---
library_name: peft
base_model: mistralai/Mistral-7B-Instruct-v0.2
license: apache-2.0
tags:
  - nixpkgs
  - security
  - lora
  - nix
  - patch-generation
datasets:
  - odoom/nixpkgs-security-patches
---

# nixpkgs-security-lora

LoRA adapter for generating nixpkgs security patches. Fine-tuned on [odoom/nixpkgs-security-patches](https://huggingface.co/datasets/odoom/nixpkgs-security-patches) — 586 complex security fixes from the NixOS/nixpkgs repository.

## Model Details

- **Base model**: [Mistral 7B Instruct v0.2](https://huggingface.co/mistralai/Mistral-7B-Instruct-v0.2)
- **Method**: QLoRA (4-bit NF4 quantization + LoRA rank 32)
- **Target**: Cloudflare Workers AI `@cf/mistral/mistral-7b-instruct-v0.2-lora`
- **Adapter size**: 160 MB
- **Version**: v2 — retrained on filtered complex-only patches

## Training

- **LoRA rank**: 32, alpha: 64, dropout: 0.05
- **Target modules**: q_proj, k_proj, v_proj, o_proj, gate_proj, up_proj, down_proj
- **Epochs**: 3 (110 steps)
- **Effective batch size**: 16 (batch 1 × gradient accumulation 16)
- **Learning rate**: 2e-4, cosine schedule
- **Max sequence length**: 4,096 tokens
- **Hardware**: NVIDIA L4 GPU (HuggingFace Jobs)

### Training Metrics

| Metric | Start | End |
|--------|-------|-----|
| Loss | 1.166 | 0.867 |
| Token accuracy | 74.6% | 80.5% |
| Eval loss | — | 0.924 |
| Eval accuracy | — | 78.4% |

Training time: ~61 minutes.

## Training Data

586 training examples and 66 eval examples derived from merged security PRs in [NixOS/nixpkgs](https://github.com/NixOS/nixpkgs). Each example pairs a CVE description with the actual nix patch diff that fixed it.

Quality filters applied:
- Only merged PRs with security-related titles (CVE, vulnerability, security fix)
- **Removed version bumps and hash-only updates** — these are deterministic and don't need AI (763 examples filtered out)
- Kept only complex fixes: fetchpatch backports, patch additions, config changes, etc.
- Removed trivially small diffs (< 3 changed lines)

## Changelog

- **v2** (2026-03-03): Retrained on filtered dataset — removed 763 version bump / hash-only examples. Higher accuracy (80.5% vs 75.6%) with cleaner, more focused training signal.
- **v1** (2026-03-02): Initial training on 1,273 unfiltered examples.

## Intended Use

This adapter is designed for the [Vulnpatch](https://github.com/Vulnpatch) automated security patch agent. Given a CVE description and affected package info, it generates candidate nix package patches.

## Usage with Cloudflare Workers AI

```javascript
const response = await env.AI.run(
  "@cf/mistral/mistral-7b-instruct-v0.2-lora",
  {
    messages: [
      { role: "user", content: "Fix CVE-2024-1234 in package foo..." }
    ],
    lora: "nixpkgs-security-lora"
  }
);
```

## Usage with Transformers + PEFT

```python
from transformers import AutoModelForCausalLM, AutoTokenizer
from peft import PeftModel

model = AutoModelForCausalLM.from_pretrained("mistralai/Mistral-7B-Instruct-v0.2")
model = PeftModel.from_pretrained(model, "odoom/nixpkgs-security-lora")
tokenizer = AutoTokenizer.from_pretrained("mistralai/Mistral-7B-Instruct-v0.2")
```

## Limitations

- Specialized for nixpkgs package expressions — not a general code model
- Training data is Nix-specific; won't generalize to other package managers
- May produce patches that need manual review for correctness