The adapter is fine-tuned on Qwen3-14B to act as a classifier and explanation engine for AndroSem, a purely static Android malware detection framework.
It is not a standalone malware detector: in the original setting it consumes a structured, human-readable intermediate representation (IR) produced by the AndroSem pipeline (code + manifest + strings), and outputs multi-class / binary decisions together with natural-language rationales.

For full experimental details, dataset description, and pipeline implementation, please refer to:

the paper: AndroSem: Semantics-Guided, LLM-based Interpretable Static Android Malware Detection
the code: https://github.com/AlexAshlake/AndroSem

1. Model details

Base model: Qwen/Qwen3-14B
Adapter type: LoRA (Low-Rank Adaptation)
Task (original setting):
- Multi-class Android malware family classification
- Binary benign vs. malicious classification
- Generation of natural-language rationales explaining the decision
Input format (original setting):
- A textual IR built from:
  - decompiled code fragments (Semantic Abstraction),
  - manifest fields,
  - embedded strings and static features.

The adapter is designed for research and reproducibility of the AndroSem experiments. Using it outside this context (e.g., as a generic malware detector) will require additional engineering and careful validation.

2. Intended use & limitations

Intended use

As the LLM backend of AndroSem, for:
- static Android malware classification on the CIC-AndMal2017 APK corpus (and similar datasets),
- producing interpretable rationales based on a structured IR.

Not intended / limitations

This LoRA does not directly ingest APKs or arbitrary Android projects.
It should not be used as the only signal for security-critical decisions (e.g., automatic blocking in production) without additional safeguards, traditional detectors, and thorough evaluation.
The model has been fine-tuned on IRs generated by a specific pipeline (AndroSem). Performance on other domains or input formats is unknown.

3. Training setup (SFT + LoRA)

Framework: LLaMA-Factory
Base model: Qwen3-14B
Fine-tuning paradigm: Supervised Fine-Tuning (SFT)
Adapter: LoRA
- rank: 24
- alpha: 48
- dropout: 0.15
Quantization during training: 4-bit (q4)
Inference configuration:
- Quantization: BitsAndBytes 4-bit nf4
- Context length: 32,768 tokens
- Max new tokens: 512
- Sampling:
  - temperature: 0.5
  - top_p: 0.9

Additional details about the training data construction (IR design, labeling scheme, and sampling) can be found in the AndroSem paper and the accompanying GitHub repository.

4. How to use

⚠️ This repository contains only the LoRA adapter. You must load the base Qwen3-14B model and apply the adapter (e.g., with peft) to reproduce the behavior used in AndroSem.

Example (PyTorch, `transformers` + `peft`)

python

from transformers import AutoModelForCausalLM, AutoTokenizer
from peft import PeftModel, PeftConfig

base_model_name = "Qwen/Qwen3-14B"
lora_model_id = "AlexAshlake/AndroSem-Qwen3-14B-LoRA"  # this repo

# Load tokenizer from the base model
tokenizer = AutoTokenizer.from_pretrained(base_model_name, trust_remote_code=True)

# Load base model in 4-bit (nf4) if desired
from transformers import BitsAndBytesConfig
bnb_config = BitsAndBytesConfig(
    load_in_4bit=True,
    bnb_4bit_quant_type="nf4",
    bnb_4bit_compute_dtype="bfloat16",
)

base_model = AutoModelForCausalLM.from_pretrained(
    base_model_name,
    quantization_config=bnb_config,
    device_map="auto",
    trust_remote_code=True,
)

# Load LoRA adapter
peft_config = PeftConfig.from_pretrained(lora_model_id)
model = PeftModel.from_pretrained(base_model, lora_model_id)

model.eval()

# Example: generate on an AndroSem-like IR prompt
prompt = "### AndroSem IR\n[... intermediate representation of one APK ...]\n### Task: Classify this app and explain why."
inputs = tokenizer(prompt, return_tensors="pt").to(model.device)

with torch.no_grad():
    outputs = model.generate(
        **inputs,
        max_new_tokens=512,
        do_sample=True,
        temperature=0.5,
        top_p=0.9,
    )

print(tokenizer.decode(outputs[0], skip_special_tokens=True))

For exact reproduction of the experiments in the paper (including preprocessing, IR construction, and evaluation), please use the full AndroSem repository:

https://github.com/AlexAshlake/AndroSem

5. Evaluation

The full evaluation (metrics, baselines, ablations, and qualitative case studies) is reported in:

AndroSem: Semantics-Guided, LLM-based Interpretable Static Android Malware Detection

Key points:

Dataset: CIC-AndMal2017 APK corpus (full APK-level evaluation).
Tasks:
- Multi-class malware family classification,
- Binary benign vs. malicious classification,
- Rationale quality (qualitative analysis).

This model card does not duplicate all metrics; please refer to the paper and the GitHub repo for detailed numbers and evaluation scripts.

6. Data & privacy

The LoRA is trained on derived intermediate representations constructed from APKs in the CIC-AndMal2017 dataset, plus associated labels and analysis prompts.
The model may implicitly encode patterns specific to this dataset and task.
Please ensure that your usage complies with:
- the license and terms of use of the base model Qwen3-14B, and
- any restrictions associated with the training data (CIC-AndMal2017 and related artifacts).

AlexAshlake/AndroSem-Qwen3-14B-LoRA

AndroSem-Qwen3-14B-LoRA