ZeroSec-7B 🔴

A QLoRA fine-tune of Qwen2.5-Coder-7B on 29,588 exploit and security samples.

Built by The Zero Project — use only for authorized security testing.

What is this?

ZeroSec-7B is a specialist language model trained exclusively on offensive security data:

• 15,023 exploit code files (Python, C, Perl, Ruby, PHP) from ExploitDB
• 13,468 vulnerability detection rules from Nuclei templates
• 576 attack payloads from PayloadsAllTheThings (SQLi, XSS, CMDi, SSTI, SSRF, etc.)
• 523 methodology & reference documents on exploitation techniques

It's designed to assist with legitimate penetration testing, vulnerability research, and security education.

Quick Start

Option 1: Merge + run locally (recommended)

# 1. Download the LoRA adapter
git lfs install
git clone https://huggingface.co/ezradixon/ZeroSec-7B

# 2. Merge with base model
python merge_and_export.py

# 3. Quantize for local inference (Mac/CPU)
llama-quantize merged-model-f16.gguf Q4_K_M zerosect-7b-Q4_K_M.gguf

# 4. Run
llama-server -m zerosect-7b-Q4_K_M.gguf -ngl 99

Option 2: Python inference

from transformers import AutoModelForCausalLM, AutoTokenizer
from peft import PeftModel
import torch

base_model = "Qwen/Qwen2.5-Coder-7B-Instruct"
model = AutoModelForCausalLM.from_pretrained(
    base_model,
    torch_dtype=torch.float16,
    device_map="auto",
    trust_remote_code=True,
)
model = PeftModel.from_pretrained(model, "ezradixon/ZeroSec-7B")
model = model.merge_and_unload()

tokenizer = AutoTokenizer.from_pretrained(base_model, trust_remote_code=True)

prompt = "Write a Python script to check for SQL injection in a login form"
inputs = tokenizer(prompt, return_tensors="pt").to("cuda")
outputs = model.generate(**inputs, max_new_tokens=512)
print(tokenizer.decode(outputs[0], skip_special_tokens=True))

Training Details

Parameter	Value
Base model	Qwen/Qwen2.5-Coder-7B-Instruct
Method	QLoRA (4-bit quantization)
GPU	NVIDIA A10G (24GB)
Training samples	29,588
Max sequence length	1024 tokens
Batch size	2 (effective 8 with grad accum)
Epochs	2
Learning rate	2e-4
LoRA rank	16, alpha 32
Training time	~2 hours
Cost	~$2.00 (Modal serverless)

Limitations

• 7B parameters — not as capable as larger models (GPT-4, Claude)
• Training data quality varies — ExploitDB contains legacy code that may not work on modern systems
• No real-world validation — exploits were not tested against live targets
• English only — training data is overwhelmingly English

⚠️ Disclaimer

This model is for authorized security testing and education only.

Do not use ZeroSec-7B for:

• Attacking systems without explicit written permission
• Developing malware or ransomware
• Any illegal activity whatsoever

The Zero Project and the model's creator are not responsible for any misuse.

Author

Ezra Dixon — The Zero Project

Built on Modal cloud GPUs. 🇦🇺