| --- |
| license: apache-2.0 |
| language: |
| - en |
| - vi |
| - zh |
| tags: |
| - cybersecurity |
| - security-audit |
| - vulnerability-detection |
| - penetration-testing |
| - vision-language-model |
| - qwen |
| base_model: Qwen/Qwen3.8-27B |
| pipeline_tag: image-text-to-text |
| --- |
| |
| # Con0 |
|
|
| **Con0** is a state-of-the-art vision-language model specialized for **cyber |
| security**, developed by **Arcanic AI** in collaboration with **NextZero**. |
|
|
| Con0 is built to *think like a security auditor*. It reads code, logs, |
| screenshots, and infrastructure diagrams, and surfaces vulnerabilities - from |
| classic web-application flaws to the newest AI-agent attack surfaces - with |
| actionable remediation guidance. |
|
|
| ## What Con0 audits |
|
|
| ### Web & application security |
| - **SQL injection (SQLi)** - time-based, boolean-based, error-based, and blind |
| variants across query builders and ORMs |
| - **Cross-site scripting (XSS)** - reflected, stored, and DOM-based injection |
| - **Cross-site request forgery (CSRF)**, **server-side request forgery (SSRF)** |
| - **Command injection**, **path traversal**, **XXE**, **deserialization** |
| - Broken authentication, broken access control, and IDOR |
| - OWASP Top 10 coverage, code review, and secure-configuration assessment |
|
|
| ### AI & agent security |
| - Prompt injection and jailbreak surface analysis |
| - Tool-calling and function-dispatch misuse |
| - Least-privilege / permission-scope review |
| - Multi-step agent threat modeling |
|
|
| ### General security |
| - Vulnerability triage and CVE context mapping |
| - Incident analysis from logs, traces, and screenshots |
| - Secure-code guidance and remediation planning |
|
|
| ## Model architecture |
|
|
| - 27B parameters, hybrid **Gated DeltaNet** + full attention |
| - Native vision-language model (image + video + OCR) |
| - 262,144-token context window |
| - Flexible reasoning (thinking) control and tool calling |
|
|
| ## Benchmarks |
|
|
| > Benchmark evaluation is in progress and will be published here. |
|
|
| | Benchmark | Con0 | Baseline (Qwen3.8-27B) | |
| |---|---|---| |
| | SQLi Detection | *pending* | *pending* | |
| | XSS Detection | *pending* | *pending* | |
| | OWASP Top 10 (aggregate) | *pending* | *pending* | |
| | Secure Coding | *pending* | *pending* | |
| | Prompt-Injection Detection | *pending* | *pending* | |
| | MMLU | *pending* | 84.7 | |
| | GSM8K | *pending* | 90.0 | |
|
|
| ## Usage |
|
|
| ```python |
| from transformers import AutoModelForMultimodalLM, AutoProcessor |
| import torch |
| |
| model = AutoModelForMultimodalLM.from_pretrained( |
| "arcanicai/Con0", torch_dtype=torch.bfloat16, device_map="auto" |
| ) |
| processor = AutoProcessor.from_pretrained("arcanicai/Con0") |
| |
| messages = [{"role": "user", "content": "Review this code for SQL injection vulnerabilities."}] |
| text = processor.apply_chat_template(messages, tokenize=False, add_generation_prompt=True) |
| inputs = processor(text=[text], return_tensors="pt").to(model.device) |
| output = model.generate(**inputs, max_new_tokens=512) |
| print(processor.decode(output[0], skip_special_tokens=True)) |
| ``` |
|
|
| ## About the developers |
|
|
| Con0 is developed by **[Arcanic AI](https://arcanic.ai)**, a research lab focused on reliable and |
| secure AI systems, in partnership with **[NextZero](https://nextzero.vn)**. |
|
|
| ## License |
|
|
| Apache 2.0. |
|
|
