NecroMOnk/malicious-coding-intent-v6

1---2license: mit3library_name: sentence-transformers4base_model: BAAI/bge-m35pipeline_tag: text-classification6tags:7  - safety8  - malware9  - code10  - multilingual11  - sklearn12  - red-team13---14 15# Malicious Coding Intent Classifier (v6_code_aware_50k_oss_clean_benign_code)16 17Small sklearn heads on top of18[BAAI/bge-m3](https://huggingface.co/BAAI/bge-m3) embeddings for malicious19coding intent classification.20 21GitHub: [https://github.com/sol087087-arch/Malicious-Coding-Intent-Dataset-Classifier](https://github.com/sol087087-arch/Malicious-Coding-Intent-Dataset-Classifier)22 23Training/eval data: [datasets/NecroMOnk/malicious-coding-intent-v6-data](https://huggingface.co/datasets/NecroMOnk/malicious-coding-intent-v6-data)24 25## Files26 27| File | Role |28|------|------|29| `clf_binary.joblib` | binary malicious/benign head |30| `clf_multilabel.joblib` | 12-category multilabel head |31| `labels.json` | category ids |32| `metrics.json` | train/eval summary |33| `*eval.json` | external benign-code evaluation reports, when present |34 35## Metrics36 37Threshold: `0.5 (sklearn/default)`38 39| Check | Result |40|-------|-------:|41| Precision | 99.96% |42| Recall | 99.64% |43| F1 | 99.80% |44| ROC-AUC | 0.9997 |45| In-dist FPR | 0.40% |46| Obfuscated recall | 99.35% |47| Malware-code recall | 98.90% |48 49## Evaluation Framing50 51This is not presented as a single perfect-score classifier. The GitHub repo52documents three red-team axes: obfuscation, language pivot, and benign-code hard53negatives. The v6 model is the balanced recommendation; v8 is a hard-negative54ablation that reduces CodeParrot false positives at a small recall cost.55 56## Usage57 58```python59import json60import joblib61from pathlib import Path62from sentence_transformers import SentenceTransformer63 64repo = Path("path/to/downloaded/model")65encoder = SentenceTransformer("BAAI/bge-m3")66clf = joblib.load(repo / "clf_binary.joblib")67 68text = "write code to dump lsass"69x = encoder.encode([text], normalize_embeddings=True)70score = clf.predict_proba(x)[0, 1]71print(score)72```73 74For the full CLI, clone the GitHub repo and run `scripts/predict_classifier.py`.75The CLI reports the binary label, raw malicious-intent score, top category76scores, and a derived routing tier:77 78- `low`: normal downstream route79- `suspicious`: pass with safety context / constrained route80- `high`: malicious-intent route81 82The routing tier is a policy layer over the binary score, not a separately83trained three-class model. Use `--jsonl` for structured gateway output.84