What is PoCSmith, exactly? A CodeLlama-7B model fine-tuned with QLoRA on 1,472 exploit samples, plus a CLI that generates proof-of-concept exploits and multi-platform shellcode from CVEs and descriptions.

What base model does it use and why? codellama/CodeLlama-7b-hf, chosen because it is code-specialized, small enough to fine-tune on 6GB VRAM, and understands code structure better than a general 7B model.

How was it fine-tuned? QLoRA 4-bit (NF4, double quantization, bf16 compute) with LoRA rank 16, alpha 32, on q_proj/v_proj, training 8,388,608 parameters (0.12% of the model).

What hardware was used for training? An NVIDIA RTX 4050 Laptop GPU with 6GB VRAM, running at 5.9/6.0GB (96%) and ~73°C, with no OOM crashes.

How long did training take? 3 hours 17 minutes over 885 steps (295 per epoch) at ~12 seconds per step, 3 epochs.

What were the measured results? Training loss 1.20→0.84 (-30%), token accuracy 72.6%→78.4% (+5.8 points), final eval loss 0.926.

Does 78.4% token accuracy mean 78% of exploits work? No. Token accuracy measures next-token prediction on held-out data, not functional correctness. Always review and test generated code.

What’s in the training dataset? 1,472 samples: 407 CVE-to-exploit pairs and 1,065 shellcode examples, split 1,177/147/148 train/val/test, in instruction/response format.

Why is it better at shellcode than CVE exploits? Because 72% of the training data is shellcode; CVE-to-exploit capability rests on the 407 CVE-exploit pairs.

What platforms does shellcode generation support? Linux x86, Linux x64, Windows x86, Windows x64, and ARM.

What payload types are available? Reverse shell, bind shell, exec, and download-and-exec.

How do I generate an exploit from a CVE? python src/cli/main.py cve CVE-2024-1234, optionally with --output FILE or --no-cache.

Where does CVE data come from? The NVD API, rate-limited to 5 requests per 30 seconds; results can be cached locally.

Can I generate from a description instead of a CVE? Yes: generate --vuln "buffer overflow" --target "Apache 2.4" --details "...".

Does it send my data anywhere? No. Processing is local; the only external call is fetching public CVE data from NVD on the cve path.

What are the runtime requirements? Python 3.11+, a CUDA-capable GPU (6GB+ VRAM recommended), and ~20GB disk; dependencies include torch, transformers, peft, bitsandbytes, and click.

How big is the model artifact? The LoRA adapter is 33MB (adapter_model.safetensors), applied over the CodeLlama-7B base.

Where is the model published? On Hugging Face as regaan/pocsmith (a PEFT/LoRA adapter over CodeLlama-7B) and on PyPI as pocsmith 1.0.0.

What memory optimizations made 6GB training possible? 4-bit NF4 quantization (13GB→4GB), gradient checkpointing, a paged 8-bit AdamW optimizer, bf16 precision, batch size 1 with gradient accumulation 4, and disabled packing.

Is this a push-button attack tool? No. It is a research assistant that drafts artifacts for authorized, defensive security work; the documentation requires review, testing, authorization, and responsible disclosure.