PySecPatch - Defensive Python security model, 72K corpus, and r

项目说明

PySecPatch

![DOI]()

PySecPatch is an open defensi security model and e suite for triage, CWE classification, secure-code explanation, and candidate repair generation. The release combines a two-stage QLoRA adapter for Qwen/Qwen2.5-Coder-7B-Instruct, a deterministic 72,000-record Python security corpus, and reproducible internal and external e.

PySecPatch is best used as a human-re triage and secure-coding assistant. Repository-le application remains experimental.

Results

The final adapter and the unmodified base model were e on the same 3,200-record family-disjoint holdout under identical prompts, decoding settings, and seed.

| Metric | Qwen base | PySecPatch | Difference |
|---|---:|---:|---:|
| Classification accuracy | 4.81% | 90.72% | +85.91 pp |
| Classification F1 | 9.18% | 93.40% | +84.22 pp |
| Strict JSON | 91.53% | 99.44% | +7.91 pp |
| Clean-negati | 0.00% | 100.00% | +100.00 pp |
| Security-control pass | 1.63% | 88.08% | +86.46 pp |
| Normalized exact repair | 0.17% | 83.33% | +83.17 pp |
| Parseable fixed code | 6.42% | 99.21% | +92.79 pp |

The paired classification comparison contains 2,770 PySecPatch-only correct predictions and 21 base-only correct predictions. The exact two-sided McNemar result is log10(p) = -787.25.

External SALLM e is materially harder. On the 96 prompts with fixtures at the pinned upstream re, PySecPatch achieved 26.77% functional pass, 31.88% security-test pass, and 9.58% secure-functional pass. Four upstream prompts lacked fixtures; the report preser exclusions and full-benchmark bounds.

Repository repair remains the principal limitation. The repo-format holdout achieved 38.00% patch application and 34.38% security-control pass. On the frozen 24-case Stage 6 suite, detection and clean preser were perfect, but none of 12 proposed repository patches passed the complete acceptance gate.

Training Lineage

The published adapter was trained in two consecuti:

| Stage | Corpus | Train | | Test | Holdout |
|---|---:|---:|---:|---:|---:|
| A | 12,000 | 8,400 | 1,200 | 1,200 | 1,200 |
| B | 60,000 | 48,000 | 4,000 | 4,000 | 4,000 |

Only train splits entered optimization. The combined released corpus contains 72,000 records; 56,400 records were used for training. Both stages are generated Python examples released under Apache-2.0. Exact normalized duplicate o between stages is zero; the audit records 702 shared abstract structures.

Install

The model repository contains a PEFT adapter. Set HF_TOKEN only when access or rate limits require it; PySecPatch ne credentials.

Run

Local repository scan:

Generate and candidate patches:

Explicit GitHub repository:

Reproduce E

See REPRODUCIBILITY.md for frozen hashes, exact commands, paired statistics, and e layout. RELEASE_MANIFEST.json records the principal metrics and artifact hashes; RELEASE_.json records the offline package audit.

Intended Use

Not Intended For

Research Position

PySecPatch demonstrates a large controlled-benchmark impro over its base model and a substantial gap between synthetic holdout performance and external or repository-le. The release does not claim state-of-the-art or production-ready autonomous repair.

Citation

CITATION.cff and paper/references.bib provide copy-ready citation records. Cite the current v0.1.1 archive as 10.5281/zenodo.21015885. The all- DOI is 10.5281/zenodo.21015503, and the initial v0.1.0 snapshot is 10.5281/zenodo.21015504.

The independently archi dataset should be cited as 10.5281/zenodo.21016753.

License

Code, generated data, and adapter artifacts are released under Apache License 2.0. The base model is not redistributed.

项目信息

开发语言：Python

Star 数：2

技术要点

该项目属于防护思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Defensive Python security model, 72K corpus, and reproducible vulnerability-repair evaluation展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。