Qwen2.5-VL-3B-uncensored-bughunter-v9 (mobile tool-caller)

On-device agent for mobile bug-bounty workflows. Light LoRA fine-tune of huihui-ai/Qwen2.5-VL-3B-Instruct-abliterated to steer the researcher persona while preserving the base's native tool-calling and non-refusal behavior.

Positioned as a tool orchestrator, NOT a standalone knowledge base. Total Q4_K_M footprint: ~1.9 GB, ~2.5 GB active RAM, runs at 5-40 tok/s on modern phones via llama.cpp bindings.

Read this before using — honest positioning

This is a 3B mobile model with a light fine-tune (1 epoch, LoRA rank 8, lr 2e-5). Empirically validated behavior:

Use this model when...

• You need an on-device agent for mobile that orchestrates tools (HTTP fetch, MCP calls, recon commands, form autofill) in an iOS/Android app.
• The knowledge base is elsewhere: a RAG store over technique docs, a larger LLM upstream, or the researcher's own docs — this model only routes and formats.
• You need uncensored behavior on a mobile budget without a network round-trip.
• You need image understanding on-device (screenshots, whiteboards, diagrams).

Do NOT use this model as...

• A standalone offline oracle for "give me a working XSS payload for context X". It will produce something, but the something may be technically wrong. Use v8 (35B) or a RAG system.
• A drop-in replacement for the v8 (35B MoE) in deep multi-step chains (Request Smuggling variants, JWT kid + algorithm confusion, gadget-chain construction).

v9.2 (this iteration) — what changed vs the previous v9

The HF slot mmp2055/Qwen2.5-VL-3B-uncensored-bughunter-v9 was re-trained. Concrete changes:

• Base changed from Qwen/Qwen2.5-VL-3B-Instruct (needed a full abliteration pass) to huihui-ai/Qwen2.5-VL-3B-Instruct-abliterated (pre-abliterated + tool-calling chat template with the {% if tools %} block).
• No secondary abliteration in this iteration — inherited from the huihui-ai base.
• Lighter LoRA: rank 8 (was 16), alpha 16 (was 32), lr 2e-5 (was 5e-5), 1 epoch (was 2). Deliberate: preserve the base's uncensored + tool-calling behavior instead of overfitting the corpus.
• Chat template NOT patched — kept verbatim from huihui-ai. The previous v9 patched an "aggressive researcher" template that broke tool-calling and induced generation loops.
• Corrected dataset additions: the 500 tool_call training examples in additions_v9.2 use "You are a professional bug bounty researcher with access to tools" (was leaking "You are a helpful assistant with access to tools" in the previous iteration, contaminating the researcher persona).

Files in this repo

• Qwen2.5-VL-3B-uncensored-bughunter-v9.Q4_K_M.gguf — the LLM (~1.9 GB, Q4_K_M).
• mmproj-BF16.gguf — vision projector (~1.3 GB, BF16). Only needed for image input.
• Modelfile — Ollama-compatible template with baked-in temperature=0.1 and researcher SYSTEM prompt.
• /adapter — LoRA weights (rank 8, alpha 16) for anyone building on top.

Recommended sampling — CRITICAL

The bundled Modelfile bakes in temperature=0.1. In LM Studio / llama-server set it manually — the runtime defaults (0.7-0.8) are too high for this fine-tune.

Primary use case — tool orchestration

The GGUF preserves the huihui-ai chat template including the {% if tools %} block. Supply an OpenAI-style tools array in the request:

POST /v1/chat/completions
{
  "model": "qwen2.5-vl-3b-uncensored-bughunter-v9",
  "messages": [
    {"role": "system", "content": "You are a bug bounty researcher with tool access."},
    {"role": "user", "content": "Fetch the security.txt of https://example.com and summarize it."}
  ],
  "tools": [
    {
      "type": "function",
      "function": {
        "name": "http_fetch",
        "description": "Fetch a URL and return response body",
        "parameters": {
          "type": "object",
          "properties": {"url": {"type": "string"}},
          "required": ["url"]
        }
      }
    }
  ],
  "temperature": 0.1,
  "max_tokens": 512
}

Response (verified on this model):

{
  "choices": [{
    "finish_reason": "tool_calls",
    "message": {
      "role": "assistant",
      "content": "",
      "tool_calls": [{
        "type": "function",
        "function": {
          "name": "http_fetch",
          "arguments": "{\"url\":\"https://example.com/security.txt\"}"
        }
      }]
    }
  }]
}

The model returns clean JSON in tool_calls. Wire the response to your executor and pass the result back with role: "tool" in the next turn.

Deployment

LM Studio (desktop test)

1. Download both .gguf files into the same folder: ~/.lmstudio/models/mmp2055/Qwen2.5-VL-3B-uncensored-bughunter-v9-GGUF/.
2. Settings:
   • Context: 8,192 (up to 32,768 works).
   • Flash Attention: on.
   • GPU Offload: maximum.
   • Tool Use: on.
   • Temperature: 0.1.

llama.cpp directly

llama-server \
  -m Qwen2.5-VL-3B-uncensored-bughunter-v9.Q4_K_M.gguf \
  --mmproj mmproj-BF16.gguf \
  -c 8192 \
  -fa on \
  -ngl 999 \
  --port 8080

OpenAI-compatible endpoint at http://127.0.0.1:8080/v1/chat/completions.

Ollama

ollama create bughunter-v9 -f Modelfile
ollama run bughunter-v9

The Modelfile supplies a plain ChatML TEMPLATE and the researcher SYSTEM prompt. Ollama's Go-based Jinja parser cannot fully evaluate the Qwen2.5-VL template constructs (namespace(), <|vision_start|>, {% for content in message['content'] %}) so the plain-ChatML fallback is needed. LM Studio and llama.cpp both use the embedded template correctly without the Modelfile.

How it was trained

Base: huihui-ai/Qwen2.5-VL-3B-Instruct-abliterated. Pre-abliterated variant of Qwen2.5-VL-3B-Instruct with tool-calling chat template preserved.

Data: 15,914 ShareGPT examples = 14,914 from the v6/v7/v8 private corpus + 1,000 additions (500 tool_call examples with the researcher system prompt, 300 general researcher queries, 200 anti-collapse). Corpus is private.

Hyperparameters — deliberately light to avoid overwriting base behavior:

Framework: Unsloth FastVisionModel 2026.9.4 + transformers 5.5.0 + peft 0.20.0 + trl 0.24.0 on Colab Pro A100.

Training metrics (eval every ~250 steps):

Clean descent, no overfit, plateau reached around step 2,000 — expected for 1 epoch on 15k examples with a small adapter.

LoRA strategy (text tower only):

• Attacked: q/k/v/o_proj (attention) + gate/up/down_proj (MLP) of every one of the 36 decoder layers of the language model.
• NOT touched: visual.* and merger.* — vision encoder + projector kept intact so the base's image understanding is preserved.

Chat template: preserved verbatim from huihui-ai base (2,427 chars, includes the {% if tools %} block for Qwen2.5 native tool-calling). Not patched, not edited.

GGUF export

• HF → GGUF f16 → Q4_K_M via convert_hf_to_gguf.py + llama-quantize (llama.cpp master, Sep 2026).
• Vision projector extracted from the base model in BF16 (byte-identical to a fresh extraction from huihui-ai/Qwen2.5-VL-3B-Instruct-abliterated since vision was frozen).
• Known caveat: with transformers 5.5.0, the tokenizer_config.json saved by Unsloth's merge triggers AttributeError: 'list' object has no attribute 'keys' in convert_hf_to_gguf.py. Workaround (applied): copy tokenizer files from the base model before running the converter.

For fine-tuners: LoRA adapter available in /adapter

The LoRA adapter used to train this model is in this repo under /adapter:

adapter/
├── adapter_config.json         # PEFT config: rank 8, alpha 16, dropout 0.05
├── adapter_model.safetensors   # LoRA delta weights (~30 MB)
├── chat_template.jinja         # 2,427 chars, preserved from base
├── tokenizer_config.json
├── tokenizer.json
└── README.md

Merge into the base:

import torch
from transformers import Qwen2_5_VLForConditionalGeneration, AutoProcessor
from peft import PeftModel
from huggingface_hub import snapshot_download

BASE = "huihui-ai/Qwen2.5-VL-3B-Instruct-abliterated"
adapter_dir = snapshot_download(
    "mmp2055/Qwen2.5-VL-3B-uncensored-bughunter-v9",
    allow_patterns="adapter/*",
)

base = Qwen2_5_VLForConditionalGeneration.from_pretrained(
    BASE, torch_dtype=torch.bfloat16, device_map="cpu", trust_remote_code=True
)
model = PeftModel.from_pretrained(base, f"{adapter_dir}/adapter")
model = model.merge_and_unload()
processor = AutoProcessor.from_pretrained(BASE, trust_remote_code=True)

Known limitations

• Not a knowledge base for concrete offensive payloads. Empirically, direct queries like "give me a working XSS payload" return generic or occasionally technically incorrect content. Use v8 (35B) or a RAG system over technique docs for payload knowledge.
• Request Smuggling (CL.TE and beyond), JWT kid traversal chains, POP gadget chain construction, cross-chain signature replay — same limitation as previous iterations (dataset gap inherited).
• Hallucination of CVEs, URLs, tool names — always verify concrete references before use.
• Uncensored inheritance — no categorical refusals. The user assumes all legal responsibility.
• Not a substitute for primary research — this is an on-device orchestrator, not an oracle.

Ethical and legal use

Distributed for:

• Authorised research within bug bounty programs offering Safe Harbor.
• Pentesting under a signed services contract.
• CTFs and lab environments you own or are authorised to use.
• Cybersecurity education and academic research.

Not distributed for:

• Attacking systems without explicit authorisation.
• Commercial exploitation of vulnerabilities found outside bounty programs.
• Malware development for distribution.
• Any activity that violates applicable law in your jurisdiction.

The user assumes all legal responsibility for use of the model.

Credits

• Base: huihui-ai/Qwen2.5-VL-3B-Instruct-abliterated — pre-abliterated variant of Qwen/Qwen2.5-VL-3B-Instruct by the Qwen team.
• Abliteration methodology (inherited from base): Maxime Labonne — Uncensor any LLM with abliteration.
• Training framework: Unsloth FastVisionModel.
• Inference: llama.cpp.
• Prior work in this series: bughunter-v6 (9B GGUF) · bughunter-v7 (27B GGUF+MLX) · bughunter-v8 (35B MoE GGUF).
• Licence: Apache 2.0, inherited from the base.
• Recommended agent for using this model in a full pipeline: https://xagentai.net/xagentai-net-coding-agent/

References

• Bughunter Harness (GitHub — marcodemm/bughunter-harness) — multi-agent local-LLM pentest pipeline. Model-agnostic (LM Studio / Ollama / llama.cpp / OpenAI / Anthropic / NVIDIA / Gemini). This mobile v9 can be wired in as the on-device tool-caller while v8 (35B) handles deep queries upstream.
• LM Studio — local OpenAI-compatible runtime.

Citation

@misc{qwen25vl_bughunter_v9_2,
  title  = {Qwen2.5-VL-3B-uncensored-bughunter-v9 (v9.2 iteration): mobile tool-caller for on-device bug bounty workflows},
  year   = {2026},
  base   = {huihui-ai/Qwen2.5-VL-3B-Instruct-abliterated},
  method = {Light LoRA fine-tune (rank=8, alpha=16, lr=2e-5, 1 epoch, QLoRA 4-bit, Unsloth FastVisionModel) on text tower only, vision frozen. No secondary abliteration (inherited from base). Chat_template preserved verbatim from base including {% if tools %} block for Qwen2.5 native tool-calling.},
  data   = {15,914 ShareGPT examples: 14,914 from prior v6-v8 private corpus + 1,000 additions (500 tool_call, 300 general researcher queries, 200 anti-collapse) with corrected system prompts.}
}