freakyskittle/qwen36-35b-a3b-distill-lora-t4

Qwen3.6-35B-A3B LoRA adapter fine-tuned with Unsloth on a distillation mix of agentic GLM-5.3 traces, security reasoning traces (cybench / autopenbench / OpenVul / SecCoderX / CTF), SWE-agent trajectories, and benchmark train splits.

Trained on NVIDIA Tesla T4 (Colab high-RAM), emulated bf16.

Base model

huihui-ai/Huihui-Qwen3.6-35B-A3B-abliterated — abliterated (uncensored) safetensors weights, the trainable equivalent of the GGUF-only HauhauCS/Qwen3.6-35B-A3B-Uncensored-HauhauCS-Aggressive. Hybrid MoE: gated-deltanet linear attention + full attention, 256 experts, ~3B active params.

Training data

Hyperparameters

Benchmark results

Small-sample eval for sanity checking only — not a rigorous benchmark run.

Qualitative security samples

Prompt: Audit this C function for vulnerabilities:

void copy(char *dst, const char *src) { while (*src) *dst++ = *src++; *dst = 0; }

Here's a thinking process that leads to the audit of the provided C function:

1.  **Understand the Goal:** The user wants an audit of a specific C function `copy` for vulnerabilities.

2.  **Analyze the Code:**
    ```c
    void copy(char *dst, const char *src) {
        while (*src) {
            *dst++ = *src++;
        }
        *dst = 0;
    }
    ```

3.  **Break Down the Logic:**
    *   **Inputs:** Two pointers, `dst` (destination) and `src` (source).
    *   **Loop:** `while (*src)` checks if the current character at `src` is non-zero (not the null terminator).
    *   **Body:** `*dst++ = *src++;` copies the character from `src` to `dst`, then increments both pointers.
    *   **Termination:** After the loop, `*dst = 0;` explicitly writes a null terminator at the current `dst` position.

4.  **Identify Potential Vulnerabilities (Brainstorming):**

    *   *Null Pointers:* What if `dst` or `src` is `NULL`?
    *   *Buffer Overflows:* What if `dst` doesn't have enough space?
    *   *Infinite Loops:* What if `src` points to an array without a terminator?
    *   *Dangling Pointers/Uninitialized Memory:* (Less relevant for this specific function, but worth noting context).
    *   *Pointer Arithmetic:* Is the increment logic correct? (Yes, post-increment is standard).

5.  **Detailed Vulnerability Analysis:**

    *   **Vulnerability 1: Null Pointer Dereference (CWE-476)**
        *   *

Prompt: Explain step by step how you would approach a web CTF challenge whose description says 'flag is in the admin panel'.

Here's a thinking process:

1.  **Understand User Request:**
   - **Context:** Web CTF (Capture The Flag) challenge
   - **Clue:** "flag is in the admin panel"
   - **Task:** Explain step-by-step approach to solve it

2.  **Deconstruct the Clue:**
   - "Admin panel" implies a specific route/page (e.g., `/admin`, `/admin.php`, `/dashboard`)
   - "Flag is in" means either visible on the page, in the source code, in network requests, or in the database/session
   - Common admin panel characteristics: authentication, specific cookies/sessions, IP restrictions, role-based access, hidden endpoints, API endpoints

3.  **Brainstorming Step-by-Step Approach:**
   I need a logical, systematic workflow that a CTF player would follow:
   - Initial reconnaissance
   - Accessing the admin panel
   - Bypassing restrictions (if any)
   - Locating the flag
   - Verifying & submitting

   Let's flesh out each step with concrete actions and common CTF techniques:

   **Step 1: Initial Reconnaissance & Enumeration**
   - Visit the main URL
   - View page source (HTML, JS, comments, hidden elements)
   - Check HTTP headers, cookies, network tab
   - Look for clues in the description/source pointing to admin panel location
   - Common admin paths: `/admin`, `/admin.php`, `/admin.html`, `/dashboard`, `/api/admin`
   - Use tools: browser dev tools, curl, Burp Suite, dirb/gobuster, wappalyzer

   **Step 2: Accessing the Admin Panel**
   - Try common URLs
   - Check authentication requirements (login 

Training metrics

{
  "train_loss": 2.305,
  "steps": 3,
  "note": "T4 smoke-validation run, not a full finetune"
}

Usage

from unsloth import FastLanguageModel
model, tokenizer = FastLanguageModel.from_pretrained(
    "freakyskittle/qwen36-35b-a3b-distill-lora-t4",
    load_in_4bit = True,
    text_only = True,
)

Caveats

• Distillation data includes uncensored security/agentic traces — review outputs before production use.
• Small-sample benchmark numbers are directional, not definitive.
• Trained text-only; vision tower comes from the base model.