Antares: Foundation Models for Agentic Vulnerability Localization

AI 中文解读

先记住核心：IBM团队搞了个叫Antares的AI模型，专门帮程序员找软件漏洞。最抢眼的是它个头虽小，本事却不小——3B参数的版本效果接近GPT-5.5，还比那些大它200倍的同类模型更聪明。跑完全套500个测试只要一刻钟，每项成本不到两厘钱，速度快到飞起。通俗讲，找软件漏洞就像在巨型代码迷宫里抓坏蛋。以前得靠超大规模AI慢慢搜，费钱费电。Antares则像一支装备精良的特种小分队，通过“先学习安全推理+再实战强化”的两步训练，能像侦探一样边翻代码边锁定问题位置。小身材低成本，普通电脑也能跑，让高质量安全检测不再是大厂的专利。对普通人来说，这意味着手机APP和网站里的安全漏洞能被更快、更便宜地发现和修复。以前很多小团队钱不够只能凑合，现在几分钟就能完成一次深度安全体检，恶意攻击者还没来得及下手，漏洞就被堵上了。我们日常用到的软件会更稳、更安全，数据泄露的概率也随之降低。

Vulnerability localization is a fundamental step in software security, requiring models to reason over large codebases and iteratively identify vulnerable implementations. We present Antares, a family of compact language models (350M, 1B, and 3B parameters) for agentic vulnerability localization. Based on IBM Granite base models, Antares is trained through a two-stage pipeline that combines supervised fine-tuning on cybersecurity reasoning and repository exploration data with reinforcement learning from verifiable rewards over vulnerable repositories. Across extensive evaluations, Antares-3B approaches GPT-5.5 while outperforming open-weight models over 200x larger in size. The Antares family further enables fast, low-cost local inference, completing a full 500-task evaluation sweep in approximately 15 minutes on a single H100 GPU, corresponding to an amortized evaluation time of under 2 seconds and less than $0.002 per task.