Mellum2.1-12B-A2.5B-Thinking-DevSec — LoRA adapter

This is a completed, single-GPU supervised fine-tune of JetBrains/Mellum2.1-12B-A2.5B-Thinking at revision 92ddae9fc7665e9f801d141d2e5a6b2caf2460c4. This repository contains attention LoRA weights; it requires the pinned base model.

Training

BF16 frozen base; LoRA on q_proj, k_proj, v_proj, o_proj; rank 16, alpha 32; learning rate 1e-05; context 8192; microbatch 1; accumulation 16; at most one pass through the prepared examples. Expert and router weights are frozen. The unmodified Mellum tokenizer/chat template and EOS are retained. Recipe reasoning-v2 uses target selection policy reasoning_v2; the training recipe records the actual selected reasoning/direct-answer distribution, including shortages after filtering.

Loss covers the selected assistant response (reasoning, tool call, final answer and EOS). Earlier messages and tool observations are context only. Each source conversation must fit completely; no partial tool JSON or unfinished final target is created through truncation. At most 4 assistant targets are drawn per task, always including its final response. Whole task groups stay in one split. A chunked frozen output head reduces peak training memory without changing the causal targets.

Data and attribution

• nvidia/Open-SWE-Traces, revision 4fa4c2ae9afc6b397bc50391d43450c79993c138, dataset-card license cc-by-4.0; 1767 retained trajectories.
• prabhatl0dhi/C_C_plus_plus_Patch_Dataset_for_Secure_Code_LLMs, revision fed7dc43e722fbb4dac5e1cf0da12e4a0d5cef70, dataset-card license mit; 300 retained trajectories.
• open-thoughts/OpenThoughts3-1.2M, revision 61bcf9d4eb38b30295efc2021227a63cc5bb34c8, dataset-card license apache-2.0; 284 retained trajectories.
• runanlab/gpt-5.4-frontend-development-11062026, revision a10fa67215789b0ebb8a36e055fd40ad279d787c, dataset-card license cc-by-4.0; 200 retained trajectories.

NVIDIA Open-SWE-Traces data is attributed to NVIDIA and the upstream repositories/creators identified in its dataset metadata; CC BY 4.0 applies to its dataset distribution. The C/C++ security-pair corpus is attributed to prabhatl0dhi and its upstream code authors; MIT covers the dataset aggregation/tooling, while original repository licenses continue to apply. OpenThoughts3 is attributed to the OpenThoughts/OPEN THOUGHTS authors and contributors. The React/TypeScript frontend dataset is attributed to runanlab, its publisher, under CC BY 4.0. If explicitly enabled in a custom recipe, CyberForge teacher data is attributed to the AmL-hug/CyberForge contributors. Dataset-card licenses are provenance, not a claim that every underlying code fragment has been independently cleared. This release does not redistribute the raw training corpus.

Open-SWE examples use the source's success flag and retain bash actions and observed results. Its effort selection and retained distribution are recorded in the data manifest. Security function pairs use recorded fixes; they are not reasoning traces and were not independently compiled here. Teacher reasoning is not labelled independently verified unless its source supplies such evidence. Converted agent environments were not replayed. Shell interactions are adapted to Pi's bash schema; this is not evidence of coverage of every Pi tool or backend. Long trajectories that do not fit the selected context are excluded without truncation. Extra user-provided traces, if configured, are not redistributed.

Evaluation and limitations

See evaluation_summary.json for actual held-out loss, pre/post protocol probes, and the paired reasoning diagnostics when enabled. The authored diagnostic suite covers code/algorithm reasoning, defensive security, web/backend semantics and tool decisions with objective answer checks; it never executes generated code or shell commands. Base and final use the same tasks, native template, sampler, seed and generation budget. Pass counts, paired gains/regressions, reasoning token lengths, EOS/cutoff and repetition are reported separately. More reasoning tokens do not count as higher correctness. These authored probes and source holdouts are not independent SWE-bench, Terminal-Bench, cybersecurity, frontend or live Pi benchmarks. They cannot establish general reasoning improvement or eliminate looping. Measure real task completion and stopping on fresh tasks before deployment.

Loading

Use transformers==5.22.1 and peft==0.21.2 with a compatible CUDA PyTorch. Preserve the native template and tool schemas. The base is about 12B total parameters: active-parameter count does not determine the memory needed for the stored weights.

import torch
from transformers import AutoTokenizer, AutoModelForCausalLM
from peft import PeftModel
base_id = "JetBrains/Mellum2.1-12B-A2.5B-Thinking"
tokenizer = AutoTokenizer.from_pretrained("Nullmega/Mellum2.1-12B-A2.5B-Thinking-DevSec")
base = AutoModelForCausalLM.from_pretrained(
    base_id, revision="92ddae9fc7665e9f801d141d2e5a6b2caf2460c4", dtype=torch.bfloat16,
    device_map="auto", attn_implementation="sdpa")
model = PeftModel.from_pretrained(base, "Nullmega/Mellum2.1-12B-A2.5B-Thinking-DevSec")

For the merged repository, load its repository ID directly with AutoModelForCausalLM.from_pretrained(...). Start generation with temperature=0.6, top_p=0.95, top_k=20, the native EOS, and a finite output-token budget (for example 4,096 when the loaded context has room for prompt plus output). The native template permits thinking by default; enable_thinking=False disables it. A generic reasoning_effort=high is not a supported depth control in this template. Preserve separate reasoning content in the inference client, and check token budgets before diagnosing short reasoning. Do not suppress EOS or impose a minimum reasoning length. Do not treat a repetition penalty as a substitute for evaluating complete tool interactions.

License

The base model is Apache-2.0. The adapter contribution is released under Apache-2.0; the merged release retains the base license. Third-party dataset and source-code notices remain relevant. See LICENSE, NOTICE, and dataset_attribution.json.