https://vaktex.com/_app/immutable/nodes/21.BJTyaY3E.js

1(function(){try{var e=typeof window<`u`?window:typeof global<`u`?global:typeof globalThis<`u`?globalThis:typeof self<`u`?self:{};e.SENTRY_RELEASE={id:`d3d7f33885ffe420ffaed73d5934e4a2be1856ef`};var t=new e.Error().stack;t&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[t]=`e2b10f6b-4d0d-4b1e-8950-cb17067e7a61`,e._sentryDebugIdIdentifier=`sentry-dbid-e2b10f6b-4d0d-4b1e-8950-cb17067e7a61`)}catch{}})();import{At as e,Dt as t,F as n,J as r,K as i,Ot as a,P as o,_t as s,a as c,dt as l,gt as u,jt as d,n as f,v as p,yt as m}from"../chunks/F2x2LXrT.js";import"../chunks/D_t_OSPh.js";import{t as h}from"../chunks/C7ZX1lA-.js";import"../chunks/Dmugh0XH.js";import"../chunks/DCENQH30.js";var g=r(`<div class="bp-tabs"><!></div>`);function _(e,n){a(n,!0);var r=g(),s=u(r);o(s,()=>n.children),d(r),l(e=>p(r,`data-labels`,e),[()=>n.labels.join(`|`)]),i(e,r),t()}var v={category:`Engineering`,title:`Introducing DOM-0.8B`,description:`DOM-0.8B and VAKT bring code-security review to your machine, helping you prioritise what to investigate before production.`,author:`Vaktex`,date:`2026-09-28T00:00:00.000Z`,thumbnail:`/blog/dom-oss/dom-oss-launch.jpg`,video:`/blog/dom-oss/dom-oss-launch.mp4`,videoAv1:`/blog/dom-oss/dom-oss-launch.av1.mp4`,cta:!0,previous:`/dom-oss`,headings:[{id:`running-locally`,text:`Running locally`,depth:2},{id:`benchmarks`,text:`Benchmarks`,depth:2},{id:`architecture`,text:`Architecture`,depth:2},{id:`what-s-next`,text:`What’s next`,depth:2}]},{category:y,title:b,description:x,author:S,date:C,thumbnail:w,video:T,videoAv1:E,cta:D,previous:O,headings:k}=v,A=r(`<pre class="language-bash"></pre> <pre class="language-bash"></pre>`,1),j=r(`<p>Today we’re introducing <a href="https://huggingface.co/vaktex/dom-oss-0.8b" rel="nofollow">DOM-0.8B</a>, an 800M-parameter code-security model, alongside <a href="https://github.com/Vaktex/vakt" rel="nofollow">VAKT</a>, our local scanner. Our mission is to make security review accessible to everyone, regardless of nationality or budget. We release the model weights and VAKT’s source code under our <a href="/legal/licenses/evaluation">Evaluation License</a>: free for research, education and evaluation, and fully local. You can now optimize your co

1de review without using cloud models.</p> <p>Our tool VAKT extracts functions from your repository, scores them with DOM-0.8B and ranks them for further investigation. Rather than generating a written review of every function, DOM returns severity and vulnerability-family scores. The aim is to focus human review and generative-model tokens where they are most useful, before the code reaches production.</p> <h2 id="running-locally">Running locally</h2> <p>VAKT runs on Apple Silicon through Metal, NVIDIA GPUs through CUDA 13, and Linux CPUs. The fp16 weights are approximately 1.5 GB to download; runtime memory use depends on the input and backend.</p> <p>Install VAKT with one command.</p> <!> <p>Access to the gated weights may still require approval on <a href="https://huggingface.co/vaktex/dom-oss-0.8b" rel="nofollow">HuggingFace</a>.</p> <p>Then scan the current repository:</p> <pre class="language-bash"></pre> <p>VAKT uses AST-aware parsing to extract functions, with a scanning window of 16,384 tokens. Results are available as a terminal report or structured JSON, and cached scores avoid repeating work on unchanged inputs. Use the scores to prioritise investigation, then check callers, reachability and assumptions. A score is not proof of an exploitable vulnerability.</p> <h2 id="benchmarks">Benchmarks</h2> <p>Severity AUROC measures how well a model ranks vulnerable code above non-vulnerable code across thresholds. Higher is better; it is not percentage accuracy.</p> <figure><img src="/blog/dom-oss/benchmarks.png" alt="Severity AUROC on a fixed 0 to 1 scale: DOM-0.8B 0.5731, DOM-4B 0.8371, character n-gram baseline 0.6009. Higher is better." loading="lazy"/><figcaption>Severity AUROC on a fixed 0 to 1 scale. Higher is better.</figcaption></figure> <p>An AUROC of 0.5 represents chance-level ranking; 1.0 represents perfect separation on the evaluated examples. DOM-4B’s score of 0.8371 means a randomly chosen vulnerable example ranks above a randomly chosen non-vulnerable example about 84% of the time, counting ties as half. It does not mean 84% of findings are correct.</p> <p>DOM-0.8B scores 0.5731, below the character n-gram baseline at 0.6009. That baseline uses recurring text patterns rather than explicit program analysis, making it a useful check on what the model adds. The graph reports a stronger result for DOM-4B, but establishing an improvement requires evaluating the builds on the same held-out examples. For review workflows, precision and recall at the chosen threshold also matter: they determine how much code gets flagged and how many issues are missed.</p> <h2 id="architecture">Architecture</h2> <p>DOM-0.8B uses a 24-layer text backbone with a hidden width of 1,024. Each of six groups combines three linear-attention layers with one full-attention layer. In the current recipe, the lower 16 layers remain frozen while the upper eight are adapted.</p> <p><img src="/blog/dom-oss/architecture.png" alt="DOM-0.8B architecture: source code passes through a tokenizer, decoder and attention pooling before branching into severity and CWE classification heads."/></p> <p>One backbone pass per input chunk produces token representations. Learned four-head attention pooling in fp32 combines them into a representation for a severity score and 18 CWE family scores. A separate 256-dimensional training projection is discarded for inference.</p> <p>A generative model processes the input and then decodes its answer one token at a time. DOM processes each input chunk and returns classification scores, without generating a written report. That removes answer-generation work and gives VAKT fixed outputs it can rank and threshold. The engineering advantage is a narrower task; its effect on review time and accuracy still needs to be measured.</p> <h2 id="what-s-next">What’s next</h2> <p>This release is a big first step in making security reviews more accessible. We’re excited to share more in the coming weeks about our security developments and how they advance our goal of accessible security for everyone.</p> <p>If you’re an existing Vaktex customer, you may be eligible for DOM-4B. If you’re interested, we’d love to hear from you.</p>`,1);function M(t,r){let a=f(r,[`children`,`$$slots`,`$$events`,`$$legacy`]);h(t,c(()=>

1a,()=>v,{children:(t,r)=>{var a=j(),o=m(s(a),10);_(o,{labels:[`curl`,`wget`],children:(e,t)=>{var r=A(),a=s(r);n(a,()=>`<code class="language-bash"><span class="token function">curl</span> <span class="token parameter variable">-fsSL</span> https://get.vaktex.com/oss-vakt <span class="token operator">|</span> <span class="token function">bash</span></code>`,!0),d(a);var o=m(a,2);n(o,()=>`<code class="language-bash"><span class="token function">wget</span> -qO- https://get.vaktex.com/oss-vakt <span class="token operator">|</span> <span class="token function">bash</span></code>`,!0),d(o),i(e,r)},$$slots:{default:!0}});var c=m(o,6);n(c,()=>`<code class="language-bash">vakt <span class="token builtin class-name">.</span></code>`,!0),d(c),e(28),i(t,a)},$$slots:{default:!0}}))}export{M as component};