Antares: Foundation Models for Agentic Vulnerability Localization
2026-08-03 • Cryptography and Security
Cryptography and SecurityArtificial Intelligence
AI summaryⓘ
The authors introduce Antares, a set of smaller, efficient language models designed to find security bugs in large software codebases. They trained Antares using a combination of supervised learning and reinforcement learning to improve its ability to spot vulnerabilities. In tests, the largest Antares model performed nearly as well as GPT-5.5 but is much smaller and faster. This makes Antares practical for quick and affordable security checks on big code projects.
vulnerability localizationlanguage modelssupervised fine-tuningreinforcement learningcode securitysoftware vulnerabilitiesagentic modelsGPU inferenceIBM Granite models
Authors
Supriti Vijay, Aman Priyanshu, Didier Chapoteau, Arthur Goldblatt, Jianliang He, Kimia Majd, Fraser Burch, Baturay Saglam, Takahiro Matsumoto, Zhuoran Yang, Amin Karbasi
Abstract
Vulnerability localization is a fundamental step in software security, requiring models to reason over large codebases and iteratively identify vulnerable implementations. We present Antares, a family of compact language models (350M, 1B, and 3B parameters) for agentic vulnerability localization. Based on IBM Granite base models, Antares is trained through a two-stage pipeline that combines supervised fine-tuning on cybersecurity reasoning and repository exploration data with reinforcement learning from verifiable rewards over vulnerable repositories. Across extensive evaluations, Antares-3B approaches GPT-5.5 while outperforming open-weight models over 200x larger in size. The Antares family further enables fast, low-cost local inference, completing a full 500-task evaluation sweep in approximately 15 minutes on a single H100 GPU, corresponding to an amortized evaluation time of under 2 seconds and less than $0.002 per task.