Cisco Foundation AI 发布 Antares 系列安全小语言模型，专用于漏洞定位

思科基础AI：https://blogs.cisco.com/ai/introducing-antares-the-most-efficient-open-weight-ai-models-for-vulnerability-localization 已发布 Antares，一系列为单一安全任务构建的安全小型语言模型（SLMs）。该任务是漏洞定位。给定漏洞描述和代码库，找到包含漏洞的文件。

两个模型是开源权重，目前已在 Hugging Face 上可用，Antares-350M：https://huggingface.co/fdtn-ai/antares-350m 和 Antares-1B：https://huggingface.co/fdtn-ai/antares-1b。两者均为 Apache 2.0 许可。思科团队还发布了漏洞定位基准测试：https://cisco-foundation-ai.github.io/vulnerability-localization-benchmark/（VLoc Bench），这是一个包含 500 个任务的代理评估，同样在 Apache 2.0 许可下提供。

主要结果并不是新的最先进技术。结果显示，一个 1B 模型达到 0.209 的文件 F1 分数。GPT-5.5 达到 0.229，而一个 753B 的开源权重模型达到 0.186。

软件安全依赖于将外部漏洞知识与内部源代码连接起来。那些知识存在于公共数据库、公告以及常见弱点枚举（https://cwe.mitre.org/）中。代码存在于大型、模块化且依赖丰富的代码库中。

将两者连接起来成本很高。开发者需要搜索不熟悉的代码、遵循命名规范、检查调用路径并比较候选文件。思科的观点是，这个初步筛查步骤是成本集中的地方。

Antares 并不取代应用安全工具链。思科对此非常明确。开发团队仍然需要依赖项扫描、密钥扫描、动态测试、容器检查、威胁建模和专家审查。

Antares 由三个仅解码器的变换模型组成，参数量分别为 350M、1B 和 3B。所有三个模型都从 IBM Granite 4.0 初始化：https://huggingface.co/ibm-granite/granite-4.0-1b 检查点。它们共享一个分词器和架构：分组查询注意力（grouped-query attention）、SwiGLU MLP、RMSNorm、RoPE，以及共享的输入/输出嵌入。

Antares 并未作为独立序列模型进行评估。它在一个受限循环中与三个工具一起运行。

模型仅接收 CWE 分类描述，而不接收其他任何信息。没有咨询文本、没有文件提示、没有严重性细节。然后它会对网络禁用的 Docker 沙箱发出只读终端命令。在进入记录之前，命令输出被截断为 2,000 个字符。

每个任务的预算是 15 次终端调用。模型通过调用 submit_vulnerable_files（带有排名列表）或 submit_no_vulnerability_found 来终止。提交本身不计入预算。

输出是文件路径的排名列表以及产生该列表的探索轨迹。

VLoc Bench 从 290 个独特的真实世界代码库中抽取 500 个任务。来源是公共的 GitHub 安全咨询：https://github.com/advisories，覆盖六个生态系统：npm、pip、Maven、Go、Rust 和 Composer。它涵盖 147 个独特的 CWE 分类，其中 78% 的条目带有已分配的 CVE 标识符。

真实情况来源于安全补丁。修复中修改的文件被标记，测试、文档和配置文件被排除在外。

数据中的模式是能力断崖，而不是扩展曲线。

Antares-3B 达到 0.223 的文件 F1，略低于 GPT-5.5（xhigh）的 0.229。Antares-1B 达到 0.209，高于 GLM-5.2：https://huggingface.co/zai-org 在 753B 参数下的 0.186。Antares-350M 达到 0.135，高于 Gemma-4-31B 的 0.101 和 Gemini 2.5 Flash 的 0.102。

Antares-1B 还记录了任何评估系统中最高的召回率，为 0.224。

静态分析工具在相同评估下运行。Semgrep：https://semgrep.dev/ 得分 0.086 文件 F1，CodeQL：https://codeql.github.com/ 得分 0.023，Horusec 得分 0.020。思科的看法是，基于规则的扫描器可以恢复一些易受攻击的文件，但无法适应性地检查代码库上下文。

未经训练的 Granite 4.0 基础检查点在相同协议下的得分为 0.001、0.000 和 0.000 文件 F1。它们具有工具调用能力，但在具有代理循环的环境中仍会产生退化输出。

监督微调完成了主要工作。它将三个量表提升到0.108、0.188和0.198。SFT语料库中，71.5%用于网络安全推理，15.4%用于代码搜索轨迹，13.1%用于深度研究和通用推理。所有推理轨迹都来自单一教师GPT-OSS-120B，以避免跨教师分布偏移。

GRPO：https://arxiv.org/abs/2402.03300 随后增加了11%到25%，最大相对增益出现在350M。奖励是可验证的，并通过轨迹文本程序化计算，无需学习奖励模型。组件涵盖定位质量、提交行为、工具使用合规性、探索以及格式错误输出惩罚。

方差效应可能比均值更重要。GRPO将运行间标准偏差减少了42%到65%。一次GRPO评估运行比一次SFT运行的估计更可靠。

学习策略也存在依赖规模的差异。GRPO之后，350M和1B模型使用了87%到89%的搜索命令，并提交更多文件。3B模型保持在52%的搜索和37%的阅读，并以更高的精度提交更少文件。奖励从未规定任何策略。

查看Hugging Face上的模型：https://huggingface.co/collections/fdtn-ai/antares，基准测试：https://cisco-foundation-ai.github.io/vulnerability-localization-benchmark/，GitHub仓库：https://github.com/cisco-foundation-ai/vulnerability-localization-benchmark，以及提到的技术报告：https://cisco-foundation-ai.github.io/antares/technical-report.pdf。

Michal Sutter是一名数据科学专业人士，拥有帕多瓦大学数据科学硕士学位。凭借在统计分析、机器学习和数据工程方面的坚实基础，Michal擅长将复杂的数据集转化为可操作的洞见。

构建一个智能事件场馆运营者 [完整代码]：https://pxllnk.co/twdn5

谢谢！我们的团队会尽快联系你 🙌

Cisco Foundation AI：https://blogs.cisco.com/ai/introducing-antares-the-most-efficient-open-weight-ai-models-for-vulnerability-localization has released Antares , a family of security small language models (SLMs) built for one narrow security task. The task is vulnerability localization. Given a vulnerability description and a repository, find the files containing the flaw.

Two models are open-weight and available now on Hugging Face, Antares-350M：https://huggingface.co/fdtn-ai/antares-350m and Antares-1B：https://huggingface.co/fdtn-ai/antares-1b. Both are Apache 2.0. Cisco team also shipped the Vulnerability Localization Benchmark：https://cisco-foundation-ai.github.io/vulnerability-localization-benchmark/ (VLoc Bench), a 500-task agentic evaluation, under the same license.

The main result is not a new state of the art. It is that a 1B model reaches 0.209 File F1. GPT-5.5 reaches 0.229, and a 753B open-weight model reaches 0.186.

Software security depends on connecting external vulnerability knowledge to internal source code. That knowledge lives in public databases, advisories, and Common Weakness Enumerations：https://cwe.mitre.org/. The code lives in repositories that are large, modular, and dependency-rich.

Connecting the two is expensive. Devs search unfamiliar code, follow naming conventions, inspect call paths, and compare candidate files. Cisco’s framing is that this first triage step is where the cost concentrates.

Antares does not replace the application security toolchain. Cisco is explicit about this. Dev teams still need dependency scanning, secret scanning, dynamic testing, container checks, threat modeling, and expert review.

Antares consists of three decoder-only transformers at 350M, 1B, and 3B parameters. All three initialize from IBM Granite 4.0：https://huggingface.co/ibm-granite/granite-4.0-1b checkpoints. They share a tokenizer and architecture: grouped-query attention, SwiGLU MLPs, RMSNorm, RoPE, and shared input/output embeddings.

Antares is not evaluated as a standalone sequence model. It runs inside a constrained loop with three tools.

The model receives a CWE category description and nothing else. No advisory text, no file hints, no severity details. It then issues read-only terminal commands against a Docker sandbox with networking disabled. Command output is truncated to 2,000 characters before entering the transcript.

The budget is 15 terminal calls per task. The model terminates by calling submit_vulnerable_files with a ranked list, or submit_no_vulnerability_found . The submission itself does not count against the budget.

Output is a ranked list of file paths plus the exploration trace that produced it.

VLoc Bench draws 500 tasks from 290 unique real-world repositories. Sources are public GitHub Security Advisories：https://github.com/advisories across six ecosystems: npm, pip, Maven, Go, Rust, and Composer. It covers 147 unique CWE categories, and 78% of entries carry assigned CVE identifiers.

Ground truth is derived from the security patch. Files modified in the fix are labels, with tests, docs, and configuration excluded.

The pattern in the data is a capability cliff, not a scaling curve.

Antares-3B reaches 0.223 File F1, just under GPT-5.5 (xhigh) at 0.229. Antares-1B reaches 0.209, above GLM-5.2：https://huggingface.co/zai-org at 753B parameters, which scores 0.186. Antares-350M reaches 0.135, above Gemma-4-31B at 0.101 and Gemini 2.5 Flash at 0.102.

Antares-1B also records the highest recall of any evaluated system at 0.224.

Static analysis tools were run under the same evaluation. Semgrep：https://semgrep.dev/ scores 0.086 File F1, CodeQL：https://codeql.github.com/ scores 0.023, and Horusec scores 0.020. Cisco's reading is that rule-based scanners recover some vulnerable files but cannot adaptively inspect repository context.

The untrained Granite 4.0 base checkpoints score 0.001, 0.000, and 0.000 File F1 under the identical protocol. They have tool-calling ability and still produce degenerate output inside an agentic loop.

Supervised fine-tuning does the heavy lifting. It lifts the three scales to 0.108, 0.188, and 0.198. The SFT corpus is 71.5% cybersecurity reasoning, 15.4% code search trajectories, and 13.1% deep research and general reasoning. All reasoning traces come from a single teacher, GPT-OSS-120B, to avoid cross-teacher distribution shift.

GRPO：https://arxiv.org/abs/2402.03300 then adds 11% to 25%, with the largest relative gain at 350M. Rewards are verifiable and computed programmatically from trajectory text, with no learned reward model. Components cover localization quality, submission behavior, tool-use compliance, exploration, and malformed-output penalties.

The variance effect may matter more than the mean. GRPO cuts run-to-run standard deviation by 42% to 65%. One GRPO evaluation run is a more reliable estimate than one SFT run.

There is also a scale-dependent split in learned strategy. After GRPO, the 350M and 1B models use 87% to 89% search commands and submit more files. The 3B model settles at 52% search and 37% read, and submits fewer files at higher precision. The reward never prescribed either policy.

Check out the Models on Hugging Face：https://huggingface.co/collections/fdtn-ai/antares, Benchmark：https://cisco-foundation-ai.github.io/vulnerability-localization-benchmark/, GitHub Repo：https://github.com/cisco-foundation-ai/vulnerability-localization-benchmark and Mentioned Technical Report：https://cisco-foundation-ai.github.io/antares/technical-report.pdf.

Michal Sutter is a data science professional with a Master of Science in Data Science from the University of Padova. With a solid foundation in statistical analysis, machine learning, and data engineering, Michal excels at transforming complex datasets into actionable insights.

Build an Agentic Event Venue Operator [Full Codes]：https://pxllnk.co/twdn5

Thanks! Our team will contact you soon 🙌