badtheorylabs

btl-2-coder

README

License: apache-2.0

Intended Use

This adapter is intended for local-first code review. It is trained to produce structured findings with:

severity
file path
line number
title
evidence
recommendation
numeric confidence

The main supported issue classes are SQL injection, path traversal, authorization bypass, missing error handling, boundary/off-by-one logic, and related security/correctness findings.

The adapter is optimized for review output rather than broad chat behavior.

Training

Base model: unsloth/Qwen2.5-Coder-7B-Instruct
Method: LoRA SFT with Unsloth
Data mix: 4,000 API-generated review traces + 1,000 template traces
Train/eval split: 4,500 train examples + 500 eval examples
Epochs: 2
Max sequence length: 4096

Only redacted, opt-in traces should be used for future training.

Recommended Prompt Contract

Use strict schema prompting:

text
Return only a JSON array. No markdown and no wrapper object.
Each finding must include: severity, file, line, title, evidence, recommendation, confidence.
severity must be exactly one of: critical, high, medium, low.
Never put a category in severity.
confidence must be a number from 0 to 1, never a string label.
Every finding must include concrete evidence and a non-empty recommendation.

Example output:

json
[
  {
    "severity": "critical",
    "file": "src/users.ts",
    "line": 42,
    "title": "SQL injection through string-built query",
    "evidence": "The user id is concatenated directly into the SQL string.",
    "recommendation": "Use a parameterized query.",
    "confidence": 0.96
  }
]

Load The Adapter

python
from peft import PeftModel
from transformers import AutoModelForCausalLM, AutoTokenizer

base = "unsloth/Qwen2.5-Coder-7B-Instruct"
adapter = "badtheorylabs/btl-2-coder"

tokenizer = AutoTokenizer.from_pretrained(adapter)
model = AutoModelForCausalLM.from_pretrained(base, device_map="auto")
model = PeftModel.from_pretrained(model, adapter)

Evaluation

Measured on an NVIDIA H200 with 4-bit adapter inference.

Table with columns: Eval, JSON parse, Schema valid, Numeric confidence, Category hit, File hit, Precision, Recall, Weighted severity recall
Eval	JSON parse	Schema valid	Numeric confidence	Category hit	File hit	Precision	Recall	Weighted severity recall
Heldout 100 strict	1.000	0.952	1.000	0.783	0.840	n/a	n/a	n/a
Heldout 30 strict v2	1.000

Notes:

Heldout precision/recall is marked n/a because the heldout set is broader and does not use one normalized ground-truth finding per example.
The seeded benchmark is a controlled regression suite with known findings.
Reported results use the recommended strict schema prompt.

Scope

Primary task: structured security and correctness review.
Output format: JSON findings with severity, location, evidence, recommendation, and confidence.
Best runtime path: strict schema prompting, with optional constrained decoding.
Evaluation focus: code-review findings, file hits, schema validity, and seeded precision/recall.
Next track: patch proposals and terminal workflows.

Files

This repository contains a PEFT/LoRA adapter:

adapter_model.safetensors
adapter_config.json
tokenizer.json
tokenizer_config.json
chat_template.jinja
training_args.bin
SHA256SUMS

Available on FriendliAI

Dedicated Endpoints

Run this model inference on single tenant GPU with unmatched speed and reliability at scale.

Learn more

Container

Run this model inference with full control and performance in your environment.

Learn more

Model Details

Model Provider

badtheorylabs

Model Tree

Base

unsloth/Qwen2.5-Coder-7B-Instruct

Adapter

this model

Input Modalities

Text

Output Modalities