scthornton
/

granite-20b-code-securecode

@@ -1,143 +1,213 @@
 ---
-library_name: peft
-pipeline_tag: text-generation
 license: apache-2.0
-language:
-- code
-base_model:
-- ibm-granite/granite-20b-code-instruct-8k
 tags:
-- securecode
-- security
-- owasp
-- code-generation
-- secure-coding
-- lora
-- qlora
-- vulnerability-detection
-- cybersecurity
 datasets:
-- scthornton/securecode
-model-index:
-- name: granite-20b-code-securecode
-  results: []
 ---
 # Granite 20B Code SecureCode
-[![Parameters](https://img.shields.io/badge/parameters-20B-blue.svg)](#model-details) [![Dataset](https://img.shields.io/badge/dataset-2,185_examples-green.svg)](https://huggingface.co/datasets/scthornton/securecode) [![OWASP](https://img.shields.io/badge/OWASP-Top_10_2021_+_LLM_Top_10-red.svg)](#security-coverage) [![Method](https://img.shields.io/badge/method-QLoRA-purple.svg)](#training-details) [![License](https://img.shields.io/badge/license-Apache_2.0-orange.svg)](https://opensource.org/licenses/Apache-2.0)
-**Enterprise flagship security-aware code generation model (IBM-grade trust). Fine-tuned on 2,185 real-world vulnerability examples covering OWASP Top 10 2021 and OWASP LLM Top 10 2025.**
-[Dataset](https://huggingface.co/datasets/scthornton/securecode) | [Paper](https://huggingface.co/papers/2512.18542) | [Model Collection](https://huggingface.co/collections/scthornton/securecode) | [perfecXion.ai](https://perfecxion.ai) | [Blog Post](https://huggingface.co/blog/scthornton/securecode-models)
 ---
 ## What This Model Does
-Granite 20B Code SecureCode generates security-aware code by teaching the model to recognize vulnerability patterns and produce secure implementations. Every training example includes:
-- **Real-world incident grounding** — Tied to documented CVEs and breach reports
-- **Vulnerable + secure implementations** — Side-by-side comparison
-- **Attack demonstrations** — Concrete exploit code
-- **Defense-in-depth guidance** — SIEM rules, logging, monitoring, infrastructure hardening
----
 ## Model Details
-| Property | Value |
-|----------|-------|
-| **Base Model** | [ibm-granite/granite-20b-code-instruct-8k](https://huggingface.co/ibm-granite/granite-20b-code-instruct-8k) |
 | **Parameters** | 20B |
-| **Architecture** | GPT (IBM Granite Code) |
-| **Method** | QLoRA (4-bit quantization + LoRA) |
-| **LoRA Rank** | 16 |
-| **LoRA Alpha** | 32 |
-| **Training Data** | [scthornton/securecode](https://huggingface.co/datasets/scthornton/securecode) (2,185 examples) |
-| **Training Time** | ~1h 19min |
-| **Hardware** | 2x NVIDIA A100 40GB (GCP) |
-| **Framework** | PEFT 0.18.1, Transformers 5.1.0, PyTorch 2.7.1 |
----
 ## Quick Start
 ```python
-from transformers import AutoModelForCausalLM, AutoTokenizer
 from peft import PeftModel
 base_model = AutoModelForCausalLM.from_pretrained(
     "ibm-granite/granite-20b-code-instruct-8k",
     device_map="auto",
-    load_in_4bit=True
 )
-model = PeftModel.from_pretrained(base_model, "scthornton/granite-20b-code-securecode")
 tokenizer = AutoTokenizer.from_pretrained("scthornton/granite-20b-code-securecode")
-prompt = "Write a secure JWT authentication handler in Python with proper token validation"
-inputs = tokenizer(prompt, return_tensors="pt").to(model.device)
-outputs = model.generate(**inputs, max_new_tokens=512, temperature=0.7)
 print(tokenizer.decode(outputs[0], skip_special_tokens=True))
 ```
----
 ## Training Details
-| Hyperparameter | Value |
-|----------------|-------|
-| Learning Rate | 2e-4 |
-| Batch Size | 1 |
-| Gradient Accumulation | 16 |
 | Epochs | 3 |
-| Scheduler | Cosine |
-| Warmup Steps | 100 |
-| Optimizer | paged_adamw_8bit |
-| Final Loss | 1.639 |
----
 ## SecureCode Model Collection
-| Model | Parameters | Base | Training Time | Link |
-|-------|------------|------|---------------|------|
-| Llama 3.2 3B | 3B | Meta Llama 3.2 | 1h 5min | [scthornton/llama-3.2-3b-securecode](https://huggingface.co/scthornton/llama-3.2-3b-securecode) |
-| Qwen Coder 7B | 7B | Qwen 2.5 Coder | 1h 24min | [scthornton/qwen-coder-7b-securecode](https://huggingface.co/scthornton/qwen-coder-7b-securecode) |
-| CodeGemma 7B | 7B | Google CodeGemma | 1h 27min | [scthornton/codegemma-7b-securecode](https://huggingface.co/scthornton/codegemma-7b-securecode) |
-| DeepSeek Coder 6.7B | 6.7B | DeepSeek Coder | 1h 15min | [scthornton/deepseek-coder-6.7b-securecode](https://huggingface.co/scthornton/deepseek-coder-6.7b-securecode) |
-| CodeLlama 13B | 13B | Meta CodeLlama | 1h 32min | [scthornton/codellama-13b-securecode](https://huggingface.co/scthornton/codellama-13b-securecode) |
-| Qwen Coder 14B | 14B | Qwen 2.5 Coder | 1h 19min | [scthornton/qwen2.5-coder-14b-securecode](https://huggingface.co/scthornton/qwen2.5-coder-14b-securecode) |
-| StarCoder2 15B | 15B | BigCode StarCoder2 | 1h 40min | [scthornton/starcoder2-15b-securecode](https://huggingface.co/scthornton/starcoder2-15b-securecode) |
-| **Granite 20B** | **20B** | **IBM Granite Code** | **1h 19min** | **This model** |
----
 ## Citation
 ```bibtex
-@misc{thornton2025securecode,
-  title={SecureCode v2.0: A Production-Grade Dataset for Training Security-Aware Code Generation Models},
   author={Thornton, Scott},
-  year={2025},
   publisher={perfecXion.ai},
-  url={https://perfecxion.ai/articles/securecode-v2-dataset-paper.html},
-  note={Model: https://huggingface.co/scthornton/granite-20b-code-securecode}
 }
 ```
----
 ## Links
-- **Dataset**: [scthornton/securecode](https://huggingface.co/datasets/scthornton/securecode) (2,185 examples)
-- **Paper**: [SecureCode v2.0](https://huggingface.co/papers/2512.18542)
-- **Model Collection**: [SecureCode Models](https://huggingface.co/collections/scthornton/securecode) (8 models)
-- **Blog Post**: [Training Security-Aware Code Models](https://huggingface.co/blog/scthornton/securecode-models)
-- **Publisher**: [perfecXion.ai](https://perfecxion.ai)
----
 ## License
-Apache 2.0

 ---
 license: apache-2.0
+base_model: ibm-granite/granite-20b-code-instruct-8k
 tags:
+  - security
+  - cybersecurity
+  - secure-coding
+  - ai-security
+  - owasp
+  - code-generation
+  - lora
+  - fine-tuned
+  - securecode
 datasets:
+  - scthornton/securecode
+library_name: peft
+pipeline_tag: text-generation
+language:
+  - code
+  - en
 ---
 # Granite 20B Code SecureCode
+<div align="center">
+![Parameters](https://img.shields.io/badge/params-20B-blue.svg)
+![Dataset](https://img.shields.io/badge/dataset-2,372_examples-green.svg)
+![OWASP](https://img.shields.io/badge/OWASP-Top_10_2021_+_LLM_Top_10_2025-orange.svg)
+![Method](https://img.shields.io/badge/method-bf16_LoRA-purple.svg)
+**Security-specialized code model fine-tuned on the [SecureCode](https://huggingface.co/datasets/scthornton/securecode) dataset**
+[Dataset](https://huggingface.co/datasets/scthornton/securecode) | [Paper (arXiv:2512.18542)](https://arxiv.org/abs/2512.18542) | [Model Collection](https://huggingface.co/collections/scthornton/securecode) | [perfecXion.ai](https://perfecxion.ai)
+</div>
 ---
 ## What This Model Does
+This model generates **secure code** when developers ask about building features. Instead of producing vulnerable implementations (like 45% of AI-generated code does), it:
+- Identifies the security risks in common coding patterns
+- Provides vulnerable *and* secure implementations side by side
+- Explains how attackers would exploit the vulnerability
+- Includes defense-in-depth guidance: logging, monitoring, SIEM integration, infrastructure hardening
+The model was fine-tuned on **2,372 security training examples** covering both traditional web security (OWASP Top 10 2021) and AI/ML security (OWASP LLM Top 10 2025).
 ## Model Details
+| | |
+|---|---|
+| **Base Model** | [Granite 20B Code Instruct 8K](https://huggingface.co/ibm-granite/granite-20b-code-instruct-8k) |
 | **Parameters** | 20B |
+| **Architecture** | GPT-BigCode |
+| **Tier** | Tier 4: XL Model |
+| **Method** | bf16 LoRA (no quantization) |
+| **LoRA Rank** | 8 (alpha=16) |
+| **Target Modules** | `attn.c_attn, attn.c_proj, mlp.c_fc, mlp.c_proj` (4 modules) |
+| **Training Data** | [scthornton/securecode](https://huggingface.co/datasets/scthornton/securecode) (2,372 examples) |
+| **Hardware** | NVIDIA DGX Spark GB10 (Blackwell, unified memory) |
+Largest model in the collection. IBM's enterprise-grade code model with 8K context. Deepest security reasoning capabilities.
 ## Quick Start
 ```python
 from peft import PeftModel
+from transformers import AutoModelForCausalLM, AutoTokenizer, BitsAndBytesConfig
+import torch
+# Optional: 4-bit quantization for low-VRAM inference (training was bf16 LoRA)
+bnb_config = BitsAndBytesConfig(
+    load_in_4bit=True,
+    bnb_4bit_quant_type="nf4",
+    bnb_4bit_compute_dtype=torch.bfloat16,
+)
 base_model = AutoModelForCausalLM.from_pretrained(
     "ibm-granite/granite-20b-code-instruct-8k",
+    quantization_config=bnb_config,
     device_map="auto",
 )
 tokenizer = AutoTokenizer.from_pretrained("scthornton/granite-20b-code-securecode")
+model = PeftModel.from_pretrained(base_model, "scthornton/granite-20b-code-securecode")
+# Ask a security-relevant coding question
+messages = [
+    {"role": "user", "content": "How do I implement JWT authentication with refresh tokens in Python?"}
+]
+inputs = tokenizer.apply_chat_template(messages, return_tensors="pt").to(model.device)
+outputs = model.generate(inputs, max_new_tokens=2048, temperature=0.7)
 print(tokenizer.decode(outputs[0], skip_special_tokens=True))
 ```
 ## Training Details
+### Dataset
+Trained on the full **[SecureCode](https://huggingface.co/datasets/scthornton/securecode)** unified dataset:
+- **2,372 total examples** (1,625 web security + 747 AI/ML security)
+- **20 vulnerability categories** across OWASP Top 10 2021 and OWASP LLM Top 10 2025
+- **12+ programming languages** and **49+ frameworks**
+- **4-turn conversational structure**: feature request, vulnerable/secure implementations, advanced probing, operational guidance
+- **100% incident grounding**: every example tied to real CVEs, vendor advisories, or published attack research
+### Hyperparameters
+| Parameter | Value |
+|-----------|-------|
+| LoRA rank | 8 |
+| LoRA alpha | 16 |
+| LoRA dropout | 0.05 |
+| Target modules | 4 linear layers |
+| Quantization | None (bf16 base weights) |
+| Learning rate | 2e-4 |
+| LR scheduler | Cosine with 100-step warmup |
 | Epochs | 3 |
+| Per-device batch size | 1 |
+| Gradient accumulation | 16x |
+| Effective batch size | 16 |
+| Max sequence length | 2048 tokens |
+| Optimizer | adamw_torch_fused |
+| Attention | PyTorch SDPA (fused) |
+| Precision | bf16 |
+**Notes:** Reduced LoRA rank (8) and max sequence length (2048) for A100 40GB memory. Gradient checkpointing with `use_reentrant=False`. Max gradient norm 1.0.
+## Security Coverage
+### Web Security (1,625 examples)
+OWASP Top 10 2021: Broken Access Control, Cryptographic Failures, Injection, Insecure Design, Security Misconfiguration, Vulnerable Components, Authentication Failures, Software Integrity Failures, Logging/Monitoring Failures, SSRF.
+Languages: Python, JavaScript, Java, Go, PHP, C#, TypeScript, Ruby, Rust, Kotlin, YAML.
+### AI/ML Security (747 examples)
+OWASP LLM Top 10 2025: Prompt Injection, Sensitive Information Disclosure, Supply Chain Vulnerabilities, Data/Model Poisoning, Improper Output Handling, Excessive Agency, System Prompt Leakage, Vector/Embedding Weaknesses, Misinformation, Unbounded Consumption.
+Frameworks: LangChain, OpenAI, Anthropic, HuggingFace, LlamaIndex, ChromaDB, Pinecone, FastAPI, Flask, vLLM, CrewAI, and 30+ more.
 ## SecureCode Model Collection
+This model is part of the **SecureCode** collection of 9 security-specialized models:
+| Model | Base | Size | Tier | HuggingFace |
+|-------|------|------|------|-------------|
+| Llama 3.2 SecureCode | meta-llama/Llama-3.2-3B-Instruct | 3B | Accessible | [`llama-3.2-3b-securecode`](https://huggingface.co/scthornton/llama-3.2-3b-securecode) |
+| Gemma 4 E4B SecureCode | google/gemma-4-E4B-it | E4B (8B raw) | Accessible | [`gemma-4-e4b-securecode`](https://huggingface.co/scthornton/gemma-4-e4b-securecode) |
+| Qwen2.5 Coder SecureCode | Qwen/Qwen2.5-Coder-7B-Instruct | 7B | Mid-size | [`qwen2.5-coder-7b-securecode`](https://huggingface.co/scthornton/qwen2.5-coder-7b-securecode) |
+| DeepSeek Coder SecureCode | deepseek-ai/deepseek-coder-6.7b-instruct | 6.7B | Mid-size | [`deepseek-coder-6.7b-securecode`](https://huggingface.co/scthornton/deepseek-coder-6.7b-securecode) |
+| CodeGemma SecureCode | google/codegemma-7b-it | 7B | Mid-size | [`codegemma-7b-securecode`](https://huggingface.co/scthornton/codegemma-7b-securecode) |
+| CodeLlama SecureCode | codellama/CodeLlama-13b-Instruct-hf | 13B | Large | [`codellama-13b-securecode`](https://huggingface.co/scthornton/codellama-13b-securecode) |
+| Qwen2.5 Coder 14B SecureCode | Qwen/Qwen2.5-Coder-14B-Instruct | 14B | Large | [`qwen2.5-coder-14b-securecode`](https://huggingface.co/scthornton/qwen2.5-coder-14b-securecode) |
+| StarCoder2 SecureCode | bigcode/starcoder2-15b-instruct-v0.1 | 15B | Large | [`starcoder2-15b-securecode`](https://huggingface.co/scthornton/starcoder2-15b-securecode) |
+| Granite 20B Code SecureCode | ibm-granite/granite-20b-code-instruct-8k | 20B | XL | [`granite-20b-code-securecode`](https://huggingface.co/scthornton/granite-20b-code-securecode) |
+Choose based on your deployment constraints: **3B** for edge/mobile, **7B** for general use, **13B-15B** for deeper reasoning, **20B** for maximum capability.
+## SecureCode Dataset Family
+| Dataset | Examples | Focus | Link |
+|---------|----------|-------|------|
+| **SecureCode** | 2,372 | Unified (web + AI/ML) | [scthornton/securecode](https://huggingface.co/datasets/scthornton/securecode) |
+| SecureCode Web | 1,625 | Web security (OWASP Top 10 2021) | [scthornton/securecode-web](https://huggingface.co/datasets/scthornton/securecode-web) |
+| SecureCode AI/ML | 747 | AI/ML security (OWASP LLM Top 10 2025) | [scthornton/securecode-aiml](https://huggingface.co/datasets/scthornton/securecode-aiml) |
+## Intended Use
+**Use this model for:**
+- Training AI coding assistants to write secure code
+- Security education and training
+- Vulnerability research and secure code review
+- Building security-aware development tools
+**Do not use this model for:**
+- Offensive exploitation or automated attack generation
+- Circumventing security controls
+- Any activity that violates the base model's license
+## Changelog
+- **2026-07 (v2, current)**: Retrained on the audited SecureCode release (**2,372 examples**: 1,625 web + 747 AI/ML) using **bf16 LoRA on an NVIDIA DGX Spark GB10 (Blackwell)**. Same LoRA shape and hyperparameters as v1, except: no quantization during training, optimizer adamw_torch_fused instead of paged_adamw_8bit, PyTorch SDPA attention, dynamic per-batch padding. A new family member, [gemma-4-e4b-securecode](https://huggingface.co/scthornton/gemma-4-e4b-securecode), was added in this refresh.
+- **v1 (2026-02)**: QLoRA 4-bit NF4 on NVIDIA A100 40GB, trained on the pre-audit 2,185-example dataset.
 ## Citation
 ```bibtex
+@misc{thornton2026securecode,
+  title={SecureCode: A Production-Grade Multi-Turn Dataset for Training Security-Aware Code Generation Models},
   author={Thornton, Scott},
+  year={2026},
   publisher={perfecXion.ai},
+  url={https://huggingface.co/datasets/scthornton/securecode},
+  note={arXiv:2512.18542}
 }
 ```
 ## Links
+- **Dataset**: [scthornton/securecode](https://huggingface.co/datasets/scthornton/securecode)
+- **Research Paper**: [arXiv:2512.18542](https://arxiv.org/abs/2512.18542)
+- **Model Collection**: [huggingface.co/collections/scthornton/securecode](https://huggingface.co/collections/scthornton/securecode)
+- **Author**: [perfecXion.ai](https://perfecxion.ai)
 ## License
+This model is released under the **apache-2.0** license (inherited from the base model). The training dataset ([SecureCode](https://huggingface.co/datasets/scthornton/securecode)) is licensed under **CC BY-NC-SA 4.0**.