sast-llm-qwen25_coder-sva

SAST-LLM — QWEN25_CODER fine-tuned for SVA

Static Analysis Security Tool berbasis LLM. Fine-tuned dari Qwen/Qwen2.5-Coder-7B-Instruct menggunakan QLoRA untuk mendeteksi kerentanan keamanan pada kode C/C++.

Model Details

Quick Start

from transformers import AutoModelForCausalLM, AutoTokenizer
import torch

model_id = "raih443/sast-llm-qwen25_coder-sva"

tokenizer = AutoTokenizer.from_pretrained(model_id)
model = AutoModelForCausalLM.from_pretrained(
    model_id,
    torch_dtype = torch.float16,
    device_map  = "auto",
)

# Contoh analisis vulnerability
code = (
    "int main() {\n"
    "    char buffer[10];\n"
    "    gets(buffer);  // buffer overflow!\n"
    "    return 0;\n"
"}")

messages = [
    {"role": "system",
     "content": "You are a security vulnerability detector. "
                "Respond with 1 if vulnerable or 0 if safe."},
    {"role": "user",
     "content": f"Analyze this C code:\n```c\n{code}\n```"},
]

text   = tokenizer.apply_chat_template(messages, tokenize=False,
                                        add_generation_prompt=True)
inputs = tokenizer(text, return_tensors="pt").to(model.device)

with torch.no_grad():
    outputs = model.generate(
        **inputs,
        max_new_tokens = 50,
        temperature    = 0.1,
        do_sample      = False,
    )

response = tokenizer.decode(
    outputs[0][inputs["input_ids"].shape[1]:],
    skip_special_tokens=True
)
print(response)  # "1" = vulnerable, "0" = safe

Training Details

• Dataset: C/C++ code snippets dengan label kerentanan (CWE-based)
• Method: QLoRA (4-bit NF4 quantization + LoRA adapter)
• Task: Binary vulnerability classification (1 = vulnerable, 0 = safe)
• Training Type: SVA

GGUF

Model tersedia dalam format GGUF (f16) di folder gguf/ untuk dipakai dengan llama.cpp / Ollama.

Limitations

• Dilatih pada C/C++ code — performa pada bahasa lain tidak dijamin
• Output biner (1/0) tanpa penjelasan detail
• False positive/negative mungkin terjadi pada kode kompleks

Citation

@misc{sast-llm-percobaan_2,
  title  = {SAST-LLM: Fine-tuned QWEN25_CODER for Vulnerability Detection},
  author = {raih443},
  year   = {2026},
}