Push model using huggingface_hub.

README.md

@@ -1,136 +1,130 @@
 ---
-language: en
-license: apache-2.0
 tags:
-  - setfit
-  - text-classification
-  - code-security
-  - secret-detection
-  - vulnerability-detection
-  - false-positive-reduction
-  - sast
-  - dlp
+- setfit
+- sentence-transformers
+- text-classification
+- generated_from_setfit_trainer
+widget: []
+metrics:
+- accuracy
 pipeline_tag: text-classification
 library_name: setfit
-metrics:
-  - accuracy
-model-index:
-- name: spidercob/code-risk-classifier
-  results:
-  - task:
-      type: text-classification
-      name: Text Classification
-    dataset:
-      name: Public repos (WebGoat, DVWA, factory_boy, Django, FastAPI, truffleHog)
-      type: mixed
-      split: test
-    metrics:
-    - type: accuracy
-      value: 0.9942
-      name: Accuracy
+inference: true
 ---
 
-# spidercob/code-risk-classifier
+# SetFit
 
-A [SetFit](https://github.com/huggingface/setfit) model that classifies **code security findings** — distinguishing real secrets and vulnerabilities from test fixtures and safe code.
+This is a [SetFit](https://github.com/huggingface/setfit) model that can be used for Text Classification. A [LogisticRegression](https://scikit-learn.org/stable/modules/generated/sklearn.linear_model.LogisticRegression.html) instance is used for classification.
 
-## The Problem
+The model has been trained using an efficient few-shot learning technique that involves:
 
-Static analysis tools (SAST, secret scanners) generate high false-positive rates:
+1. Fine-tuning a [Sentence Transformer](https://www.sbert.net) with contrastive learning.
+2. Training a classification head with features from the fine-tuned Sentence Transformer.
 
-- A `SECRET_KEY = 'testing.'` in Django's test suite is not a real secret
-- A `$_GET['id']` in DVWA is an intentional vulnerability example, not production code
-- `factory_boy` password fields are test fixtures, not real credentials
-- A `bcrypt.hashpw()` call is safe, not a credential leak
-
-This model reads the code context and decides whether a finding is actionable.
+## Model Details
 
-## Labels
+### Model Description
+- **Model Type:** SetFit
+<!-- - **Sentence Transformer:** [Unknown](https://huggingface.co/unknown) -->
+- **Classification head:** a [LogisticRegression](https://scikit-learn.org/stable/modules/generated/sklearn.linear_model.LogisticRegression.html) instance
+- **Maximum Sequence Length:** 256 tokens
+- **Number of Classes:** 4 classes
+<!-- - **Training Dataset:** [Unknown](https://huggingface.co/datasets/unknown) -->
+<!-- - **Language:** Unknown -->
+<!-- - **License:** Unknown -->
 
-| Label | Description | Action |
-|---|---|---|
-| `REAL_SECRET` | Genuine hardcoded credential, API key, or private key | BLOCK |
-| `VULNERABLE_LOGIC` | Exploitable code pattern (SQLi, RCE, XSS, etc.) | BLOCK |
-| `TEST_MOCK` | Test fixture, dummy value, or mock data | ALLOW |
-| `SAFE_CODE` | Clean production code or secure implementation | ALLOW |
+### Model Sources
 
-## Quick Start
+- **Repository:** [SetFit on GitHub](https://github.com/huggingface/setfit)
+- **Paper:** [Efficient Few-Shot Learning Without Prompts](https://arxiv.org/abs/2209.11055)
+- **Blogpost:** [SetFit: Efficient Few-Shot Learning Without Prompts](https://huggingface.co/blog/setfit)
 
-```python
-from setfit import SetFitModel
+## Uses
 
-model = SetFitModel.from_pretrained("spidercob/code-risk-classifier")
+### Direct Use for Inference
 
-examples = [
-    "Analyze this hardcoded_secret: AWS_ACCESS_KEY_ID=AKIA4REALKEY123ABC committed to main branch .env file",
-    "Analyze this vulnerable_pattern: $query = 'SELECT * FROM users WHERE id=' . $_GET['id'];",
-    "Analyze this test_fixture: factory_boy default: user.password = 'testpass123' for pytest fixtures",
-    "Analyze this clean_code: def get_user(db, user_id): return db.query(User).filter(User.id == user_id).first()",
-]
+First install the SetFit library:
 
-predictions = model.predict(examples)
-# ['REAL_SECRET', 'VULNERABLE_LOGIC', 'TEST_MOCK', 'SAFE_CODE']
+```bash
+pip install setfit
 ```
 
-## Input Format
+Then you can load this model and run inference.
 
-```
-Analyze this {issue_type}: {code_snippet}
+```python
+from setfit import SetFitModel
+
+# Download from the 🤗 Hub
+model = SetFitModel.from_pretrained("setfit_model_id")
+# Run inference
+preds = model("I loved the spiderman movie!")
 ```
 
-- `issue_type`: the scanner finding type — e.g. `hardcoded_secret`, `vulnerable_pattern`, `sql_injection`, `test_fixture`, `clean_code`
-- `code_snippet`: the code context around the finding, up to ~400 characters
+<!--
+### Downstream Use
 
-## Integration Pattern
+*List how someone could finetune this model on their own dataset.*
+-->
 
-```python
-from setfit import SetFitModel
+<!--
+### Out-of-Scope Use
 
-model = SetFitModel.from_pretrained("spidercob/code-risk-classifier")
+*List how the model may foreseeably be misused and address what users ought not to do with the model.*
+-->
 
-def assess_finding(issue_type: str, code_snippet: str) -> dict:
-    text = f"Analyze this {issue_type}: {code_snippet}"
-    label = model.predict([text])[0]
-    probs = model.predict_proba([text])[0]
-    conf = max(probs)
+<!--
+## Bias, Risks and Limitations
 
-    if label in ("REAL_SECRET", "VULNERABLE_LOGIC"):
-        return {"action": "BLOCK", "label": label, "confidence": conf}
-    else:
-        return {"action": "ALLOW", "label": label, "confidence": conf}
+*What are the known or foreseeable issues stemming from this model? You could also flag here known failure cases or weaknesses of the model.*
+-->
 
-# Example
-result = assess_finding("hardcoded_secret", "SECRET_KEY = '0123456789ABCDEF' in production settings.py")
-# {"action": "BLOCK", "label": "REAL_SECRET", "confidence": 0.83}
-```
+<!--
+### Recommendations
 
-## Model Details
+*What are recommendations with respect to the foreseeable issues? For example, filtering explicit content.*
+-->
 
-- **Base model**: `sentence-transformers/all-MiniLM-L6-v2`
-- **Method**: SetFit — contrastive fine-tuning + logistic regression head
-- **Test accuracy**: **99.4%**
-- **Classes**: 4 (REAL_SECRET, VULNERABLE_LOGIC, TEST_MOCK, SAFE_CODE)
+## Training Details
 
-## Training Data
+### Framework Versions
+- Python: 3.12.12
+- SetFit: 1.1.3
+- Sentence Transformers: 5.2.2
+- Transformers: 4.57.6
+- PyTorch: 2.10.0
+- Datasets: 5.0.0
+- Tokenizers: 0.22.2
 
-~860 examples from 15 public repos (capped at 300 per class):
+## Citation
 
-| Source | Label | Why |
-|---|---|---|
-| OWASP WebGoat, DVWA, NodeGoat | `VULNERABLE_LOGIC` | Intentionally vulnerable apps |
-| vulhub, DVGA | `VULNERABLE_LOGIC` | CVE docker environments |
-| truffleHog test corpus | `REAL_SECRET` | Confirmed leaked secrets |
-| factory_boy, Faker, pytest, model_bakery | `TEST_MOCK` | Test fixture libraries |
-| Django, FastAPI, Flask, requests, httpx | `SAFE_CODE` | Clean production frameworks |
+### BibTeX
+```bibtex
+@article{https://doi.org/10.48550/arxiv.2209.11055,
+    doi = {10.48550/ARXIV.2209.11055},
+    url = {https://arxiv.org/abs/2209.11055},
+    author = {Tunstall, Lewis and Reimers, Nils and Jo, Unso Eun Seo and Bates, Luke and Korat, Daniel and Wasserblat, Moshe and Pereg, Oren},
+    keywords = {Computation and Language (cs.CL), FOS: Computer and information sciences, FOS: Computer and information sciences},
+    title = {Efficient Few-Shot Learning Without Prompts},
+    publisher = {arXiv},
+    year = {2022},
+    copyright = {Creative Commons Attribution 4.0 International}
+}
+```
 
-## Related Model
+<!--
+## Glossary
 
-For DLP regex false-positive reduction (SSNs, credit cards, emails, API keys in content), see [spidercob/dlp-intent-classifier](https://huggingface.co/spidercob/dlp-intent-classifier).
+*Clearly define terms in order to be accessible across audiences.*
+-->
 
-## About
+<!--
+## Model Card Authors
 
-Built by [Spidercob](https://spidercob.com) — enterprise DLP SaaS. This model powers the false-positive reduction layer in Spidercob's code security scanner.
+*Lists the people who create the model card, providing recognition and accountability for the detailed work that goes into its construction.*
+-->
 
-## License
+<!--
+## Model Card Contact
 
-Apache 2.0
+*Provides a way for people who have updates to the Model Card, suggestions, or questions, to contact the Model Card authors.*
+-->

model.safetensors

@@ -1,3 +1,3 @@
 version https://git-lfs.github.com/spec/v1
-oid sha256:208fafaef8a66bca5ebe9674b5da6a4098927b902cc30b3abbad55355a0bd3ff
+oid sha256:9c4c93bb1d3444cdc0eec9908b2e6e61660c7606b020a6776b3bd450f315bee7
 size 90864192

model_head.pkl

@@ -1,3 +1,3 @@
 version https://git-lfs.github.com/spec/v1
-oid sha256:ed88c40c0609b6c2e6ab1c99f43eb54188cf7ad265981b8f0533c20ec8998775
+oid sha256:7e9f45b9e642972266844fc03150c434167110c84d54306ba7119d5b0fea50fc
 size 13191