krxi123/asmsense-qwen3-8b-lora

asmsense: Qwen3-8B LoRA v5

A LoRA adapter for Qwen/Qwen3-8B that looks at one function from a stripped x86-64 binary (Intel-syntax assembly plus a short summary of its callees) and writes a one-sentence English description, a guessed function name, and a one-sentence Turkish description.

Code, data pipeline and all measurements: github.com/krxi/asmsense. Training data: the v5 config of krxi123/asmsense (also on Kaggle).

This is a research checkpoint, not a reliable tool. On unseen projects most of its descriptions are wrong (see below). Treat its output as a suggestion to check.

Results

Test projects are disjoint from training projects and were chosen to be little known (≤200 stars, mostly created in 2024 or later). Name F1 is token overlap between the predicted and the real name.

Model	fixed v4 test sample (n=2,000)	eval_115 (n=115)
mimo-v2.6-pro with call context (large, reference)	0.167	0.195
deepseek-v4.1-flash with call context (large, reference)	0.154	0.159
this adapter (v5)	0.124	0.155
Qwen3-8B + LoRA v1 (name only, earlier run)	0.106	0.094

• v5 versus v1 on the same 2,000 rows: +0.018 name F1 (95% bootstrap interval +0.009 to +0.026).
• Functions with string constants: 0.299. Functions without (85% of the test sample): 0.093.
• 30% of predictions are verbatim copies of a name seen in training.
• Description quality: a judge model (mimo-v2.6-pro) compared the descriptions with the C source on 300 test rows. English: 20.0% correct, 15.3% partly correct, 64.7% wrong. Turkish: 20.9% / 18.9% / 60.1%. Name F1 is 0.306 when the description is correct and 0.054 when it is wrong.
• All 2,115 test outputs were valid JSON.

The checkpoint is step 4,500 of 5,938, chosen by name F1 on 300 validation rows (0.263); the test sets were scored once with it.

Training

• Data: 95,000 rows covering 72,061 source functions from 287 projects, compiled with clang at -O0/-O1/-O2/-O3/-Os, linked and stripped. Targets come from the original function names and from teacher descriptions written by models that saw the C source. A judge audit of 2,883 teacher labels rated the Turkish description 1.96/2 and the English one 1.92/2.
• LoRA r=16, alpha=32, dropout 0.05, all linear layers; bf16, no quantization; lr 1e-4 cosine, 3% warmup; effective batch 16; 1 epoch; max length 3,072 tokens; seed 7; loss on the assistant answer only.
• transformers 5.3.0, torch 2.11; one RTX Pro 6000 (96 GB), about 9.5 hours.

Usage

The model was trained with this exact (Turkish) system prompt and with thinking disabled:

import json, torch
from transformers import AutoModelForCausalLM, AutoTokenizer
from peft import PeftModel

SYSTEM = ('Sen deneyimli bir tersine mühendissin. Sana sembolleri silinmiş bir x86-64 fonksiyonu (Intel sözdizimi) '
          've varsa çağrı bağlamı verilecek. İç fonksiyonlar sub_XXXX diye gizlendi; dış kütüphane çağrıları görünür. '
          'Önce fonksiyonun ne yaptığını tek cümle İngilizce açıkla, sonra asıl kaynak adını snake_case veya kaynak '
          'stilinde bir tanımlayıcı olarak tahmin et, sonra tek cümle Türkçe açıkla. Yalnız bu sırada JSON dön: '
          '{"aciklama_en": "Reads a record from the stream.", "ad": "read_record", "aciklama": "Akıştan bir kayıt okur."}')

tok = AutoTokenizer.from_pretrained("Qwen/Qwen3-8B")
model = AutoModelForCausalLM.from_pretrained("Qwen/Qwen3-8B", torch_dtype=torch.bfloat16, device_map="auto")
model = PeftModel.from_pretrained(model, "krxi123/asmsense-qwen3-8b-lora")

asm = "push\trbp\nmov\trbp, rsp\n..."   # one function, Intel syntax, internal calls as sub_XXXX
ids = tok.apply_chat_template(
    [{"role": "system", "content": SYSTEM}, {"role": "user", "content": asm}],
    add_generation_prompt=True, enable_thinking=False, return_tensors="pt", return_dict=True).to(model.device)
out = model.generate(**ids, max_new_tokens=160, do_sample=False)
print(json.loads(tok.decode(out[0, ids["input_ids"].shape[1]:], skip_special_tokens=True)))
# {"aciklama_en": "...", "ad": "...", "aciklama": "..."}

The input format (how assembly is normalized and how the call context is appended) is produced by lora/hazirla.py in the repository; the Ghidra script in ghidra/ builds it from a real binary.

Limitations

• x86-64, clang, Mach-O builds of C code only; other compilers, architectures and languages were not tested.
• Functions longer than about 2,500 input tokens were truncated in training.
• Project-specific name prefixes are stripped from training targets, so the model does not predict them.
• Intended for defensive reverse engineering and research on open-source code.

License

Apache-2.0, the same as the base model. The training sources are permissively licensed projects; see the dataset card for the list.