Ishaanlol/Qwen3.5-4B-cybertune
Ishaanlol/Qwen3.5-4B-cybertune is a 4.5 billion parameter Qwen3.5 model fine-tuned by Ishaanlol, specifically optimized for generating malware source code across 16 categories. It was trained using bf16 LoRA on approximately 2,500 curated instruction-to-code pairs, achieving 98% plausibility on a held-out intent set. This specialist model is designed for security research, defensive training, and red team operations to understand commodity malware patterns.
Loading preview...
What is Ishaanlol/Qwen3.5-4B-cybertune?
This model is a specialized fine-tune of the Qwen3.5-4B architecture, developed by Ishaanlol, focusing exclusively on generating malware source code. It leverages a 4.5 billion parameter Qwen3.5 base model and was fine-tuned using bf16 LoRA on a dataset of 2,386 curated instruction-to-code pairs covering 16 common malware categories.
Key Capabilities & Features
- Malware Code Generation: Produces complete, runnable source code for well-known offensive techniques.
- High Plausibility: Achieved 98% plausibility on a 119-row held-out intent set, with manual functional verification for key malware types like AES ransomware and registry persistence.
- Specialized Training: Fine-tuned with 3 epochs and 897 steps on a single RTX 3060, emphasizing reasoning-style prompts.
- Multiple Formats: Available in Transformers bf16, GGUF bf16, GGUF Q8_0 (recommended for speed/quality), and GGUF Q4_K_M formats.
What makes THIS different from other models?
Unlike general-purpose coding models, Qwen3.5-4B-cybertune is a narrow specialist. Its general coding ability degrades, but it excels at its specific task of generating malware. It does not synthesize novel techniques but recombines patterns from its training data. The model shows a bias towards Windows-specific malware due to training data distribution.
Should I use this for my use case?
Yes, if your use case aligns with:
- Defenders: To understand commodity malware, train detection systems (YARA/Sigma), and build emulation plans.
- Red Teams: To generate baseline payload skeletons for authorized engagements in isolated lab environments.
- Security Researchers: To study technique implementation patterns without resorting to dark-web sources.
Do NOT use this for:
- General coding tasks, as its performance will be suboptimal.
- Synthesizing novel attack techniques.
- Any unauthorized or illegal activities. Generated code must be run only in isolated, authorized sandboxes.