GLM-5.3 is live. Run Z.ai's latest model on Friendli Model APIs. Try it today ➜
eiphuggincve
Available on FriendliAI
Run this model inference on single tenant GPU with unmatched speed and reliability at scale.
Run this model inference with full control and performance in your environment.
Model Details
Model Provider
eiphuggincve
Model Tree
Qwen/Qwen3-8B
Input Modalities
Output Modalities
Supported Functionality
| Metric | Score |
|---|---|
| Exact-match | 0.676 |
| Micro-F1 | 0.702 |
| Macro-F1 | 0.511 |
By difficulty (does the description name the weakness, or must it be inferred?):
| Stratum | n | Exact-match | Micro-F1 |
|---|---|---|---|
| Easy (weakness named) | 2,046 | 0.841 | 0.870 |
| Hard (must infer) | 4,756 | 0.605 | 0.628 |
The high macro-F1 reflects a dataset that caps majority CWEs (e.g. CWE-79) so rare weaknesses are actually learned rather than drowned out.
Reading the numbers:
python
import torchfrom transformers import AutoModelForCausalLM, AutoTokenizermid = "eiphuggincve/cve-cwe-qwen3-8b"tok = AutoTokenizer.from_pretrained(mid)model = AutoModelForCausalLM.from_pretrained(mid, torch_dtype="auto", device_map="auto")messages = [{"role": "system", "content": "You are a vulnerability analyst. Given a CVE description, ""reply with only the CWE ID(s) it maps to, comma-separated."},{"role": "user", "content": "A SQL injection vulnerability in the login endpoint allows an ""unauthenticated attacker to execute arbitrary SQL via the username parameter."},]inputs = tok.apply_chat_template(messages, add_generation_prompt=True, return_tensors="pt").to(model.device)out = model.generate(inputs, max_new_tokens=32, do_sample=False)print(tok.decode(out[0][inputs.shape[-1]:], skip_special_tokens=True))# -> CWE-89
Qwen/Qwen3-8B (trained 4-bit via unsloth/qwen3-8b-unsloth-bnb-4bit)eiphuggincve/cve-cwe-consensus — 69,386 rows (55,810 / 6,774 / 6,802), majority CWEs capped at 2,500ChatML (Qwen3 standard). System prompt fixed; the description is the only user input — never feed the label or CVE-ID.
You are a vulnerability analyst. Given a CVE description, reply with only the CWE ID(s) it maps to, comma-separated.CWE-79, CWE-80Apache-2.0 (inherited from Qwen3-8B). Dataset derives from public upstreams (NVD, MITRE CVE/CWE).