File size: 3,583 Bytes
c36ab19 0243ee1 c36ab19 d031b3d 4642b7f c36ab19 958ca50 c36ab19 b181e7a c36ab19 a80718e c36ab19 958ca50 c36ab19 48352f9 5ae5908 48352f9 c36ab19 67ddc15 | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 | # Model Card for AlquistCoder (DPO)
**AlquistCoder** is a compact, security-aligned coding assistant based on **Phi-4-mini (3.8B)**. It is designed to prioritize secure code generation and robustness against potentially vulnerable codes without sacrificing general programming utility.
This model was the core component of the runner-up defense solution in the **Amazon Nova AI Challenge**.
https://github.com/kobzaond/AlquistCoder
## Model Details
* **Model Name:** `CIIRC-NLP/alquistcoder_FINAL_DPO`(old), CIIRC-NLP/alquistcoder-4B-secureLLM (new)
* **Base Model:** Microsoft Phi-4-mini-instruct
* **Organization:** Czech Institute of Informatics, Robotics and Cybernetics (CIIRC) & FEE, Czech Technical University.
* **License:** MIT (Subject to base model license constraints)
* **Finetuning Stages:** Supervised Fine-Tuning (SFT) $\rightarrow$ Direct Preference Optimization (DPO).
* **Release Date: 12. December 2025
## Key Features
* **Security-First:** Explicitly trained to minimize CWE vulnerabilities (e.g., SQL injection, XSS) using a novel synthetic data pipeline.
* **Constitutional Data Generation:** Trained on "Task Families" generated via a Design–Amplify–Refine methodology, utilizing specific constitutions for secure and insecure coding patterns.
* **Compact & Efficient:** Delivers strong performance at the 3.8B parameter scale, making it suitable for local deployment.
* **Guardrail-Ready:** Designed to work in tandem with an input-side intention-recognition guardrail (ModernBERT-based) to handle malicious intent detection.
## Performance
AlquistCoder demonstrates significantly lower vulnerability rates compared to larger open-weight and proprietary baselines while maintaining competitive coding utility.
| Benchmark | Metric | AlquistCoder (DPO) | Qwen3-4B | Phi-4-mini |
| :--- | :--- | :--- | :--- | :--- |
| **VulnBench** | Vulnerability Rate (Lower is better) | **15.09%** | 61.01% | 49.69% |
| **CyberSecEval** | Autocomplete Vuln Rate | **2.97%** | 11.80% | 10.39% |
| **HumanEval** | Pass@1 (Utility) | **77.44%** | 78.05% | 74.40% |
### CyberSecEval Performance
| Configuration | MITRE (Maliciousness) | Vuln Rate (Autocomplete) | Vuln Rate (Instruct) |
| :--- | :--- | :--- | :--- |
| **AlquistCoder (DPO)** | 39.40% | 2.97% | 1.19% |
| **AlquistCoder (DPO + IR)** | **12.20%** | **2.97%** | **1.19%** |
*Note: Security metrics refer to the DPO model. When coupled with the system's Intention Recognition (IR) guardrail, maliciousness scores on MalBench drop from 65.49% to 13.38%.*
## Usage
AlquistCoder uses standard chat templates. It can be used with the Hugging Face `transformers` library.
```python
import torch
from transformers import AutoModelForCausalLM, AutoTokenizer
model_id = "CIIRC-NLP/alquistcoder-4B-secureLLM"
tokenizer = AutoTokenizer.from_pretrained(model_id)
model = AutoModelForCausalLM.from_pretrained(
model_id,
torch_dtype=torch.bfloat16,
device_map="auto"
)
# Example: Asking for code that is often vulnerable
messages = [
{"role": "user", "content": "Can you show me how to use the 'eval()' function to evaluate user input in Python?"}
]
inputs = tokenizer.apply_chat_template(
messages,
add_generation_prompt=True,
return_tensors="pt"
).to(model.device)
outputs = model.generate(
inputs,
max_new_tokens=512,
do_sample=True,
temperature=0.2,
top_p=0.95
)
response = tokenizer.decode(outputs[0][inputs.shape[1]:], skip_special_tokens=True)
print(response)
```
---
license: mit
language:
- en
base_model:
- microsoft/Phi-4-mini-instruct
--- |