Cisco Foundation AI Releases Antares: 350M and 1B Open-Weight Models That Localize Known Vulnerabilities Inside Real Codebases
Cisco Foundation AI has launched Antares, a household of safety small language fashions (SLMs) constructed for one slim safety activity. The activity is vulnerability localization. Given a vulnerability description and a repository, discover the recordsdata containing the flaw.
Two fashions are open-weight and accessible now on Hugging Face, Antares-350M and Antares-1B. Both are Apache 2.0. Cisco staff additionally shipped the Vulnerability Localization Benchmark (VLoc Bench), a 500-task agentic analysis, underneath the identical license.
The principal end result is just not a brand new state-of-the-art. It is {that a} 1B mannequin reaches 0.209 File F1. GPT-5.5 reaches 0.229, and a 753B open-weight mannequin reaches 0.186.
The downside Antares is scoped to
Software safety will depend on connecting exterior vulnerability information to inside supply code. That information lives in public databases, advisories, and Common Weakness Enumerations. The code lives in repositories which are giant, modular, and dependency-rich.
Connecting the 2 is pricey. Devs search unfamiliar code, comply with naming conventions, examine name paths, and evaluate candidate recordsdata. Cisco’s framing is that this primary triage step is the place the associated fee concentrates.
Antares doesn’t exchange the appliance safety toolchain. Cisco is specific about this. Dev groups nonetheless want dependency scanning, secret scanning, dynamic testing, container checks, menace modeling, and professional evaluate.
Understanding the Models
Antares consists of three decoder-only transformers at 350M, 1B, and 3B parameters. All three initialize from IBM Granite 4.0 checkpoints. They share a tokenizer and structure: grouped-query consideration, SwiGLU MLPs, RMSNorm, RoPE, and shared enter/output embeddings.
| Model | Params | Base checkpoint | Context | Layers / hidden / KV heads | Status |
|---|---|---|---|---|---|
| Antares-350M | 350M | Granite 4.0 350M | 32K | 28 / 1024 / 4 | Open weights |
| Antares-1B | 1.6B | Granite 4.0 1B | 128K | 40 / 2048 / 4 | Open weights |
| Antares-3B | 3B | Granite 4.0 Micro | 128K | Not printed | Not launched |
How the Agent Loop Works
Antares is just not evaluated as a standalone sequence mannequin. It runs inside a constrained loop with three instruments.
The mannequin receives a CWE class description and nothing else. No advisory textual content, no file hints, no severity particulars. It then points read-only terminal instructions towards a Docker sandbox with networking disabled. Command output is truncated to 2,000 characters earlier than coming into the transcript.
The finances is 15 terminal calls per activity. The mannequin terminates by calling submit_vulnerable_files with a ranked listing, or submit_no_vulnerability_found. The submission itself doesn’t rely towards the finances.
Output is a ranked listing of file paths plus the exploration hint that produced it.
What VLoc Bench measures
VLoc Bench attracts 500 duties from 290 distinctive real-world repositories. Sources are public GitHub Security Advisories throughout six ecosystems: npm, pip, Maven, Go, Rust, and Composer. It covers 147 distinctive CWE classes, and 78% of entries carry assigned CVE identifiers.
Ground fact is derived from the safety patch. Files modified within the repair are labels, with exams, docs, and configuration excluded.
The benchmark has two phases:
- Phase A offers the mannequin the susceptible snapshot and scores File F1.
- Phase B offers the patched snapshot and scores True Negative Rate, testing whether or not the mannequin raises a false alarm on mounted code.
Results: task-specific coaching beats parameter scale
The sample within the information is a functionality cliff, not a scaling curve.
Antares-3B reaches 0.223 File F1, slightly below GPT-5.5 (xhigh) at 0.229. Antares-1B reaches 0.209, above GLM-5.2 at 753B parameters, which scores 0.186. Antares-350M reaches 0.135, above Gemma-4-31B at 0.101 and Gemini 2.5 Flash at 0.102.
Antares-1B additionally information the very best recall of any evaluated system at 0.224.
Static evaluation instruments have been run underneath the identical analysis. Semgrep scores 0.086 File F1, CodeQL scores 0.023, and Horusec scores 0.020. Cisco's studying is that rule-based scanners recuperate some susceptible recordsdata however can't adaptively examine repository context.
Where the potential comes from
The untrained Granite 4.0 base checkpoints rating 0.001, 0.000, and 0.000 File F1 underneath the similar protocol. They have tool-calling potential and nonetheless produce degenerate output inside an agentic loop.
Supervised fine-tuning does the heavy lifting. It lifts the three scales to 0.108, 0.188, and 0.198. The SFT corpus is 71.5% cybersecurity reasoning, 15.4% code search trajectories, and 13.1% deep analysis and basic reasoning. All reasoning traces come from a single instructor, GPT-OSS-120B, to keep away from cross-teacher distribution shift.
GRPO then provides 11% to 25%, with the biggest relative acquire at 350M. Rewards are verifiable and computed programmatically from trajectory textual content, with no discovered reward mannequin. Components cowl localization high quality, submission conduct, tool-use compliance, exploration, and malformed-output penalties.
The variance impact might matter greater than the imply. GRPO cuts run-to-run commonplace deviation by 42% to 65%. One GRPO analysis run is a extra dependable estimate than one SFT run.
There can be a scale-dependent break up in discovered technique. After GRPO, the 350M and 1B fashions use 87% to 89% search instructions and submit extra recordsdata. The 3B mannequin settles at 52% search and 37% learn, and submits fewer recordsdata at larger precision. The reward by no means prescribed both coverage.
Deployment
Key Takeaways
- Antares-1B hits 0.209 File F1 on VLoc Bench, above GLM-5.2 at 753B parameters and Gemini 3 Pro.
- The Granite 4.0 base checkpoints rating ~0.000 underneath the identical protocol, so post-training provides primarily all the potential.
- GRPO provides 11-25% File F1 and cuts run-to-run variance 42-65%, which issues extra for repeatable CI scans.
- A full 500-task sweep prices underneath $1 on one H100, towards $12.50 for GLM-5.2 and $141 for GPT-5.5.
- The strongest variant, Antares-3B, is just not launched, and Antares has no printed Phase B false-alarm numbers.
Check out the Models on Hugging Face, Benchmark, GitHub Repo and Mentioned Technical Report.
The submit Cisco Foundation AI Releases Antares: 350M and 1B Open-Weight Models That Localize Known Vulnerabilities Inside Real Codebases appeared first on MarkTechPost.
