The rapid expansion of the global software supply chain has created an unprecedented challenge for cybersecurity professionals: the widening gap between the discovery of a vulnerability and its remediation within complex, multi-layered codebases. Addressing this bottleneck, Cisco Foundation AI has announced the release of Antares, a family of specialized small language models (SLMs) specifically engineered for the critical task of vulnerability localization. Unlike general-purpose large language models (LLMs) that prioritize breadth across diverse domains, Antares is meticulously scoped to identify the exact files containing security flaws within a repository, given only a vulnerability description.
The release includes two open-weight models, Antares-350M and Antares-1B, both made available under the permissive Apache 2.0 license. Alongside these models, Cisco has introduced the Vulnerability Localization Benchmark (VLoc Bench), a rigorous agentic evaluation framework consisting of 500 tasks designed to simulate real-world security triage scenarios. The introduction of Antares marks a significant shift in the application of artificial intelligence to cybersecurity, demonstrating that highly specialized, smaller models can outperform massive, trillion-parameter systems in narrow, high-stakes technical domains.
The Technical Architecture of Antares
The Antares family comprises three decoder-only transformer models with parameter counts of 350 million, 1.6 billion, and 3 billion. These models are built upon the foundation of IBM’s Granite 4.0 checkpoints, a choice that provides a robust baseline for code understanding and logical reasoning. The architecture utilizes state-of-the-art transformer components, including grouped-query attention (GQA) to optimize memory efficiency, SwiGLU activation functions for enhanced non-linear processing, and Rotary Positional Embeddings (RoPE) to handle varying sequence lengths.
The Antares-350M model is designed for high-speed, low-resource environments, featuring a 32K context window, 28 layers, and a hidden dimension of 1024. The more robust Antares-1B scales this to 40 layers and a 2048 hidden dimension, significantly expanding the context window to 128K tokens. This expanded context is vital for modern software development, where a single repository may contain thousands of files and deeply nested directory structures. While a 3B parameter version has been developed, the current open-weight release focuses on the 350M and 1B variants, providing the community with tools that can be run on consumer-grade hardware or integrated into existing CI/CD pipelines with minimal overhead.
Solving the Localization Bottleneck
In the standard vulnerability management lifecycle, the "triage" phase is often the most resource-intensive. When a new Common Vulnerabilities and Exposures (CVE) identifier is published or an internal security advisory is issued, developers must manually bridge the gap between high-level descriptions—often written in natural language—and the specific lines of source code responsible for the weakness. This process requires an intimate understanding of the codebase, naming conventions, and complex call paths.
Cisco Foundation AI’s framing of the problem acknowledges that while tools like Static Application Security Testing (SAST) and Dynamic Application Security Testing (DAST) are essential, they often lack the contextual adaptability required to find "needles in haystacks" within unfamiliar or large-scale repositories. Antares is not intended to replace the existing security toolchain, which includes secret scanning, container checks, and threat modeling. Instead, it serves as a specialized "navigator" that accelerates the initial discovery phase, allowing human experts to focus their efforts on remediation rather than search.
The Training Methodology: SFT and GRPO
The performance of Antares is not merely a result of its architecture but stems from a sophisticated multi-stage training regimen. Initial testing of the raw IBM Granite 4.0 base models revealed a "capability floor," where the models scored near zero on localization tasks. Despite having general tool-calling abilities, the base models lacked the specific domain logic required to navigate a repository agentically.
To bridge this gap, Cisco employed Supervised Fine-Tuning (SFT) using a high-quality corpus. This training set was strategically weighted: 71.5% focused on cybersecurity reasoning, 15.4% on code search trajectories, and 13.1% on deep research and general reasoning. To maintain consistency and avoid the "distribution shift" that occurs when learning from multiple inconsistent sources, all reasoning traces were generated by a single "teacher" model, the GPT-OSS-120B.
Following SFT, the models underwent Group Relative Policy Optimization (GRPO). This reinforcement learning technique proved transformative, particularly for the smaller 350M model, which saw its performance increase by up to 25%. Unlike traditional RLHF (Reinforcement Learning from Human Feedback), which relies on subjective human preferences, GRPO rewards were computed programmatically. The models were rewarded for localization accuracy, compliance with tool-use protocols, and efficient exploration, while being penalized for malformed outputs or redundant actions. A key finding of the research was that GRPO significantly reduced the variance in model performance, cutting the standard deviation of results by 42% to 65% across different runs, thereby ensuring more predictable behavior in production environments.
The Agentic Evaluation Loop and VLoc Bench
Evaluation of Antares deviates from standard static benchmarks. The models operate within a constrained agentic loop, interacting with a Docker sandbox environment where networking is disabled for security. Each model is presented with a Common Weakness Enumeration (CWE) category description and nothing else—no hints regarding file names or specific advisory text.
The model is granted a budget of 15 terminal calls per task. It can use read-only commands to explore the directory structure, read file contents, and search for patterns. The loop terminates when the model calls a specific submission function, either identifying the vulnerable files or stating that no vulnerability was found. This setup mirrors the actual workflow of a security researcher who must explore an unknown repository under time constraints.
The VLoc Bench itself is a significant contribution to the field. It comprises 500 tasks sourced from 290 unique real-world repositories across six major programming ecosystems: npm (JavaScript/TypeScript), pip (Python), Maven (Java), Go, Rust, and Composer (PHP). Covering 147 unique CWE categories, the benchmark provides a diverse and representative sample of the modern software landscape. Ground truth for the benchmark is derived from actual security patches, ensuring that the model is evaluated on its ability to find the files that developers eventually had to fix.
Comparative Performance and Industry Impact
The results released by Cisco Foundation AI challenge the prevailing "bigger is better" narrative in the AI industry. In the VLoc Bench evaluations, the Antares-1B model achieved a File F1 score of 0.209. To put this in perspective, GLM-5.2, a model with 753 billion parameters, scored 0.186. The Antares-3B model reached 0.223, placing it within striking distance of GPT-5.5 (xhigh), which scored 0.229.
Perhaps more telling is the comparison with traditional static analysis tools. In the same agentic evaluation framework, industry-standard tools like Semgrep, CodeQL, and Horusec scored significantly lower, with Semgrep leading the group at 0.086. While these tools are highly effective at identifying known patterns via rule-based scanning, they lack the adaptive reasoning required to understand how a vulnerability described in text manifests within the specific logic of a unique repository.
The data reveals a "capability cliff" rather than a linear scaling curve. The Antares-350M model, despite its diminutive size, outperformed much larger models like Gemma-4-31B and Gemini 2.5 Flash. This suggests that for highly technical, narrow tasks, specialized training and reinforcement learning are more critical than raw parameter count.
Strategic Divergence in Model Behavior
An intriguing aspect of the Antares research is the emergence of different strategies based on model scale. Following the GRPO phase, researchers observed that the 350M and 1B models adopted an "aggressive search" strategy, with roughly 88% of their actions consisting of search commands. These models tended to submit a larger number of files to ensure higher recall.
In contrast, the 3B model developed a more "deliberative" approach. It balanced its actions between searching (52%) and reading file contents (37%), resulting in fewer submissions but with significantly higher precision. This divergence was not explicitly programmed into the reward functions but emerged naturally during the reinforcement learning process, indicating that larger models may develop more sophisticated internal heuristics for navigating information density.
Implications for the Cybersecurity Landscape
The release of Antares has several profound implications for the future of DevSecOps and AI-assisted security. First, the efficiency of these models allows for local, private deployment. Organizations with sensitive proprietary codebases often hesitate to send data to cloud-based LLM providers due to privacy and intellectual property concerns. Antares can be hosted on-premises, providing high-tier localization capabilities without data exfiltration risks.
Second, the cost-effectiveness of Antares is a game-changer for automated security triage. Running a 753B parameter model for every security advisory is economically non-viable for most enterprises. In contrast, a 1B parameter model can be run continuously as part of a background triage process at a fraction of the cost, potentially automating the first line of defense in security operations centers (SOCs).
Finally, the release of VLoc Bench as an open-source tool provides a new standard for evaluating security-centric AI. As more companies develop specialized models for cybersecurity, having a transparent, reproducible benchmark will be essential for validating claims of "state-of-the-art" performance.
Conclusion and Future Outlook
Cisco Foundation AI’s Antares represents a milestone in the transition from general-purpose AI to "expert" AI. By focusing on the specific, high-friction task of vulnerability localization, Cisco has demonstrated that small, efficient models can rival the world’s most powerful LLMs when properly trained and incentivized.
The decision to release these models as open-weights under the Apache 2.0 license reflects a commitment to the broader security community. As software complexity continues to outpace human capacity for manual review, tools like Antares will become indispensable components of the modern security stack. The future of AI in cybersecurity appears to be moving toward a "constellation" of specialized models—each a master of its specific domain—working in concert to protect the digital infrastructure of the 21st century.
While Antares is currently scoped to localization, the methodologies used in its creation—specifically the combination of high-reasoning SFT and programmatic GRPO—provide a blueprint for future models that might handle remediation (automated patching) or even proactive threat hunting. For now, Antares stands as the most efficient solution for one of the most persistent bottlenecks in the vulnerability management lifecycle.
