What it does
Given a CVE and a nixpkgs package, the model acts as an agent that:
- Reads the current package expression (
read_nixpkgs_file)
- Finds the upstream fix (
find_upstream_fix)
- Computes source hashes (
prefetch_hash)
- Generates and submits a patch diff (
submit_for_approval)
The model uses Qwen 2.5's native <tool_call> / <tool_response> XML format for tool interactions.
Training
Table with columns: Parameter, Value| Parameter | Value |
|---|
| Base model | Qwen/Qwen2.5-Coder-32B-Instruct (4-bit quantized) |
| Method | QLoRA (SFT) |
| LoRA rank | 8 |
| LoRA alpha | 16 |
| Target modules | q_proj, k_proj, v_proj, o_proj |
| Adapter size | 64 MB |
| Training examples | 588 train / 66 eval |
| Epochs | 3 (108 steps) |
| Effective batch size | 16 (batch 1 x grad accum 16) |
| Learning rate | 1e-4 (cosine schedule) |
| Max sequence length | 4096 |
| Precision | bf16 |
| Hardware | NVIDIA L40S (48 GB) |
| Training time | ~2.3 hours |
Training curves
Table with columns: Step, Train Loss, Eval Loss, Token Accuracy| Step | Train Loss | Eval Loss | Token Accuracy |
|---|
| 5 | 1.569 | -- | 70.0% |
| 50 | 0.758 | 0.625 | -- |
| 100 | 0.517 | 0.472 | -- |
| 108 | 0.511 | -- | -- |
Previous versions
Table with columns: Version, Rank, Adapter Size, Notes| Version | Rank | Adapter Size | Notes |
|---|
| v9 (current) | 8 | 64 MB | Reduced rank for faster cold starts on Workers AI |
| v8 | 32 | 256 MB | Cold-start timeouts on Workers AI due to large adapter |
| v4-v7 | 32 | 256 MB | Failed: model_type: "qwen2" rejected by CF |
Dataset
Trained on adastracomputing/nixpkgs-security-patches -- 654 multi-turn tool-calling conversations derived from real merged security PRs in NixOS/nixpkgs.
Deployment on Cloudflare Workers AI
This adapter is designed for Cloudflare Workers AI deployment. Key requirements:
model_type must be "llama" in adapter_config.json (CF rejects "qwen2", but "llama" works due to similar architecture)
- Stop sequences are required to prevent the model from hallucinating conversation continuations:
stop: ["</tool_call>", "<tool_response>", "<|im_end|>", "<|endoftext|>"]
- Upload only
adapter_config.json + adapter_model.safetensors (max 2 assets)
npx wrangler ai finetune create @cf/qwen/qwen2.5-coder-32b-instruct <name> <adapter_folder>/
Usage (local inference)
from peft import PeftModelfrom transformers import AutoModelForCausalLM, AutoTokenizer base = AutoModelForCausalLM.from_pretrained( "Qwen/Qwen2.5-Coder-32B-Instruct", device_map="auto", torch_dtype="auto",)model = PeftModel.from_pretrained(base, "adastracomputing/nixpkgs-security-qwen-lora")tokenizer = AutoTokenizer.from_pretrained("Qwen/Qwen2.5-Coder-32B-Instruct")
Limitations
- Nix is low-resource: The base model has limited Nix language understanding. Continued pre-training on raw
.nix files would likely improve results.
- Small dataset: 654 examples covers common patterns (version bumps, fetchpatch) but edge cases may produce lower quality output.
- Tool-calling only: The model is trained for the specific 6-tool workflow above. General Nix code generation was not a training objective.
License
Apache 2.0