Introducing dfs-large1: A New Frontier for Cybersecurity | depthfirst

What it claims

dfs-large1 is depthfirst's vulnerability-discovery and validation model, in preview inside the depthfirst platform only. It is GLM 5.2 post-trained with RL inside depthfirst's security agent harness, with Fireworks AI scaling training and inference. depthfirst says it is best-in-class and sets a new Pareto frontier on its internal benchmark, dfbench, but publishes no scores. Training curves are described as still rising with no sign of plateauing.

How it works

The harness splits a repository into audit scopes. Each agent gets a bounded file list and a scoped threat model covering attack surfaces, trust boundaries and data flows. Its shell stays rooted at the full repository, so it can trace callers, shared libraries and dependencies outside its scope. In multi-repository audits, related repositories are available as context. Scopes run concurrently.

The model trains jointly on three tasks: application-code detection, low-level systems-code detection, and validation of candidate findings. Systems code supplies direct verification signals, such as fuzz targets and reproducible ASan reports. Web findings are harder to validate automatically.

Reward shaping applies two terms to the scalar task reward:

• Effort penalty. Effort is a linear mix of action tokens, agent rounds and tool-output tokens. The penalty is λ·log(1+αx)/log(1+α). It is concave, so short rollouts are penalized more per unit of effort than long ones, an idea adapted from Cursor's Composer 2.
• Finding budget. Credit is multiplied by 1/max(1, n − B_t + 1), where n is the number of findings. The budget B_t starts large and is lowered in stages once baseline recall exists.

Rollouts run about 100 agent turns. An asynchronous actor-learner pipeline introduces policy lag, and trainer-sampler numerics add further mismatch. To counter the mismatch, MoE expert routes are recorded at generation and replayed in the training forward pass. The update is masked importance-sampling REINFORCE (Periodic Labs): tokens whose ratio falls outside (1−ε_l, 1+ε_h) are dropped from the loss. Advantages use Dr. GRPO, then a per-task normalization (from AgentRL) so high-variance task families do not dominate. Context compaction reuses dfs-mini1's learned summarization.

flowchart LR
  A[Async actors, routes recorded] --> R[Task reward]
  R --> S[Shaped reward]
  E[Effort penalty] --> S
  F[Finding budget] --> S
  S --> G[Dr. GRPO + task norm]
  G --> M[MIS: mask out-of-range ratios]
  M --> L[Learner, routes replayed]
  L -->|weights, with lag| A

Evidence

• Ablations. These are qualitative, with no numbers given. Without the effort penalty, rounds and action tokens grew indefinitely with more RL compute. With it, parallel tool use rose while rounds held flat or fell.
• Toy runs. Without the finding budget, the policy degraded into reporting locally plausible bugs with no reachability or exploitability evidence.
• Optimizer choice. Masking was more stable than CISPO-style clipping for these long-horizon tasks.
• Learned behavior. In judged samples, later checkpoints spent more turns tracing attacker-controlled input and ran executable harnesses more often. Repository reads and searches declined.
• Field results. An earlier checkpoint supported part of a Ruby ecosystem campaign that validated 105 vulnerabilities across 34 projects, about 61% memory-safety issues. The campaign as a whole is credited, not the model alone.

Evaluation setup

• Models run at high thinking effort inside depthfirst's harness.
• Sandboxes have no internet access and expose a depth-1 clone with no commit history.
• LLM monitors flag reward hacking and attempts to find patch information.
• Every passing trajectory was manually reviewed.
• No failures came from safety refusals.

Limits

There are no benchmark numbers, baselines or compute figures. dfbench's construction is deferred to a future post. No weights, licence, model size or API are given. Access is a platform preview. The ablations are described only qualitatively, and the causes of the behavior shift are stated as suspicion. The thousands of executable training environments are described as unsaturated.