README.md

---
license: apache-2.0
base_model: Qwen/Qwen2.5-Coder-7B-Instruct
library_name: peft
tags:
  - cybersecurity
  - penetration-testing
  - exploit-development
  - offensive-security
  - lora
  - qwen
  - code
datasets:
  - ezradixon/zerosectraining
language:
  - en
pipeline_tag: text-generation
---

# ZeroSec-7B 🔴

A QLoRA fine-tune of Qwen2.5-Coder-7B on 29,588 exploit and security samples.

**Built by [The Zero Project](https://github.com/ezradixon) — use only for authorized security testing.**

## What is this?

ZeroSec-7B is a specialist language model trained exclusively on offensive security data:
- **15,023 exploit code files** (Python, C, Perl, Ruby, PHP) from ExploitDB
- **13,468 vulnerability detection rules** from Nuclei templates
- **576 attack payloads** from PayloadsAllTheThings (SQLi, XSS, CMDi, SSTI, SSRF, etc.)
- **523 methodology & reference documents** on exploitation techniques

It's designed to assist with legitimate penetration testing, vulnerability research, and security education.

## Quick Start

### Option 1: Merge + run locally (recommended)

```bash
# 1. Download the LoRA adapter
git lfs install
git clone https://huggingface.co/ezradixon/ZeroSec-7B

# 2. Merge with base model
python merge_and_export.py

# 3. Quantize for local inference (Mac/CPU)
llama-quantize merged-model-f16.gguf Q4_K_M zerosect-7b-Q4_K_M.gguf

# 4. Run
llama-server -m zerosect-7b-Q4_K_M.gguf -ngl 99
```

### Option 2: Python inference

```python
from transformers import AutoModelForCausalLM, AutoTokenizer
from peft import PeftModel
import torch

base_model = "Qwen/Qwen2.5-Coder-7B-Instruct"
model = AutoModelForCausalLM.from_pretrained(
    base_model,
    torch_dtype=torch.float16,
    device_map="auto",
    trust_remote_code=True,
)
model = PeftModel.from_pretrained(model, "ezradixon/ZeroSec-7B")
model = model.merge_and_unload()

tokenizer = AutoTokenizer.from_pretrained(base_model, trust_remote_code=True)

prompt = "Write a Python script to check for SQL injection in a login form"
inputs = tokenizer(prompt, return_tensors="pt").to("cuda")
outputs = model.generate(**inputs, max_new_tokens=512)
print(tokenizer.decode(outputs[0], skip_special_tokens=True))
```

## Training Details

| Parameter | Value |
|---|---|
| Base model | Qwen/Qwen2.5-Coder-7B-Instruct |
| Method | QLoRA (4-bit quantization) |
| GPU | NVIDIA A10G (24GB) |
| Training samples | 29,588 |
| Max sequence length | 1024 tokens |
| Batch size | 2 (effective 8 with grad accum) |
| Epochs | 2 |
| Learning rate | 2e-4 |
| LoRA rank | 16, alpha 32 |
| Training time | ~2 hours |
| Cost | ~$2.00 (Modal serverless) |

## Limitations

- **7B parameters** — not as capable as larger models (GPT-4, Claude)
- **Training data quality varies** — ExploitDB contains legacy code that may not work on modern systems
- **No real-world validation** — exploits were not tested against live targets
- **English only** — training data is overwhelmingly English

## ⚠️ Disclaimer

**This model is for authorized security testing and education only.**

Do not use ZeroSec-7B for:
- Attacking systems without explicit written permission
- Developing malware or ransomware
- Any illegal activity whatsoever

The Zero Project and the model's creator are not responsible for any misuse.

## Author

**Ezra Dixon** — [The Zero Project](https://github.com/ezradixon)

Built on Modal cloud GPUs. 🇦🇺