odoom/nixpkgs-security-qwen-lora

nixpkgs-security-qwen-lora

QLoRA adapter for Qwen2.5-Coder-32B-Instruct, fine-tuned on real NixOS/nixpkgs security patches to generate CVE fixes as an agentic tool-calling workflow.

Deployed on Cloudflare Workers AI as part of vulnpatch.dev.

What it does

Given a CVE and a nixpkgs package, the model acts as an agent that:

1. 1.Reads the current package expression (read_nixpkgs_file)
2. 2.Finds the upstream fix (find_upstream_fix)
3. 3.Computes source hashes (prefetch_hash)
4. 4.Generates and submits a patch diff (submit_for_approval)

The model uses Qwen 2.5's native <tool_call> / <tool_response> XML format for tool interactions.

Training

Training curves

Previous versions

Dataset

Trained on odoom/nixpkgs-security-patches -- 654 multi-turn tool-calling conversations derived from real merged security PRs in NixOS/nixpkgs.

Deployment on Cloudflare Workers AI

This adapter is designed for Cloudflare Workers AI deployment. Key requirements:

1. 1.`model_type` must be `"llama"` in adapter_config.json (CF rejects "qwen2", but "llama" works due to similar architecture)
2. 2.Stop sequences are required to prevent the model from hallucinating conversation continuations:

   stop: ["</tool_call>", "<tool_response>", "<|im_end|>", "<|endoftext|>"]

1. 1.Upload only adapter_config.json + adapter_model.safetensors (max 2 assets)

npx wrangler ai finetune create @cf/qwen/qwen2.5-coder-32b-instruct <name> <adapter_folder>/

Usage (local inference)

from peft import PeftModel
from transformers import AutoModelForCausalLM, AutoTokenizer

base = AutoModelForCausalLM.from_pretrained(
    "Qwen/Qwen2.5-Coder-32B-Instruct",
    device_map="auto",
    torch_dtype="auto",
)
model = PeftModel.from_pretrained(base, "odoom/nixpkgs-security-qwen-lora")
tokenizer = AutoTokenizer.from_pretrained("Qwen/Qwen2.5-Coder-32B-Instruct")

Limitations

• —Nix is low-resource: The base model has limited Nix language understanding. Continued pre-training on raw .nix files would likely improve results.
• —Small dataset: 654 examples covers common patterns (version bumps, fetchpatch) but edge cases may produce lower quality output.
• —Tool-calling only: The model is trained for the specific 6-tool workflow above. General Nix code generation was not a training objective.

License

Apache 2.0