🛡️ BugBounty-Triage-Assistant-3B

TL;DR

• Overview: An open-weights defensive AI assistant fine-tuned on web vulnerability reporting and bug bounty triage tasks across English and Indonesian.
• Base Architecture: Qwen/Qwen2.5 with PEFT LoRA adapter merged into full precision safetensors.
• Export Formats: Standard Hugging Face safetensors + GGUF Q4_K_M for local offline deployment via llama.cpp.

---

🔗 Ecosystem Cross-Links

• Dataset: Kicaulah/bugbounty-reports-synthetic
• Interactive Space: Kicaulah/bugbounty-report-helper

---

🎯 Intended Use

• Restructuring unstructured researcher notes into reproducible bug bounty submissions.
• Assisting application security engineers with triage communications, duplicate analysis, and remediation drafting.
• Educational training for junior security researchers learning professional reporting standards.

🚫 Out-of-Scope Use

• Automated offensive exploitation or weaponized payload generation against live systems.
• Replacing certified human triage engineers or authoritative NVD CVSS scoring panels.

---

💻 Working Inference Snippet

import torch
from transformers import AutoTokenizer, AutoModelForCausalLM

model_id = "Kicaulah/bugbounty-triage-assistant-3b"
tokenizer = AutoTokenizer.from_pretrained(model_id)
model = AutoModelForCausalLM.from_pretrained(
    model_id,
    torch_dtype=torch.float32,
    device_map="auto"
)

prompt = """Task: Convert researcher notes to report
Notes:
target host: api.portal.example.com
route tested: /api/v1/invoices/9921
vuln type: Broken Object Level Authorization (IDOR)
requires standard user session
"""

messages = [
    {"role": "system", "content": "You are a professional web bug bounty triage and report assistant."},
    {"role": "user", "content": prompt}
]

text = tokenizer.apply_chat_template(messages, tokenize=False, add_generation_prompt=True)
inputs = tokenizer(text, return_tensors="pt").to(model.device)

with torch.no_grad():
    outputs = model.generate(**inputs, max_new_tokens=256, temperature=0.2, do_sample=False)

response = tokenizer.decode(outputs[0][inputs["input_ids"].shape[1]:], skip_special_tokens=True)
print(response)

---

🏋️ Training Data & Hyperparameters

• Training Corpus: Kicaulah/bugbounty-reports-synthetic (multi-task instruction mix from 6 target triage configs).
• Fine-Tuning Method: Parameter-Efficient Fine-Tuning (PEFT) LoRA.
• Target Modules: q_proj, k_proj, v_proj, o_proj.
• LoRA Parameters: r=16, lora_alpha=32, dropout=0.05.
• Learning Rate: 2e-4 with warmup and AdamW optimizer.
• Hardware: Linux x86_64, CPU / CUDA compatible.

---

📊 Evaluation & Benchmark Results

Evaluated against the untuned base foundation model on held-out test split (isolated by scenario_id hash):

Benchmark Metric	Untuned Base Model	BugBounty-Triage-Assistant	Improvement
ROUGE-1 (Report Quality)	0.135	0.185	+0.050
ROUGE-2 (Phrasal Match)	0.029	0.049	+0.020
ROUGE-L (Structure Match)	0.106	0.117	+0.011
ROUGE-L (EN subset)	0.113	0.117	+0.004
ROUGE-L (ID subset)	0.050	0.033	-0.017

⚠️ Honest Analysis of Weak Spots

1. CVSS Vector Exact Match: Like most sub-3B parameters LLMs, the model should not be relied upon to guess numerical CVSS floats or exact 40-character vector strings in freeform generation. Programmatic calculation (as implemented in the companion Space using the official cvss library) should always be used.
2. Strict JSON Output: In zero-shot mode without JSON schema constraint or BNF grammar guidance, the model can emit conversational headers around JSON payloads.

---

🔒 Limitations, Bias & Risks

• Human Triage Required: Output is an aid for reporting and triage, not a definitive legal or financial determination for bounty payouts.
• Synthetic Domain Safeguard: Trained purely on synthetic data using reserved namespaces (*.example.com, RFC 5737 IPs) to ensure zero real-world operational exposure.

---

📜 Citation & BibTeX

@misc{kicaulah2026bugbountytriage,
  author = {Kicaulah},
  title = {BugBounty-Triage-Assistant-3B: Parameter-Efficient Web Vulnerability Report and Triage Model},
  year = {2026},
  publisher = {Hugging Face},
  howpublished = {\url{https://huggingface.co/Kicaulah/bugbounty-triage-assistant-3b}}
}