Qwen2.5-Coder Edges DeepSeek-Coder in Local Solidity Security Reviews at 7B Scale

·6 views

A developer tested Qwen2.5-Coder and DeepSeek-Coder locally via Ollama on WSL2, running both 7B-and-below models against ten small Solidity contracts containing deliberately planted security bugs. Each contract was evaluated using three prompt types — open-ended, targeted, and structured — with results scored manually on bug detection, accuracy, and output noise. Qwen2.5-Coder showed a clear advantage in instruction-following, consistently respecting structured output formats critical for automated pipelines. While DeepSeek-Coder matched Qwen on detecting classic vulnerabilities, it more frequently drifted off-topic and produced generic explanations rather than specific attack sequences. The author notes the comparison was motivated by model selection for an open-source auditing tool and cautions that neither model is suited for large, real-world contract audits.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

R&D Test Shows Lightweight OPT-125M Model Curbs Hallucinations With HUQAN Framework

Researchers paired the ultra-lightweight OPT-125M language model with HUQAN's agentic framework to test whether a trust-hierarchy layer could reduce hallucinations without making the model itself more complex. The system assigns baseline trust scores to information based on its source, with model-generated claims scoring as low as 0.1, while verified databases and experimental data score up to 0.9. Crucially, a model cannot raise its own trust score through repetition — only external corroboration can do so, directly targeting self-validation loops. In three structured tests covering harmful guidance, causal consistency, and hallucination, the HUQAN-assisted model outperformed the raw model significantly, correctly flagging a fabricated cancer study citation and reversing a scientifically false climate claim. Adversarial probes showed the system held firm against repeated false claims, though paraphrased attacks only partially bypassed defenses, pointing to an area for further improvement.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

HUQAN Aims to Give Humans Final Say Over AI Agent Actions Before They Execute

A new local-first security layer called HUQAN is being developed to intercept and evaluate AI agent requests before they are carried out, rather than logging them after the fact. Unlike many existing AI security tools that rely on one language model policing another, HUQAN uses a deterministic, rules-based engine to classify each requested action as ALLOW, BLOCK, REVIEW, or DRY_RUN_ONLY. Every decision is recorded as a signed, hash-linked, auditable entry, creating a verifiable trail of agent behavior. The system also scrutinizes information that agents attempt to write into their own persistent memory, treating potentially false or manipulated memory writes as a security risk on par with harmful actions. The project is still in development, with core fail-closed logic under testing and signing layers planned for later stages.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How to Set Up a Kubernetes Node on Ubuntu 24.04 Using containerd Runtime

A step-by-step guide published on DEV Community outlines how to configure a single Kubernetes control-plane node on Ubuntu 24.04 using containerd, the same runtime engine that powers Docker. The setup uses kubeadm for node initialization and sources packages from the current pkgs.k8s.io repository, replacing the retired apt.kubernetes.io repo. A critical configuration step involves enabling the systemd cgroup driver in both containerd and kubelet, as Ubuntu 22.04 and later use cgroup v2 by default, which can cause node instability if mismatched. Flannel is applied as the CNI plugin for pod networking, and Docker-built OCI images run on containerd without any modification. Common first-node failures such as kubelet startup issues and pending pods are attributed to swap being enabled or cgroup driver mismatches.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Fylgja CSS v2.2 Launches CLI to Copy CSS Files Without Installing Dependencies

Fylgja CSS v2.2 has been released with a new command-line interface that allows developers to copy CSS files directly into their projects using a single npx command, without adding a package dependency. The CLI supports all three core packages — @fylgja/base, @fylgja/tokens, and utilities — and lets users fetch either full bundles or individual component files. The tool is particularly aimed at prototyping workflows where a quick setup is preferred over a full npm install. Installing via npm remains the recommended approach for production projects, as it offers version pinning and full source access. The CLI is the first of its kind for Fylgja and is expected to expand in coverage as the library grows.

0 comments Read more at DEV Community