Antares: Foundation Models for
Agentic Vulnerability Localization

Foundation AI Team

Cisco

Abstract

Compact Models, Frontier Performance

Antares is a family of compact language models (350M, 1B, 3B) purpose-built for agentic vulnerability localization. Given a CWE description and terminal access to a repository, Antares identifies vulnerable source files through multi-turn reasoning and tool use.

Built on Granite 4.0 and trained via SFT + GRPO with verifiable rewards, Antares-3B approaches GPT-5.5 on the 500-entry Vulnerability Localization Benchmark while outperforming all open-weight models including systems 250x larger. The full evaluation completes in ~15 minutes on a single H100 at less than $0.002 per task.

The Antares Family

Three Scales, One Pipeline

All Antares variants share a common architecture and training pipeline, differing only in parameter count. Each operates as an autonomous security agent: receiving a CWE description, exploring a repository via terminal commands, and submitting its findings.

Antares-350M
350M
Base: Granite 4.0 350M
Context: 32K tokens
Target: Mobile / IoT / Edge
File F1: 0.135
Antares-1B
1B
Base: Granite 4.0 1B
Context: 128K tokens
Target: Laptop / Workstation
File F1: 0.209 (highest recall: 0.224)
Antares-3B
3B
Base: Granite 4.0 Micro
Context: 128K tokens
Target: Any single GPU
File F1: 0.223

Why small models? Security tools must run close to code. Local inference avoids supply-chain risk from sending source to third-party APIs. Multi-turn agent loops amplify latency and cost linearly with turns. Antares-3B generates >1,500 tokens/sec on a single GPU, completing the full 500-task sweep in ~15 minutes.

Results

Approaching Frontier at 3B Parameters

Evaluated on the Vulnerability Localization Benchmark: 500 real-world entries across 6 ecosystems and 147 CWE categories. All scores are means over 3 independent runs. Temperature 0.3.

Antares vs Frontier APIs
Antares vs Open-Weight Models
Antares vs Static Analysis Tools

Capability cliff: A clear separation exists between the top cluster (0.186-0.229 File F1) and all remaining systems. Parameter count alone does not predict performance: Llama-3.3-70B scores 0.012, Qwen3.5-122B-A10B scores 0.091, while Antares-3B (3B) scores 0.223.

Efficiency

172x Cheaper Than GPT-5.5

Antares completes the full 500-task evaluation in ~15 minutes on a single H100 at $0.82 total ($0.00164/task). This enables continuous-integration deployment at negligible marginal cost.

Antares-3B
Cost
0
$0.82
Time
0
15 min
CHEAP & FAST
GLM-5.2
Cost
753B 0
$12.50
Time
753B 0
50 min
SLOW
GPT-5.5 (xhigh)
Cost
???T HEAVY 0
$141
Time
???T HEAVY 0
5 hrs
SLOW & EXPENSIVE
Training Pipeline

From Base Model to Security Agent

Two-stage post-training transforms a general-purpose Granite checkpoint into a domain-specialized vulnerability localization agent.

Base
Granite 4.0
F1: 0.000
Stage 1
SFT
Terminal + Security
Stage 2
GRPO
Verifiable Rewards
Output
Antares
F1: 0.223

Stage 1: Supervised Fine-Tuning

SFT corpus: cybersecurity reasoning (71.5%), deep research (13.1%), code search trajectories (15.4%). Semantic conditioning on intermediate-layer representations yields 5.1x improvement at 350M scale.

Stage 2: GRPO

Multi-component verifiable rewards in isolated Docker workspaces. Reward: File F1, submission behavior, tool compliance, exploration incentive. Infrastructure: veRL + vLLM, 8xH100, FSDP.

Training Progression: Base → SFT → GRPO
Analysis

What GRPO Changes

GRPO reduces run-to-run variance by 42-65% and reshapes agent behavior in scale-dependent ways. Smaller models adopt aggressive search-flooding strategies; the 3B model learns balanced search-and-verify patterns.

Variance Reduction (Std Dev: SFT vs GRPO)
Command Strategy (% of tool calls)
350M Strategy
89% grep
Search flooding. Maximizes coverage with minimal per-file reasoning.
1B Strategy
87% grep
Similar flooding with improved pattern selection and highest recall.
3B Strategy
52% + 37%
Balanced search-verify-refine. Confirms findings before submission.

Emergent specialization: These strategy differences are not explicitly programmed. GRPO discovers scale-appropriate strategies: models with limited reasoning capacity maximize information throughput via grep flooding, while the 3B model can afford to read and verify before committing.

Transfer

Zero-Shot Generalization

Antares transfers to benchmarks it was never trained on, demonstrating that vulnerability localization training produces general agentic capabilities.

CodeScout SWE-Bench Verified — File F1 (no SWE-bench training data)
BFCL v3 — Multi-Turn Tool Calling Score

No task-specific post-training: Antares receives zero CodeScout SWE-Bench or tool-use/function-calling data during post-training. The terminal navigation policy learned from vulnerability localization transfers directly to software engineering localization and structured tool calling.

Can You Beat a 1B Model?

Race against Antares-1B on real vulnerability localization. You both get the same repo and CWE description. Find the vulnerable file(s) before the model does.

Note: The model side replays traces recorded from live inference runs, not live weights on your browser.