mxguru1/castorred-v0.1-4b-instruct-merged

VISIONConcurrent Unit Cost:1Model Size:4.5BQuant:BF16Context Size:32kTool Calling:SupportedPublished:Aug 5, 2026License:apache-2.0Architecture:Transformer Open Weights Featherless Exclusive Cold

The mxguru1/castorred-v0.1-4b-instruct-merged model is a 4.5 billion parameter instruction-tuned causal language model, based on Qwen/Qwen3.5-4B, developed by mxguru1. It is specifically fine-tuned using GRPO reinforcement learning for C/C++ vulnerability analysis, including reading sanitizer crash reports, classifying weaknesses, and proposing patches. This model excels at security reasoning for memory-safety bugs in C/C++ code, offering a 32768 token context length.

Loading preview...

Overview

mxguru1/castorred-v0.1-4b-instruct-merged is a 4.5 billion parameter model, built upon the Qwen/Qwen3.5-4B architecture. It has been fine-tuned using GRPO reinforcement learning to specialize in C/C++ vulnerability analysis. The model's weights are merged, meaning the LoRA adapter is baked in, eliminating the need for PEFT at runtime. It is designed as a security-reasoning prior for tasks similar to CyberGym, focusing on textual analysis rather than exploit generation.

Key Capabilities

  • C/C++ Vulnerability Analysis: Proficient in reading sanitizer crash reports, identifying memory-safety weaknesses, and judging code vulnerability.
  • Patch Proposal: Can propose minimal secure patches for identified vulnerabilities.
  • High Context Length: Supports a context window of 32768 tokens, allowing for analysis of larger code segments.
  • Performance: Achieved a +26.3% improvement in composite evaluation reward over its base, with pass@1 increasing to 0.9712 and pass@8 to 1.0000, particularly strong in "remediation" (crash/weakness identification).

Good for

  • Defensive Security Work: Triaging fuzzer output and explaining sanitizer reports.
  • Code Review: Reviewing C/C++ code for memory-safety bugs.
  • Security Research: Ideal for research into security-focused reinforcement learning.

Limitations

  • C/C++ Memory Safety Only: Not trained for web-application vulnerabilities (e.g., SQLi, XSS).
  • No Exploit Generation: Does not generate proof-of-concept exploits or crash inputs.
  • Lexical Reward: Outputs are based on lexical similarity to correct answers, not verified correctness; human review is essential.
  • Undertrained: Training stopped at 38% of the planned schedule, though performance had largely plateaued.

Finetunes
1 models