Cisco Foundation AI has launched Antares, a household of safety small language fashions (SLMs) constructed for one slender safety activity. The duty is vulnerability localization. Given a vulnerability description and a repository, discover the information containing the flaw.
Two fashions are open-weight and out there now on Hugging Face, Antares-350M and Antares-1B. Each are Apache 2.0. Cisco staff additionally shipped the Vulnerability Localization Benchmark (VLoc Bench), a 500-task agentic analysis, below the identical license.
The primary end result is just not a brand new state-of-the-art. It’s {that a} 1B mannequin reaches 0.209 File F1. GPT-5.5 reaches 0.229, and a 753B open-weight mannequin reaches 0.186.
The issue Antares is scoped to
Software program safety will depend on connecting exterior vulnerability information to inside supply code. That information lives in public databases, advisories, and Common Weakness Enumerations. The code lives in repositories which might be massive, modular, and dependency-rich.
Connecting the 2 is pricey. Devs search unfamiliar code, observe naming conventions, examine name paths, and examine candidate information. Cisco’s framing is that this primary triage step is the place the associated fee concentrates.
Antares doesn’t substitute the applying safety toolchain. Cisco is express about this. Dev groups nonetheless want dependency scanning, secret scanning, dynamic testing, container checks, menace modeling, and knowledgeable evaluate.
Understanding the Fashions
Antares consists of three decoder-only transformers at 350M, 1B, and 3B parameters. All three initialize from IBM Granite 4.0 checkpoints. They share a tokenizer and structure: grouped-query consideration, SwiGLU MLPs, RMSNorm, RoPE, and shared enter/output embeddings.
| Mannequin | Params | Base checkpoint | Context | Layers / hidden / KV heads | Standing |
|---|---|---|---|---|---|
| Antares-350M | 350M | Granite 4.0 350M | 32K | 28 / 1024 / 4 | Open weights |
| Antares-1B | 1.6B | Granite 4.0 1B | 128K | 40 / 2048 / 4 | Open weights |
| Antares-3B | 3B | Granite 4.0 Micro | 128K | Not printed | Not launched |
How the Agent Loop Works
Antares is just not evaluated as a standalone sequence mannequin. It runs inside a constrained loop with three instruments.
The mannequin receives a CWE class description and nothing else. No advisory textual content, no file hints, no severity particulars. It then points read-only terminal instructions towards a Docker sandbox with networking disabled. Command output is truncated to 2,000 characters earlier than getting into the transcript.
The finances is 15 terminal calls per activity. The mannequin terminates by calling submit_vulnerable_files with a ranked listing, or submit_no_vulnerability_found. The submission itself doesn’t depend towards the finances.
Output is a ranked listing of file paths plus the exploration hint that produced it.
What VLoc Bench measures
VLoc Bench attracts 500 duties from 290 distinctive real-world repositories. Sources are public GitHub Security Advisories throughout six ecosystems: npm, pip, Maven, Go, Rust, and Composer. It covers 147 distinctive CWE classes, and 78% of entries carry assigned CVE identifiers.
Floor reality is derived from the safety patch. Information modified within the repair are labels, with exams, docs, and configuration excluded.
The benchmark has two phases:
- Section A offers the mannequin the susceptible snapshot and scores File F1.
- Section B offers the patched snapshot and scores True Detrimental Charge, testing whether or not the mannequin raises a false alarm on mounted code.
Outcomes: task-specific coaching beats parameter scale
The sample within the information is a functionality cliff, not a scaling curve.
Antares-3B reaches 0.223 File F1, just below GPT-5.5 (xhigh) at 0.229. Antares-1B reaches 0.209, above GLM-5.2 at 753B parameters, which scores 0.186. Antares-350M reaches 0.135, above Gemma-4-31B at 0.101 and Gemini 2.5 Flash at 0.102.
Antares-1B additionally information the very best recall of any evaluated system at 0.224.
Static evaluation instruments had been run below the identical analysis. Semgrep scores 0.086 File F1, CodeQL scores 0.023, and Horusec scores 0.020. Cisco’s studying is that rule-based scanners get better some susceptible information however can not adaptively examine repository context.
The place the aptitude comes from
The untrained Granite 4.0 base checkpoints rating 0.001, 0.000, and 0.000 File F1 below the similar protocol. They’ve tool-calling potential and nonetheless produce degenerate output inside an agentic loop.
Supervised fine-tuning does the heavy lifting. It lifts the three scales to 0.108, 0.188, and 0.198. The SFT corpus is 71.5% cybersecurity reasoning, 15.4% code search trajectories, and 13.1% deep analysis and normal reasoning. All reasoning traces come from a single trainer, GPT-OSS-120B, to keep away from cross-teacher distribution shift.
GRPO then provides 11% to 25%, with the most important relative achieve at 350M. Rewards are verifiable and computed programmatically from trajectory textual content, with no realized reward mannequin. Parts cowl localization high quality, submission habits, tool-use compliance, exploration, and malformed-output penalties.
The variance impact could matter greater than the imply. GRPO cuts run-to-run customary deviation by 42% to 65%. One GRPO analysis run is a extra dependable estimate than one SFT run.
There’s additionally a scale-dependent cut up in realized technique. After GRPO, the 350M and 1B fashions use 87% to 89% search instructions and submit extra information. The 3B mannequin settles at 52% search and 37% learn, and submits fewer information at greater precision. The reward by no means prescribed both coverage.
Deployment
Key Takeaways
- Antares-1B hits 0.209 File F1 on VLoc Bench, above GLM-5.2 at 753B parameters and Gemini 3 Professional.
- The Granite 4.0 base checkpoints rating ~0.000 below the identical protocol, so post-training provides basically all the aptitude.
- GRPO provides 11-25% File F1 and cuts run-to-run variance 42-65%, which issues extra for repeatable CI scans.
- A full 500-task sweep prices below $1 on one H100, towards $12.50 for GLM-5.2 and $141 for GPT-5.5.
- The strongest variant, Antares-3B, is just not launched, and Antares has no printed Section B false-alarm numbers.
Take a look at the Models on Hugging Face, Benchmark, GitHub Repo and Talked about Technical Report.
