Cisco Basis AI releases Antares: 350M and 1B open weight fashions to establish identified vulnerabilities in real-world codebases

Cisco Foundation AI launched Antaresa household of safety small language fashions (SLMs) constructed for one slim safety process. The problem is localization of vulnerabilities. Discover information containing flaws given the vulnerability description and repository.

Each fashions are open weight and out there at Hugging Face. Antares-350M and Antares-1B. Each are Apache 2.0. The Cisco staff additionally Vulnerability localization benchmark (VLoc Bench), agent analysis of 500 duties beneath the identical license.

The primary consequence shouldn’t be new cutting-edge know-how. The 1B mannequin implies that file F1 reaches 0.209. GPT-5.5 reaches 0.229 and 753B open weight mannequin reaches 0.186.

The scope of the Antares downside is:

Software program safety depends on linking information of exterior vulnerabilities to inner supply code. That information could be accessed via public databases, suggestions, List of common weaknesses. Code is saved in giant, modular, dependency-rich repositories.

Connecting the 2 is dear. Builders seek for unfamiliar code, observe naming conventions, examine name paths, and examine candidate information. In Cisco’s framework, this primary triage step is cost-intensive.

Antares shouldn’t be meant to interchange your utility safety toolchain. Cisco is evident about this. Growth groups nonetheless require dependency scanning, secret scanning, dynamic testing, container checking, menace modeling, and skilled opinions.

perceive the mannequin

Antares consists of three decoder-specific transformers with 350M, 1B, and 3B parameters. All three are initialized from IBM Granite 4.0 Checkpoint. They share structure with tokenizers comparable to Grouped Question Consideration, SwiGLU MLP, RMSNorm, RoPE, and Shared I/O Embedding.

How agent loops work

Antares shouldn’t be evaluated as a standalone sequencing mannequin. It’s executed in a constrained loop utilizing three instruments.

The mannequin receives the CWE class description, however nothing else. No advisory textual content, file hints, or severity particulars. Subsequent, problem read-only terminal instructions to the Docker sandbox with networking disabled. Command output is truncated to 2,000 characters earlier than inputting the transcript.

The funds is 15 terminal calls per process. The mannequin is terminated by calling submit_vulnerable_files Use a ranked listing or submit_no_vulnerability_found. The submission itself doesn’t rely towards the funds.

The output is a ranked listing of file paths and the exploration traces that generated them.

What the VLoc Bench Measures

VLoc Bench extracts 500 duties from 290 distinctive real-world repositories. supply is public GitHub Security Advisory Throughout six ecosystems: npm, pip, Maven, Go, Rust, and Composer. It covers 147 distinctive CWE classes, with 78% of entries containing an assigned CVE identifier.

Floor fact comes from safety patches. The information modified within the repair are labels, excluding assessments, documentation, and configuration.

The benchmark has two phases.

• Section A Give the mannequin a susceptible snapshot and rating file F1.
• Section B Present a patched snapshot and rating the true unfavourable charge to check whether or not the mannequin points false warnings for the modified code.

Consequence: Process-specific coaching outperforms parameter scale

The sample within the knowledge is a functionality cliff, not a scaling curve.

Antares-3B reaches 0.223 for file F1, barely beneath 0.229 for GPT-5.5 (xhigh). Antares 1B reaches 0.209 or increased GLM-5.2 For the 753B parameter, the rating is 0.186. Antares-350M reaches 0.135, beating Gemma-4-31B’s 0.101 and Gemini 2.5 Flash’s 0.102.

Antares-1B additionally has the very best recall charge of 0.224 among the many evaluated techniques.

Static evaluation instruments had been run beneath the identical analysis. sem grep Rating 0.086 File F1, Code QL He has a rating of 0.023 and Holcek has a rating of 0.020. In Cisco’s view, rule-based scanners get well some susceptible information, however can not adaptively examine the repository context.

the place does means come from?

The untrained Granite 4.0 base checkpoints had scores of 0.001, 0.000, and 0.000 for file F1 with the identical protocol. These have device invocation performance and produce degenerate output throughout the agent loop.

Supervised fine-tuning does the heavy lifting. Increase the three scales to 0.108, 0.188, and 0.198. The SFT corpus is 71.5% cybersecurity inference, 15.4% code search trajectories, and 13.1% deep investigation and common inference. All inference traces are obtained from a single instructor GPT-OSS-120B to keep away from distribution shifts between academics.

GRPO Then 11% to 25% is added for a most relative revenue of 350M. Rewards are verifiable and calculated programmatically from trajectory textual content with out utilizing a realized reward mannequin. Elements embody localization high quality, sending habits, device utilization compliance, exploration, and malformed output penalties.

Diversification results could also be extra essential than the typical. GRPO reduces the usual deviation per run by 42% to 65%. One GRPO analysis run is a extra dependable estimate than one SFT run.

There may be additionally a scale-dependent partitioning of the realized methods. After GRPO, 350M and 1B fashions use 87% to 89% extra search instructions and ship extra information. The 3B mannequin settles at 52% for searches and 37% for reads, sending fewer information with much less accuracy. Compensation didn’t dictate both coverage.

introduction

Essential factors

• Antares-1B reaches 0.209 file F1 on VLoc bench and outperforms GLM-5.2 with parameters 753B and Gemini 3 Professional.
• Granite 4.0’s base checkpoint rating is ~0.000 beneath the identical protocol, so post-training basically offers all performance.
• GRPO provides 11-25% to file F1 and reduces run-to-run variance by 42-65%. That is extra essential for repeatable CI scans.
• An entire sweep of 500 duties prices lower than $1 for one H100. This compares to $12.50 for GLM-5.2 and $141 for GPT-5.5.
• Essentially the most highly effective variant, Antares-3B, has not been launched, and Antares doesn’t have a broadcast variety of false alarms for Section B.

Please examine Models with hugging faces, benchmark, GitHub repository was talked about technical report.