Monibee-Fudgekins/gemma-coder
Monibee-Fudgekins/gemma-coder is a 26 billion parameter QLoRA fine-tune of Google's gemma-4-26B-A4B-it, a mixture-of-experts model with approximately 4 billion active parameters. This model is specifically re-scoped and aligned for secure code generation and vulnerability detection, aiming to avoid introducing vulnerabilities and identify existing ones in codebases. It is intended for use in sandboxed environments for secure coding across multiple languages and for code review, with a context length of 32768 tokens.
Loading preview...
Overview
gemma-coder is a QLoRA fine-tune of Google's gemma-4-26B-A4B-it (a mixture-of-experts base with ~4B active parameters), designed to prioritize code security over mere correctness. While the base model is proficient in coding, this fine-tune focuses on generating code that avoids vulnerabilities and detecting existing security flaws. It is developed as the default agent model for the remote-agent-dev-platform, operating within a sandboxed environment that builds, executes, and tests its outputs.
Key Differentiator: Security Hardening with ExploitGym
The model's primary objective is to write code that does not introduce vulnerabilities and recognize existing ones. This alignment is driven by ExploitGym, a benchmark of 898 real-world vulnerabilities across C/C++, V8 JavaScript, and the Linux kernel. ExploitGym serves as a rich curriculum for the model to learn:
- Avoiding defect classes: Learning from memory-safety, type-confusion, and privilege-boundary mistakes to prevent their emission.
- Vulnerability detection: Identifying vulnerabilities in code, naming their CWE class, explaining trigger conditions, and proposing fixes.
It's crucial to note that ExploitGym is used defensively for evaluation and alignment, not for producing exploits.
Intended Uses
- Secure code generation in Python, JavaScript/React, Go, Java, and Swift within a sandboxed, tested environment.
- Vulnerability detection and code review, including flagging insecure patterns, classifying CWEs, and suggesting fixes.
Limitations
As a small, free-tier-trained MoE fine-tune, outputs should always be reviewed and tested by a human. The security re-scoping is currently in progress, and ExploitGym-measured results are not yet established or reported. Therefore, the model should not be relied upon for vulnerability detection until these benchmarks are published.