Instructions to use exploitintel/cve-cwe-qwen3-8b with libraries, inference providers, notebooks, and local apps. Follow these links to get started.

Libraries

How to use exploitintel/cve-cwe-qwen3-8b with Transformers:

# Use a pipeline as a high-level helper
from transformers import pipeline

pipe = pipeline("text-generation", model="exploitintel/cve-cwe-qwen3-8b")
messages = [
    {"role": "user", "content": "Who are you?"},
]
pipe(messages)

# Load model directly
from transformers import AutoTokenizer, AutoModelForCausalLM

tokenizer = AutoTokenizer.from_pretrained("exploitintel/cve-cwe-qwen3-8b")
model = AutoModelForCausalLM.from_pretrained("exploitintel/cve-cwe-qwen3-8b")
messages = [
    {"role": "user", "content": "Who are you?"},
]
inputs = tokenizer.apply_chat_template(
	messages,
	add_generation_prompt=True,
	tokenize=True,
	return_dict=True,
	return_tensors="pt",
).to(model.device)

outputs = model.generate(**inputs, max_new_tokens=40)
print(tokenizer.decode(outputs[0][inputs["input_ids"].shape[-1]:]))

llama-cpp-python

How to use exploitintel/cve-cwe-qwen3-8b with llama-cpp-python:

# !pip install llama-cpp-python

from llama_cpp import Llama

llm = Llama.from_pretrained(
	repo_id="exploitintel/cve-cwe-qwen3-8b",
	filename="qwen3-8b.Q4_K_M.gguf",
)

llm.create_chat_completion(
	messages = [
		{
			"role": "user",
			"content": "What is the capital of France?"
		}
	]
)

Inference
Notebooks
Google Colab
Kaggle
Local Apps Settings

llama.cpp

How to use exploitintel/cve-cwe-qwen3-8b with llama.cpp:

Install from brew

brew install llama.cpp
# Start a local OpenAI-compatible server with a web UI:
llama-server -hf exploitintel/cve-cwe-qwen3-8b:Q4_K_M
# Run inference directly in the terminal:
llama-cli -hf exploitintel/cve-cwe-qwen3-8b:Q4_K_M

Install from WinGet (Windows)

winget install llama.cpp
# Start a local OpenAI-compatible server with a web UI:
llama-server -hf exploitintel/cve-cwe-qwen3-8b:Q4_K_M
# Run inference directly in the terminal:
llama-cli -hf exploitintel/cve-cwe-qwen3-8b:Q4_K_M

Use pre-built binary

# Download pre-built binary from:
# https://github.com/ggerganov/llama.cpp/releases
# Start a local OpenAI-compatible server with a web UI:
./llama-server -hf exploitintel/cve-cwe-qwen3-8b:Q4_K_M
# Run inference directly in the terminal:
./llama-cli -hf exploitintel/cve-cwe-qwen3-8b:Q4_K_M

Build from source code

git clone https://github.com/ggerganov/llama.cpp.git
cd llama.cpp
cmake -B build
cmake --build build -j --target llama-server llama-cli
# Start a local OpenAI-compatible server with a web UI:
./build/bin/llama-server -hf exploitintel/cve-cwe-qwen3-8b:Q4_K_M
# Run inference directly in the terminal:
./build/bin/llama-cli -hf exploitintel/cve-cwe-qwen3-8b:Q4_K_M

Use Docker

docker model run hf.co/exploitintel/cve-cwe-qwen3-8b:Q4_K_M

LM Studio
Jan

vLLM

How to use exploitintel/cve-cwe-qwen3-8b with vLLM:

Install from pip and serve model

# Install vLLM from pip:
pip install vllm
# Start the vLLM server:
vllm serve "exploitintel/cve-cwe-qwen3-8b"
# Call the server using curl (OpenAI-compatible API):
curl -X POST "http://localhost:8000/v1/chat/completions" \
	-H "Content-Type: application/json" \
	--data '{
		"model": "exploitintel/cve-cwe-qwen3-8b",
		"messages": [
			{
				"role": "user",
				"content": "What is the capital of France?"
			}
		]
	}'

Use Docker

docker model run hf.co/exploitintel/cve-cwe-qwen3-8b:Q4_K_M

SGLang

How to use exploitintel/cve-cwe-qwen3-8b with SGLang:

Install from pip and serve model

# Install SGLang from pip:
pip install sglang
# Start the SGLang server:
python3 -m sglang.launch_server \
    --model-path "exploitintel/cve-cwe-qwen3-8b" \
    --host 0.0.0.0 \
    --port 30000
# Call the server using curl (OpenAI-compatible API):
curl -X POST "http://localhost:30000/v1/chat/completions" \
	-H "Content-Type: application/json" \
	--data '{
		"model": "exploitintel/cve-cwe-qwen3-8b",
		"messages": [
			{
				"role": "user",
				"content": "What is the capital of France?"
			}
		]
	}'

Use Docker images

docker run --gpus all \
    --shm-size 32g \
    -p 30000:30000 \
    -v ~/.cache/huggingface:/root/.cache/huggingface \
    --env "HF_TOKEN=<secret>" \
    --ipc=host \
    lmsysorg/sglang:latest \
    python3 -m sglang.launch_server \
        --model-path "exploitintel/cve-cwe-qwen3-8b" \
        --host 0.0.0.0 \
        --port 30000
# Call the server using curl (OpenAI-compatible API):
curl -X POST "http://localhost:30000/v1/chat/completions" \
	-H "Content-Type: application/json" \
	--data '{
		"model": "exploitintel/cve-cwe-qwen3-8b",
		"messages": [
			{
				"role": "user",
				"content": "What is the capital of France?"
			}
		]
	}'

Ollama
How to use exploitintel/cve-cwe-qwen3-8b with Ollama:
```
ollama run hf.co/exploitintel/cve-cwe-qwen3-8b:Q4_K_M
```

Unsloth Studio

How to use exploitintel/cve-cwe-qwen3-8b with Unsloth Studio:

Install Unsloth Studio (macOS, Linux, WSL)

curl -fsSL https://unsloth.ai/install.sh | sh
# Run unsloth studio
unsloth studio -H 0.0.0.0 -p 8888
# Then open http://localhost:8888 in your browser
# Search for exploitintel/cve-cwe-qwen3-8b to start chatting

Install Unsloth Studio (Windows)

irm https://unsloth.ai/install.ps1 | iex
# Run unsloth studio
unsloth studio -H 0.0.0.0 -p 8888
# Then open http://localhost:8888 in your browser
# Search for exploitintel/cve-cwe-qwen3-8b to start chatting

Using HuggingFace Spaces for Unsloth

# No setup required
# Open https://huggingface.co/spaces/unsloth/studio in your browser
# Search for exploitintel/cve-cwe-qwen3-8b to start chatting

How to use exploitintel/cve-cwe-qwen3-8b with Pi:

Start the llama.cpp server

# Install llama.cpp:
brew install llama.cpp
# Start a local OpenAI-compatible server:
llama-server -hf exploitintel/cve-cwe-qwen3-8b:Q4_K_M

Configure the model in Pi

# Install Pi:
npm install -g @mariozechner/pi-coding-agent
# Add to ~/.pi/agent/models.json:
{
  "providers": {
    "llama-cpp": {
      "baseUrl": "http://localhost:8080/v1",
      "api": "openai-completions",
      "apiKey": "none",
      "models": [
        {
          "id": "exploitintel/cve-cwe-qwen3-8b:Q4_K_M"
        }
      ]
    }
  }
}

Run Pi

# Start Pi in your project directory:
pi

Hermes Agent new

How to use exploitintel/cve-cwe-qwen3-8b with Hermes Agent:

Start the llama.cpp server

# Install llama.cpp:
brew install llama.cpp
# Start a local OpenAI-compatible server:
llama-server -hf exploitintel/cve-cwe-qwen3-8b:Q4_K_M

Configure Hermes

# Install Hermes:
curl -fsSL https://hermes-agent.nousresearch.com/install.sh | bash
hermes setup
# Point Hermes at the local server:
hermes config set model.provider custom
hermes config set model.base_url http://127.0.0.1:8080/v1
hermes config set model.default exploitintel/cve-cwe-qwen3-8b:Q4_K_M

Run Hermes

hermes

Docker Model Runner
How to use exploitintel/cve-cwe-qwen3-8b with Docker Model Runner:
```
docker model run hf.co/exploitintel/cve-cwe-qwen3-8b:Q4_K_M
```

Lemonade

How to use exploitintel/cve-cwe-qwen3-8b with Lemonade:

Pull the model

# Download Lemonade from https://lemonade-server.ai/
lemonade pull exploitintel/cve-cwe-qwen3-8b:Q4_K_M

Run and chat with the model

lemonade run user.cve-cwe-qwen3-8b-Q4_K_M

List all available models

lemonade list

Exploit Intel commited on 5 days ago

Commit

0b5983c

verified ·

1 Parent(s): 14f09b4

Add model card with eval results (exact 0.676 / micro 0.702 / macro 0.511)

Browse files

Files changed (1) hide show

README.md +96 -0

README.md ADDED Viewed

	@@ -0,0 +1,96 @@

+---
+license: apache-2.0
+base_model: Qwen/Qwen3-8B
+datasets:
+  - eiphuggincve/cve-cwe-consensus
+language:
+  - en
+tags:
+  - cybersecurity
+  - vulnerability
+  - cve
+  - cwe
+  - text-classification
+  - qlora
+  - unsloth
+pipeline_tag: text-generation
+library_name: transformers
+---
+# CVE → CWE Classifier (Qwen3-8B)
+A QLoRA fine-tune of **Qwen3-8B** that maps a free-text **CVE description** to the **CWE weakness
+ID(s)** it corresponds to. The LoRA adapter is merged into the base and released in 16-bit, so it
+loads directly with `transformers`.
+Trained only on labels where **NVD and the CNA agree** after roll-up to **CWE View-1003** — see the
+[`cve-cwe-consensus`](https://huggingface.co/datasets/eiphuggincve/cve-cwe-consensus) dataset.
+## Results (held-out test split, 6,802 rows)
+| Metric | This model | Prior baseline |
+|---|---|---|
+| Exact-match | **0.676** | 0.29 |
+| Micro-F1 | **0.702** | 0.32 |
+| Macro-F1 (125 CWEs) | **0.511** | 0.067 |
+By difficulty (does the description *name* the weakness, or must it be inferred?):
+| Stratum | n | Exact-match | Micro-F1 |
+|---|---|---|---|
+| Easy (weakness named) | 2,046 | 0.841 | 0.870 |
+| Hard (must infer) | 4,756 | 0.605 | 0.628 |
+The high macro-F1 reflects a dataset that caps majority CWEs (e.g. CWE-79) so rare weaknesses are
+actually learned rather than drowned out.
+## Usage
+```python
+import torch
+from transformers import AutoModelForCausalLM, AutoTokenizer
+mid = "eiphuggincve/cve-cwe-qwen3-8b"
+tok = AutoTokenizer.from_pretrained(mid)
+model = AutoModelForCausalLM.from_pretrained(mid, torch_dtype="auto", device_map="auto")
+messages = [
+    {"role": "system", "content": "You are a vulnerability analyst. Given a CVE description, "
+                                   "reply with only the CWE ID(s) it maps to, comma-separated."},
+    {"role": "user", "content": "A SQL injection vulnerability in the login endpoint allows an "
+                                "unauthenticated attacker to execute arbitrary SQL via the username parameter."},
+]
+inputs = tok.apply_chat_template(messages, add_generation_prompt=True, return_tensors="pt").to(model.device)
+out = model.generate(inputs, max_new_tokens=32, do_sample=False)
+print(tok.decode(out[0][inputs.shape[-1]:], skip_special_tokens=True))
+# -> CWE-89
+```
+## Training
+- **Base:** `Qwen/Qwen3-8B` (trained 4-bit via `unsloth/qwen3-8b-unsloth-bnb-4bit`)
+- **Method:** QLoRA (4-bit) with Unsloth, merged to 16-bit · released checkpoint: **checkpoint-960** (final; eval loss declined monotonically through training)
+- **Dataset:** [`eiphuggincve/cve-cwe-consensus`](https://huggingface.co/datasets/eiphuggincve/cve-cwe-consensus) — 69,386 rows (55,810 / 6,774 / 6,802), majority CWEs capped at 2,500
+- **Epochs:** 2 · **Context:** 512 · **LR:** 2e-4 · **Optimizer:** AdamW 8-bit · **Scheduler:** linear · **Batch:** 32 · **Weight decay:** 0.01 · **Seed:** 3407
+- **LoRA:** rank 16 / alpha 32 / dropout 0 · **Packing:** on · **Train-on-completions-only:** off
+## Prompt format
+ChatML (Qwen3 standard). System prompt fixed; the description is the only user input — never feed the
+label or CVE-ID.
+- **system:** `You are a vulnerability analyst. Given a CVE description, reply with only the CWE ID(s) it maps to, comma-separated.`
+- **user:** the CVE description
+- **assistant:** `CWE-79, CWE-80`
+## Limitations
+- CWEs below the dataset's 50-example floor are not in the label space and won't be predicted.
+- Outputs CWE IDs as text and can occasionally emit a malformed/non-existent ID — validate against
+  the official CWE list.
+- English-only; descriptions only (no code, CVSS, or references).
+- A triage/assist aid, not an authoritative CWE assignment — human-review before acting.
+## License
+Apache-2.0 (inherited from Qwen3-8B). Dataset derives from public upstreams (NVD, MITRE CVE/CWE).