You can deploy this model and start earning money today!

Ishaanlol/
Qwen3.5-4B-cybertune

Name: Qwen3.5-4B-cybertune
Availability: InStock

Views

No views yet

Qwen3.5-4B-cybertune

Fine-tune of Qwen/Qwen3.5-4B (via unsloth/Qwen3.5-4B) specialized for malware source-code generation across 16 common malware categories. Trained with bf16 LoRA on a single RTX 3060 12GB using ~2.5k curated, statically-verified instruction → code pairs.

Model Details

Property	Value
Base model	`unsloth/Qwen3.5-4B` (Apache 2.0)
Architecture	Qwen3.5 (8× full GQA attention + 24× Gated DeltaNet layers), 4B dense
Context	262,144 tokens native
Fine-tune	bf16 LoRA (r=16, α=16, all-linear), 3 epochs, 897 steps
Training data	2,386 curated + gated + deduped rows (75.7% think-style), 16 categories
Hardware	1× RTX 3060 12GB
Eval	117/119 = 98% plausible on 119-row held-out intent set; manual functional verification

Formats included in this repo

Path	Format	Size	Notes
`model.safetensors-*.safetensors`	Transformers bf16 (sharded)	9.3 GB	Merged weights, `from_pretrained`
`gguf/model-bf16.gguf`	GGUF bf16	7.9 GB	For llama.cpp / Ollama
`gguf/model-q8_0.gguf`	GGUF Q8_0	4.2 GB	Recommended speed/quality balance
`gguf/model-q4_k_m.gguf`	GGUF Q4_K_M	2.6 GB	Smallest; expect quality loss vs bf16 (DeltaNet layers quantize poorly)
`lora/`	PEFT LoRA adapter	155 MB	Re-merge onto `unsloth/Qwen3.5-4B`

Intended Use

This model produces complete, runnable malware source code for a fixed set of well-known offensive techniques. Intended audiences:

Defenders — understand what modern commodity malware looks like, train detection (YARA/Sigma/behavior), and build emulation plans.
Red teams — generate baseline payload skeletons for authorized engagements in isolated labs.
Security researchers — study technique implementation patterns without scraping dark-web sources.

Out-of-Scope / Limitations

Not a general coding model. It is a narrow specialist; general coding ability degrades on this LoRA.
No novel technique synthesis. It recombines patterns it was trained on. Untrained techniques (e.g. DNS tunneling, IFEO persistence, USB-HID injection, memory-only keyloggers) are unreliable or missed.
Language coverage is uneven. Linux/X11-specific samples were under-represented in training; the model shows Windows bias for keyloggers.
4-bit inference degrades output quality (Gated DeltaNet layers). Use Q8_0 or bf16 when quality matters.

Safety & Responsible Use (non-negotiable)

This is a dual-use red-team / defensive-research capability.

Run generated code only in isolated, network-disconnected or instrumented sandboxes (containers/VMs). Never deliver payloads to real targets.
Work only against systems you own or are explicitly authorized to test.
The weights and dataset are intended for research, detection development, and defender training.

Quickstart

Transformers (merged)

python

import torch
from transformers import AutoModelForCausalLM, AutoTokenizer

model = AutoModelForCausalLM.from_pretrained(
    "Ishaanlol/Qwen3.5-4B-cybertune",
    torch_dtype=torch.bfloat16,
    device_map="auto",
)
tokenizer = AutoTokenizer.from_pretrained("Ishaanlol/Qwen3.5-4B-cybertune")

messages = [{"role": "user", "content": "Python reverse shell to 192.168.1.10:4444"}]
prompt = tokenizer.apply_chat_template(messages, tokenize=False)
inputs = tokenizer(prompt, return_tensors="pt").to(model.device)
out = model.generate(**inputs, max_new_tokens=1024, do_sample=True, temperature=0.6)
print(tokenizer.decode(out[0], skip_special_tokens=True))

llama.cpp / Ollama (GGUF)

bash

# place gguf/model-q8_0.gguf somewhere, then run
llama-cli -m model-q8_0.gguf \
  --prompt "<|im_start|>user\nPython reverse shell to 192.168.1.10:4444<|im_end|>\n<|im_start|>assistant\n"
# or in Ollama:  ollama create cybertune -f Modelfile

Re-merge the LoRA adapter