Update model card: audited SecureCode 2,372 dataset, bf16 LoRA on DGX Spark GB10

README.md

@@ -2,23 +2,22 @@
 license: llama2
 base_model: codellama/CodeLlama-13b-Instruct-hf
 tags:
-- security
-- cybersecurity
-- secure-coding
-- ai-security
-- owasp
-- code-generation
-- qlora
-- lora
-- fine-tuned
-- securecode
+  - security
+  - cybersecurity
+  - secure-coding
+  - ai-security
+  - owasp
+  - code-generation
+  - lora
+  - fine-tuned
+  - securecode
 datasets:
-- scthornton/securecode
+  - scthornton/securecode
 library_name: peft
 pipeline_tag: text-generation
 language:
-- code
-- en
+  - code
+  - en
 ---
 
 # CodeLlama 13B SecureCode
@@ -26,9 +25,9 @@ language:
 <div align="center">
 
 ![Parameters](https://img.shields.io/badge/params-13B-blue.svg)
-![Dataset](https://img.shields.io/badge/dataset-2,185_examples-green.svg)
+![Dataset](https://img.shields.io/badge/dataset-2,372_examples-green.svg)
 ![OWASP](https://img.shields.io/badge/OWASP-Top_10_2021_+_LLM_Top_10_2025-orange.svg)
-![Method](https://img.shields.io/badge/method-QLoRA_4--bit-purple.svg)
+![Method](https://img.shields.io/badge/method-bf16_LoRA-purple.svg)
 
 **Security-specialized code model fine-tuned on the [SecureCode](https://huggingface.co/datasets/scthornton/securecode) dataset**
 
@@ -47,7 +46,7 @@ This model generates **secure code** when developers ask about building features
 - Explains how attackers would exploit the vulnerability
 - Includes defense-in-depth guidance: logging, monitoring, SIEM integration, infrastructure hardening
 
-The model was fine-tuned on **2,185 security training examples** covering both traditional web security (OWASP Top 10 2021) and AI/ML security (OWASP LLM Top 10 2025).
+The model was fine-tuned on **2,372 security training examples** covering both traditional web security (OWASP Top 10 2021) and AI/ML security (OWASP LLM Top 10 2025).
 
 ## Model Details
 
@@ -57,11 +56,11 @@ The model was fine-tuned on **2,185 security training examples** covering both t
 | **Parameters** | 13B |
 | **Architecture** | Llama 2 |
 | **Tier** | Tier 3: Large Model |
-| **Method** | QLoRA (4-bit NormalFloat quantization) |
+| **Method** | bf16 LoRA (no quantization) |
 | **LoRA Rank** | 16 (alpha=32) |
 | **Target Modules** | `q_proj, k_proj, v_proj, o_proj, gate_proj, up_proj, down_proj` (7 modules) |
-| **Training Data** | [scthornton/securecode](https://huggingface.co/datasets/scthornton/securecode) (2,185 examples) |
-| **Hardware** | NVIDIA A100 40GB |
+| **Training Data** | [scthornton/securecode](https://huggingface.co/datasets/scthornton/securecode) (2,372 examples) |
+| **Hardware** | NVIDIA DGX Spark GB10 (Blackwell, unified memory) |
 
 Meta's code-specialized Llama variant at 13B parameters. Deeper security reasoning with strong code understanding.
 
@@ -72,7 +71,7 @@ from peft import PeftModel
 from transformers import AutoModelForCausalLM, AutoTokenizer, BitsAndBytesConfig
 import torch
 
-# Load with 4-bit quantization (matches training)
+# Optional: 4-bit quantization for low-VRAM inference (training was bf16 LoRA)
 bnb_config = BitsAndBytesConfig(
     load_in_4bit=True,
     bnb_4bit_quant_type="nf4",
@@ -103,7 +102,7 @@ print(tokenizer.decode(outputs[0], skip_special_tokens=True))
 
 Trained on the full **[SecureCode](https://huggingface.co/datasets/scthornton/securecode)** unified dataset:
 
-- **2,185 total examples** (1,435 web security + 750 AI/ML security)
+- **2,372 total examples** (1,625 web security + 747 AI/ML security)
 - **20 vulnerability categories** across OWASP Top 10 2021 and OWASP LLM Top 10 2025
 - **12+ programming languages** and **49+ frameworks**
 - **4-turn conversational structure**: feature request, vulnerable/secure implementations, advanced probing, operational guidance
@@ -117,7 +116,7 @@ Trained on the full **[SecureCode](https://huggingface.co/datasets/scthornton/se
 | LoRA alpha | 32 |
 | LoRA dropout | 0.05 |
 | Target modules | 7 linear layers |
-| Quantization | 4-bit NormalFloat (NF4) |
+| Quantization | None (bf16 base weights) |
 | Learning rate | 2e-4 |
 | LR scheduler | Cosine with 100-step warmup |
 | Epochs | 3 |
@@ -125,20 +124,21 @@ Trained on the full **[SecureCode](https://huggingface.co/datasets/scthornton/se
 | Gradient accumulation | 8x |
 | Effective batch size | 16 |
 | Max sequence length | 2048 tokens |
-| Optimizer | paged_adamw_8bit |
+| Optimizer | adamw_torch_fused |
+| Attention | PyTorch SDPA (fused) |
 | Precision | bf16 |
 
 **Notes:** Reduced max sequence length (2048) to fit A100 40GB memory. Strong at multi-turn security reasoning.
 
 ## Security Coverage
 
-### Web Security (1,435 examples)
+### Web Security (1,625 examples)
 
 OWASP Top 10 2021: Broken Access Control, Cryptographic Failures, Injection, Insecure Design, Security Misconfiguration, Vulnerable Components, Authentication Failures, Software Integrity Failures, Logging/Monitoring Failures, SSRF.
 
 Languages: Python, JavaScript, Java, Go, PHP, C#, TypeScript, Ruby, Rust, Kotlin, YAML.
 
-### AI/ML Security (750 examples)
+### AI/ML Security (747 examples)
 
 OWASP LLM Top 10 2025: Prompt Injection, Sensitive Information Disclosure, Supply Chain Vulnerabilities, Data/Model Poisoning, Improper Output Handling, Excessive Agency, System Prompt Leakage, Vector/Embedding Weaknesses, Misinformation, Unbounded Consumption.
 
@@ -146,11 +146,12 @@ Frameworks: LangChain, OpenAI, Anthropic, HuggingFace, LlamaIndex, ChromaDB, Pin
 
 ## SecureCode Model Collection
 
-This model is part of the **SecureCode** collection of 8 security-specialized models:
+This model is part of the **SecureCode** collection of 9 security-specialized models:
 
 | Model | Base | Size | Tier | HuggingFace |
 |-------|------|------|------|-------------|
 | Llama 3.2 SecureCode | meta-llama/Llama-3.2-3B-Instruct | 3B | Accessible | [`llama-3.2-3b-securecode`](https://huggingface.co/scthornton/llama-3.2-3b-securecode) |
+| Gemma 4 E4B SecureCode | google/gemma-4-E4B-it | E4B (8B raw) | Accessible | [`gemma-4-e4b-securecode`](https://huggingface.co/scthornton/gemma-4-e4b-securecode) |
 | Qwen2.5 Coder SecureCode | Qwen/Qwen2.5-Coder-7B-Instruct | 7B | Mid-size | [`qwen2.5-coder-7b-securecode`](https://huggingface.co/scthornton/qwen2.5-coder-7b-securecode) |
 | DeepSeek Coder SecureCode | deepseek-ai/deepseek-coder-6.7b-instruct | 6.7B | Mid-size | [`deepseek-coder-6.7b-securecode`](https://huggingface.co/scthornton/deepseek-coder-6.7b-securecode) |
 | CodeGemma SecureCode | google/codegemma-7b-it | 7B | Mid-size | [`codegemma-7b-securecode`](https://huggingface.co/scthornton/codegemma-7b-securecode) |
@@ -165,9 +166,9 @@ Choose based on your deployment constraints: **3B** for edge/mobile, **7B** for
 
 | Dataset | Examples | Focus | Link |
 |---------|----------|-------|------|
-| **SecureCode** | 2,185 | Unified (web + AI/ML) | [scthornton/securecode](https://huggingface.co/datasets/scthornton/securecode) |
-| SecureCode Web | 1,435 | Web security (OWASP Top 10 2021) | [scthornton/securecode-web](https://huggingface.co/datasets/scthornton/securecode-web) |
-| SecureCode AI/ML | 750 | AI/ML security (OWASP LLM Top 10 2025) | [scthornton/securecode-aiml](https://huggingface.co/datasets/scthornton/securecode-aiml) |
+| **SecureCode** | 2,372 | Unified (web + AI/ML) | [scthornton/securecode](https://huggingface.co/datasets/scthornton/securecode) |
+| SecureCode Web | 1,625 | Web security (OWASP Top 10 2021) | [scthornton/securecode-web](https://huggingface.co/datasets/scthornton/securecode-web) |
+| SecureCode AI/ML | 747 | AI/ML security (OWASP LLM Top 10 2025) | [scthornton/securecode-aiml](https://huggingface.co/datasets/scthornton/securecode-aiml) |
 
 ## Intended Use
 
@@ -182,6 +183,11 @@ Choose based on your deployment constraints: **3B** for edge/mobile, **7B** for
 - Circumventing security controls
 - Any activity that violates the base model's license
 
+## Changelog
+
+- **2026-07 (v2, current)**: Retrained on the audited SecureCode release (**2,372 examples**: 1,625 web + 747 AI/ML) using **bf16 LoRA on an NVIDIA DGX Spark GB10 (Blackwell)**. Same LoRA shape and hyperparameters as v1, except: no quantization during training, optimizer adamw_torch_fused instead of paged_adamw_8bit, PyTorch SDPA attention, dynamic per-batch padding. A new family member, [gemma-4-e4b-securecode](https://huggingface.co/scthornton/gemma-4-e4b-securecode), was added in this refresh.
+- **v1 (2026-02)**: QLoRA 4-bit NF4 on NVIDIA A100 40GB, trained on the pre-audit 2,185-example dataset.
+
 ## Citation
 
 ```bibtex