Cisco Foundation AI Releases Antares: 350M and 1B Open-Weight Models That Localize Known Vulnerabilities Inside Real Codebases

Cisco Foundation AI has released Antares, a family of security small language models (SLMs) built for one narrow security task. The task is vulnerability localization. Given a vulnerability description and a repository, find the files containing the flaw.

Two models are open-weight and available now on Hugging Face, Antares-350M and Antares-1B. Both are Apache 2.0. Cisco team also shipped the Vulnerability Localization Benchmark (VLoc Bench), a 500-task agentic evaluation, under the same license.

The main result is not a new state of the art. It is that a 1B model reaches 0.209 File F1. GPT-5.5 reaches 0.229, and a 753B open-weight model reaches 0.186.

The problem Antares is scoped to

Software security depends on connecting external vulnerability knowledge to internal source code. That knowledge lives in public databases, advisories, and Common Weakness Enumerations. The code lives in repositories that are large, modular, and dependency-rich.

Connecting the two is expensive. Devs search unfamiliar code, follow naming conventions, inspect call paths, and compare candidate files. Cisco’s framing is that this first triage step is where the cost concentrates.

Antares does not replace the application security toolchain. Cisco is explicit about this. Dev teams still need dependency scanning, secret scanning, dynamic testing, container checks, threat modeling, and expert review.

Understanding the Models

Antares consists of three decoder-only transformers at 350M, 1B, and 3B parameters. All three initialize from IBM Granite 4.0 checkpoints. They share a tokenizer and architecture: grouped-query attention, SwiGLU MLPs, RMSNorm, RoPE, and shared input/output embeddings.

How the Agent Loop Works

Antares is not evaluated as a standalone sequence model. It runs inside a constrained loop with three tools.

The model receives a CWE category description and nothing else. No advisory text, no file hints, no severity details. It then issues read-only terminal commands against a Docker sandbox with networking disabled. Command output is truncated to 2,000 characters before entering the transcript.

The budget is 15 terminal calls per task. The model terminates by calling submit_vulnerable_files with a ranked list, or submit_no_vulnerability_found. The submission itself does not count against the budget.

Output is a ranked list of file paths plus the exploration trace that produced it.

What VLoc Bench measures

VLoc Bench draws 500 tasks from 290 unique real-world repositories. Sources are public GitHub Security Advisories across six ecosystems: npm, pip, Maven, Go, Rust, and Composer. It covers 147 unique CWE categories, and 78% of entries carry assigned CVE identifiers.

Ground truth is derived from the security patch. Files modified in the fix are labels, with tests, docs, and configuration excluded.

The benchmark has two phases:

• Phase A gives the model the vulnerable snapshot and scores File F1.
• Phase B gives the patched snapshot and scores True Negative Rate, testing whether the model raises a false alarm on fixed code.

Results: task-specific training beats parameter scale

The pattern in the data is a capability cliff, not a scaling curve.

Antares-3B reaches 0.223 File F1, just under GPT-5.5 (xhigh) at 0.229. Antares-1B reaches 0.209, above GLM-5.2 at 753B parameters, which scores 0.186. Antares-350M reaches 0.135, above Gemma-4-31B at 0.101 and Gemini 2.5 Flash at 0.102.

Antares-1B also records the highest recall of any evaluated system at 0.224.

Static analysis tools were run under the same evaluation. Semgrep scores 0.086 File F1, CodeQL scores 0.023, and Horusec scores 0.020. Cisco’s reading is that rule-based scanners recover some vulnerable files but cannot adaptively inspect repository context.

Where the capability comes from

The untrained Granite 4.0 base checkpoints score 0.001, 0.000, and 0.000 File F1 under the identical protocol. They have tool-calling ability and still produce degenerate output inside an agentic loop.

Supervised fine-tuning does the heavy lifting. It lifts the three scales to 0.108, 0.188, and 0.198. The SFT corpus is 71.5% cybersecurity reasoning, 15.4% code search trajectories, and 13.1% deep research and general reasoning. All reasoning traces come from a single teacher, GPT-OSS-120B, to avoid cross-teacher distribution shift.

GRPO then adds 11% to 25%, with the largest relative gain at 350M. Rewards are verifiable and computed programmatically from trajectory text, with no learned reward model. Components cover localization quality, submission behavior, tool-use compliance, exploration, and malformed-output penalties.

The variance effect may matter more than the mean. GRPO cuts run-to-run standard deviation by 42% to 65%. One GRPO evaluation run is a more reliable estimate than one SFT run.

There is also a scale-dependent split in learned strategy. After GRPO, the 350M and 1B models use 87% to 89% search commands and submit more files. The 3B model settles at 52% search and 37% read, and submits fewer files at higher precision. The reward never prescribed either policy.

Deployment

Key Takeaways

• Antares-1B hits 0.209 File F1 on VLoc Bench, above GLM-5.2 at 753B parameters and Gemini 3 Pro.
• The Granite 4.0 base checkpoints score ~0.000 under the same protocol, so post-training supplies essentially all the capability.
• GRPO adds 11-25% File F1 and cuts run-to-run variance 42-65%, which matters more for repeatable CI scans.
• A full 500-task sweep costs under $1 on one H100, against $12.50 for GLM-5.2 and $141 for GPT-5.5.
• The strongest variant, Antares-3B, is not released, and Antares has no published Phase B false-alarm numbers.

Check out the Models on Hugging Face, Benchmark, GitHub Repo and Mentioned Technical Report.