sahilempire/redsec-14b-distill

RedSec-14B (distilled QLoRA adapter)

A QLoRA adapter that turns Qwen2.5-Coder-14B into RedSec, a security assistant for authorized penetration testing, red-team, and LLM-security research. This is the 14B step up from sahilempire/redsec-7b-distill, trained for stronger reasoning on the nuanced attacks (indirect prompt injection, request smuggling) where the 7B hit its ceiling.

• Base model: Qwen2.5-Coder-14B-Instruct (trained via Unsloth 4-bit, unsloth/Qwen2.5-Coder-14B-Instruct-bnb-4bit)
• Adapter: LoRA (PEFT), r=16, alpha=16, ~69M trainable params (0.46%)
• Training data: sahilempire/redsec-distill-sft-v1
• Training: QLoRA on a Kaggle T4, 200 steps, loss 1.99 -> 0.32
• License: other (responsible use)

Usage (PEFT + transformers)

import torch
from transformers import AutoModelForCausalLM, AutoTokenizer
from peft import PeftModel

base = "Qwen/Qwen2.5-Coder-14B-Instruct"
tok = AutoTokenizer.from_pretrained(base)
model = AutoModelForCausalLM.from_pretrained(base, torch_dtype=torch.float16, device_map="auto", load_in_4bit=True)
model = PeftModel.from_pretrained(model, "sahilempire/redsec-14b-distill")

sys = ("You are RedSec, a security assistant for authorized penetration testing and red-team work. "
       "Answer with concrete, correct payloads or steps, a brief explanation, and an authorization reminder.")
msgs = [{"role": "system", "content": sys},
        {"role": "user", "content": "Give me SQL injection payloads to test a login form."}]
inputs = tok.apply_chat_template(msgs, add_generation_prompt=True, return_tensors="pt").to(model.device)
out = model.generate(inputs, max_new_tokens=400, temperature=0.5, repetition_penalty=1.1)
print(tok.decode(out[0][inputs.shape[1]:], skip_special_tokens=True))

Intended use

Authorized security testing, red-teaming, and defensive research only. This adapter makes the model emit live attack payloads. Not for unauthorized access or harm. Use only on systems you own or are explicitly authorized to assess.

Status

Freshly trained. A broad evaluation (like the 7B's 24-prompt eval) has not yet been run on this checkpoint, so verify nuanced categories by hand. Built by distillation on the base model's own correct outputs plus curated OWASP LLM01-style gold. See the dataset card for method and provenance.