Antares: Foundation Models for Agentic Vulnerability Localization

2026-08-03

AI Summary

This work addresses the challenge of automatically localizing security vulnerabilities in large codebases by introducing the Antares family of lightweight language models (350M–3B parameters), which employ a two-stage agent-style training strategy for vulnerability localization. The approach first applies supervised fine-tuning on datasets encompassing cybersecurity reasoning and code exploration, followed by reinforcement learning guided by a verifiable reward mechanism—a novel integration of reinforcement learning with verifiable rewards in this domain. This methodology enables small-scale models to surpass open-source counterparts over 100 times larger in parameter count. Built upon IBM Granite, Antares-3B completes 500 evaluations in just 15 minutes on a single H100 GPU, achieving sub-2-second average per-task latency and costing less than $0.002 per task, approaching the performance of GPT-5.5 while supporting efficient local deployment.

Abstract

Vulnerability localization is a fundamental step in software security, requiring models to reason over large codebases and iteratively identify vulnerable implementations. We present Antares, a family of compact language models (350M, 1B, and 3B parameters) for agentic vulnerability localization. Based on IBM Granite base models, Antares is trained through a two-stage pipeline that combines supervised fine-tuning on cybersecurity reasoning and repository exploration data with reinforcement learning from verifiable rewards over vulnerable repositories. Across extensive evaluations, Antares-3B approaches GPT-5.5 while outperforming open-weight models over 200x larger in size. The Antares family further enables fast, low-cost local inference, completing a full 500-task evaluation sweep in approximately 15 minutes on a single H100 GPU, corresponding to an amortized evaluation time of under 2 seconds and less than $0.002 per task.

Problem

• vulnerability localization
• software security
• codebase analysis
• agentic reasoning
• cybersecurity

Innovation

• agentic vulnerability localization
• compact language models
• reinforcement learning from verifiable rewards
• supervised fine-tuning
• efficient local inference