---

license: apache-2.0

Cipheron

Cipheron is a lightweight coding model designed for secure code review.

It analyzes source code for common security vulnerabilities and attempts to explain the issue and provide a safer implementation.

What Cipheron Is Good At

Cipheron performs particularly well on:

• SQL injection — identifies unsafe query construction and recommends parameterized queries.
• Command injection — identifies unsafe shell command construction and recommends safer subprocess-based approaches.

These vulnerability classes are strongly represented in its evaluation data.

Known Limitations

Cipheron has limited reliability across many security vulnerability categories.

In testing, it struggled with:

• Path traversal
• Hardcoded secrets and API keys
• Weak password hashing
• Insecure deserialization
• Reflected XSS
• Complex multi-step security vulnerabilities

For these cases, the model may produce changes that appear security-related but do not actually eliminate the underlying vulnerability.

Do not rely on Cipheron as a replacement for professional security review, static analysis, penetration testing, or a larger security-focused model.

Cipheron is best considered a lightweight, experimental tool for first-pass security analysis and secure-coding experimentation.

Usage

from transformers import AutoModelForCausalLM, AutoTokenizer
import torch

model_id = "bencodez/Cipheron"

tokenizer = AutoTokenizer.from_pretrained(model_id)

model = AutoModelForCausalLM.from_pretrained(
    model_id,
    torch_dtype=torch.bfloat16
)

messages = [
    {
        "role": "system",
        "content": (
            "You are a secure coding assistant. "
            "Review code for security vulnerabilities "
            "and provide fixed, secure versions."
        )
    },
    {
        "role": "user",
        "content": """Review this code for security issues and fix it:

def get_user(username):
    query = "SELECT * FROM users WHERE username = '" + username + "'"
    return db.execute(query)"""
    }
]

input_ids = tokenizer.apply_chat_template(
    messages,
    add_generation_prompt=True,
    return_tensors="pt"
)

with torch.no_grad():
    output = model.generate(
        input_ids,
        max_new_tokens=250
    )

response = tokenizer.decode(
    output[0][input_ids.shape[1]:],
    skip_special_tokens=True
)

print(response)

Local Inference

A quantized Cipheron-Q8_0.gguf version is available for lightweight local inference.

Cipheron can be used with compatible local inference runtimes for CPU and other supported devices.

Intended Use

Cipheron is intended for:

• Secure-coding education
• Security experimentation
• Offline code analysis
• Vulnerability-detection research
• Lightweight local development workflows

Model Information

Property	Value
Model	Cipheron
Parameters	0.5B
Architecture	Causal language model
Primary domain	Secure coding
Input	Source code and security questions
Output	Security analysis and safer code
License	Apache 2.0

Disclaimer

Cipheron is an experimental security-oriented coding model.

Security output should always be independently verified before being used in production systems. A model-generated fix does not guarantee that a vulnerability has been completely eliminated.

License

Apache 2.0