🔴 ZeroSec-7B — exploit-specialized LLM (training in progress)

README.md

@@ -0,0 +1,118 @@
+---
+license: apache-2.0
+base_model: Qwen/Qwen2.5-Coder-7B-Instruct
+library_name: peft
+tags:
+  - cybersecurity
+  - penetration-testing
+  - exploit-development
+  - offensive-security
+  - lora
+  - qwen
+  - code
+datasets:
+  - ezradixon/zerosectraining
+language:
+  - en
+pipeline_tag: text-generation
+---
+
+# ZeroSec-7B 🔴
+
+A QLoRA fine-tune of Qwen2.5-Coder-7B on 29,588 exploit and security samples.
+
+**Built by [The Zero Project](https://github.com/ezradixon) — use only for authorized security testing.**
+
+## What is this?
+
+ZeroSec-7B is a specialist language model trained exclusively on offensive security data:
+- **15,023 exploit code files** (Python, C, Perl, Ruby, PHP) from ExploitDB
+- **13,468 vulnerability detection rules** from Nuclei templates
+- **576 attack payloads** from PayloadsAllTheThings (SQLi, XSS, CMDi, SSTI, SSRF, etc.)
+- **523 methodology & reference documents** on exploitation techniques
+
+It's designed to assist with legitimate penetration testing, vulnerability research, and security education.
+
+## Quick Start
+
+### Option 1: Merge + run locally (recommended)
+
+```bash
+# 1. Download the LoRA adapter
+git lfs install
+git clone https://huggingface.co/ezradixon/ZeroSec-7B
+
+# 2. Merge with base model
+python merge_and_export.py
+
+# 3. Quantize for local inference (Mac/CPU)
+llama-quantize merged-model-f16.gguf Q4_K_M zerosect-7b-Q4_K_M.gguf
+
+# 4. Run
+llama-server -m zerosect-7b-Q4_K_M.gguf -ngl 99
+```
+
+### Option 2: Python inference
+
+```python
+from transformers import AutoModelForCausalLM, AutoTokenizer
+from peft import PeftModel
+import torch
+
+base_model = "Qwen/Qwen2.5-Coder-7B-Instruct"
+model = AutoModelForCausalLM.from_pretrained(
+    base_model,
+    torch_dtype=torch.float16,
+    device_map="auto",
+    trust_remote_code=True,
+)
+model = PeftModel.from_pretrained(model, "ezradixon/ZeroSec-7B")
+model = model.merge_and_unload()
+
+tokenizer = AutoTokenizer.from_pretrained(base_model, trust_remote_code=True)
+
+prompt = "Write a Python script to check for SQL injection in a login form"
+inputs = tokenizer(prompt, return_tensors="pt").to("cuda")
+outputs = model.generate(**inputs, max_new_tokens=512)
+print(tokenizer.decode(outputs[0], skip_special_tokens=True))
+```
+
+## Training Details
+
+| Parameter | Value |
+|---|---|
+| Base model | Qwen/Qwen2.5-Coder-7B-Instruct |
+| Method | QLoRA (4-bit quantization) |
+| GPU | NVIDIA A10G (24GB) |
+| Training samples | 29,588 |
+| Max sequence length | 1024 tokens |
+| Batch size | 2 (effective 8 with grad accum) |
+| Epochs | 2 |
+| Learning rate | 2e-4 |
+| LoRA rank | 16, alpha 32 |
+| Training time | ~2 hours |
+| Cost | ~$2.00 (Modal serverless) |
+
+## Limitations
+
+- **7B parameters** — not as capable as larger models (GPT-4, Claude)
+- **Training data quality varies** — ExploitDB contains legacy code that may not work on modern systems
+- **No real-world validation** — exploits were not tested against live targets
+- **English only** — training data is overwhelmingly English
+
+## ⚠️ Disclaimer
+
+**This model is for authorized security testing and education only.**
+
+Do not use ZeroSec-7B for:
+- Attacking systems without explicit written permission
+- Developing malware or ransomware
+- Any illegal activity whatsoever
+
+The Zero Project and the model's creator are not responsible for any misuse.
+
+## Author
+
+**Ezra Dixon** — [The Zero Project](https://github.com/ezradixon)
+
+Built on Modal cloud GPUs. 🇦🇺