macmacmacmac/VibeThinker-3B-BugBounty-Triage-litert-lm

VibeThinker-3B · BugBounty-Triage · LiteRT-LM (fp16)

On-device LiteRT-LM (.litertlm) build of a **VibeThinker-3B** model fine-tuned for bug-bounty / vulnerability-disclosure triage (the vibebounty sidecar). It reads a single researcher submission and returns a JSON verdict — one of 9 dispositions (valid_impactful, valid_low, corroborated_surge, likely_duplicate, out_of_scope, theoretical_no_poc, self_inflicted, accepted_risk, slop) with severity, confidence, and a rationale.

Files

Eval (held-out, via the production harness path)

n = 20 held-out reports (subset; CPU eval). Strong signal, not the full 300-set number.

Provenance & conversion

• —Base: WeiboAI/VibeThinker-3B (Qwen2.5-3B architecture, reasoning model)
• —Fine-tune: LoRA (rank 16, all 36 layers, q/k/v/o + MLP), trained via MLX on ~18k labeled disclosure outcomes, then fused into the base weights
• —Convert: litert-torch → multi-signature .tflite (fp16), packaged with litert-lm-builder — qwen2p5 metadata, 8192 KV cache, HF tokenizer, chat template, stop tokens 151645/151643
• —Why fp16, not int8: this aggressive (scale 20) merge has weight outliers that int8 weight-quantization clips into incoherent output; fp16 preserves the fine-tune. (A separately-validated int8 build may be offered if it survives quantization.)

Usage

litert-lm import vibethinker3b-bbtriage-v2_fp16_ekv8192.litertlm bbtriage
litert-lm serve --port 8092           # OpenAI-compatible /v1/chat/completions

Then point any OpenAI client — or the vibebounty harness (MODEL_BASE_URL) — at it.

License

MIT, inherited from the base model WeiboAI/VibeThinker-3B.