You can deploy this model and start earning money today!

samscrack/
Qwopus3.6-27B-solidity-audit-stage2

Name: Qwopus3.6-27B-solidity-audit-stage2
Availability: InStock

Views

No views yet

Qwopus3.6-27B-solidity-audit-stage2

⚠️ Intermediate checkpoint — Stage 2 of 5. This is the audit / Long-CoT reasoning LoRA, layered on top of the Stage 1B SFT base. Not yet RFT-tuned — Stage 3 (rejection-sampling fine-tuning against forge test) and the optional Stage 4 (GSPO RL with executor reward) come next.

A LoRA r=16 adapter on top of Qwopus3.6-27B-solidity-sft1B-merged (Stage 1B merged into bf16 base) that teaches the model to:

read a Solidity contract end-to-end
emit a long chain-of-thought (8-15 substantive paragraphs) in <think>...</think>
output a structured finding (severity, category, location, description, impact, fix, confidence)

Pipeline context

#	Stage	Status	Output
0	Continued pretrain (DoRA on Solidity corpus)	✅ done	`Qwopus3.6-27B-solidity-cpt-stageA`
1	SFT (instruction): spec → contract	✅ done	`Qwopus3.6-27B-solidity-sft-stage1B`
2	SFT (audit / Long-CoT reasoning)	✅ done — this repo	this repo
3	RFT (rejection-sampling FT against `forge test`)	⬜ planned	TBD
4	GSPO (sequence-level RL with executor reward)	⬜ optional	TBD

Training data

Corpus: samscrack/solidity-audit-cot — Long-CoT audit traces generated by Claude Opus 4.7 (adaptive thinking, xhigh effort) over real Solidity contracts.
Strict-quality cleaned: 7,707 rows. 8K-friendly subset for this stage: 6,140 rows (filtered to ≤30,000 chars total → fits in 8K ctx). The remaining 1,567 long-tail rows are preserved at [audit_cot_clean_long_tailed.jsonl] for a future longer-context Stage 2 re-run.
After ctx-filter at training time: 6,106 rows (34 marginal rows dropped).
Severity distribution (full clean corpus): 33% high · 25% medium · 14% low · 14% informational · 14% none. The none rows are deliberate — they teach the model not to fabricate vulnerabilities.

Each row's user turn is the contract code with an "Audit this contract" instruction. The assistant turn is <think>{12 reasoning paragraphs joined}</think> followed by a structured finding rendered as markdown.

Recipe (Stage 2 specifics, per SOTA-plan §2)

LoRA: r=16, α=16, dropout=0 (smaller than Stage 1B's r=64 — layered on, not replacing)
Target modules: q_proj, k_proj, v_proj, o_proj, gate_proj, up_proj, down_proj, out_proj
Trainable parameters: 88,342,528 (~0.60% of effective 14.8B param count)
Quantization: base loaded in 4-bit (BnB NF4); adapter weights bf16
Effective batch size: 72 (4 per device × 9 grad accum × 2 GPUs)
Sequence length: 8,192
Optimizer: 8-bit AdamW, weight decay 0.001
Learning rate: 1e-4 (half of Stage 1B's 2e-4 — finer adjustment on top of trained base)
Epochs: 1
Total steps: 85
Chat template: qwen3-thinking (with <think> filled by real Opus-derived reasoning)
Loss masking: train_on_responses_only (loss only on assistant tokens after <|im_start|>assistant\n<think>)

Training metrics

Wall time: 3h 48m
Train loss: 1.21 (start) → ~0.99 (min) → 1.026 (final under linear decay)
Hardware: 2× NVIDIA RTX PRO 6000 Blackwell Workstation Edition (96 GB each)
Distributed: DDP via torchrun --nproc-per-node=2
Framework: Unsloth 2026.4.7 with TRL 0.22.2

Usage

python

from peft import PeftModel
from transformers import AutoModelForCausalLM, AutoTokenizer

# Load the Stage-1B-merged base, then layer the Stage 2 LoRA
base = AutoModelForCausalLM.from_pretrained(
    "samscrack/Qwopus3.6-27B-solidity-sft-stage1B",  # merge with the CPT base first locally
    torch_dtype="bfloat16", device_map="auto",
)
model = PeftModel.from_pretrained(base, "samscrack/Qwopus3.6-27B-solidity-audit-stage2")
tokenizer = AutoTokenizer.from_pretrained("samscrack/Qwopus3.6-27B-solidity-audit-stage2")

contract = open("MyContract.sol").read()
messages = [{"role": "user", "content":
    "Audit the following Solidity contract for security issues. Identify the most "
    "impactful vulnerability (or 'none' if the contract is clean), reason step-by-step "
    "about your analysis, then output a structured finding with severity, category, "
    "location, description, impact, and a concrete fix.\n\n"
    f"```solidity\n{contract}\n```"}]
prompt = tokenizer.apply_chat_template(messages, tokenize=False, add_generation_prompt=True)
inputs = tokenizer(prompt, return_tensors="pt").to(model.device)
out = model.generate(**inputs, max_new_tokens=4096, do_sample=False)
print(tokenizer.decode(out[0], skip_special_tokens=False))

The output will contain a <think> block with multi-paragraph reasoning followed by a markdown audit report.

Limitations

Single-finding output by design. Each response identifies the one most-impactful issue. Multi-finding audits would require either prompting it to "find all issues" or running it with different temperatures and aggregating.
Synthetic teacher. Reasoning style and breadth reflect Claude Opus 4.7's idiom. The model has been pushed in that direction; output quality is bounded by Opus's audit ceiling.
No forge test validation in the loss. This stage uses next-token cross-entropy on Opus traces. Stage 3 RFT introduces test-pass as a reward signal — that's where functional correctness gets enforced.
Long contracts truncated. Training set was filtered to contracts that fit in 8K tokens. Contracts >~7,500 tokens may produce shorter or less coherent reasoning at inference time.
Solidity ≥ 0.7 bias (inherited from Stage 1B's strict pragma filter).
Findings can be wrong. Like any synthetic-teacher SFT, this model can produce confident-sounding false positives (flagging non-bugs) or miss real issues. Use as a triage assistant, not a substitute for human audit review.

Related artifacts

Stage 0 CPT: samscrack/Qwopus3.6-27B-solidity-cpt-stageA
Stage 1 SFT: samscrack/Qwopus3.6-27B-solidity-sft-stage1B
Training data: samscrack/solidity-audit-cot
Eval set (held-out, must not train on): samscrack/solidity-eval-2026

Citation

bibtex

@misc{qwopus3-6-27b-solidity-audit-stage2-2026,
  author       = {samscrack},
  title        = {Qwopus3.6-27B-solidity-audit-stage2: Stage 2 audit/Long-CoT LoRA},
  year         = {2026},
  publisher    = {Hugging Face},
  howpublished = {\url{https://huggingface.co/samscrack/Qwopus3.6-27B-solidity-audit-stage2}},
}