Instructions to use anicka/cve-backport-codegen-qwen25-32b with libraries, inference providers, notebooks, and local apps. Follow these links to get started.

Notebooks
Google Colab
Kaggle
Local Apps Settings

How to use anicka/cve-backport-codegen-qwen25-32b with llama.cpp:

Install (macOS, Linux)

curl -LsSf https://llama.app/install.sh | sh
# Start a local OpenAI-compatible server with a web UI:
llama serve -hf anicka/cve-backport-codegen-qwen25-32b:Q8_0
# Run inference directly in the terminal:
llama cli -hf anicka/cve-backport-codegen-qwen25-32b:Q8_0

Install from WinGet (Windows)

winget install llama.cpp
# Start a local OpenAI-compatible server with a web UI:
llama serve -hf anicka/cve-backport-codegen-qwen25-32b:Q8_0
# Run inference directly in the terminal:
llama cli -hf anicka/cve-backport-codegen-qwen25-32b:Q8_0

Use pre-built binary

# Download pre-built binary from:
# https://github.com/ggerganov/llama.cpp/releases
# Start a local OpenAI-compatible server with a web UI:
./llama-server -hf anicka/cve-backport-codegen-qwen25-32b:Q8_0
# Run inference directly in the terminal:
./llama-cli -hf anicka/cve-backport-codegen-qwen25-32b:Q8_0

Build from source code

git clone https://github.com/ggerganov/llama.cpp.git
cd llama.cpp
cmake -B build
cmake --build build -j --target llama-server llama-cli
# Start a local OpenAI-compatible server with a web UI:
./build/bin/llama-server -hf anicka/cve-backport-codegen-qwen25-32b:Q8_0
# Run inference directly in the terminal:
./build/bin/llama-cli -hf anicka/cve-backport-codegen-qwen25-32b:Q8_0

Use Docker

docker model run hf.co/anicka/cve-backport-codegen-qwen25-32b:Q8_0

LM Studio
Jan

vLLM

How to use anicka/cve-backport-codegen-qwen25-32b with vLLM:

Install from pip and serve model

# Install vLLM from pip:
pip install vllm
# Start the vLLM server:
vllm serve "anicka/cve-backport-codegen-qwen25-32b"
# Call the server using curl (OpenAI-compatible API):
curl -X POST "http://localhost:8000/v1/chat/completions" \
	-H "Content-Type: application/json" \
	--data '{
		"model": "anicka/cve-backport-codegen-qwen25-32b",
		"messages": [
			{
				"role": "user",
				"content": "What is the capital of France?"
			}
		]
	}'

Use Docker

docker model run hf.co/anicka/cve-backport-codegen-qwen25-32b:Q8_0

Ollama
How to use anicka/cve-backport-codegen-qwen25-32b with Ollama:
```
ollama run hf.co/anicka/cve-backport-codegen-qwen25-32b:Q8_0
```

Unsloth Studio

How to use anicka/cve-backport-codegen-qwen25-32b with Unsloth Studio:

Install Unsloth Studio (macOS, Linux, WSL)

curl -fsSL https://unsloth.ai/install.sh | sh
# Run unsloth studio
unsloth studio -H 0.0.0.0 -p 8888
# Then open http://localhost:8888 in your browser
# Search for anicka/cve-backport-codegen-qwen25-32b to start chatting

Install Unsloth Studio (Windows)

irm https://unsloth.ai/install.ps1 | iex
# Run unsloth studio
unsloth studio -H 0.0.0.0 -p 8888
# Then open http://localhost:8888 in your browser
# Search for anicka/cve-backport-codegen-qwen25-32b to start chatting

Using HuggingFace Spaces for Unsloth

# No setup required
# Open https://huggingface.co/spaces/unsloth/studio in your browser
# Search for anicka/cve-backport-codegen-qwen25-32b to start chatting

How to use anicka/cve-backport-codegen-qwen25-32b with Pi:

Start the llama.cpp server

# Install llama.cpp:
brew install llama.cpp
# Start a local OpenAI-compatible server:
llama serve -hf anicka/cve-backport-codegen-qwen25-32b:Q8_0

Configure the model in Pi

# Install Pi:
npm install -g @mariozechner/pi-coding-agent
# Add to ~/.pi/agent/models.json:
{
  "providers": {
    "llama-cpp": {
      "baseUrl": "http://localhost:8080/v1",
      "api": "openai-completions",
      "apiKey": "none",
      "models": [
        {
          "id": "anicka/cve-backport-codegen-qwen25-32b:Q8_0"
        }
      ]
    }
  }
}

Run Pi

# Start Pi in your project directory:
pi

Docker Model Runner
How to use anicka/cve-backport-codegen-qwen25-32b with Docker Model Runner:
```
docker model run hf.co/anicka/cve-backport-codegen-qwen25-32b:Q8_0
```

Lemonade

How to use anicka/cve-backport-codegen-qwen25-32b with Lemonade:

Pull the model

# Download Lemonade from https://lemonade-server.ai/
lemonade pull anicka/cve-backport-codegen-qwen25-32b:Q8_0

Run and chat with the model

lemonade run user.cve-backport-codegen-qwen25-32b-Q8_0

List all available models

lemonade list

Hermes Agent

How to use anicka/cve-backport-codegen-qwen25-32b with Hermes Agent:

Start the llama.cpp server

# Install llama.cpp:
brew install llama.cpp
# Start a local OpenAI-compatible server:
llama serve -hf anicka/cve-backport-codegen-qwen25-32b:Q8_0

Configure Hermes

# Install Hermes:
curl -fsSL https://hermes-agent.nousresearch.com/install.sh | bash
hermes setup
# Point Hermes at the local server:
hermes config set model.provider custom
hermes config set model.base_url http://127.0.0.1:8080/v1
hermes config set model.default anicka/cve-backport-codegen-qwen25-32b:Q8_0

Run Hermes

hermes

Atomic Chat

OpenClaw

How to use anicka/cve-backport-codegen-qwen25-32b with OpenClaw:

Start the llama.cpp server

# Install llama.cpp:
brew install llama.cpp
# Start a local OpenAI-compatible server:
llama serve -hf anicka/cve-backport-codegen-qwen25-32b:Q8_0

Configure OpenClaw

# Install OpenClaw:
npm install -g openclaw@latest
# Register the local server and set it as the default model:
openclaw onboard --non-interactive --mode local \
  --auth-choice custom-api-key \
  --custom-base-url http://127.0.0.1:8080/v1 \
  --custom-model-id "anicka/cve-backport-codegen-qwen25-32b:Q8_0" \
  --custom-provider-id llama-cpp \
  --custom-compatibility openai \
  --custom-text-input \
  --accept-risk \
  --skip-health

Run OpenClaw

openclaw agent --local --agent main --message "Hello from Hugging Face"

anicka commited on Mar 28

Commit

22e2b5b

verified ·

1 Parent(s): 4b854c4

v4 model card: 93% recall, test generation, Gemini comparison

Browse files

Files changed (1) hide show

README.md +103 -59

README.md CHANGED Viewed

@@ -5,6 +5,7 @@ tags:
   - security
   - patch-backporting
   - code-generation
   - qwen2
   - qlora
   - opensuse
@@ -15,70 +16,73 @@ language:
 pipeline_tag: text-generation
 ---
-# CVE Backport Code Generation — Qwen2.5-Coder-32B
-Fine-tuned [Qwen2.5-Coder-32B-Instruct](https://huggingface.co/Qwen/Qwen2.5-Coder-32B-Instruct) for security patch backporting via per-hunk code generation.
-Instead of generating unified diffs directly, this model takes a vulnerable code region and a fix description, and outputs the **fixed version of the code**. A programmatic diff then produces the final patch. This plays to LLM strengths in code completion and avoids format-sensitivity issues.
 ## Quick Start
-The easiest way to use this model is with the **[cve-backport-tool](https://github.com/openSUSE/cve-backport-tool)** CLI, which handles the full pipeline: parse upstream patch, extract per-hunk regions, call the model, and reconstruct a unified diff.
 ```bash
-# Download and serve the model
-./setup.sh
-# Generate a backport patch
 python3 cve-backport.py \
-    --cve CVE-2025-3887 \
-    --package gstreamer-plugins-bad \
-    --patch upstream.patch \
-    --obs-fetch --backend openai --retry 3
 ```
 ## GGUF Downloads
-| File | Quant | Size | Dataset | Notes |
-|------|-------|------|---------|-------|
-| `cve-backport-codegen-v3-q8_0.gguf` | Q8_0 | 33 GB | 35,667 examples | **Recommended** — highest precision |
-| `cve-backport-codegen-v2-q8_0.gguf` | Q8_0 | 33 GB | 24,452 examples | Previous release |
-| `cve-backport-codegen-v1-q8_0.gguf` | Q8_0 | 33 GB | 17,007 examples | First release |
-Older GGUFs (v1, v2) are available in the [legacy repo](https://huggingface.co/anicka/cve-backport-codegen-qwen25-32b-v1).
-## Evaluation
-Per-hunk evaluation on held-out test cases the model never saw during training:
-| Metric | v1 | v2 | v3 |
-|--------|----|----|-----|
-| Average recall | 91% | 94% | **94%** |
-| Average precision | — | 93% | **98%** |
-| Exact match | — | 15/20 | **16/20** |
-| Perfect hunks (>=95%) | 16/18 | 17/20 | **17/20** |
-| Fail (<10%) | 1/18 | 0/20 | **0/20** |
 By tier:
-- **Identical** (upstream patch applies directly): 95% recall, 98% precision
-- **Adapted** (line numbers/context differ): 89% recall, 97% precision
-## Training Details
-| | v1 | v2 | v3 |
-|-|----|----|-----|
-| Dataset | 17,007 | 24,452 | **35,667** |
-| Learning rate | 2e-4 | 2e-4 | **1e-4** |
-| Epochs | 2 | 2 | 2 |
-| Training time | 13h | 27h | 41h |
-| Hardware | H100 NVL | H100 NVL | H100 NVL |
-| Method | QLoRA r=64 α=128 | QLoRA r=64 α=128 | QLoRA r=64 α=128 |
-v3 uses a lower learning rate (1e-4 vs 2e-4) for stability with the larger dataset, and includes data quality filtering to remove toxic examples (XML test data, huge outputs) that caused training instability in earlier runs.
 ## Prompt Format
-ChatML format. Each prompt covers one hunk region with 15 lines of context padding:
 **System:**
 ```
@@ -94,37 +98,77 @@ Rules:
 ```
 **User:**
-```
-## File: lib/url.c
-## Lines: 100-130
-\`\`\`c
-<vulnerable source code region>
-\`\`\`
 ## Fix
-CVE-2024-1234: fix buffer overflow in url_parse()
-\`\`\`diff
-<upstream patch>
-\`\`\`
 ```
-**Assistant:** (the fixed source code, raw, no fences)
 ## Training Data
-**[anicka/cve-backport-codegen-dataset](https://huggingface.co/datasets/anicka/cve-backport-codegen-dataset)** — 35,667 per-hunk examples from openSUSE maintenance patches, covering 90+ packages and 2,300+ CVEs.
-## Intended Use
-This model assists with security patch backporting in Linux distribution maintenance. It is a research tool — all generated patches must be reviewed by a maintainer before application. "Applies and builds" validates mechanical correctness, not semantic correctness.
-## Links
-- **Tool**: [github.com/openSUSE/cve-backport-tool](https://github.com/openSUSE/cve-backport-tool)
-- **Dataset**: [anicka/cve-backport-codegen-dataset](https://huggingface.co/datasets/anicka/cve-backport-codegen-dataset)
-- **Legacy repo** (v1/v2 GGUFs + safetensors): [anicka/cve-backport-codegen-qwen25-32b-v1](https://huggingface.co/anicka/cve-backport-codegen-qwen25-32b-v1)
 ## License

   - security
   - patch-backporting
   - code-generation
+  - test-generation
   - qwen2
   - qlora
   - opensuse
 pipeline_tag: text-generation
 ---
+# CVE Backport Code Generation — Qwen2.5-Coder-32B (v4)
+Fine-tuned [Qwen2.5-Coder-32B-Instruct](https://huggingface.co/Qwen/Qwen2.5-Coder-32B-Instruct) for security patch backporting via per-hunk code generation, with CVE test case generation.
+Instead of generating unified diffs, this model takes a vulnerable code region and a fix description, and outputs the **fixed version of the code**. A programmatic diff then produces the final patch. Optionally, the model can also generate a **test case** that verifies the fix.
 ## Quick Start
 ```bash
+git clone https://github.com/openSUSE/cve-backport-tool
+cd cve-backport-tool
+./setup.sh                  # downloads GGUF, registers with ollama
 python3 cve-backport.py \
+    --cve CVE-2024-1234 \
+    --package curl \
+    --patch upstream-fix.patch \
+    --obs-fetch --obs-project openSUSE:Leap:15.6:Update \
+    --retry 3
 ```
 ## GGUF Downloads
+| File | Quant | Size | Notes |
+|------|-------|------|-------|
+| `cve-backport-codegen-v4-q8_0.gguf` | Q8_0 | 33 GB | **Recommended** (v4, 36K dataset + test generation) |
+| `cve-backport-codegen-v3-q8_0.gguf` | Q8_0 | 33 GB | v3 (35K dataset, 98% precision) |
+## Evaluation (v4)
+Per-hunk evaluation on 100 held-out examples the model never saw during training:
+| Metric | v3 (n=20) | v4 (n=100) |
+|--------|-----------|------------|
+| Average recall | 94% | **93%** |
+| Average precision | 98% | **95%** |
+| Exact match | 16/20 | **87/100** |
+| Failures (<10%) | 0/20 | **4/100** |
 By tier:
+- **Identical** (upstream patch applies directly): 94% recall
+- **Adapted** (line numbers/context differ): 86% recall
+### Test Generation (new in v4)
+50 held-out CVEs with known reference tests:
+- Average quality score: **0.67**
+- All 50 produced structurally valid tests
+- 17/50 matched reference test exactly
+### Comparison with Frontier Models
+Same eval, same 100 examples, optimized prompts with markdown stripping:
+| Model | Recall | Precision | Exact | Failures |
+|-------|--------|-----------|-------|----------|
+| **CVE Backport v4** (32B fine-tuned) | **93%** | **95%** | **87/100** | **4** |
+| Gemini 3.1 Pro (frontier, zero-shot) | 27% | 24% | 10/100 | 50 |
+| Gemini 2.0 Flash (frontier, zero-shot) | 13% | 17% | 4/100 | 81 |
+Fine-tuning on 36K domain-specific examples outperforms frontier models by 3-7x on this task.
 ## Prompt Format
+ChatML format. Each prompt covers one hunk region with 15 lines of context padding.
+### Code Generation (3-turn)
 **System:**
 ```
 ```
 **User:**
+````
+## File: lib/ftp.c
+## Lines: 2836-2912
+```c
+{vulnerable code region with 15-line padding}
+```
 ## Fix
+CVE-2017-8817: FTP wildcard matching — zero terminate the entry path
+```diff
+{upstream patch}
+```
+````
+**Assistant:** The fixed code (same region with the security fix applied).
+### Test Generation (5-turn, new in v4)
+After the code generation turn, an optional second turn:
+**User:**
+```
+Write a test case that:
+1. Triggers the vulnerability in the original code above
+2. Passes after applying your fix
+Output ONLY the test code, nothing else.
 ```
+**Assistant:** Test code targeting the specific CVE.
+## Training
+| | |
+|-|-|
+| Base model | Qwen2.5-Coder-32B-Instruct |
+| Method | QLoRA (4-bit NF4, r=64, alpha=128) |
+| Epochs | 2 |
+| Learning rate | 1e-4 |
+| Max sequence length | 4,096 tokens |
+| Batch size | 1 (gradient accumulation 8) |
+| Training examples | 36,166 (35,396 codegen + 770 codegen+test) |
+| Training time | 41.2 hours |
+| Hardware | 2x NVIDIA H100 NVL 94GB |
+| Label masking | Multi-turn aware (both assistant segments trained) |
 ## Training Data
+**[anicka/cve-backport-codegen-dataset](https://huggingface.co/datasets/anicka/cve-backport-codegen-dataset)** — 36,166 per-hunk examples from openSUSE maintenance patches, covering 145+ packages and 2,300+ CVEs, with per-example SPDX license metadata.
+## Reproducibility
+Trained using the [Teapot](https://github.com/anicka-net/teapot) composable training pipeline:
+```bash
+teapot compose configs/cve-backport.config
+teapot train configs/cve-backport.config --backend qlora-hf
+teapot eval configs/cve-backport.config
+```
+All versioned datasets available at the dataset repo (`train-v1.jsonl` through `train-v4.jsonl`).
+## How It Was Built
+This model, tool, dataset pipeline, and training infrastructure were developed by Claude (Anthropic) with code review by Codex (OpenAI), under the direction of Anna Maresova (SUSE Engineering).
+## Intended Use
+This model assists with security patch backporting in Linux distribution maintenance. It is a research tool — all generated patches must be reviewed by a maintainer before application.
 ## License