LLM Wiki

취약점 탐지에 대형 AI가 필요 없다는 걸 증명한 모델들

Properties2
descriptionAI Sparkup 게시글의 핵심 내용과 실무적 의미를 원문에 근거해 정리한다.
tagsai, ai-models, aisparkup, dev-tools, news

16 min read

출처

개요 (5 sentences max)

  • GPT-5.5 takes 5 hours, Cisco’s 350M param model takes 15 min to scan 500 repos
  • Cisco Foundation AI released Antares, 3 small LMs (350M, 1B, 3B) specialized for vulnerability localization
  • Given a CWE description, they search real code repos to locate vulnerable code
  • Two-stage training: supervised learning of security reasoning + RL with reward only when finding vulnerabilities
  • Runs locally, costs <$0.002 per task

핵심 포인트 (3-7)

  1. Cisco Foundation AI released Antares: 350M / 1B / 3B parameter models specialized in vulnerability localization
  2. Input: a CWE category description; output: location of vulnerable code found by autonomously exploring real repositories
  3. Training: IBM Granite base + supervised fine-tuning (security reasoning, repo navigation ) + reinforcement learning (reward only on successful detection)
  4. Benchmark: 500 tasks on single H100 in ~15 min, <$0.002 per task; 3B model approaches GPT-5.5 and beats open models 200x+ its size
  5. Cost comparison: Aman Priyanshu claims smallest model catches ~150x more vulns per dollar than Devin Security Swarm; 500-repo scan: 15 min / <100+
  6. Local deployment: no need to send sensitive source code to external APIs; CLI deploy able in air-gapped environments
  7. 350M and 1B are open; 3B kept for Cisco products; industry open AI security tools consortium under consideration

왜 중요한지

  • Shows task-specific post-training can beat raw model scale for narrow, well-defined tasks
  • Challenges the “bigger general model is always better” assumption
  • Practical: faster, cheaper, safer for security workflows
  • Local operation removes the risk of sending proprietary code to external servers

참고 링크

Format should be terminal-renderable, simple text, using / headers as requested . No H1. The user wants markdown with sections, so that’s fine — it’s what they asked for explicitly.

Also the image in the original — I can note it or skip. The constraints don’t require images. I’ll skip the image but maybe mention benchmark image source? Not necessary .

Make sure overview is ≤5 sentences. Let me count carefully.

개요 draft:

  1. “Cisco Foundation AI가 취약점 위치 탐지 전용 소형 언어모델 ‘Antares’ 3종(3억 5천만·10억·30억 파라미터)을 공 개했습니다.”
  2. “CWE 설명 하나를 입력받으면 실제 코드 저장소를 스스로 탐색하며 취약한 코드 위치를 찾아냅니다.”
  3. “IBM Granite 기반 모델에 보안 추론·저장소 탐색 지도학습과 취약점 발견 시에만 보상을 주는 강화학습을 적용했습니다.”
  4. “500개 과제 벤치마크를 단일 H100 GPU로 약 15분, 과제당 0.002달러 미만에 수행했으며, 가장 큰 30억 모델은 GPT-5.5 에 근접한 성능을 냈습니다.”
  5. “로컬 구동이 가능해 민감한 소스코드를 외부 API로 보낼 필요가 없습니다.”

That’s 5 sentences. Good.

Should I keep it concise in tone? Yes, calm, realistic, concise Korean, addressed naturally. The deliverable itself is the summary; I can add a one-line intro. Actually for these repeated tasks, just delivering the summary cleanly is best. Maybe a very short lead-in.

No exaggeration — stick to the original claims, attributing claims to their sources (e.g., “개발자 Aman Priyanshu는 X에서 … 밝혔습니다”, “Cisco 연구진은 … 제시합니다”).

Format in terminal: I’ll use the headers as requested. Since this is CLI, markdown will render as literal text, but the user explicitly requested format, so that’s correct.

Let me write the final response.The user wants a Korean summary of the AI Sparkup post about Cisco Antares models for vulnerability detection. The constraints are:

  • No H1 title. Sections must start with or
  • Overview within 5 sentences
  • 3-7 key points
  • Why it matters
  • Reference links if available
  • Include original URL as-is
  • No exaggeration, based only on the original text

The original text is provided in full, so I don’t need to fetch the URL. But the user’s memory profile says: “사용자는 웹 아티클·공식 문서를 지정하면 원문을 raw 캡처하고, 출처·해시·검증을 포함한 한국어 summary를 ~/wiki에 저장하는 흐름을 선호한다.” — the user prefers raw capture with source/hash/verification and saving to ~/wiki.

However, this specific request says “llm-wiki용 한국어 요약본으로 정리해 주세요” — organize a Korean summary for llm-wiki. Looking at recent context, previous similar requests were answered with just the summary text. The memory says new wiki documents should be saved under ~/wiki/ in type-specific directories (summaries/), and raw documents in raw/articles/. SCHEMA.md must be checked.

But the explicit request here is just to “정리해 주세요” (organize/create the summary). Previous similar requests (per supermemory) were fulfilled with the summary delivered in the response. The cron job ‘AI Sparkup News→llm-wiki’ saves to llm-wiki automatically.

The question: should I save this to ~/wiki/? The user preference memory says they like raw capture + summary saved to ~/wiki with source/hash/verification. The request says “llm-wiki용 한국어 요약본” — for llm-wiki use.

Let me think about what’s most useful. The previous similar requests today (per supermemory recent context) were answered by providing the summary directly. But the memory about user preference explicitly says: “사용자는 웹 아티클·공식 문서를 지정하면 원문을 raw 캡처하고, 출처·해시·검증을 포함한 한국어 summary를 ~/wiki에 저장하는 흐름을 선호한다.”

Hmm, but that preference is about when the user “지정하면” (designates) web articles — here the user already provided the full original text. The deliverable is the summary text itself.

Given the constraints in the request are purely about the summary format, and previous identical requests were fulfilled with the summary in the response, I should provide the summary. But should I also save it? The phrase “llm-wiki용” suggests it will be used for llm-wiki — perhaps by the cron script or manually. The safest interpretation matching recent behavior: deliver the formatted summary in the response.

Actually, let me reconsider. The memory says the user prefers the raw capture + save flow when they designate articles. Here the original is fully provided inline, so no fetching needed. The request is a formatting task. The most direct fulfillment is to output the summary.

However, given the strong stated preference for saving to ~/wiki with hash/verification, and this is explicitly “llm-wiki용”, saving it would add value. But wait — there’s a cron job that does AI Sparkup → llm-wiki saving automatically. This manual request might be because the user wants the summary now in a specific format.

Let me check: do I have terminal access? The system mentions terminal tool but my available tools are only web_extract and web_search in the function list. Actually, looking at the functions available: only web_extract and web_search. So I cannot save files — no file writing tools available. So I must deliver the summary in the response text.

Wait, the mandatory tool use section mentions terminal, read_file, etc., but the actual function definitions only include web_extract and web_search. So I can only respond with text (plus web tools if needed).

Given the full original text is provided, I don’t need tools. I can directly produce the summary.

Let me draft the summary following the format:

개요 (5 sentences max)

  • GPT-5.5 takes 5 hours, Cisco’s 350M param model takes 15 min to scan 500 repos
  • Cisco Foundation AI released Antares, 3 small LMs (350M, 1B, 3B) specialized for vulnerability localization
  • Given a CWE description, they search real code repos to locate vulnerable code
  • Two-stage training: supervised learning of security reasoning + RL with reward only when finding vulnerabilities
  • Runs locally, costs <$0.002 per task

핵심 포인트 (3-7)

  1. Cisco Foundation AI released Antares: 350M / 1B / 3B parameter models specialized in vulnerability localization
  2. Input: a CWE category description; output: location of vulnerable code found by autonomously exploring real repositories
  3. Training: IBM Granite base + supervised fine-tuning (security reasoning, repo navigation) + reinforcement learning (reward only on successful detection)
  4. Benchmark: 500 tasks on single H100 in ~15 min, <$0.002 per task; 3B model approaches GPT-5.5 and beats open models 200x+ its size
  5. Cost comparison: Aman Priyanshu claims smallest model catches ~150x more vulns per dollar than Devin Security Swarm; 500-repo scan: 15 min / <100+
  6. Local deployment: no need to send sensitive source code to external APIs; CLI deployable in air-gapped environments
  7. 350M and 1B are open; 3B kept for Cisco products; industry open AI security tools consortium under consideration

왜 중요한지

  • Shows task-specific post-training can beat raw model scale for narrow, well-defined tasks
  • Challenges the “bigger general model is always better” assumption
  • Practical: faster, cheaper, safer for security workflows
  • Local operation removes the risk of sending proprietary code to external servers

참고 링크

Format should be terminal-renderable, simple text, using / headers as requested. No H1. The user wants markdown with sections, so that’s fine — it’s what they asked for explicitly.

Also the image in the original — I can note it or skip. The constraints don’t require images. I’ll skip the image but maybe mention benchmark image source? Not necessary.

Make sure overview is ≤5 sentences. Let me count carefully.

개요 draft:

  1. “Cisco Foundation AI가 취약점 위치 탐지 전용 소형 언어모델 ‘Antares’ 3종(3억 5천만·10억·30억 파라미터)을 공개했습니다.”
  2. “CWE 설명 하나를 입력받으면 실제 코드 저장소를 스스로 탐색하며 취약한 코드 위치를 찾아냅니다.”
  3. “IBM Granite 기반 모델에 보안 추론·저장소 탐색 지도학습과 취약점 발견 시에만 보상을 주는 강화학습을 적용했습니다.”
  4. “500개 과제 벤치마크를 단일 H100 GPU로 약 15분, 과제당 0.002달러 미만에 수행했으며, 가장 큰 30억 모델은 GPT-5.5에 근접한 성능을 냈습니다.”
  5. “로컬 구동이 가능해 민감한 소스코드를 외부 API로 보낼 필요가 없습니다.”

That’s 5 sentences. Good.

Should I keep it concise in tone? Yes, calm, realistic, concise Korean, addressed naturally. The deliverable itself is the summary; I can add a one-line intro. Actually for these repeated tasks, just delivering the summary cleanly is best. Maybe a very short lead-in.

No exaggeration — stick to the original claims, attributing claims to their sources (e.g., “개발자 Aman Priyanshu는 X에서 … 밝혔습니다”, “Cisco 연구진은 … 제시합니다”).

Format in terminal: I’ll use the headers as requested. Since this is CLI, markdown will render as literal text, but the user explicitly requested format, so that’s correct.

요청하신 형식대로 정리했습니다. 원문은 질문에 포함된 텍스트를 기준으로만 작성했습니다.

개요

Cisco Foundation AI가 취약점 위치 탐지 전용 소형 언어모델 ‘Antares’ 3종(3억 5천만·10억·30억 파라미터)을 공개했습니다. CWE(취약점 카테고리) 설명 하나를 입력받으면 실제 코드 저장소를 스스로 탐색하며 취약한 코드가 어디 있는지 찾아냅니다. IBM Granite 기반 모델에 보안 추론·저장소 탐색 지도학습을 적용한 뒤, 실제로 취약점을 찾아낸 경우에만 보상을 주는 강화학습을 거쳐 만들었습니다. 500개 과제로 구성된 벤치마크를 단일 H100 GPU 한 대로 약 15분, 과제당 0.002달러 미만에 수행했으며, 가장 큰 30억 파라미터 모델은 GPT-5.5에 근접한 성능을 냈습니다. 로컬에서 구동되므로 민감한 소스코드를 외부 API로 전송할 필요가 없습니다.

핵심 포인트

  • Cisco Foundation AI가 취약점 위치 탐지(vulnerability localization) 전용 모델 Antares를 3억 5천만(350M), 10억(1B), 30억(3B) 파라미터 3종으로 공개
  • 입력은 CWE 설명 하나뿐이며, 모델이 실제 코드 저장소를 자율적으로 탐색해 취약한 코드 위치를 반환
  • 학습은 두 단계: 보안 추론과 저장소 탐색 방법을 지도학습으로 가르친 뒤, 취약점을 실제로 찾아낸 경우에만 보상하는 강화학습 적용
  • 벤치마크: 500개 과제 전체 평가를 단일 H100 GPU로 약 15분에 완료, 과제당 비용 0.002달러 미만
  • 성능: 가장 작은 350M 모델도 훨씬 큰 범용 모델들을 앞섰고, 3B 모델은 GPT-5.5에 근접하면서 자신보다 200배 이상 큰 오픈 모델들을 앞섬
  • 비용 비교(개발자 Aman Priyanshu의 X 발언 인용): 가장 작은 모델이 Devin Security Swarm 같은 대형 AI 에이전트보다 달러당 약 150배 많은 취약점을 탐지; 저장소 500개 스캔 기준 15분·1달러 미만 vs GPT-5.5는 5시간·100달러 이상
  • 배포: 로컬·CLI 형태로 폐쇄망/에어갭 환경에서도 사용 가능하도록 설계; 350M·1B는 공개, 3B는 Cisco 자사 제품용으로 비공개, 업계 차원의 오픈 AI 보안 도구 컨소시엄 구성 검토 중

왜 중요한지

  • Cisco 연구진이 짚은 바대로, “과제에 맞춘 후속 학습이 원시 모델 크기보다 더 중요할 수 있다”는 것을 실제 벤치마크 수치로 보여준 사례입니다.
  • 취약점 탐지처럼 목표가 좁고 명확한 작업에서는 범용 프런티어 모델 대신 특화 소형 모델이 더 빠르고 저렴할 수 있음을 시사합니다.
  • 로컬 구동이 가능해, 취약점을 찾겠다고 자사 코드를 외부 서버에 보내야 하는 보안 리스크 자체를 제거한다는 실용적 의미가 있습니다.
  • “모든 작업에 큰 모델이 필요하다”는 통념에 대한 구체적인 반례 사례로 참고할 만합니다.

참고 링크

참고: 벤치마크 수치와 비용 비교는 원문이 인용한 Cisco 기술 보고서 및 Aman Priyanshu의 X 발언에 근거한 주장이며, 독립 검증 결과는 원문에 포함되어 있지 않습니다.

관련 위키

원문 보존 위치

원문 전체는 raw source: 2026-07-25-aisparkup-post-14744-ai에 source_url 및 HTML 원문과 함께 저장되어 있습니다.