scthornton/codegemma-7b-securecode
015
1---2license: gemma3base_model: google/codegemma-7b-it4tags:5 - security6 - cybersecurity7 - secure-coding8 - ai-security9 - owasp10 - code-generation11 - lora12 - fine-tuned13 - securecode14datasets:15 - scthornton/securecode16library_name: peft17pipeline_tag: text-generation18language:19 - code20 - en21---22 23# CodeGemma 7B SecureCode24 25<div align="center">26 2728293031 32**Security-specialized code model fine-tuned on the [SecureCode](https://huggingface.co/datasets/scthornton/securecode) dataset**33 34[Dataset](https://huggingface.co/datasets/scthornton/securecode) | [Paper (arXiv:2512.18542)](https://arxiv.org/abs/2512.18542) | [Model Collection](https://huggingface.co/collections/scthornton/securecode) | [perfecXion.ai](https://perfecxion.ai)35 36</div>37 38---39 40## What This Model Does41 42This model generates **secure code** when developers ask about building features. Instead of producing vulnerable implementations (like 45% of AI-generated code does), it:43 44- Identifies the security risks in common coding patterns45- Provides vulnerable *and* secure implementations side by side46- Explains how attackers would exploit the vulnerability47- Includes defense-in-depth guidance: logging, monitoring, SIEM integration, infrastructure hardening48 49The model was fine-tuned on **2,372 security training examples** covering both traditional web security (OWASP Top 10 2021) and AI/ML security (OWASP LLM Top 10 2025).50 51## Model Details52 53| | |54|---|---|55| **Base Model** | [CodeGemma 7B IT](https://huggingface.co/google/codegemma-7b-it) |56| **Parameters** | 7B |57| **Architecture** | Gemma |58| **Tier** | Tier 2: Mid-size Code Specialist |59| **Method** | bf16 LoRA (no quantization) |60| **LoRA Rank** | 16 (alpha=32) |61| **Target Modules** | `q_proj, k_proj, v_proj, o_proj, gate_proj, up_proj, down_proj` (7 modules) |62| **Training Data** | [scthornton/securecode](https://huggingface.co/datasets/scthornton/securecode) (2,372 examples) |63| **Hardware** | NVIDIA DGX Spark GB10 (Blackwell, unified memory) |64 65Google's code-specialized Gemma variant. Strong instruction following with efficient architecture.66 67## Quick Start68 69```python70from peft import PeftModel71from transformers import AutoModelForCausalLM, AutoTokenizer, BitsAndBytesConfig72import torch73 74# Optional: 4-bit quantization for low-VRAM inference (training was bf16 LoRA)75bnb_config = BitsAndBytesConfig(76 load_in_4bit=True,77 bnb_4bit_quant_type="nf4",78 bnb_4bit_compute_dtype=torch.bfloat16,79)80 81base_model = AutoModelForCausalLM.from_pretrained(82 "google/codegemma-7b-it",83 quantization_config=bnb_config,84 device_map="auto",85)86tokenizer = AutoTokenizer.from_pretrained("scthornton/codegemma-7b-securecode")87model = PeftModel.from_pretrained(base_model, "scthornton/codegemma-7b-securecode")88 89# Ask a security-relevant coding question90messages = [91 {"role": "user", "content": "How do I implement JWT authentication with refresh tokens in Python?"}92]93 94inputs = tokenizer.apply_chat_template(messages, return_tensors="pt").to(model.device)95outputs = model.generate(inputs, max_new_tokens=2048, temperature=0.7)96print(tokenizer.decode(outputs[0], skip_special_tokens=True))97```98 99## Training Details100 101### Dataset102 103Trained on the full **[SecureCode](https://huggingface.co/datasets/scthornton/securecode)** unified dataset:104 105- **2,372 total examples** (1,625 web security + 747 AI/ML security)106- **20 vulnerability categories** across OWASP Top 10 2021 and OWASP LLM Top 10 2025107- **12+ programming languages** and **49+ frameworks**108- **4-turn conversational structure**: feature request, vulnerable/secure implementations, advanced probing, operational guidance109- **100% incident grounding**: every example tied to real CVEs, vendor advisories, or published attack research110 111### Hyperparameters112 113| Parameter | Value |114|-----------|-------|115| LoRA rank | 16 |116| LoRA alpha | 32 |117| LoRA dropout | 0.05 |118| Target modules | 7 linear layers |119| Quantization | None (bf16 base weights) |120| Learning rate | 2e-4 |121| LR scheduler | Cosine with 100-step warmup |122| Epochs | 3 |123| Per-device batch size | 2 |124| Gradient accumulation | 8x |125| Effective batch size | 16 |126| Max sequence length | 4096 tokens |127| Optimizer | adamw_torch_fused |128| Attention | PyTorch SDPA (fused) |129| Precision | bf16 |130 131**Notes:** Requires `trust_remote_code=True`. Extended 4096-token context for full security conversations.132 133## Security Coverage134 135### Web Security (1,625 examples)136 137OWASP Top 10 2021: Broken Access Control, Cryptographic Failures, Injection, Insecure Design, Security Misconfiguration, Vulnerable Components, Authentication Failures, Software Integrity Failures, Logging/Monitoring Failures, SSRF.138 139Languages: Python, JavaScript, Java, Go, PHP, C#, TypeScript, Ruby, Rust, Kotlin, YAML.140 141### AI/ML Security (747 examples)142 143OWASP LLM Top 10 2025: Prompt Injection, Sensitive Information Disclosure, Supply Chain Vulnerabilities, Data/Model Poisoning, Improper Output Handling, Excessive Agency, System Prompt Leakage, Vector/Embedding Weaknesses, Misinformation, Unbounded Consumption.144 145Frameworks: LangChain, OpenAI, Anthropic, HuggingFace, LlamaIndex, ChromaDB, Pinecone, FastAPI, Flask, vLLM, CrewAI, and 30+ more.146 147## SecureCode Model Collection148 149This model is part of the **SecureCode** collection of 9 security-specialized models:150 151| Model | Base | Size | Tier | HuggingFace |152|-------|------|------|------|-------------|153| Llama 3.2 SecureCode | meta-llama/Llama-3.2-3B-Instruct | 3B | Accessible | [`llama-3.2-3b-securecode`](https://huggingface.co/scthornton/llama-3.2-3b-securecode) |154| Gemma 4 E4B SecureCode | google/gemma-4-E4B-it | E4B (8B raw) | Accessible | [`gemma-4-e4b-securecode`](https://huggingface.co/scthornton/gemma-4-e4b-securecode) |155| Qwen2.5 Coder SecureCode | Qwen/Qwen2.5-Coder-7B-Instruct | 7B | Mid-size | [`qwen2.5-coder-7b-securecode`](https://huggingface.co/scthornton/qwen2.5-coder-7b-securecode) |156| DeepSeek Coder SecureCode | deepseek-ai/deepseek-coder-6.7b-instruct | 6.7B | Mid-size | [`deepseek-coder-6.7b-securecode`](https://huggingface.co/scthornton/deepseek-coder-6.7b-securecode) |157| CodeGemma SecureCode | google/codegemma-7b-it | 7B | Mid-size | [`codegemma-7b-securecode`](https://huggingface.co/scthornton/codegemma-7b-securecode) |158| CodeLlama SecureCode | codellama/CodeLlama-13b-Instruct-hf | 13B | Large | [`codellama-13b-securecode`](https://huggingface.co/scthornton/codellama-13b-securecode) |159| Qwen2.5 Coder 14B SecureCode | Qwen/Qwen2.5-Coder-14B-Instruct | 14B | Large | [`qwen2.5-coder-14b-securecode`](https://huggingface.co/scthornton/qwen2.5-coder-14b-securecode) |160| StarCoder2 SecureCode | bigcode/starcoder2-15b-instruct-v0.1 | 15B | Large | [`starcoder2-15b-securecode`](https://huggingface.co/scthornton/starcoder2-15b-securecode) |161| Granite 20B Code SecureCode | ibm-granite/granite-20b-code-instruct-8k | 20B | XL | [`granite-20b-code-securecode`](https://huggingface.co/scthornton/granite-20b-code-securecode) |162 163Choose based on your deployment constraints: **3B** for edge/mobile, **7B** for general use, **13B-15B** for deeper reasoning, **20B** for maximum capability.164 165## SecureCode Dataset Family166 167| Dataset | Examples | Focus | Link |168|---------|----------|-------|------|169| **SecureCode** | 2,372 | Unified (web + AI/ML) | [scthornton/securecode](https://huggingface.co/datasets/scthornton/securecode) |170| SecureCode Web | 1,625 | Web security (OWASP Top 10 2021) | [scthornton/securecode-web](https://huggingface.co/datasets/scthornton/securecode-web) |171| SecureCode AI/ML | 747 | AI/ML security (OWASP LLM Top 10 2025) | [scthornton/securecode-aiml](https://huggingface.co/datasets/scthornton/securecode-aiml) |172 173## Intended Use174 175**Use this model for:**176- Training AI coding assistants to write secure code177- Security education and training178- Vulnerability research and secure code review179- Building security-aware development tools180 181**Do not use this model for:**182- Offensive exploitation or automated attack generation183- Circumventing security controls184- Any activity that violates the base model's license185 186## Changelog187 188- **2026-07 (v2, current)**: Retrained on the audited SecureCode release (**2,372 examples**: 1,625 web + 747 AI/ML) using **bf16 LoRA on an NVIDIA DGX Spark GB10 (Blackwell)**. Same LoRA shape and hyperparameters as v1, except: no quantization during training, optimizer adamw_torch_fused instead of paged_adamw_8bit, PyTorch SDPA attention, dynamic per-batch padding. A new family member, [gemma-4-e4b-securecode](https://huggingface.co/scthornton/gemma-4-e4b-securecode), was added in this refresh.189- **v1 (2026-02)**: QLoRA 4-bit NF4 on NVIDIA A100 40GB, trained on the pre-audit 2,185-example dataset.190 191## Citation192 193```bibtex194@misc{thornton2026securecode,195 title={SecureCode: A Production-Grade Multi-Turn Dataset for Training Security-Aware Code Generation Models},196 author={Thornton, Scott},197 year={2026},198 publisher={perfecXion.ai},199 url={https://huggingface.co/datasets/scthornton/securecode},200 note={arXiv:2512.18542}201}202```203 204## Links205 206- **Dataset**: [scthornton/securecode](https://huggingface.co/datasets/scthornton/securecode)207- **Research Paper**: [arXiv:2512.18542](https://arxiv.org/abs/2512.18542)208- **Model Collection**: [huggingface.co/collections/scthornton/securecode](https://huggingface.co/collections/scthornton/securecode)209- **Author**: [perfecXion.ai](https://perfecxion.ai)210 211## License212 213This model is released under the **gemma** license (inherited from the base model). The training dataset ([SecureCode](https://huggingface.co/datasets/scthornton/securecode)) is licensed under **CC BY-NC-SA 4.0**.214