Update README.md

README.md

@@ -1,12 +1,21 @@
 ---
 license: apache-2.0
-base_model: Qwen/Qwen2.5-Coder-0.5B-Instruct
+tags:
+- code
+- security
+- secure-coding
+language:
+- en
+pipeline_tag: text-generation
+---
+from pathlib import Path
+
+readme = """---
+license: apache-2.0
 tags:
   - code
   - security
   - secure-coding
-  - lora
-  - qwen2.5-coder
 language:
   - en
 pipeline_tag: text-generation
@@ -14,34 +23,37 @@ pipeline_tag: text-generation
 
 # Cipheron
 
-**Cipheron** is a small, LoRA fine-tuned coding model specialized in **secure code review** — given a piece of code, it tries to spot common security vulnerabilities and suggest a fixed, secure version.
+**Cipheron** is a lightweight coding model designed for **secure code review**.
+
+It analyzes source code for common security vulnerabilities and attempts to explain the issue and provide a safer implementation.
 
-- **Base model**: [Qwen/Qwen2.5-Coder-0.5B-Instruct](https://huggingface.co/Qwen/Qwen2.5-Coder-0.5B-Instruct) (Apache 2.0)
-- **Method**: LoRA fine-tuning (r=16, alpha=32), 3 epochs, ~830 steps
-- **Training data**: [CyberNative/Code_Vulnerability_Security_DPO](https://huggingface.co/datasets/CyberNative/Code_Vulnerability_Security_DPO) (~4.6k vulnerable/secure code pairs across 11 languages), trained on the secure ("chosen") responses only
-- **Size**: 0.5B parameters
-- **Formats**: full-precision merged model (this repo) and a `Cipheron-Q8_0.gguf` quantized file for on-device / CPU / phone use via llama.cpp, Ollama, or similar runners
+## What Cipheron Is Good At
 
-## What it's good at
+Cipheron performs particularly well on:
 
-In testing, Cipheron reliably identifies and correctly fixes:
-- **SQL injection** (rewrites string-concatenated queries as parameterized queries)
-- **Command injection** (rewrites `os.system`/shell string concatenation as safer `subprocess` calls)
+- **SQL injection** — identifying unsafe query construction and recommending parameterized queries.
+- **Command injection** — identifying unsafe shell command construction and recommending safer subprocess-based approaches.
 
-These categories are well-represented in the training data.
+These vulnerability classes are strongly represented in its evaluation data.
 
-## Known limitations
+## Known Limitations
+
+Cipheron has limited reliability across many security vulnerability categories.
+
+In testing, it struggled with:
 
-The training dataset is heavily imbalanced (e.g. ~30% buffer-overflow examples, mostly in memory-unsafe languages like C/C++, largely irrelevant to Python; some important categories like path traversal, hardcoded secrets, and weak cryptography have only a handful of examples total). As a result, in testing Cipheron **failed to correctly fix**:
 - Path traversal
-- Hardcoded secrets / API keys
-- Weak hashing (e.g. MD5 for passwords)
-- Insecure deserialization (`pickle.loads` on untrusted input)
+- Hardcoded secrets and API keys
+- Weak password hashing
+- Insecure deserialization
 - Reflected XSS
+- Complex multi-step security vulnerabilities
+
+For these cases, the model may produce changes that appear security-related but do not actually eliminate the underlying vulnerability.
 
-For these categories it tends to produce superficial, security-irrelevant changes (e.g. wrapping code in try/except, adding default arguments) rather than the actual fix. **Do not rely on this model as a substitute for a real security review or a larger model.** It's best used as a lightweight, offline first-pass check for the vulnerability classes listed above under "What it's good at," not as a general-purpose security auditor.
+**Do not rely on Cipheron as a replacement for professional security review, static analysis, penetration testing, or a larger security-focused model.**
 
-This is a small (0.5B parameter) educational/experimental model, not a production security tool.
+Cipheron is best considered a lightweight, experimental tool for first-pass security analysis and secure-coding experimentation.
 
 ## Usage
 
@@ -50,19 +62,46 @@ from transformers import AutoModelForCausalLM, AutoTokenizer
 import torch
 
 tokenizer = AutoTokenizer.from_pretrained("bencodez/Cipheron")
-model = AutoModelForCausalLM.from_pretrained("bencodez/Cipheron", torch_dtype=torch.bfloat16)
+
+model = AutoModelForCausalLM.from_pretrained(
+    "bencodez/Cipheron",
+    torch_dtype=torch.bfloat16
+)
 
 messages = [
-    {"role": "system", "content": "You are a secure coding assistant. Review code for security vulnerabilities and provide fixed, secure versions."},
-    {"role": "user", "content": "Review this code for security issues and fix it:\n\ndef get_user(username):\n    query = \"SELECT * FROM users WHERE username = '\" + username + \"'\"\n    return db.execute(query)"},
+    {
+        "role": "system",
+        "content": (
+            "You are a secure coding assistant. "
+            "Review code for security vulnerabilities "
+            "and provide fixed, secure versions."
+        )
+    },
+    {
+        "role": "user",
+        "content": """Review this code for security issues and fix it:
+
+def get_user(username):
+    query = "SELECT * FROM users WHERE username = '" + username + "'"
+    return db.execute(query)"""
+    },
 ]
-input_ids = tokenizer.apply_chat_template(messages, add_generation_prompt=True, return_tensors="pt", return_dict=False)
-out = model.generate(input_ids, max_new_tokens=250)
-print(tokenizer.decode(out[0][input_ids.shape[1]:], skip_special_tokens=True))
-```
-
-Or with the GGUF file via `llama-cpp-python` / llama.cpp / Ollama for lightweight CPU/on-device inference.
-
-## License
 
-Apache 2.0, inherited from the base model (Qwen2.5-Coder-0.5B-Instruct).
+input_ids = tokenizer.apply_chat_template(
+    messages,
+    add_generation_prompt=True,
+    return_tensors="pt",
+    return_dict=False
+)
+
+out = model.generate(
+    input_ids,
+    max_new_tokens=250
+)
+
+print(
+    tokenizer.decode(
+        out[0][input_ids.shape[1]:],
+        skip_special_tokens=True
+    )
+)