Flexan/elsiddik-finsec_detector-GGUF

GGUF Files for finsec_detector

These are the GGUF files for elsiddik/finsec_detector.

Note: this model has only been quantized to Q2_K, Q4_K_M, and Q8_0. Other quantizations may become available later.

Downloads

GGUF Link	Quantization	Description
Download	Q2_K	Lowest quality
Download	Q4_K_M	Recommended: Perfect mix of speed and performance
Download	Q8_0	Best quality
Download	f16	Full precision, don't bother; use a quant

Note from Flexan

I provide GGUFs and quantizations of publicly available models that do not have a GGUF equivalent available yet, usually for models I deem interesting and wish to try out.

If there are some quants missing that you'd like me to add, you may request one in the community tab. If you want to request a public model to be converted, you can also request that in the community tab. If you have questions regarding this model, please refer to the original model repo.

You can find more info about me and what I do here.

FineSec-Detector: Specialized Security LLM (Qwen2.5-Coder-7B-Instruct)

FineSec-Detector is a 7B parameter specialized cybersecurity Large Language Model fine-tuned on high-precision CVE vulnerability reports, real-world exploit benchmarks, and secure code repair patterns using Unsloth 4-bit QLoRA.

The model acts as an automated Senior Application Security (AppSec) Auditor. It audits source code, identifies vulnerabilities, classifies severity and CWE IDs, and produces ready-to-merge secure code patches in structured JSON.

---

Verified Benchmark Performance

Evaluating FineSec-Detector on multi-language vulnerability benchmarks (SQL Injection, RCE, XSS, Path Traversal, Insecure Deserialization, Buffer Overflows) yielded the following performance metrics:

Metric	Score	Rating	Analysis
Precision Rate	100.0%	Perfect	Zero false positives. Safe code is never misflagged.
Detection Recall	83.3%	High	High-confidence detection across Python, C, JS, and Go.
F1 Rating Score	90.9%	Outstanding	Superior overall vulnerability detection balance.

---

Key Features

• Automated Vulnerability Detection: Audits Python, C/C++, JavaScript, Go, PHP, Java, and Bash source code.
• Structured JSON Output: Produces standardized security reports suitable for CI/CD pipeline integration.
• CWE and Severity Classification: Classifies bugs into standard CWE categories (e.g., CWE-89 SQLi, CWE-79 XSS, CWE-78 RCE, CWE-120 Buffer Overflow) with CVSS-aligned severity levels (CRITICAL, HIGH, MEDIUM, LOW).
• Remediation and Patching: Generates diffs and secure code refactors directly replacing vulnerable logic.

---

Quickstart: Inference

1. Using Unsloth (Fast and Memory Efficient)

from unsloth import FastLanguageModel

# Load model and tokenizer from Hugging Face Hub
model, tokenizer = FastLanguageModel.from_pretrained(
    model_name = "elsiddik/finsec_detector",
    max_seq_length = 1024,
    load_in_4bit = True,
)
FastLanguageModel.for_inference(model)

# Security audit prompt
prompt = """### System Prompt:
You are FineSec-AI, an expert Application Security Engineer. Analyze code snippet for vulnerabilities and output JSON report with fields: 'vulnerabilities' (list of objects with severity, cwe, description, vulnerable_line, fix_code).

### Input Code:
```python
import sqlite3

def login(username, password):
    conn = sqlite3.connect('users.db')
    cursor = conn.cursor()
    query = f"SELECT * FROM users WHERE username = '{username}' AND password = '{password}'"
    cursor.execute(query)
    return cursor.fetchone()

Security Analysis (JSON):"""

inputs = tokenizer(prompt, return_tensors="pt").to("cuda") outputs = model.generate(**inputs, max_new_tokens=512, use_cache=True) print(tokenizer.decode(outputs[0][inputs.input_ids.shape[1]:], skip_special_tokens=True))

---

## Sample Output (Structured JSON)

```json
{
  "is_vulnerable": true,
  "severity": "CRITICAL",
  "cwe": "CWE-89",
  "vulnerability_type": "SQL Injection",
  "description": "User input is directly concatenated into the SQL query string without parameterization, allowing unauthenticated SQL injection.",
  "vulnerable_code": "query = f\"SELECT * FROM users WHERE username = '{username}' AND password = '{password}'\"",
  "remediation": "Use parameterized SQL queries with placeholder parameters.",
  "fixed_code": "query = 'SELECT * FROM users WHERE username = ? AND password = ?'\ncursor.execute(query, (username, password))"
}

---

Model Details

Attribute	Details
Base Architecture	Qwen2.5-Coder-7B-Instruct
Fine-Tuning Method	QLoRA 4-bit (Unsloth)
LoRA Target Modules	q_proj, k_proj, v_proj, o_proj, gate_proj, up_proj, down_proj
LoRA Rank (r)	16
LoRA Alpha	32
Context Window	1024 tokens
License	Apache-2.0

---

Intended Use and Disclaimer

FineSec-Detector is designed for defensive security purposes, code auditing, secure code development, and AppSec integration. Users are responsible for exercising due diligence when integrating model output into production systems.