| --- |
| base_model: fdtn-ai/Foundation-Sec-8B-Instruct |
| library_name: peft |
| pipeline_tag: text-generation |
| tags: |
| - base_model:adapter:fdtn-ai/Foundation-Sec-8B-Instruct |
| - lora |
| - transformers |
| - cybersecurity |
| - vulnerability-remediation |
| - cve |
| --- |
| |
| # Model Card for Model ID |
|
|
| LoRA adapter for `fdtn-ai/Foundation-Sec-8B-Instruct` tuned for structured CVE remediation output. The model is designed to take CVE evidence and return a fixed seven-field JSON object containing severity, affected component, root cause, and remediation guidance. |
|
|
|
|
| ## Model Details |
|
|
| ### Model Description |
|
|
| This model is a parameter-efficient fine-tuning adapter built on top of `fdtn-ai/Foundation-Sec-8B-Instruct`. It is intended for structured vulnerability remediation assistance rather than open-ended chat. Given CVE evidence such as CVE ID, description, CVSS score, CWE, and affected component context, it generates a JSON response with a fixed schema: |
|
|
| - `cve_id` |
| - `severity` |
| - `affected_component` |
| - `technical_root_cause` |
| - `recommended_fix` |
| - `developer_remediation_steps` |
| - `verification_steps` |
|
|
| The adapter was evaluated in a Colab-based external benchmark on 100 CVE examples and showed strong schema adherence and high exact-match performance on most structured fields. |
|
|
| - **Developed by:** Ramitha Iddamalgoda |
| - **Funded by [optional]:** Self-directed |
| - **Shared by [optional]:** Ramitha Iddamalgoda |
| - **Model type:** LoRA adapter for causal language modeling |
| - **Language(s) (NLP):** English |
| - **License:** Apache 2.0 |
| - **Finetuned from model [optional]:** `fdtn-ai/Foundation-Sec-8B-Instruct` |
|
|
|
|
| ### Model Sources [optional] |
|
|
| - **Paper [optional]:** Not applicable |
| - **Demo [optional]:** Not available |
|
|
| ## Uses |
|
|
| ### Direct Use |
|
|
| This adapter is intended for structured CVE remediation tasks where the input contains vulnerability evidence and the desired output is a constrained JSON object. Likely uses include: |
|
|
| - vulnerability triage experiments |
| - structured remediation drafting |
| - evaluation workflows for CVE understanding |
| - prototype security assistant pipelines |
|
|
| ### Downstream Use |
|
|
| This adapter can be used inside larger systems that: |
|
|
| - collect CVE descriptions from vulnerability feeds |
| - normalize vulnerability information into a fixed schema |
| - generate remediation suggestions for analyst review |
| - compare structured output quality across model variants |
|
|
| ### Out-of-Scope Use |
|
|
| This model should not be used as: |
|
|
| - a fully autonomous security remediation engine |
| - a guaranteed-safe patch recommendation system |
| - a replacement for expert review in production security operations |
| - a general-purpose cybersecurity assistant outside its structured CVE task |
|
|
| ## Bias, Risks, and Limitations |
|
|
| This model inherits limitations from the base model and from its fine-tuning data. It may produce incomplete, incorrect, outdated, or oversimplified remediation guidance. Although it performs well on the reported benchmark, the benchmark is small and not a definitive production evaluation. |
|
|
| ### Recommendations |
|
|
| Use this model as an assistive tool, not an authoritative source. All outputs should be reviewed by a human with security context before operational use. When reporting results, describe them as an initial external benchmark rather than a final research-grade evaluation. |
|
|
| ## How to Get Started with the Model |
|
|
| Use the code below to get started with the model. |
|
|
| ```python |
| from transformers import AutoModelForCausalLM, AutoTokenizer |
| from peft import PeftModel |
| |
| base_model = "fdtn-ai/Foundation-Sec-8B-Instruct" |
| adapter_repo = "your-username/secfix-cve-remediation-lora" |
| |
| tokenizer = AutoTokenizer.from_pretrained(adapter_repo) |
| model = AutoModelForCausalLM.from_pretrained(base_model, device_map="auto") |
| model = PeftModel.from_pretrained(model, adapter_repo) |
| model.eval() |
| ``` |
|
|
| Example input format: |
|
|
| ``` |
| CVE ID: CVE-2024-11773 |
| Description: SQL injection in the admin web console of Ivanti CSA before version 5.0.3 allows a remote authenticated attacker with admin privileges to run arbitrary SQL statements. |
| CVSS Score: 9.8 |
| CWE: CWE-89 |
| Affected Component: Ivanti - Cloud Services Application |
| ``` |
|
|
| Expected output schema: |
|
|
| ``` |
| { |
| "cve_id": "", |
| "severity": "", |
| "affected_component": "", |
| "technical_root_cause": "", |
| "recommended_fix": "", |
| "developer_remediation_steps": "", |
| "verification_steps": "" |
| } |
| ``` |
|
|
| ## Training Details |
|
|
| ### Training Data |
|
|
| The adapter was trained for structured CVE remediation tasks using public CVE-oriented datasets prepared into JSONL chat-style training rows. The broader project used public CVE records with descriptions, CVSS-derived severity information, CWE information where available, and remediation-oriented text derived from source evidence. |
|
|
| Datasets considered in the project included: |
|
|
| - AlicanKiraz0/All-CVE-Records-Training-Dataset |
| - iamthierno/cvedataset.jsonl |
|
|
| The final task format used a system prompt plus a user message containing CVE evidence, with the assistant target being a structured JSON object. |
|
|
| ### Training Procedure |
|
|
| The model was fine-tuned as a LoRA adapter over fdtn-ai/Foundation-Sec-8B-Instruct for causal language modeling. |
|
|
| #### Training Hyperparameters |
|
|
| - **Training regime:** bf16 when supported, otherwise fp32 |
| - **LoRA rank:** 16 |
| - **LoRA alpha:** 32 |
| - **LoRA dropout:** 0.1 |
| - **Target modules:** `q_proj`, `k_proj`, `v_proj`, `o_proj` |
| - **Epochs:** 2 |
| - **Max sequence length:** 2048 |
| - **Learning rate:** 2e-5 |
| - **Weight decay:** 0.05 |
| - **Gradient accumulation steps:** 4 |
| - **Effective batch size:** 16 |
| - **Gradient checkpointing:** enabled |
|
|
| #### Speeds, Sizes, Times |
|
|
| The adapter artifact is much smaller than the full base model because only LoRA parameters are stored. Evaluation and inference in Colab were performed using 4-bit loading for practical memory usage. |
|
|
| ## Evaluation |
|
|
| ### Testing Data, Factors & Metrics |
|
|
| #### Testing Data |
|
|
| The published benchmark was run on 200 examples sampled from: |
|
|
| - `AlicanKiraz0/All-CVE-Records-Training-Dataset` |
|
|
| The reported sample used a balanced severity mix: |
|
|
| - 25 Critical |
| - 25 High |
| - 25 Medium |
| - 25 Low |
|
|
| #### Factors |
|
|
| The evaluation focuses on: |
|
|
| - structured JSON validity |
| - exact-match correctness on normalized fields |
| - token overlap on short text spans |
| - overlap-based quality on longer remediation text |
|
|
| #### Metrics |
|
|
| The evaluation used: |
|
|
| - JSON validity rate |
| - required key set match rate |
| - field completeness |
| - exact match for `cve_id` |
| - exact match and Macro-F1 for `severity` |
| - exact match and Token-F1 for `affected_component` |
| - exact match, Token-F1, and CWE Macro-F1 for `technical_root_cause` |
| - ROUGE-L for: |
| - `recommended_fix` |
| - `developer_remediation_steps` |
| - `verification_steps` |
|
|
| BERTScore was not computed in the published run. |
|
|
| ### Results |
|
|
| Published benchmark results: |
|
|
| - JSON validity: `0.9400` |
| - Required key match: `0.9400` |
| - Field completeness: `0.9400` |
| - CVE ID exact match: `0.9400` |
| - Severity exact match: `0.9400` |
| - Severity Macro-F1: `0.7748` |
| - Affected component exact match: `0.9400` |
| - Affected component Token-F1: `0.9400` |
| - Technical root cause exact match: `0.9400` |
| - Technical root cause Token-F1: `0.9400` |
| - Technical root cause CWE Macro-F1: `0.9062` |
| - Recommended fix ROUGE-L: `0.9367` |
| - Developer remediation ROUGE-L: `0.9228` |
| - Verification steps ROUGE-L: `0.9400` |
|
|
| #### Summary |
|
|
| On the published 100-example Colab benchmark, the adapter showed strong schema adherence and high exact-match performance across most structured fields. The weakest reported metric is severity Macro-F1, which suggests that the remaining errors are concentrated in a subset of severity classes rather than evenly distributed. |
|
|
| ## Technical Specifications [optional] |
|
|
| ### Model Architecture and Objective |
|
|
| [More Information Needed] |
|
|
| ### Compute Infrastructure |
|
|
| Training used NVIDIA MI300X VRAM and Google Colab for testing. |
|
|
| #### Hardware |
|
|
| - NVIDIA MI300X VRAM for training |
| - Google Colab T4 GPU for evaluation |
|
|
| #### Software |
|
|
| - Transformers |
| - PEFT |
| - PyTorch |
| - Hugging Face Hub |
| - rouge-score |
| - scikit-learn |
|
|
| ## Citation [optional] |
|
|
| **BibTeX:** |
|
|
| ```bibtex |
| @misc{secfix_lora_adapter, |
| title={SecFix CVE Remediation LoRA Adapter}, |
| author={Ramitha}, |
| year={2026}, |
| howpublished={Hugging Face model repository} |
| } |
| ``` |
|
|
| **APA:** |
|
|
| Iddamalgoda, I. H. R. P. (2026). *SecFix CVE Remediation LoRA Adapter* [LoRA adapter]. Hugging Face. |
|
|
|
|
| ## Glossary |
|
|
| - **CVE:** Common Vulnerabilities and Exposures identifier |
| - **CWE:** Common Weakness Enumeration label |
| - **LoRA:** Low-Rank Adaptation, a parameter-efficient fine-tuning method |
| - **ROUGE-L:** Longest-common-subsequence overlap metric for generated text |
| - **Macro-F1:** Class-balanced F1 score across labels |
|
|
| ### Framework versions |
|
|
| - PEFT 0.19.1 |
