[Cherry-pick] PRs #1393 #1389 #1268 #1397 #1402 #1411 #1410 #1419 #1408 #1416

[kevalmorabia97]

Cherry-picked PRs

• llm_sparsity: Set warmup_steps 0 instead of 0.0 for transformers 5.x compat #1393
• [specdec_bench] Stratify --num_requests across categories #1389
• Centralize 'trtexec' subprocess runs in ONNX into a single function #1268
• [Quantization] Saturate NVFP4 export FP8 scale cast to avoid NaN #1397
• [NVBug 6102977] Disable use_cache during export dummy forward for custom configs #1402
• [NVbug 6142360] Share fused gate_up amax fallback to keep weight_scale_2 consistent #1411
• [NVBug 6143871] Fix awq_lite uncalibrated branch leaving input_quantizer disabled #1410
• Fix 6115282 #1419
• [6106576] Restore qdq_utils symbols used by edgellm 0.6.1 #1408
• fix(llm_eval): migrate lm_eval_hf.py to lm-eval >= 0.4.10 HarnessCLI #1416

Summary by CodeRabbit

• New Features

  • SPEEDBench now uses stratified sampling for deterministic, balanced dataset selection.
  • Added legacy quantization conversion shims for INT4, MXFP8 and FP4→2DQ workflows.
  • AWQ Lite: fallback handling for uncalibrated per-expert quantizers during export.

• Bug Fixes

  • Clamp FP8 scales in NVFP4 quantization to avoid NaNs.
  • Fixed warmup steps formatting in finetune launch script.

• Improvements

  • LM-Eval integration updated for v0.4.10+ compatibility.
  • TensorRT execution routed through a dedicated trtexec helper.

• Tests

  • Added/regressed tests covering quantization shims, FP8 scale behavior, export fallbacks, and LM eval.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 0787cc16-3ffd-417b-9408-e17966495872

📥 Commits

Reviewing files that changed from the base of the PR and between 3f28248 and 5b16509.

📒 Files selected for processing (1)

• pyproject.toml

✅ Files skipped from review due to trivial changes (1)

• pyproject.toml

---

📝 Walkthrough

Walkthrough

This PR consolidates TensorRT subprocess execution into shared helpers, adds legacy ONNX quantization shims for backwards compatibility, fixes FP8 scale overflow handling, improves quantizer state consistency for fused experts, extends model export compatibility for newer dependency versions, and updates evaluation examples to integrate with lm-eval 0.4.10+.

Changes

TensorRT Subprocess Execution Refactoring

Layer / File(s)	Summary
Shared trtexec Helper modelopt/onnx/quantization/ort_utils.py, modelopt/onnx/quantization/autotune/benchmark.py	Introduces _run_trtexec() with subprocess wrapping, timeout support, and clearer error handling; updates _check_for_trtexec() and replaces direct subprocess usage in benchmark.
TensorRT Constants Cleanup modelopt/torch/_deploy/_runtime/tensorrt/constants.py	Removes TRTEXEC and TRTEXEC_PATH constants no longer needed after subprocess refactoring.
Engine Builder Integration modelopt/torch/_deploy/_runtime/tensorrt/engine_builder.py	Adds _run_trtexec_with_logging() wrapper for hardcoded trtexec invocation; refactors build_engine and profile_engine to build command args without executable path and use the new wrapper.
Test Mocking Updates tests/unit/torch/deploy/_runtime/tensorrt/test_engine_builder.py	Updates test fixture to mock refactored _run_trtexec_with_logging instead of _run_command.

Legacy ONNX Quantization Deprecation Shims

Layer / File(s)	Summary
Helper Documentation modelopt/onnx/export/nvfp4_exporter.py	Adds docstring notes documenting that _cast_fp4 and _replace_fp4qdq_with_2dq are reused by deprecated shims and must maintain stable signatures.
Legacy Conversion Functions modelopt/onnx/quantization/qdq_utils.py	Adds three deprecation-wrapped conversion shims: quantize_weights_to_int4, quantize_weights_to_mxfp8, and fp4qdq_to_2dq; expands quantization helper imports and adds deprecation messaging.
Shim Test Coverage tests/unit/onnx/quantization/test_qdq_utils.py	Adds TestLegacyEdgeLLMShims with end-to-end regression tests verifying deprecation warnings and correct graph/initializer transformations for all three shims.

Quantizer State and FP8 Scale Handling

Layer / File(s)	Summary
FP8 Scale Overflow Prevention modelopt/torch/quantization/qtensor/nvfp4_tensor.py, tests/gpu/torch/quantization/test_nvfp4_static_quantizer_cuda.py	Clamps FP8 scale values to 448.0 before casting to float8_e4m3fn to prevent NaN encoding; adds regression test checking no NaN-encoded bytes and expected saturation.
Fused Expert amax Fallback & AWQ-Lite Postprocessing modelopt/torch/export/moe_utils.py, modelopt/torch/quantization/model_calib.py, tests/unit/torch/quantization/plugins/test_fused_experts.py, tests/unit/torch/quantization/test_calib.py	Adds pre-split amax fallback for fused gate/up quantizers and extends AWQ-Lite disabled-expert postprocess to collapse per-channel amax and restore input_quantizer state; includes regression tests for both behaviors.

Model Export and Dependency Compatibility

Layer / File(s)	Summary
use_cache Handling modelopt/torch/export/unified_export_hf.py	Wraps dummy forward pass in collect_shared_input_modules with _disable_use_cache to support models where use_cache affects probe forward.
Transformers Version Gating modelopt/torch/opt/plugins/transformers.py	Detects Transformers version at runtime and conditionally passes load_config to cached zero3 loader only for versions >= 5.0.

LLM Evaluation Framework Integration

Layer / File(s)	Summary
lm_eval Version and CLI examples/llm_eval/lm_eval_hf.py	Enforces lm_eval >= 0.4.10 (ImportError if older); switches to HarnessCLI/setup_logging; adds _add_modelopt_args parser-extension hook and _inject_modelopt_args_into_model_args; refactors __main__ to call cli.execute(args).
Requirements Update examples/llm_eval/requirements.txt, examples/puzzletron/requirements.txt	Updates llm_eval requirement to lm_eval[api,ifeval]>=0.4.10 and removes lm-eval==0.4.8 from puzzletron example.
Test Suite tests/examples/llm_eval/test_llm_eval.py	Adds test_lm_eval_hf() for HF eval and replaces previous FP8 llama test with Qwen3-based test_qwen3_eval_fp8(); updates imports and tiny-model creation helpers.

Example Scripts and Dataset Utilities

Layer / File(s)	Summary
Parameter Updates examples/llm_sparsity/weight_sparsity/launch_finetune.sh	Changes --warmup_steps from 0.0 to 0.
Dataset Sampling examples/specdec_bench/specdec_bench/datasets/speed.py	Replaces simple prefix truncation with category-stratified round-robin sampling via new _stratified_select() helper when num_samples is specified.
pyproject hf Extra Formatting pyproject.toml	Adjusts whitespace/alignment in the hf optional dependency block without changing dependencies.

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~75 minutes

Suggested reviewers

• cjluo-nv
• sugunav14

---

Important

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

❌ Failed checks (1 error, 1 warning)

Check name	Status	Explanation	Resolution
Security Anti-Patterns	❌ Error	PR contains 5 # nosec comments in modified files, violating SECURITY.md which prohibits this pattern.	Remove # nosec comments from ort_utils.py, engine_builder.py, benchmark.py. Add inline safety justifications. Request @NVIDIA/modelopt-setup-codeowners review with justification in PR description per SECURITY.md.
Docstring Coverage	⚠️ Warning	Docstring coverage is 37.50% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title directly and accurately reflects the core purpose: cherry-picking multiple numbered PRs into a release branch. It is concise, specific, and clearly communicates the main change.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch cherry-picks/release-0.44.0

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[github-actions]

PR Preview Action v1.8.1
🚀 View preview at https://NVIDIA.github.io/Model-Optimizer/pr-preview/pr-1426/
Built to branch gh-pages at 2026-05-11 13:26 UTC. Preview will be ready when the GitHub Pages deployment is complete.

[coderabbitai]

Actionable comments posted: 5

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (2)

tests/unit/torch/deploy/_runtime/tensorrt/test_engine_builder.py (1)

67-67: ⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Match mocked subprocess output type to runtime contract (bytes).

Line 67 returns "success" as str, but _run_trtexec_with_logging returns bytes. Keeping the mock as bytes avoids type-skew in tests.

Proposed fix

-        mock_run.return_value = (0, "success")
+        mock_run.return_value = (0, b"success")

(Then update string assertions in this test file to b"success".)

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@tests/unit/torch/deploy/_runtime/tensorrt/test_engine_builder.py` at line 67,
The test mocks subprocess output as a str but the runtime function
_run_trtexec_with_logging returns bytes; change mock_run.return_value in
test_engine_builder.py from (0, "success") to (0, b"success") and update any
assertions comparing the captured output (e.g., equality checks against
"success") to use b"success" so types match the runtime contract; look for uses
of mock_run, _run_trtexec_with_logging-related assertions, and string
comparisons in that test file and replace them with the bytes literal.

examples/llm_eval/lm_eval_hf.py (1)

193-217: ⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Don't overwrite user --model_args with parser defaults.

Lines 248-259 unconditionally copy every ModelOpt parser field into args.model_args, but several of those fields have defaults on Lines 193, 206, 217, plus the implicit False from Line 231. That means a call like --model_args calib_size=1024,compress=True gets silently rewritten back to 512 / False unless the same values are also passed as top-level flags.

create_from_arg_obj() already supplies these defaults, so the safer pattern is to leave parser defaults unset and only inject keys the user explicitly provided.

Proposed fix

     parser.add_argument(
-        "--calib_size", type=int, help="Calibration size for quantization", default=512
+        "--calib_size", type=int, help="Calibration size for quantization"
     )
@@
     parser.add_argument(
         "--auto_quantize_method",
         type=str,
-        default="gradient",
         choices=["gradient", "kl_div"],
         help=(
             "Method for auto_quantize sensitivity analysis. 'gradient' uses gradient-based method "
@@
     parser.add_argument(
         "--auto_quantize_score_size",
         type=int,
-        default=128,
         help=(
             "Number of samples to use for auto_quantize scoring. Most of auto_quantize time is spent on "
             "sensitivity score estimation, so reducing this speeds it up while only minimally affecting "
@@
     parser.add_argument(
         "--compress",
         action="store_true",
+        default=None,
         help="Compress the model after quantization",
     )
@@
     for key in _MODELOPT_ARG_KEYS:
         if hasattr(args, key):
-            model_args[key] = getattr(args, key)
+            value = getattr(args, key)
+            if value is not None:
+                model_args[key] = value
             delattr(args, key)

Also applies to: 229-232, 241-259

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@examples/llm_eval/lm_eval_hf.py` around lines 193 - 217, The code is
overwriting user-provided args.model_args with parser default values for
ModelOpt fields (e.g., calib_size, auto_quantize_bits, auto_quantize_method,
auto_quantize_score_size and the implicit booleans); instead, only merge keys
that the user explicitly passed at the command line into args.model_args so
create_from_arg_obj() can supply defaults. Modify the merge logic that currently
copies every ModelOpt parser field into args.model_args to: detect which flags
were explicitly set (via argparse's actions or by comparing against
parser.get_default for each option) and only inject those keys into
args.model_args (leave absent fields untouched so create_from_arg_obj() provides
defaults). Ensure this change applies to the same merging blocks that handle
calib_size/auto_quantize_* and any other ModelOpt fields referenced earlier.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@examples/specdec_bench/specdec_bench/datasets/speed.py`:
- Around line 745-773: Add an early guard in _stratified_select to handle
non-positive n: if n <= 0 return dataset.select(range(n)) before checking
"category" presence or building cat_to_rows, so the interleaving code never runs
for n<=0 and the function returns an empty selection deterministically.

In `@modelopt/onnx/quantization/ort_utils.py`:
- Line 66: Remove the inline Bandit suppression by deleting the trailing "#
nosec B603" on the subprocess.run call so the security scan can validate it;
ensure the call remains using the argv list variable `cmd` (as already used) and
keeps the existing parameters (capture_output=True, text=True, timeout=timeout)
or replace with an explicit safer pattern if desired (e.g., subprocess.run(cmd,
capture_output=True, text=True, timeout=timeout, check=True))—locate the return
statement that invokes subprocess.run(cmd, ...) in ort_utils.py and remove only
the "# nosec B603" comment.

In `@modelopt/onnx/quantization/qdq_utils.py`:
- Around line 1264-1272: The current filter builds weight_dq_nodes by selecting
all DequantizeLinear nodes, causing index errors when activation DQ nodes (whose
inputs aren't in initializer_map) are processed; update the selection logic to
only include DequantizeLinear nodes whose input[0] is present in initializer_map
(i.e., backed by an initializer) before iterating. Locate the list comprehension
that defines weight_dq_nodes and change it to check initializer_map membership
of node.input[0] (or validate via get_tensor_producer_nodes/initializer_map) so
only weight-backed DequantizeLinear nodes are processed.
- Around line 1348-1359: The branch that replaces "Constant_output_0" with
"scale" and unconditionally appends a new initializer can create duplicate
initializer names; update the logic in qdq_utils.py around
scale_name/initializer_map/tensor_producer_map so that before calling
graph.initializer.append(...) you check whether an initializer with the target
name already exists (e.g., consult initializer_map or graph.initializer names)
and if it does, reuse that existing initializer and do not append a new one;
alternatively generate a unique name when needed and set node.input[1] to that
unique or existing initializer name to avoid duplicate initializers.

In `@modelopt/torch/_deploy/_runtime/tensorrt/engine_builder.py`:
- Around line 64-70: Remove the `# nosec` suppressions around the subprocess
invocation in engine_builder.py and harden the call instead: keep using
subprocess.run with a list (no shell=True), remove the comments,
validate/sanitize the `args` list before building `cmd = ["trtexec", *args]`
(reject or escape unsafe characters and ensure each entry is a string), verify
the executable exists (e.g., use shutil.which("trtexec") and raise a clear
error), and wrap subprocess.run in try/except to log and rethrow the caught
exception from the subprocess.run invocation so no security bypass comment is
needed; update references to subprocess.run, cmd, and args accordingly.

---

Outside diff comments:
In `@examples/llm_eval/lm_eval_hf.py`:
- Around line 193-217: The code is overwriting user-provided args.model_args
with parser default values for ModelOpt fields (e.g., calib_size,
auto_quantize_bits, auto_quantize_method, auto_quantize_score_size and the
implicit booleans); instead, only merge keys that the user explicitly passed at
the command line into args.model_args so create_from_arg_obj() can supply
defaults. Modify the merge logic that currently copies every ModelOpt parser
field into args.model_args to: detect which flags were explicitly set (via
argparse's actions or by comparing against parser.get_default for each option)
and only inject those keys into args.model_args (leave absent fields untouched
so create_from_arg_obj() provides defaults). Ensure this change applies to the
same merging blocks that handle calib_size/auto_quantize_* and any other
ModelOpt fields referenced earlier.

In `@tests/unit/torch/deploy/_runtime/tensorrt/test_engine_builder.py`:
- Line 67: The test mocks subprocess output as a str but the runtime function
_run_trtexec_with_logging returns bytes; change mock_run.return_value in
test_engine_builder.py from (0, "success") to (0, b"success") and update any
assertions comparing the captured output (e.g., equality checks against
"success") to use b"success" so types match the runtime contract; look for uses
of mock_run, _run_trtexec_with_logging-related assertions, and string
comparisons in that test file and replace them with the bytes literal.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: caa499f6-ea17-46a7-a8dd-11708cb15dd5

📥 Commits

Reviewing files that changed from the base of the PR and between cc06062 and 3f28248.

📒 Files selected for processing (22)

• examples/llm_eval/lm_eval_hf.py
• examples/llm_eval/requirements.txt
• examples/llm_sparsity/weight_sparsity/launch_finetune.sh
• examples/puzzletron/requirements.txt
• examples/specdec_bench/specdec_bench/datasets/speed.py
• modelopt/onnx/export/nvfp4_exporter.py
• modelopt/onnx/quantization/autotune/benchmark.py
• modelopt/onnx/quantization/ort_utils.py
• modelopt/onnx/quantization/qdq_utils.py
• modelopt/torch/_deploy/_runtime/tensorrt/constants.py
• modelopt/torch/_deploy/_runtime/tensorrt/engine_builder.py
• modelopt/torch/export/moe_utils.py
• modelopt/torch/export/unified_export_hf.py
• modelopt/torch/opt/plugins/transformers.py
• modelopt/torch/quantization/model_calib.py
• modelopt/torch/quantization/qtensor/nvfp4_tensor.py
• tests/examples/llm_eval/test_llm_eval.py
• tests/gpu/torch/quantization/test_nvfp4_static_quantizer_cuda.py
• tests/unit/onnx/quantization/test_qdq_utils.py
• tests/unit/torch/deploy/_runtime/tensorrt/test_engine_builder.py
• tests/unit/torch/quantization/plugins/test_fused_experts.py
• tests/unit/torch/quantization/test_calib.py

💤 Files with no reviewable changes (2)

• examples/puzzletron/requirements.txt
• modelopt/torch/_deploy/_runtime/tensorrt/constants.py

[coderabbitai]

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Guard non-positive sample counts before interleaving.

When n <= 0, this method can still return non-empty results for multi-category datasets (because the round-robin loop appends before any len(interleaved) == n check can succeed). That makes num_samples=0 behave incorrectly.

Suggested fix

 `@staticmethod`
 def _stratified_select(dataset: "Dataset", n: int) -> "Dataset":
+    if n <= 0:
+        return dataset.select([])
+
     if "category" not in dataset.column_names:
         return dataset.select(range(n))

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@examples/specdec_bench/specdec_bench/datasets/speed.py` around lines 745 -
773, Add an early guard in _stratified_select to handle non-positive n: if n <=
0 return dataset.select(range(n)) before checking "category" presence or
building cat_to_rows, so the interleaving code never runs for n<=0 and the
function returns an empty selection deterministically.

[coderabbitai]

⚠️ Potential issue | 🔴 Critical | ⚡ Quick win

Remove the inline Bandit suppression.

This subprocess call is already using an argv list, so the new # nosec B603 is just a policy violation on a security-sensitive path and should not be merged as-is.

Suggested fix

-        return subprocess.run(cmd, capture_output=True, text=True, timeout=timeout)  # nosec B603
+        return subprocess.run(cmd, capture_output=True, text=True, timeout=timeout)

As per coding guidelines, "Bandit security checks must pass without exceptions. # nosec comments are not allowed as a bypass for security checks."

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	return subprocess.run(cmd, capture_output=True, text=True, timeout=timeout) # nosec B603
	return subprocess.run(cmd, capture_output=True, text=True, timeout=timeout)

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@modelopt/onnx/quantization/ort_utils.py` at line 66, Remove the inline Bandit
suppression by deleting the trailing "# nosec B603" on the subprocess.run call
so the security scan can validate it; ensure the call remains using the argv
list variable `cmd` (as already used) and keeps the existing parameters
(capture_output=True, text=True, timeout=timeout) or replace with an explicit
safer pattern if desired (e.g., subprocess.run(cmd, capture_output=True,
text=True, timeout=timeout, check=True))—locate the return statement that
invokes subprocess.run(cmd, ...) in ort_utils.py and remove only the "# nosec
B603" comment.

[coderabbitai]

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Filter this shim to weight-backed DequantizeLinear nodes only.

Right now weight_dq_nodes includes every DequantizeLinear in the graph. The first activation DQ will fail at initializer_map[weight_name] because its input is not an initializer. That makes the compatibility shim unusable on mixed QDQ graphs even though only weight DQs should be rewritten here.

Suggested fix

-    weight_dq_nodes = [node for node in graph.node if node.op_type == "DequantizeLinear"]
+    weight_dq_nodes = [
+        node
+        for node in graph.node
+        if node.op_type == "DequantizeLinear"
+        and node.input
+        and node.input[0] in initializer_map
+    ]

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@modelopt/onnx/quantization/qdq_utils.py` around lines 1264 - 1272, The
current filter builds weight_dq_nodes by selecting all DequantizeLinear nodes,
causing index errors when activation DQ nodes (whose inputs aren't in
initializer_map) are processed; update the selection logic to only include
DequantizeLinear nodes whose input[0] is present in initializer_map (i.e.,
backed by an initializer) before iterating. Locate the list comprehension that
defines weight_dq_nodes and change it to check initializer_map membership of
node.input[0] (or validate via get_tensor_producer_nodes/initializer_map) so
only weight-backed DequantizeLinear nodes are processed.

[coderabbitai]

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Don't append a second initializer with the same replacement name.

In the constant-scale path, Constant_output_0 is renamed to scale and then always appended as a new initializer. The fixture added in this PR already carries an unused scale initializer, so this branch produces duplicate initializer names, which makes the ONNX graph ambiguous/invalid.

Suggested fix

-            scale_tensor = onnx.numpy_helper.from_array(scale, scale_name)
-            graph.initializer.append(scale_tensor)
-            node.input[1] = scale_name
+            scale_tensor = onnx.numpy_helper.from_array(scale, scale_name)
+            if scale_name in initializer_map:
+                initializer_map[scale_name].CopyFrom(scale_tensor)
+            else:
+                graph.initializer.append(scale_tensor)
+                initializer_map[scale_name] = graph.initializer[-1]
+            node.input[1] = scale_name

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@modelopt/onnx/quantization/qdq_utils.py` around lines 1348 - 1359, The branch
that replaces "Constant_output_0" with "scale" and unconditionally appends a new
initializer can create duplicate initializer names; update the logic in
qdq_utils.py around scale_name/initializer_map/tensor_producer_map so that
before calling graph.initializer.append(...) you check whether an initializer
with the target name already exists (e.g., consult initializer_map or
graph.initializer names) and if it does, reuse that existing initializer and do
not append a new one; alternatively generate a unique name when needed and set
node.input[1] to that unique or existing initializer name to avoid duplicate
initializers.

[coderabbitai]

⚠️ Potential issue | 🔴 Critical | ⚡ Quick win

Remove # nosec suppressions in subprocess invocation.

Line 64 and Line 69 use # nosec bypasses. This violates repo security policy and must be removed (or escalated with explicit approved exception flow in PR metadata).

Proposed fix

-    import subprocess  # nosec
+    import subprocess
@@
-        result = subprocess.run(  # nosec B603 - cmd[0] is hardcoded "trtexec"
+        result = subprocess.run(
             cmd,
             stdout=subprocess.PIPE,
             stderr=subprocess.STDOUT,
             cwd=str(cwd) if cwd else None,
             timeout=3600,
         )

As per coding guidelines: "Any use of '# nosec' comments to bypass Bandit security checks is not allowed."

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@modelopt/torch/_deploy/_runtime/tensorrt/engine_builder.py` around lines 64 -
70, Remove the `# nosec` suppressions around the subprocess invocation in
engine_builder.py and harden the call instead: keep using subprocess.run with a
list (no shell=True), remove the comments, validate/sanitize the `args` list
before building `cmd = ["trtexec", *args]` (reject or escape unsafe characters
and ensure each entry is a string), verify the executable exists (e.g., use
shutil.which("trtexec") and raise a clear error), and wrap subprocess.run in
try/except to log and rethrow the caught exception from the subprocess.run
invocation so no security bypass comment is needed; update references to
subprocess.run, cmd, and args accordingly.

[codecov]

Codecov Report

❌ Patch coverage is 83.84615% with 42 lines in your changes missing coverage. Please review.
✅ Project coverage is 76.69%. Comparing base (cc06062) to head (5b16509).

Files with missing lines	Patch %	Lines
modelopt/onnx/quantization/qdq_utils.py	86.12%	29 Missing ⚠️
.../torch/_deploy/_runtime/tensorrt/engine_builder.py	66.66%	6 Missing ⚠️
modelopt/torch/quantization/model_calib.py	37.50%	5 Missing ⚠️
modelopt/onnx/quantization/ort_utils.py	85.71%	1 Missing ⚠️
modelopt/torch/opt/plugins/transformers.py	85.71%	1 Missing ⚠️

Additional details and impacted files

@@                Coverage Diff                 @@
##           release/0.44.0    #1426      +/-   ##
==================================================
- Coverage           77.19%   76.69%   -0.51%     
==================================================
  Files                 467      466       -1     
  Lines               50581    50778     +197     
==================================================
- Hits                39048    38944     -104     
- Misses              11533    11834     +301     

Flag	Coverage Δ
examples	41.27% <10.76%> (-0.32%)	⬇️
gpu	59.19% <10.38%> (-0.83%)	⬇️
regression	14.63% <1.65%> (-0.26%)	⬇️
unit	52.79% <75.76%> (+0.13%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.