license: apache-2.0
base_model: Qwen/Qwen2.5-VL-3B-Instruct
language:

• es
• en
  library_name: gguf
  pipeline_tag: image-text-to-text
  tags:
• cybersecurity
• bug-bounty
• red-team
• blue-team
• offensive-security
• defensive-security
• pentesting
• vulnerability-research
• uncensored
• abliterated
• llama-cpp
• gguf
• qwen2.5
• qwen2.5-vl
• mobile
• edge-inference
• spanish
• lora
• qlora
• unsloth
  inference: false

Qwen2.5-VL-3B-uncensored-bughunter-v9 (mobile)

Mobile-first iteration of the bughunter series. LoRA fine-tune of Qwen/Qwen2.5-VL-3B-Instruct, specialised in offensive and defensive security work and shrunk to fit on-device deployment (iOS / Android / edge).

v9 vs v8: same dataset and same operational rules as bughunter-v8 (35B MoE), applied on a 3B dense multimodal base with the vision tower frozen. Result: single Q4_K_M file ~1.8 GB that runs at 15-30 tok/s on modern smartphones via llama.cpp mobile bindings.

Uncensoring is applied in two stages: (1) fine-tune on the offensive corpus reinforces the researcher role; (2) abliteration (Maxime Labonne method) removes the residual refusal direction from the merged model.

Designed to assist researchers in real engagements on bug bounty platforms (HackerOne, Bugcrowd, Intigriti, YesWeHack, Immunefi) with operational rules baked in: authorized scope only, minimal non-destructive PoCs, callbacks to owned infrastructure. Answers in Spanish; payloads, commands and report templates in English.

Format and download

Two files:

• Qwen2.5-VL-3B-uncensored-bughunter-v9.Q4_K_M.gguf — the LLM, ~1.8 GB (Q4_K_M).
• mmproj-BF16.gguf — the vision projector, ~800 MB (BF16). Download this only if you want image understanding. Place it in the same folder as the LLM (LM Studio auto-detects it because it starts with mmproj-).

Vision is inherited from the base and untouched by the fine-tune (the fine-tune corpus is 100% text; the vision tower and projector were kept frozen with finetune_vision_layers=False). The mmproj-BF16.gguf published here is extracted from the base by convert_hf_to_gguf.py --mmproj.

Runs directly on:

• LM Studio — desktop, load and test in the GUI.
• llama.cpp — local OpenAI-compatible server (build with qwen2_5_vl support, ie. any build from Feb 2025 onward).
• Mobile apps that embed llama.cpp bindings (iOS / Android).
• Any runtime that supports GGUF and the qwen2_5_vl architecture.

Capabilities

Red team / offensive security

Covers a working subset of the full bug bounty lifecycle. Note: a 3B dense model has ~1/10 the semantic capacity of the v8 35B MoE — expect solid first-pass suggestions, not deep multi-step reasoning (see "Known limitations").

• Reconnaissance: passive subdomain enumeration hints, attack-surface mapping, API mapping, secret extraction from JavaScript, throttled use of httpx/gau/katana.
• Web vulnerabilities: root patterns for IDOR/BOLA, SSRF, CSRF, XSS (reflected/stored/DOM), SQL injection across contexts, misconfigured CORS, open redirects, prototype pollution, subdomain takeover, path traversal, LFI/RFI, request smuggling.
• Authentication and authorization: OAuth/OIDC (redirect_uri, state/nonce/PKCE), JWT (unverified signature, alg:none, weak key, kid injection, RS256→HS256 algorithm confusion), 2FA/MFA bypass, session fixation, mass assignment.
• APIs: BOLA, BFLA, excessive data exposure, legacy versions without authz, GraphQL introspection, alias abuse.
• Server-side: SSRF to cloud metadata (AWS IMDSv1/v2, GCP, Azure), SSTI, RCE via deserialization, XXE.
• Business logic: race conditions (TOCTOU), price/quantity/balance tampering, coupon/credit abuse.
• Reporting: writing reports in each platform's format (HackerOne CVSS, Bugcrowd VRT, Intigriti), severity calculation.

Blue team / defensive security

• DFIR: incident response methodology, timeline reconstruction, artifact collection.
• Traffic analysis: PCAP hints, C2 detection basics, DNS tunneling.
• Memory forensics: Volatility recipes, resident malware identification.
• Threat hunting: ATT&CK TTP-based hypothesis, event correlation.
• Vulnerability management: CVSS + context prioritisation.

Built-in operational rules

When a system prompt is provided, the model incorporates ethical research rules:

• In-scope assets only, verified against the program scope before every request.
• Sustained throughput ≤1-2 req/s. Bursts only for race conditions or authorised OTP brute-force.
• Minimal non-destructive PoC: whoami/id for RCE; SELECT version() for SQLi; two owner accounts for IDOR.
• OOB callbacks always to owned infrastructure. Never to shared third-party services.
• Never use credentials, tokens or API keys found in a finding to validate access.
• Cloud metadata: proving access is enough. Never exfiltrate IAM credentials.
• Minimum reportable severity: High or Critical (except in a chain, when Low is explicitly bountied, or in humanitarian VDPs).

How it was trained

Data

Same dataset as v6/v7/v8 (private, not published — see "Ethical and legal use" below): 14,914 ShareGPT training examples, 466 valid, 309 test, extracted from ~1,690 source documents grouped into 9 sources with weighted sampling to prioritise specialised offensive content.

v9-specific preprocessing (2 changes vs v8):

1. Filtered to ≤4,096 tokens per example — mobile inference rarely needs long context. In practice, 0 examples were filtered out (dataset is already short-medium — mean=359, median=296, p95=805 tokens after formatting).
2. Short-conversation boost ×2 — examples where every assistant turn is <300 chars are duplicated in the training mix (2,737 additional exposures). Rationale: a 3B dense model collapses format faster than a 35B MoE. Doubling the short-conv weight teaches the model to answer briefly when the prompt is brief. Final training set: 17,651 examples.

Three-thirds system prompt setup (unchanged from v6/v7/v8):

• 33% of examples with no system prompt.
• 33% with a long system prompt (the full operational ruleset).
• 33% with one of six short variants.

Hyperparameters

Adjusted for a 3B dense base:

Framework: Unsloth FastVisionModel 2026.9.4 + transformers 5.5.0 + peft 0.20.0 + trl 0.24.0 on Colab Pro A100 40GB.

Total training runtime: ~2 hours on A100.

LoRA strategy (text tower only):

• Attacked: q/k/v/o_proj (attention) + gate/up/down_proj (MLP) of every one of the 36 decoder layers of the language model. Diagnostic post-apply: 504 LoRA modules, 0 leaks to vision.
• NOT touched: visual.* and merger.* (the vision encoder + projector) — kept intact so the base's image understanding is preserved.

Training metrics

Healthy monotonic descent of eval_loss across all 17 evaluations (every 250 steps):

Notes:

• No overfit: eval never rebounded, plateau reached in the last third with Δ eval ≈ −0.001 per eval.
• Train-eval gap stabilized at ~0.10-0.15 — healthy generalisation on the offensive corpus.
• Final eval_loss = 1.217 is competitive with v6 (9B dense) at ~1.30, at 3× smaller footprint, though below v7 (27B dense) at ~1.15 which uses 9× more parameters.

Post-processing — Abliteration

After merging the LoRA adapter into the bf16 base, the merged model was passed through an abliteration pass (method by Maxime Labonne):

1. Collect residual-stream activations at every decoder layer for 32 harmful probes (concrete offensive requests) and 32 harmless probes (benign technical questions).
2. Compute the per-layer difference vector refusal_dir[i] = mean(act_harmful[i]) - mean(act_harmless[i]), normalised.
3. Select the layer where ‖refusal_dir[i]‖ is largest (best separator).
4. Orthogonalize self_attn.o_proj.weight and mlp.down_proj.weight of every layer against that direction: W' = W - R · (Rᵀ · W).

Result on this fine-tune: best refusal layer was layer 35 (the last one) with norm diff 232.38. Top 5 layers by norm: 35, 34, 33, 32, 31 — the refusal signal concentrates in the last third of the network, a common pattern in RLHF-trained bases where the guardrail is "close to the output". Orthogonalization was applied to 72 matrices (36 layers × 2 modules).

Effect: the model no longer projects into the refusal direction from the residual stream, which removes categorical refusals ("I can't help with that") without retraining or DPO. The offensive competence from the fine-tune is preserved. Validated with the same 3 harmful prompts that pre-abliteration produced refusals — post-abliteration all 3 responded with technical content.

GGUF export

• HF → GGUF f16 → Q4_K_M via convert_hf_to_gguf.py + llama-quantize (llama.cpp master, commit 3ff67eb — Sep 2026).
• Compression: 5,886 MiB fp16 → 1,834 MiB Q4_K_M (4.99 BPW).
• Vision projector extracted separately in BF16 (1.34 GB). Note: because vision was frozen during fine-tune, the mmproj was extracted from the base model directly — it is byte-identical to what a fresh extraction from Qwen/Qwen2.5-VL-3B-Instruct would produce.
• Known conversion caveat: with transformers 5.5.0, the tokenizer_config.json saved by Unsloth's merge triggers AttributeError: 'list' object has no attribute 'keys' in convert_hf_to_gguf.py. Workaround (applied during export): replace the tokenizer files with those from the base model before running the converter.

Mobile deployment

The Q4_K_M GGUF is small enough (~1.8 GB) to fit comfortably on modern phones with 6+ GB RAM, running through any app that embeds llama.cpp bindings for iOS or Android.

Recommended context on mobile

• Context length: 4,096-8,192 tokens (higher context blows RAM on-device).
• Threads: 4-6 (leave 2 free for the OS).
• GPU offload: use it if the app supports Metal/Vulkan (dramatic speedup on newer chips).

Usage

In LM Studio (desktop)

1. Download both files into the same folder: ~/.lmstudio/models/mmp2055/Qwen2.5-VL-3B-uncensored-bughunter-v9/.
2. Recommended settings:
   • Context length: 8,192 (up to 32,768 supported).
   • Flash Attention: on.
   • GPU Offload: maximum (all layers).
   • Tool Use: ON if using with the Bughunter Harness.

With llama.cpp directly

llama-server \
  -m Qwen2.5-VL-3B-uncensored-bughunter-v9.Q4_K_M.gguf \
  --mmproj mmproj-BF16.gguf \
  -c 8192 \
  -fa on \
  -ngl 999 \
  --port 8080

OpenAI-compatible endpoint at http://127.0.0.1:8080/v1/chat/completions.

Recommended system prompt

You can use the model without a system prompt (it behaves correctly by default). For bug bounty tasks specifically:

You are a professional bug bounty researcher. You work on HackerOne, Bugcrowd, Intigriti, YesWeHack, Immunefi and independent programs.

Inviolable rules:
- In-scope assets only, verified against the program scope before every request.
- Sustained throughput <=1-2 req/s.
- Minimal non-destructive PoC.
- OOB callbacks always to owned infrastructure.
- Never use credentials or tokens found in a finding to validate access.
- Minimum reportable severity: High or Critical.

Answer in Spanish. Payloads, commands and report templates in English.

For fine-tuners: LoRA adapter available in /adapter

If you want to build on top of this fine-tune, the LoRA adapter used to train this model is published inside this same repo under /adapter:

adapter/
├── adapter_config.json           # PEFT config: rank 16, alpha 32, dropout 0.05
├── adapter_model.safetensors     # LoRA delta weights (~30-50 MB)
├── chat_template.jinja
├── tokenizer_config.json
├── tokenizer.json
└── README.md

Merge into the base and use as a standalone model:

import torch
from transformers import Qwen2_5_VLForConditionalGeneration, AutoProcessor
from peft import PeftModel
from huggingface_hub import snapshot_download

BASE = "Qwen/Qwen2.5-VL-3B-Instruct"
adapter_dir = snapshot_download(
    "mmp2055/Qwen2.5-VL-3B-uncensored-bughunter-v9",
    allow_patterns="adapter/*",
)

base = Qwen2_5_VLForConditionalGeneration.from_pretrained(BASE, torch_dtype=torch.bfloat16, device_map="cpu", trust_remote_code=True)
model = PeftModel.from_pretrained(base, f"{adapter_dir}/adapter")
model = model.merge_and_unload()
processor = AutoProcessor.from_pretrained(BASE, trust_remote_code=True)

Note: the LoRA adapter alone reproduces the fine-tuned merged model, NOT the abliterated version. To reproduce abliteration, run the abliteration-standalone.py script from the training folder.

Known limitations

• 3B dense capacity ceiling. Compared to v8 (35B MoE with 3B active per token), v9 has a much smaller semantic surface. Expect solid first-pass suggestions for common patterns (IDOR, XSS, SQLi, SSRF, basic OAuth misconfig) but degraded performance on multi-step chains (HTTP Request Smuggling variants beyond CL.TE/TE.CL, JWT algorithm confusion + kid traversal chains, cross-chain signature replay, POP chain construction, deserialization gadget chains). For those, use v8.
• Uncensored model, abliterated. The abliteration pass removes categorical refusals but does not add capability. The user is responsible for using this model within applicable law and authorised scope.
• Fine-tuned on a 100% text dataset, vision frozen. Vision comes from the base's untouched projector — works for general image descriptions (screenshots, diagrams, whiteboards) but is not fine-tuned for security-specific screenshot analysis (Burp responses, admin dashboards, exploit outputs).
• Corpus mostly in Spanish with English technical terminology.
• ⚠️ Known hallucination — CL.TE: when asked about HTTP Request Smuggling with CL.TE, the model may describe it incorrectly (inherited from v6/v7/v8 dataset gap). Verify smuggling concepts against sources (PortSwigger, OWASP).
• NOT A SUBSTITUTE FOR PRIMARY RESEARCH. The model can replay learned patterns but does not discover on its own. Use it as an on-device assistant that speeds up quick lookups and drafting, not as an oracle.
• Hallucination of CVEs, URLs and tool names. Always verify any concrete reference before using it.
• Mobile inference speed depends heavily on device — expect ~5-15 tok/s on mid-range phones and 20-40 tok/s on top-tier flagships with Metal/Vulkan offload.

Ethical and legal use

This model is distributed for:

• Authorised research within bug bounty programs offering Safe Harbor.
• Pentesting under a signed services contract.
• CTFs and lab environments you own or are authorised to use.
• Cybersecurity education.
• Academic research.

It is not distributed for:

• Attacking systems without explicit authorisation.
• Commercial exploitation of vulnerabilities found outside bounty programs.
• Malware development for distribution.
• Any activity that violates the applicable law in your jurisdiction.

The user assumes all legal responsibility for the use of the model.

Credits

• Base: Qwen team — Qwen2.5-VL-3B-Instruct.
• Architecture: Qwen2.5-VL (dense 3B backbone + streamlined ViT with window attention, SwiGLU, RMSNorm; native image + video support; up to 128K context).
• Training framework: Unsloth FastVisionModel.
• Abliteration method: Maxime Labonne — Uncensor any LLM with abliteration.
• Inference: llama.cpp.
• Prior work in this series: bughunter-v6 (9B GGUF) · bughunter-v7 (27B GGUF+MLX) · bughunter-v8 (35B MoE GGUF).
• Licence: Apache 2.0, inherited from the base.
• Recommended agent for using this model: https://xagentai.net/xagentai-net-coding-agent/

Citation

@misc{qwen25vl_bughunter_v9,
  title  = {Qwen2.5-VL-3B-uncensored-bughunter-v9: mobile-first fine-tune specialised in bug bounty and offensive/defensive security},
  year   = {2026},
  base   = {Qwen/Qwen2.5-VL-3B-Instruct},
  method = {LoRA fine-tune (rank=16, alpha=32, lr=5e-5, 2 epochs, QLoRA 4-bit, Unsloth FastVisionModel) on text tower only, vision frozen. Post-hoc abliteration (Maxime Labonne method) for refusal-direction removal.},
  data   = {~14914 ShareGPT examples distilled from private bug bounty corpus, filtered to <=4k tokens with 2x weight on short conversational examples for format-collapse prevention}
}