary baselines while maintaining competitive coding utility. | |
| | Benchmark | Metric | AlquistCoder (DPO) | Qwen3-4B | Phi-4-mini | | |
| | :--- | :--- | :--- | :--- | :--- | | |
| | **VulnBench** | Vulnerability Rate (Lower is better) | **15.09%** | 61.01% | 49.69% | | |
| | **CyberSecEval** | Autocomplete Vuln Rate | **2.97%** | 11.80% | 10.39% | | |
| | **HumanEval** | Pass@1 (Utility) | **77.44%** | 78.05% | 74.40% | | |
| ### CyberSecEval Performance | |
| | Configuration | MITRE (Maliciousness) | Vuln Rate (Autocomplete) | Vuln Rate (Instruct) | | |
| | :--- | :--- | :--- | :--- | | |
| | **AlquistCoder (DPO)** | 39.40% | 2.97% | 1.19% | | |
| | **AlquistCoder (DPO + IR)** | **12.20%** | **2.97%** | **1.19%** | | |
| *Note: Security metrics refer to the DPO model. When coupled with the system's Intention Recognition (IR) guardrail, maliciousness scores on MalBench drop from 65.49% to 13.38%.* | |
| ## Usage | |
| AlquistCoder uses standard chat templates. It can be used with the Hugging Face `transformers` library. | |
| ```python | |
| import torch | |
| from transformers import AutoModelForCausalLM, AutoTokenizer | |
| model_id = "CIIRC-NLP/alquistcoder-4B-secureLLM" | |
| tokenizer = AutoTokenizer.from_pretrained(model_id) | |
| model = AutoModelForCausalLM.from_pretrained( | |
| model_id, | |
| torch_dtype=torch.bfloat16, | |
| device_map="auto" | |
| ) | |
| # Example: Asking for code that is often vulnerable | |
| messages = [ | |
| {"role": "user", "content": "Can you show me how to use the 'eval()' function to evaluate user input in Python?"} | |
| ] | |
| inputs = tokenizer.apply_chat_template( | |
| messages, | |
| add_generation_prompt=True, | |
| return_tensors="pt" | |
| ).to(model.device) | |
| outputs = model.generate( | |
| inputs, | |
| max_new_tokens=512, | |
| do_sample=True, | |
| temperature=0.2, | |
| top_p=0.95 | |
| ) | |
| response = tokenizer.decode(outputs[0][inputs.shape[1]:], skip_special_tokens=True) | |
| print(response) | |
| ``` | |
| --- | |
| license: mit | |
| language: | |
| - en | |
| base_model: | |
| - microsoft/Phi-4-mini-instruct | |
| --- |