codelion/Qwen2.5-Coder-0.5B-Instruct-security-grpo-lora

codelion/Qwen2.5-Coder-0.5B-Instruct-security-grpo-lora

🔐 Security-First Code Generation LoRA

This LoRA adapter enhances Qwen/Qwen2.5-Coder-0.5B-Instruct to generate secure code by default, trained using GRPO (Group Relative Policy Optimization) with automated security analysis via Semgrep.

🎯 Key Features

• —Automated Security Analysis: Uses Semgrep for consistent vulnerability detection
• —Self-Supervised Training: No manually curated secure/insecure datasets required
• —Comprehensive Coverage: Addresses OWASP Top 10 and CWE Top 25 vulnerabilities
• —Language Focus: Specialized for Python security patterns
• —Preference Learning: GRPO training to prefer secure coding patterns

📊 Performance Metrics

• —Base Model: Qwen/Qwen2.5-Coder-0.5B-Instruct
• —Training Method: GRPO with security-based preferences
• —LoRA Rank: 64
• —LoRA Alpha: 128
• —Training Samples: 195
• —Security Evaluation Pass Rate: 20.0%
• —Average Security Score: 0.40 (lower is better)

Vulnerability Prevention Results

🔧 Usage

from transformers import AutoModelForCausalLM, AutoTokenizer
from peft import PeftModel

# Load base model
model = AutoModelForCausalLM.from_pretrained(
    "Qwen/Qwen2.5-Coder-0.5B-Instruct",
    torch_dtype="auto",
    device_map="auto"
)
tokenizer = AutoTokenizer.from_pretrained("Qwen/Qwen2.5-Coder-0.5B-Instruct")

# Load security LoRA adapter
model = PeftModel.from_pretrained(model, "codelion/Qwen2.5-Coder-0.5B-Instruct-security-grpo-lora")

# Generate secure code
prompt = '''Write a secure Python function: Create a user login function
that checks username and password against a database'''

inputs = tokenizer(prompt, return_tensors="pt")
outputs = model.generate(**inputs, max_new_tokens=512, temperature=0.2)
secure_code = tokenizer.decode(outputs[0], skip_special_tokens=True)
print(secure_code)

📈 Expected Output

The model generates code with security best practices:

def login_user(username, password):
    """Securely authenticate a user against the database."""
    import bcrypt
    import secrets
    from sqlalchemy import text

    # Validate inputs
    if not username or not password:
        return False, "Invalid credentials"

    # Use parameterized query to prevent SQL injection
    query = text("SELECT user_id, password_hash FROM users WHERE username = :username")
    result = db.execute(query, {"username": username}).fetchone()

    if not result:
        # Prevent timing attacks by still checking a dummy password
        bcrypt.checkpw(b"dummy", b"$2b$12$dummy.hash.to.prevent.timing")
        return False, "Invalid credentials"

    # Verify password using bcrypt
    if bcrypt.checkpw(password.encode('utf-8'), result.password_hash):
        # Generate secure session token
        session_token = secrets.token_urlsafe(32)
        return True, session_token

    return False, "Invalid credentials"

🛡️ Security Patterns Learned

• —SQL Injection Prevention: Parameterized queries, prepared statements
• —Password Security: Bcrypt/Argon2 hashing, no plaintext storage
• —Input Validation: Comprehensive validation and sanitization
• —Error Handling: Safe error messages without information disclosure
• —Secure Randomness: Using secrets module instead of random
• —Path Security: Proper path joining and validation
• —Command Injection Prevention: Avoiding shell=True, using subprocess safely

🧪 Training Details

Data Generation

• —Method: Self-supervised with Magpie-style generation
• —Scenarios: 7 security categories
• —Analysis: Automated using Semgrep security rules
• —Preference Pairs: Based on security score differences

GRPO Training

• —Objective: Minimize security vulnerabilities while maintaining functionality
• —Reward Signal: Negative correlation with Semgrep security score
• —Batch Size: 1 with 8x gradient accumulation
• —Learning Rate: 3e-06
• —Epochs: 5

📚 Evaluation

The adapter was evaluated on comprehensive security test cases:

• —CWE Coverage: Top 25 most dangerous software weaknesses
• —OWASP Alignment: Addresses OWASP Top 10 vulnerabilities
• —Practical Scenarios: Real-world security challenges
• —Pattern Recognition: Identifies and applies secure coding patterns

🔍 Limitations and Considerations

1. 1.Language Focus: Currently optimized for Python; other languages may need additional training
2. 2.Context Awareness: Best results with clear security-focused prompts
3. 3.Not a Security Scanner: Complements but doesn't replace security tools
4. 4.Continuous Updates: Security landscape evolves; periodic retraining recommended

🔗 Related Resources

• —Dataset: codelion/Qwen2.5-Coder-0.5B-Instruct-security-preference
• —Base Model: Qwen/Qwen2.5-Coder-0.5B-Instruct
• —Ellora Project: GitHub Repository
• —Semgrep: Security Analysis Tool

This adapter is part of the [Ellora project](https://github.com/codelion/ellora) - standardized recipes for enhancing LLM capabilities.