Instructions to use trailio/QwenSec-38 with libraries, inference providers, notebooks, and local apps. Follow these links to get started.

Libraries

How to use trailio/QwenSec-38 with Transformers:

# Use a pipeline as a high-level helper
from transformers import pipeline

pipe = pipeline("text-generation", model="trailio/QwenSec-38")
messages = [
    {
        "role": "user",
        "content": [
            {"type": "image", "url": "https://huggingface.co/datasets/huggingface/documentation-images/resolve/main/p-blog/candy.JPG"},
            {"type": "text", "text": "What animal is on the candy?"}
        ]
    },
]
pipe(text=messages)

# Load model directly
from transformers import AutoProcessor, AutoModelForMultimodalLM

processor = AutoProcessor.from_pretrained("trailio/QwenSec-38")
model = AutoModelForMultimodalLM.from_pretrained("trailio/QwenSec-38", device_map="auto")
messages = [
    {
        "role": "user",
        "content": [
            {"type": "image", "url": "https://huggingface.co/datasets/huggingface/documentation-images/resolve/main/p-blog/candy.JPG"},
            {"type": "text", "text": "What animal is on the candy?"}
        ]
    },
]
inputs = processor.apply_chat_template(
	messages,
	add_generation_prompt=True,
	tokenize=True,
	return_dict=True,
	return_tensors="pt",
).to(model.device)

outputs = model.generate(**inputs, max_new_tokens=40)
print(processor.decode(outputs[0][inputs["input_ids"].shape[-1]:]))

Notebooks
Google Colab
Kaggle
Local Apps Settings

vLLM

How to use trailio/QwenSec-38 with vLLM:

Install from pip and serve model

# Install vLLM from pip:
pip install vllm
# Start the vLLM server:
vllm serve "trailio/QwenSec-38"
# Call the server using curl (OpenAI-compatible API):
curl -X POST "http://localhost:8000/v1/chat/completions" \
	-H "Content-Type: application/json" \
	--data '{
		"model": "trailio/QwenSec-38",
		"messages": [
			{
				"role": "user",
				"content": "What is the capital of France?"
			}
		]
	}'

Use Docker

docker model run hf.co/trailio/QwenSec-38

SGLang

How to use trailio/QwenSec-38 with SGLang:

Install from pip and serve model

# Install SGLang from pip:
pip install sglang
# Start the SGLang server:
python3 -m sglang.launch_server \
    --model-path "trailio/QwenSec-38" \
    --host 0.0.0.0 \
    --port 30000
# Call the server using curl (OpenAI-compatible API):
curl -X POST "http://localhost:30000/v1/chat/completions" \
	-H "Content-Type: application/json" \
	--data '{
		"model": "trailio/QwenSec-38",
		"messages": [
			{
				"role": "user",
				"content": "What is the capital of France?"
			}
		]
	}'

Use Docker images

docker run --gpus all \
    --shm-size 32g \
    -p 30000:30000 \
    -v ~/.cache/huggingface:/root/.cache/huggingface \
    --env "HF_TOKEN=<secret>" \
    --ipc=host \
    lmsysorg/sglang:latest \
    python3 -m sglang.launch_server \
        --model-path "trailio/QwenSec-38" \
        --host 0.0.0.0 \
        --port 30000
# Call the server using curl (OpenAI-compatible API):
curl -X POST "http://localhost:30000/v1/chat/completions" \
	-H "Content-Type: application/json" \
	--data '{
		"model": "trailio/QwenSec-38",
		"messages": [
			{
				"role": "user",
				"content": "What is the capital of France?"
			}
		]
	}'

Unsloth Studio

How to use trailio/QwenSec-38 with Unsloth Studio:

Install Unsloth Studio (macOS, Linux, WSL)

curl -fsSL https://unsloth.ai/install.sh | sh
# Run unsloth studio
unsloth studio -H 0.0.0.0 -p 8888
# Then open http://localhost:8888 in your browser
# Search for trailio/QwenSec-38 to start chatting

Install Unsloth Studio (Windows)

irm https://unsloth.ai/install.ps1 | iex
# Run unsloth studio
unsloth studio -H 0.0.0.0 -p 8888
# Then open http://localhost:8888 in your browser
# Search for trailio/QwenSec-38 to start chatting

Using HuggingFace Spaces for Unsloth

# No setup required
# Open https://huggingface.co/spaces/unsloth/studio in your browser
# Search for trailio/QwenSec-38 to start chatting

Load model with FastModel

pip install unsloth
from unsloth import FastModel
model, tokenizer = FastModel.from_pretrained(
    model_name="trailio/QwenSec-38",
    max_seq_length=2048,
)

Docker Model Runner
How to use trailio/QwenSec-38 with Docker Model Runner:
```
docker model run hf.co/trailio/QwenSec-38
```

Qwen3.8-27B — TrAIli CVE Code-QA (merged)

A merged, standalone fine-tune of Qwen/Qwen3.8-27B for CVE/PoC code question-answering, built by the TrAIli project. LoRA weights (rsLoRA r=32, QLoRA 4-bit trained) are baked into the bf16 base — download and run directly, no adapter loading required.

Model Details

Model Description

Answers grounded, technical questions about vulnerability PoCs — e.g. "which line sends the request that triggers the bug", "quote reboot_device() and describe its behavior" — when the PoC source code is included in the prompt. Loss is computed only on the assistant turn; the model is trained with the Qwen chat template rendered with enable_thinking=False, so it answers directly without emitting a <think> reasoning block.

Developed by: TrAIli project
Model type: Qwen3.8-27B (hybrid gated-DeltaNet + gated-attention, 262K native context), causal LM
Language(s): English, code
License: apache-2.0
Finetuned from model: Qwen/Qwen3.8-27B

Model Sources

Base model: https://huggingface.co/Qwen/Qwen3.8-27B
Adapter version: https://huggingface.co//qwen3.8-27b-traili-cve (LoRA-only, ~470MB)

Uses

Direct Use

CVE triage and PoC explanation in authorized, sandbox-contained security research: given the PoC/advisory text, answer questions about what the code does, where the vulnerable behavior is, and how it maps to the CVE.

Downstream Use

Fine-tuning, RAG-based CVE assistants, lab-target testing harnesses (e.g. generating and explaining test steps for dockerized vulnerable targets).

Out-of-Scope Use

Testing, probing, or exploitation of systems you are not authorized to test.
Answering CVE questions without grounding material: with no code or advisory in context the model can fabricate plausible-sounding details. Feed it the PoC or use RAG.

Bias, Risks, and Limitations

Hallucination risk when ungrounded. The model quotes provided code well; without provided facts it may confabulate CVE descriptions, product names, or versions. Always provide the PoC/advisory.
Trained on a distilled code-QA dataset (~15.7k examples) generated by a teacher model — the data inherits whatever errors the teacher made.
Thinking mode is off by training design; reasoning blocks are not emitted.

Recommendations

Treat outputs as analysis to verify, not as ground truth. For factual CVE metadata (scores, affected versions), cross-check against NVD or the vendor advisory. Use RAG for up-to-date CVE data.

How to Get Started with the Model

import torch
from transformers import AutoProcessor, AutoModelForCausalLM

model = AutoModelForCausalLM.from_pretrained(
    "<this-repo>", torch_dtype=torch.bfloat16, device_map="auto",
    attn_implementation="sdpa")
processor = AutoProcessor.from_pretrained("<this-repo>")

messages = [
    {"role": "system",
     "content": "You are a senior vulnerability researcher working in "
                "authorized, sandbox-contained research. Ground every "
                "statement ONLY in the facts provided; never invent CVE "
                "details, versions, or identifiers."},
    {"role": "user",
     "content": "Provided code (from poc.py):\n\n```python\n"
                "URL = \"http://target/reqproc/proc_post\"\n"
                "def reboot_device():\n    req = requests.get(URL)\n"
                "```\n\nWhich line triggers the bug?"},
]
prompt = processor.apply_chat_template(
    messages, tokenize=False, add_generation_prompt=True,
    enable_thinking=False)
inputs = processor(text=prompt, return_tensors="pt").to(model.device)
out = model.generate(**inputs, do_sample=True, temperature=0.7,
                     top_p=0.95, top_k=64, max_new_tokens=1024)
print(processor.decode(out[0][inputs["input_ids"].shape[1]:],
                       skip_special_tokens=True))

Runs in ~17GB VRAM with a 4-bit quant (e.g. via bitsandbytes) or ~56GB at bf16.

Training Details

Training Data

TrAIli distilled CVE/PoC code-QA set: ~15,735 chat records (system + user + assistant) generated by a teacher model over PoC-in-GitHub sources with NVD enrichment, covering a broad range of CVEs and PoC languages.

Training Procedure

Chat template rendered with enable_thinking=False; assistant-turn-only loss (labels -100 outside the final <|im_start|>assistant span).
No sample packing (per-batch dynamic padding, no cross-sample attention); length-grouped sampling; truncation to 4096 tokens.
Best checkpoint kept by eval loss, not last step.

Training Hyperparameters

QLoRA 4-bit NF4 + double quant, bf16 compute
LoRA r=32, alpha=32, rsLoRA, gaussian init; targets: all text linear projections (attention q/k/v/o, DeltaNet in_proj_qkv/z/b/a/out_proj, MLP gate/up/down — 496 modules, ~233.5M trainable params)
NEFTune noise 5, lr 2e-4 cosine, warmup 5% of steps, effective batch 32
Up to 3 epochs; single RTX PRO 6000 (96GB)

Speeds, Sizes, Times

Adapter: ~470MB. Merged bf16: ~56GB sharded.
Training: minutes-to-low-hours on a single 96GB Blackwell GPU.

Evaluation

Testing Data, Factors & Metrics

Held-out 2% split, eval loss on assistant spans.
Qualitative checks: grounded code-QA (correct, quotes the code) vs fact-free CVE questions (can hallucinate — see Limitations).

Results

Summary

Grounded code-QA answers track the provided PoC closely; ungrounded questions are the known failure mode. Eval loss and behavior improve with epochs up to the data's diversity limit.

Environmental Impact

Hardware Type: NVIDIA RTX PRO 6000 (Blackwell, 96GB)
Cloud Provider: RunPod
Hours used: a few (training + iteration)

Technical Specifications

Model Architecture and Objective

Qwen3.8-27B: 64 layers, 16 blocks of (3× gated-DeltaNet + 1× gated attention), 262,144 native context, 248,320 vocab. Objective: causal LM SFT on assistant turns.

Compute Infrastructure

Hardware

1× NVIDIA RTX PRO 6000 Blackwell Workstation Edition (96GB).

Software

Unsloth 2026.8.x (Fast Qwen3_5 patching), PEFT 0.20.0, transformers 5.5.0, torch 2.11.0 (CUDA 13), bitsandbytes 0.50.x

Citation

BibTeX:

@software{qwen38_traili_cve,
  title  = {Qwen3.8-27B TrAIli CVE Code-QA},
  author = {TrAIli project},
  note   = {Fine-tune of Qwen/Qwen3.8-27B for CVE/PoC code question-answering},
  url    = {https://huggingface.co/<your-username>/qwen3.8-27b-traili-cve}
}

Model Card Authors

TrAIli project.

Model Card Contact

Trailios

Framework versions

PEFT 0.20.0
transformers 5.5.0
Unsloth 2026.8.18
torch 2.11.0+cu130

Downloads last month: -

Safetensors

Model size

15B params

Tensor type

BF16

F32

Model tree for trailio/QwenSec-38

Base model

Qwen/Qwen3.8-27B

Adapter

(4)

this model