Model Card for deepseek-coder-6.7b-vulnerability-detection
Fine-tuned version of deepseek-coder-6.7b-instruct aiming to improve vulnerability detection in solidity smart contracts and provide informative explanations on what the vulnerabilities are, and how to solve them.
Model Details
Model Description
Given the following prompt below:
Below are one or more Solidity codeblocks. The codeblocks might contain vulnerable code.
If there is a vulnerability please provide a description of the vulnearblity in terms of the code that is responsible for it.
Describe how an attacker would be able to take advantage of the vulnerability so the explanation is even more clear.
Output only the description of the vulnerability and the attacking vector. No additional information is needed.
If there is no vulnerability output "There is no vulnearbility".
Codeblocks:
{}
When 1 or more codeblocks are provided to the model using this prompt, the model will output:
Wether there is a vulnerability or not.
What the vulnerability is.
How an attacker would take advantage of the detected vulnerability.
Afterwards, the above output can be chained to produce a solution - the context has the code, the vulnerability and the attacking vector so deducing a solution becomes a more straight-forward task.
Additionally, the same fine-tuned model can be used for the solution recommendation as the fine-tuning is low-rank (LoRA) and a lot of the model ability is preserved.
Developed by: [Kristian Apostolov]
Shared by: [Kristian Apostolov]
Model type: [Decoder]
Language(s) (NLP): [English]
License: [MIT]
Finetuned from model: [deepseek-ai/deepseek-coder-6.7b-instruct]
Provide code from a smart contract for a preliminary audit.
Direct Use
[More Information Needed]
Out-of-Scope Use
Malicious entity could detect 0-day vulnerability and take advantage of it.
Bias, Risks, and Limitations
The training data could be improved. Audits sometimes describe vulnerabilities which are not necessarily contained in the code itself, but are a part of a larger context.
Recommendations
Users (both direct and downstream) should be made aware of the risks, biases and limitations of the model.
How to Get Started with the Model
Use the code below to get started with the model.
python
1model_name ='msc-smart-contract-auditing/deepseek-coder-6.7b-vulnerability'2tokenizer = AutoTokenizer.from_pretrained(# For some reason the tokenizer didn't save properly3"deepseek-ai/deepseek-coder-6.7b-instruct",4 trust_remote_code=True,5 force_download=True,6)78prompt = \
9"""
10Below are one or more Solidity codeblocks. The codeblocks might contain vulnerable code.
11If there is a vulnerability please provide a description of the vulnearblity in terms of the code that is responsible for it.
12Describe how an attacker would be able to take advantage of the vulnerability so the explanation is even more clear.
1314Output only the description of the vulnerability and the attacking vector. No additional information is needed.
1516If there is no vulnerability output "There is no vulnearbility".
1718Codeblocks:
19{}
2021"""2223codeblocks ="Your code here"2425messages =[26{'role':'user','content': prompt.format(codeblocks)}27]2829inputs = tokenizer.apply_chat_template(messages, add_generation_prompt=True, return_tensors="pt").to(model.device)30outputs = model.generate(inputs, max_new_tokens=512, do_sample=True, top_k=25, top_p=0.95, num_return_sequences=1, eos_token_id=tokenizer.eos_token_id)31description = tokenizer.decode(outputs[0][len(inputs[0]):], skip_special_tokens=True)3233print(description)
