Foundation-Sec-8B CVE Cybersecurity Model (QLoRA Fine-tuned)

Model Description

This model is a fine-tuned version of Foundation-Sec-8B specialized for CVE (Common Vulnerabilities and Exposures) analysis and security recommendation generation using QLoRA (Quantized Low-Rank Adaptation).

Key Features

• Analyzes CVE vulnerabilities and provides actionable security recommendations
• Trained on 5,000+ diverse CVE policy recommendations
• Uses QLoRA for memory-efficient fine-tuning (4-bit quantization)
• Provides structured recommendations with rationale
• Identifies security risks and suggests mitigation strategies
• Optimized for deployment with 4x less memory than full fine-tuning

Quick Start

Installation

pip install transformers torch accelerate

Basic Usage

from transformers import AutoModelForCausalLM, AutoTokenizer
import torch

# Load model and tokenizer
model = AutoModelForCausalLM.from_pretrained(
    "sainikhiljuluri/foundation-sec-8b-cve-cybersecurity",
    torch_dtype=torch.bfloat16,
    device_map="auto",
    trust_remote_code=True
)

tokenizer = AutoTokenizer.from_pretrained("sainikhiljuluri/foundation-sec-8b-cve-cybersecurity")

# Prepare CVE analysis request
cve_query = """Analyze the following vulnerability and provide security recommendations:

CVE ID: CVE-2024-1234
Vulnerability Summary: SQL injection vulnerability in web application allows remote attackers to execute arbitrary SQL commands
CVSS Score: 9.8
Weakness Type: SQL Injection
CWE Code: CWE-89"""

# Format input
formatted_input = f"{cve_query}\n\n"

# Generate response
inputs = tokenizer(formatted_input, return_tensors="pt").to(model.device)

outputs = model.generate(
    **inputs,
    max_new_tokens=512,
    temperature=0.7,
    top_p=0.9,
    do_sample=True,
    pad_token_id=tokenizer.pad_token_id,
    eos_token_id=tokenizer.eos_token_id
)

response = tokenizer.decode(outputs[0], skip_special_tokens=True)

# Extract generated response (remove input)
if cve_query in response:
    response = response.replace(cve_query, "").strip()

print(response)

Training Details

Dataset

• Source: CVE Policy Recommendations (5,000+ diverse examples)
• Format: Structured CVE information with expert recommendations
• Split: 90% training, 10% evaluation

Training Configuration

• Method: QLoRA (Quantized Low-Rank Adaptation)
• Quantization: 4-bit NF4
• LoRA Rank: 64
• LoRA Alpha: 16
• Dropout: 0.05
• Base Precision: 4-bit
• Merged Precision: FP16
• Epochs: 3
• Batch Size: 4 (effective: 16 with gradient accumulation)
• Learning Rate: 2e-4
• Optimizer: paged_adamw_8bit
• Training Platform: Google Colab A100 GPU

Training Results

• Final Perplexity: 2.21 (Excellent)
• Average Loss: 0.79
• BLEU-1 Score: 0.1274
• BLEU-2 Score: 0.1063
• BLEU-4 Score: 0.0764
• ROUGE-L F1: 0.1643
• Semantic Similarity: 0.297 (TF-IDF based)
• Quality Retention: 102.05%

Capabilities

CVE Analysis

The model can analyze various types of vulnerabilities including:

• SQL Injection
• Cross-Site Scripting (XSS)
• Authentication Bypass
• Denial of Service (DoS)
• Buffer Overflow
• Remote Code Execution
• CSRF Attacks
• Directory Traversal
• And many more...

Recommendation Format

The model provides structured recommendations including:

• Recommended Action: Specific steps to mitigate the vulnerability
• Rationale: Explanation of why these actions are necessary
• Risk Assessment: Evaluation of severity and impact
• Implementation Details: Technical guidance for remediation

Example Output

Input:

Analyze the following vulnerability and provide security recommendations:

CVE ID: CVE-2024-SQL-001
Vulnerability Summary: SQL injection in authentication module
CVSS Score: 9.8
Weakness Type: SQL Injection
CWE Code: CWE-89

Output:

Recommended Action:
1. Immediately implement parameterized queries or prepared statements across all database interactions
2. Update the web application framework to the latest patched version
3. Enable Web Application Firewall (WAF) with SQL injection prevention rules
4. Conduct comprehensive code review of the authentication module
5. Deploy input validation and sanitization for all user inputs
6. Implement least-privilege database access controls

Rationale:
The critical CVSS score of 9.8 indicates this vulnerability requires immediate attention. 
SQL injection in the authentication module poses severe risks including unauthorized access, 
data breach, and complete system compromise. Parameterized queries eliminate SQL injection 
vulnerabilities by treating user input as data rather than executable code. WAF provides 
an additional security layer while code fixes are being deployed...

Performance Metrics

Note: Lower BLEU/ROUGE scores indicate the model generates more detailed explanations than reference texts, which is actually beneficial for security recommendations. The high quality retention shows the model maintains recommendation quality.

Model Architecture

• Base Model: Foundation-Sec-8B
• Parameters: ~8 billion
• Training Method: QLoRA (4-bit quantization)
• Final Precision: FP16 (merged model)
• LoRA Rank: 64
• Context Length: 2048 tokens
• Model Size: ~16GB (FP16)

Deployment

HuggingFace Inference API

import requests

API_URL = "https://api-inference.huggingface.co/models/sainikhiljuluri/foundation-sec-8b-cve-cybersecurity"
headers = {"Authorization": f"Bearer {YOUR_HF_TOKEN}"}

def analyze_cve(cve_info):
    payload = {
        "inputs": cve_info,
        "parameters": {
            "max_new_tokens": 512,
            "temperature": 0.7,
            "top_p": 0.9,
            "return_full_text": False
        }
    }
    response = requests.post(API_URL, headers=headers, json=payload)
    return response.json()

# Example usage
cve_info = """Analyze the following vulnerability and provide security recommendations:

CVE ID: CVE-2024-5678
Vulnerability Summary: Remote code execution via unsafe deserialization
CVSS Score: 9.8
"""

result = analyze_cve(cve_info)
print(result[0]['generated_text'])

Local Deployment

# Load model locally
model = AutoModelForCausalLM.from_pretrained(
    "sainikhiljuluri/foundation-sec-8b-cve-cybersecurity",
    torch_dtype=torch.bfloat16,
    device_map="auto",
    trust_remote_code=True
)

tokenizer = AutoTokenizer.from_pretrained("sainikhiljuluri/foundation-sec-8b-cve-cybersecurity")

Quantized Deployment (Even Lower Memory)

from transformers import BitsAndBytesConfig

# 4-bit quantization config
bnb_config = BitsAndBytesConfig(
    load_in_4bit=True,
    bnb_4bit_quant_type="nf4",
    bnb_4bit_compute_dtype=torch.bfloat16,
    bnb_4bit_use_double_quant=True
)

# Load with 4-bit quantization
model = AutoModelForCausalLM.from_pretrained(
    "sainikhiljuluri/foundation-sec-8b-cve-cybersecurity",
    quantization_config=bnb_config,
    device_map="auto",
    trust_remote_code=True
)

Limitations

1. Domain-Specific: Optimized for CVE analysis, may not generalize well to other tasks
2. Training Data: Limited to vulnerabilities seen in training data (5K examples)
3. No Real-Time Data: Model knowledge is based on training data cutoff
4. Requires Context: Best results when provided with complete CVE information
5. Not a Replacement: Should complement, not replace, professional security analysis
6. Generation Verbosity: May generate longer responses than necessary

Ethical Considerations

• This model is for research and educational purposes
• Always validate security recommendations with professional tools and experts
• Do not rely solely on AI for critical security decisions
• Use responsibly and ethically in cybersecurity contexts
• Model should not be used for malicious purposes

Citation

If you use this model in your research, please cite:

@misc{foundation-sec-8b-cve-2025,
  author = {Sainikhil Juluri},
  title = {Foundation-Sec-8B CVE Cybersecurity Model (QLoRA)},
  year = {2025},
  publisher = {HuggingFace},
  url = {https://huggingface.co/sainikhiljuluri/foundation-sec-8b-cve-cybersecurity}
}

Training Details

Training Date: 2025-11-04

Hardware: Google Colab A100 GPU (40GB)

Framework:

• PyTorch 2.8.0+cu126
• Transformers (latest)
• PEFT (QLoRA)
• BitsAndBytes

Training Time: ~2-3 hours

Contact

For questions or collaborations:

• HuggingFace: @sainikhiljuluri
• Open an issue on the model repository
• Connect via HuggingFace discussions

Model Card Authors

Sainikhil Juluri

License

Apache 2.0 License

Acknowledgments

• Base model: Foundation-Sec-8B by fdtn-ai
• Training method: QLoRA (Quantized Low-Rank Adaptation)
• Dataset: CVE Policy Recommendations (5K diverse examples)
• Inspired by GPT-OSS fine-tuning methodologies

Built with: Transformers • PEFT • QLoRA • BitsAndBytes • PyTorch

Model Type: Causal Language Model

Language: English

Finetuned from: fdtn-ai/Foundation-Sec-8B