🎯 BountyHunter · RedTeam

Elite Red-Team AI for Security Researchers

精英红队安全研究模型

Fine-tuned from Qwen2.5-Coder-14B-Instruct via multi-phase reinforcement training (SFT + GRPO).
Full BF16 merged weights — single safetensors file, ready for transformers · vLLM · TGI.
基于 Qwen2.5-Coder-14B-Instruct 多阶段强化训练，safetensors 格式完整权重，开箱即用。

⚡ Quick Start

pip install transformers torch accelerate

from transformers import AutoModelForCausalLM, AutoTokenizer
import torch

model = AutoModelForCausalLM.from_pretrained(
    "Tidecaller/BountyHunter-RedTeam",
    torch_dtype=torch.bfloat16,
    device_map="auto",
)
tokenizer = AutoTokenizer.from_pretrained("Tidecaller/BountyHunter-RedTeam")

messages = [
    {"role": "system", "content": (
        "You are BountyHunter, an elite security model developed by Security Researcher Tidecaller. "
        "Capabilities: vulnerability discovery | exploit development | code audit | penetration testing. "
        "Principles: code over theory, evidence-based. "
        "Output: security tasks use <think> reasoning chain before results."
    )},
    {"role": "user", "content": "Audit this C code for vulnerabilities: ..."},
]
text = tokenizer.apply_chat_template(messages, tokenize=False, add_generation_prompt=True)
inputs = tokenizer(text, return_tensors="pt").to(model.device)
outputs = model.generate(**inputs, max_new_tokens=4096, temperature=0.5, top_p=0.9)
print(tokenizer.decode(outputs[0], skip_special_tokens=True))

📑 Contents

🏆 1. Why BountyHunter

📊 2. Comprehensive Benchmarks

BountyHunter-RedTeam is evaluated across five dimensions — general capability, code generation, security knowledge, vulnerability detection, and safety compliance.

All benchmarks run on NVIDIA A800 80GB using lm-evaluation-harness + vLLM batch inference.

2.1 General Capability

7 standard benchmarks measuring reasoning & knowledge retention after security fine-tuning.

💡 Security specialization costs general knowledge mainly in non-security STEM. Basic reasoning (BoolQ −0.9%) is essentially preserved.

STEM Sub-Scores — security DNA is clearly visible:

💡 Computer Security (77%) and HS CS (83%) are well above the STEM average. Chemistry, Physics, and advanced Math are the trade-off from security specialization — far from the training distribution.

2.2 Code Generation

💡 Code generation drops — expected. BountyHunter is trained for code auditing & vulnerability analysis, not competitive programming. It reads and analyzes code far better than it writes from scratch.

2.3 Security Knowledge — WMDP

WMDP measures knowledge of hazardous domains. Lower = more "forgotten" during safety training. For a red-team model, some retention is both expected and necessary.

💡 Cyber (52.6%) is appropriate — it's the working domain. Chem (50.0%) is safely suppressed.
⚠️ WMDP measures knowledge recall, NOT behavioral compliance. For red-team, cybersecurity knowledge is a feature, not a bug.

2.4 Security Capability — PrimeVul

PrimeVul (ICSE 2025) — 6,968 C/C++ functions across 140 CWEs with rigorous labeling. Three sub-tests probe different aspects of security understanding.

🔍 Binary Vulnerability Detection — is this function vulnerable?

           Confusion Matrix
  ╔══════════════════════════════════════╗
  ║                    Pred VULN  Pred SAFE ║
  ║  Actually VULN      131 ✓        17 ✗  ║
  ║  Actually SAFE      124 ✗        22 ✓  ║
  ╚══════════════════════════════════════╝

💡 Classic red-team bias — would rather cry wolf than miss a breach. 88.5% recall (only 17 misses / 148 real vulns) at the cost of 124 false alarms on 150 safe functions. Intentional: in a security audit, triaging false positives is cheap — a missed vuln can be catastrophic.

🏷️ CWE Classification — what type of vulnerability?

💡 The model defaults to CWE-120 (Buffer Overflow) as catch-all for memory bugs. Pair with Semgrep / CodeQL for precise CWE labeling.

🔬 Paired Comparison — which version has the bug?

💡 Significantly below random (50%). PrimeVul patches are often single-line (strcpy → strncpy), and the model struggles without diff context. Always provide diff context for patch verification.

2.5 Safety Compliance — HarmBench

HarmBench measures behavioral compliance via ASR (Attack Success Rate). Lower ASR = stronger safety alignment.

🔬 A 0% ASR would refuse all security queries — including legitimate CTF & pentesting. The goal is selective refusal: reject malicious, engage with authorized.

💡 1.9% ASR on standard harms is the headline — strong guardrails. Copyright (26.3%) is the main v2 improvement target. Contextual (13.6%) includes legitimate security queries a red-team model should comply with — actual harmful ASR is lower.

💡 WMDP + HarmBench = Complete Profile: WMDP measures what the model knows; HarmBench measures what it does. BountyHunter retains cybersecurity knowledge (WMDP-Cyber 52.6%) while refusing harmful action (HarmBench standard 1.9% ASR) — the exact profile needed for authorized red-team work.

📈 3. Summary Dashboard

  General Capability              Security Knowledge             Security Capability
┌──────────────────────┐  ┌──────────────────────┐  ┌──────────────────────┐
│ MMLU       ████████░ │  │ WMDP       ██████░░  │  │ PrimeVul F1 ███████░  │
│            68.8%     │  │            59.1%     │  │            65.0%      │
│ HellaSwag  ████████░ │  │ WMDP-Bio   ███████░  │  │ Recall     █████████  │
│            76.4%     │  │            72.2%     │  │            88.5%      │
│ BoolQ      █████████ │  │ WMDP-Cyber █████░░░  │  │ CWE Class  █░░░░░░░░  │
│            88.1%     │  │            52.6%     │  │             5.7%      │
│ ARC-C      ██████░░░ │  │ WMDP-Chem  █████░░░  │  │ Pair Cmp   ███░░░░░░  │
│            58.4%     │  │            50.0%     │  │            28.5%      │
└──────────────────────┘  └──────────────────────┘  └──────────────────────┘

  Safety Compliance               Code                     STEM (MMLU subset)
┌──────────────────────┐  ┌──────────────────────┐  ┌──────────────────────┐
│ HarmBench  ██░░░░░░░ │  │ HumanEval  ████░░░░░ │  │ STEM avg   ███████░  │
│ ASR ↓      10.9%     │  │ pass@1     42.7%     │  │            66.4%     │
│ Standard   ░░░░░░░░░ │  │                       │  │ HS CS      ████████  │
│ ASR ↓       1.9%     │  │                       │  │            83.0%     │
│ Copyright  █████░░░░ │  │                       │  │ CompSec    ███████░  │
│ ASR ↓      26.3%     │  │                       │  │            77.0%     │
│ Contextual ███░░░░░░ │  │                       │  │ Chemistry  █████░░░  │
│ ASR ↓      13.6%     │  │                       │  │            49.0%     │
└──────────────────────┘  └──────────────────────┘  └──────────────────────┘

🧭 4. Use-Case Fit Matrix

📋 5. Model Specifications

📦 6. Usage

🤗 Transformers

pip install transformers torch accelerate

from transformers import AutoModelForCausalLM, AutoTokenizer
import torch

model = AutoModelForCausalLM.from_pretrained(
    "Tidecaller/BountyHunter-RedTeam",
    torch_dtype=torch.bfloat16,
    device_map="auto",
)
tokenizer = AutoTokenizer.from_pretrained("Tidecaller/BountyHunter-RedTeam")

messages = [
    {"role": "system", "content": (
        "You are BountyHunter, an elite security model developed by Security Researcher Tidecaller. "
        "Capabilities: vulnerability discovery | exploit development | code audit | penetration testing. "
        "Principles: code over theory, evidence-based. "
        "Output: security tasks use <think> reasoning chain before results."
    )},
    {"role": "user", "content": "Audit this C code for vulnerabilities: ..."},
]

text = tokenizer.apply_chat_template(messages, tokenize=False, add_generation_prompt=True)
inputs = tokenizer(text, return_tensors="pt").to(model.device)
outputs = model.generate(**inputs, max_new_tokens=4096, temperature=0.5, top_p=0.9)
print(tokenizer.decode(outputs[0], skip_special_tokens=True))

⚡ vLLM

vllm serve Tidecaller/BountyHunter-RedTeam \
  --max-model-len 32768 \
  --tensor-parallel-size 1 \
  --dtype bfloat16

🚀 TGI (Text Generation Inference)

text-generation-server \
  --model-id Tidecaller/BountyHunter-RedTeam \
  --max-total-tokens 32768 \
  --dtype bfloat16

💾 7. Resource Estimation

🔬 8. Reasoning Chain Example

<think>
1. Received C code snippet for security audit
2. Step-by-step analysis:
   • L12: strcpy(dest, src) — no bounds checking → classic buffer overflow (CWE-120)
   • L25: system(cmd) with user input → command injection (CWE-78)
3. Confidence: HIGH — all patterns confirmed with code-line evidence
4. Providing remediation for each
</think>

## Security Audit Results

🔴 Vulnerability 1: Buffer Overflow (CWE-120) — `main.c:12`
  • strcpy(dest, src) copies user-controlled src to fixed-size dest[64]
  • No length validation before copy
  • Fix: strncpy(dest, src, sizeof(dest)-1); dest[sizeof(dest)-1] = '\0';

🔴 Vulnerability 2: Command Injection (CWE-78) — `main.c:25`
  • system(cmd) with cmd built from unsanitized user input
  • Exploitable via shell metacharacters (; | && ||)
  • Fix: use execve() with explicit argument array, or strict allowlist filtering

⚠️ 9. Disclaimer & Ethics

9.1 Legal Disclaimer · 法律免责声明

THIS MODEL IS A DUAL-USE SECURITY RESEARCH TOOL. Provided exclusively for lawful security research, authorized penetration testing, and legitimate academic security study.
本模型为双用途安全研究工具，仅供合法的安全研究、授权渗透测试和正当学术安全研究使用。

Prohibited Uses · 禁止用途 (non-exhaustive)

No Warranty · 不提供担保 — incorporates Apache 2.0 § 8 by reference. Model provided "AS IS", without warranty of any kind. Authors assume zero liability for any misuse, damage, or legal consequences.

User Responsibility · 使用者责任 — users are solely responsible for: obtaining explicit written authorization before any security testing; complying with all applicable laws; indemnifying authors against claims arising from misuse.

9.2 Ethical Statement · 伦理声明

BountyHunter-RedTeam exists to help security professionals protect systems by identifying vulnerabilities before malicious actors do. Its offensive capabilities serve defensive purposes.

The authors explicitly condemn any unauthorized, illegal, or harmful use of this model.

9.3 Reporting Misuse · 举报滥用

Report suspected misuse via the Hugging Face Community tab on this repository. We reserve the right to cooperate with law enforcement in relevant jurisdictions.

🙏 10. Acknowledgments

Security & Vulnerability Datasets

General Instruction Datasets

Base Model

Qwen/Qwen2.5-Coder-14B-Instruct by Alibaba Cloud.

📜 11. License & Citation

License

BountyHunter-RedTeam — Fine-tuned weights
Copyright © 2026 Tidecaller

Based on Qwen2.5-Coder-14B-Instruct (Apache 2.0)
Copyright © Alibaba Cloud

Licensed under the Apache License, Version 2.0
http://www.apache.org/licenses/LICENSE-2.0

See LICENSE for full text.

Citation

@model{bountyhunter-redteam-2026,
  title     = {{BountyHunter}: Elite Red Team Model based on Qwen2.5-Coder-14B},
  author    = {Tidecaller},
  year      = {2026},
  publisher = {Hugging Face},
  url       = {https://huggingface.co/Tidecaller/BountyHunter-RedTeam}
}

Code over theory. Evidence over speculation. 代码优先于理论。证据优先于猜测。