LlamaFactory turns fine-tuning a language model from a research project into a form to fill in. It supports more than a hundred model families, including Qwen, Llama, Gemma, DeepSeek, GLM, Mistral and Phi, plus vision and audio models, and the training methods people actually use: supervised fine-tuning, DPO, KTO, ORPO, PPO and reward modelling, with full tuning, LoRA, or QLoRA down to 2-bit so a 7B model can be tuned on a single consumer GPU.
There are two ways in. LlamaBoard, a Gradio web interface, lets you pick a model, a dataset and a method, set the hyperparameters and watch the loss curve without touching code. The llamafactory-cli tool runs the same jobs from a YAML file, then chats with, evaluates, merges and exports the result, or serves it through an OpenAI-style API on vLLM or SGLang. It ships dozens of ready datasets and examples, and usually supports new model releases within a day.
It is Apache-2.0, with about 75,600 stars and 298 contributors, at v0.9.5 when scanned, and was published at ACL 2024. The README lists Amazon, NVIDIA and Aliyun among its users.
- Repository: github.com/hiyouga/LlamaFactory
- Licence: Apache-2.0 (Apache License 2.0)
- Language: Python. Stars: 75.6K. Forks: 9,266. Last push: Oct 10, 2026.
- Scan: safe, Oct 19, 2026, commit 1fded91
Who it is for
Developers and researchers who want to adapt an open model to their own data, style or task, and hobbyists with a decent NVIDIA GPU who want to try fine-tuning without writing training code.
Getting started
1. Clone and install
git clone --depth 1 https://github.com/hiyouga/LlamaFactory.git && cd LlamaFactory && pip install -e .2. Open the LlamaBoard web interface
llamafactory-cli webui3. Or run a LoRA fine-tune from an example config
llamafactory-cli train examples/train_lora/qwen3_lora_sft.yaml4. Chat with the result
llamafactory-cli chat examples/inference/qwen3_lora_sft.yamlNeeds Python 3.11+ and, for anything but tiny models, an NVIDIA GPU with CUDA (about 6 GB of memory for a 7B model with 4-bit QLoRA, 16 GB with LoRA). Install a CUDA build of PyTorch first. A Docker image, hiyouga/llamafactory, is also available.
Safety scan
We cloned hiyouga/LlamaFactory at commit 1fded91 on Oct 19, 2026 and ran the checks described on the GitHub Tools page: credential patterns, decode-and-execute code, install-time scripts, committed binaries, risky CI workflows, every host the code talks to, known vulnerabilities in pinned dependencies, and project hygiene. A person read every hit. This is what we found.
- No secrets, no suspicious code patterns, no install hooks, no committed binaries and no bare-IP URLs across 615 files and about 121,000 lines.
- LlamaBoard and the web demo start Gradio on 0.0.0.0 unless GRADIO_SERVER_NAME says otherwise, and have no login, so anyone on your network can reach them and start jobs while they run. A public Gradio share link only opens if you set GRADIO_SHARE.
- trust_remote_code is off by default. Some models need it on, which runs Python code from the model's Hugging Face repository, so turn it on only for publishers you trust.
- Dependencies are declared as version ranges in pyproject.toml rather than a lockfile, so there were no pinned versions to look up; pip installs current releases within those ranges.
- 8 workflows, none using pull_request_target; none of the 14 third-party actions is pinned to a commit. Licence, security policy, contributing guide and code of conduct present; no Dependabot.
What the scanner counted
| Check | Result |
|---|---|
| Secrets | None found. |
| Suspicious code | None found. |
| Install-time code | None: nothing runs at install beyond the package manager itself. |
| Committed binaries | None. |
| CI workflows | 8 workflows. None use pull_request_target. 14 of 14 third-party actions pinned to a tag rather than a commit. |
| Network hosts | 16 distinct hosts referenced from source; most often www.apache.org, github.com, huggingface.co, llamafactory.readthedocs.io. No URLs to bare IP addresses. |
| Known vulnerabilities | No lockfile to check: dependencies are declared as ranges, so what gets installed is whatever is current on the day. |
| Project hygiene | Has security policy, licence file, contributing guide. Missing automated dependency updates, CodeQL. |
| OpenSSF Scorecard | Not scored: the project is not in Scorecard's weekly index. |
By the numbers
| Stars | 75.6K |
|---|---|
| Forks | 9,266 |
| Contributors | 298 |
| Commits | 3,108 |
| Open issues | 1,007 |
| Open pull requests | 185 |
| Releases | 36 |
| Latest release | v0.9.5 |
| Licence | Apache-2.0 |
| Main language | Python |
| Project age | 3 years |
| Last push | Oct 10, 2026 |
| Tracked files | 615 |
| Lines of code | 121.5K |
| Checkout size | 14 MB |
Lines by language: Python 61.3K, JSON 47.6K, Markdown 7,617, YAML 4,532, TOML 150, JavaScript 94.
Questions
Is LlamaFactory free?
Yes. LlamaFactory is Apache-2.0 and free. The costs are the GPU you train on, local or rented, and the terms of each model's own licence, which the README links for every model family.
What GPU do I need to fine-tune a model?
The README's estimates: a 7B model needs about 6 GB of GPU memory with 4-bit QLoRA, 16 GB with LoRA, and 60 GB or more for full fine-tuning. Larger models scale up from there, so most people start with LoRA or QLoRA on a 7B or 8B model.
Can I use the fine-tuned model in Ollama or LM Studio?
Yes. Merge the LoRA adapter into the base model with llamafactory-cli export, then convert the merged model to GGUF with llama.cpp's conversion script, and it loads like any other local model.
This post is part of GitHub Tools, where every repository is cloned and scanned before it is written up. The scan is a snapshot of one commit on one day; the repository has moved on since, so check it before you install.