Research Overview

Formal research abstracts, future research directions, and limitations for the PoCSmith exploit development assistant.

Publications

PoCSmith: Fine-Tuning an Exploit-Generation Model on Consumer Hardware

We present PoCSmith, a fine-tuned language model for automated generation of proof-of-concept exploits and multi-platform shellcode, together with the tooling that turns it into a usable research assistant. Starting from CodeLlama-7B, we apply QLoRA 4-bit quantization (NF4 with double quantization and bfloat16 compute) and train low-rank adapters on the query and value projections (rank 16, alpha 32; 8,388,608 trainable parameters, 0.12% of the model), enabling the entire fine-tune to run on a single 6GB consumer GPU. Using an instruction-tuning dataset of 1,472 samples (407 CVE-to-exploit pairs and 1,065 shellcode examples) drawn from public exploit sources, training reduced loss by 30% (1.20 to 0.84) and improved token accuracy from 72.6% to 78.4% over three epochs in 3 hours 17 minutes, with peak VRAM at 96% and no out-of-memory failures. We describe the generation pipeline (CVE parsing via the NVD API, structured prompting matched to the training format, model inference, and output formatting), the multi-platform shellcode capability that follows from the dataset composition, and the memory-optimization stack that made constrained-hardware training feasible. We are explicit that token accuracy measures next-token prediction rather than functional exploit correctness, that generated artifacts are drafts requiring review, and that the system is scoped for authorized defensive security research.

Talks

PoCSmith: Fine-Tuning an Exploit-Generation Model on Consumer Hardware

Specializing large language models for security tasks is usually framed as a data-center activity. This talk shows the opposite: a complete fine-tune of CodeLlama-7B for proof-of-concept exploit and multi-platform shellcode generation, done in 3 hours 17 minutes on a 6GB laptop GPU. We walk through the QLoRA configuration that makes 7B training fit in 6GB (4-bit NF4 quantization, LoRA on query/value projections at 0.12% trainable parameters, gradient checkpointing, a paged 8-bit optimizer, and batch-1 gradient accumulation), and the memory bookkeeping that held the run at 96% VRAM without an out-of-memory crash. We cover the 1,472-sample instruction-tuning dataset (407 CVE-exploit pairs and 1,065 shellcode examples), the measured results (a 30% loss reduction and 78.4% token accuracy), and why the learning curve flattens after the first epoch. We are explicit about the gap between token accuracy and functional correctness, the local-inference privacy model, and the ethical scoping of an offensive-artifact generator. The talk is aimed at security researchers and ML practitioners interested in cheap, reproducible model specialization.

Limitations

• Token accuracy is not functional correctness: Token accuracy (78.4%) measures next-token prediction on held-out data, not the functional correctness of generated exploits; a high token accuracy does not guarantee a working PoC, which is why the usage guide insists on reviewing and testing every output.
• Dataset scale: The dataset is small (1,472 samples) and shellcode-weighted, so CVE-to-exploit generation rests on only 407 pairs.
• Draft quality: The model is a 4-bit-quantized 7B adapter, so it acts as a first-draft assistant, not an autonomous exploit writer.
• External API dependency: CVE generation depends on the NVD API and is subject to its rate limit.

Future Research

• Architecture Layer Breadth: Broadening the supported instruction sets and architectures beyond the documented layer.
• Fuzzing Integration: Pairing PoCSmith directly with coverage-guided fuzzers (such as ProtoCrash) to create a discover-then-weaponize automated loop.
• Dataset Expansion: Expanding the CVE-to-exploit sample base beyond the initial 407 pairs to cover more vulnerability classes.