Pith. sign in

REVIEW 3 major objections 4 minor 47 references

Reliable malware understanding needs three groundings—domain, semantics, and knowledge—not just a stronger model.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · grok-4.5

2026-07-13 04:52 UTC pith:3BK4JWBV

load-bearing objection Solid systems paper: a usable Android malware harness with real precision gains, but the “three necessary groundings” story is only partly identified by the metrics. the 3 major comments →

arxiv 2607.09179 v1 pith:3BK4JWBV submitted 2026-07-10 cs.CR cs.SE

Malaika: Understanding Malware through Tri-Grounded Agentic Reasoning

Xingzhi Qian , Xinran Zheng , Yiling He , Lorenzo Cavallaro This is my paper
classification cs.CR cs.SE
keywords malware understandinggrounded reasoningmulti-agent systemsAndroid malwareMITRE ATT&CKsemantics groundingevidence localizationLLM agents
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

Malware analysts must rebuild high-level malicious behaviors from sparse, scattered code evidence mixed with ordinary functionality. The hard part is not spotting suspicious APIs or strings, but deciding whether that evidence is enough for an auditable behavior claim. This paper argues that three complementary forms of grounding make that decision reliable: domain grounding (an analyst-style loop of hypothesis and review), semantics grounding (tools that localize execution-relevant program context), and knowledge grounding (external threat knowledge retrieved only after concrete behavior is seen). Malaika implements the three as a multi-agent harness for Android apps and is evaluated against prior LLM malware pipelines and frontier coding agents. The result is more precise, lower-cost, more stable behavior reports; ablations show each grounding fixes a different failure mode. The broader claim is that for evidence-grounded software analysis under partial observability, the harness around the model is as central as model scale.

Core claim

Reliable reconstruction of malicious behavior under partial observability requires three complementary groundings—domain, semantics, and knowledge—and a multi-agent system that operationalizes them (Malaika) yields more precise and auditable behavior-level conclusions than fixed LLM malware pipelines or generic frontier agent harnesses, with ablations showing that each grounding addresses a distinct failure mode in hypothesis generation, evidence localization, or behavioral attribution.

What carries the argument

Tri-grounded agentic reasoning (Malaika): domain grounding via Manifest Analyzer, Explorer–Reviewer loops, and Summarizer; semantics grounding via static artifacts and tools (function/class summaries, callers); knowledge grounding via post-observation MITRE ATT&CK Mobile retrieval—so claims are accepted only when localized evidence and external knowledge jointly support them.

Load-bearing premise

That scores on MalEval report quality and family-level ATT&CK technique sets on a small sample set truly measure whether per-app behavior claims are correctly grounded, so gains can be credited to the three groundings rather than to the metrics or to static-analysis coverage limits.

What would settle it

On a larger set of apps with expert per-sample technique-to-evidence ground truth (not family-level proxies), a system that drops domain, semantics, or knowledge grounding would match or beat full Malaika on precision, auditability, and stability of reported behaviors.

Watch this falsifier — get emailed when new claim-graph text bears on it.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

3 major / 4 minor

Summary. The paper formulates malware understanding as grounded reasoning under partial observability and argues that reliable behavior reconstruction requires three complementary groundings: domain (analyst-inspired hypothesis generation and review), semantics (tool-mediated localization of program evidence), and knowledge (retrieval-based ATT&CK attribution). It presents Malaika, an Android multi-agent system with Manifest Analyzer, Explorer–Reviewer loops, static-analysis tools, and MITRE retrieval, then evaluates report quality on MalEval (255 apps) and structured ATT&CK attribution on a 20-APK subset against prior LLM malware pipelines (MalEval, LAMD) and frontier agents (Codex, Claude Code). Results claim improved report metrics, higher attribution precision with fewer false positives, and complementary ablation failure modes, supporting the claim that harness design—not model capability alone—drives reliability.

Significance. If the results hold, the paper offers a useful systems contribution for security-agent design: it reframes malware analysis as verification under partial observability rather than pure exploration, and shows that an open-weight model in a grounded harness can be more precise and cheaper than frontier coding agents on behavior attribution. Strengths include a clear three-part design, multi-baseline comparison (including same-model harness controls), ablations, stability/cost metrics, and an honest threats section. The work is timely for LLM-based security analysis and could influence how agent harnesses are evaluated beyond raw capability.

major comments (3)
  1. [Section IV.A.4; Table II; Section V; Section VII] Section IV.A.4 and Table II: the strongest claim—that the three groundings address complementary failure modes and yield more precise attribution—rests on a 20-APK subset that scores P(a) against family-level technique sets G(f). Section V and VII already document GT-GAP cases where valid sample behaviors are counted as FPs. This proxy can systematically reward under-generation and penalize broader but correct sample-specific claims. Please either (i) provide a human-audited sample-level technique set for the 20 apps (or a stratified subset) with inter-annotator agreement, or (ii) reframe Table II as family-consistency rather than per-sample precision/recall and soften the complementary-grounding claim accordingly.
  2. [Table II; Section IV.C (RQ2)] Table II ablations: full Malaika uses ~1.32M tokens/$0.33, while w/o domain and w/o semantics drop to ~0.43M/$0.13 and ~0.41M/$0.12. The paper attributes distinct failure modes (under-generation vs. unsupported mappings) to each grounding, but budget is confounded with mechanism. Without a budget-matched control (e.g., fixed token/tool budget, or equalized Explorer steps), reduced TP under domain ablation and inflated FP under semantics ablation could partly reflect less exploration rather than the claimed reasoning role. A matched-budget ablation or explicit budget-normalized analysis is needed for the complementary-necessity claim.
  3. [Table I; Abstract; Section IX; Section VII] Table I report-level gains over MalEval/LAMD are clearer and less dependent on the ATT&CK proxy, but the abstract and conclusion present grounding-aware reasoning as a 'principled foundation' for reliable malware understanding. Given Rootkit 100% failure across methods, weaker Trojan performance, static-only scope (VII), and MalEval’s modest size, the paper should more carefully separate (a) improved report quality under this harness from (b) a general necessity claim for the three groundings. Strengthening the discussion of when grounding fails (categories, native/dynamic code) would keep the central claim proportionate to the evidence.
minor comments (4)
  1. [Section IV.A.2] Clarify early-stop rule (five accepted malicious findings) and candidate ranking by sensitive API/string count: how often does early stop truncate analysis, and does ranking bias toward permission-heavy adware vs. stealthier families?
  2. [Section IV.A.4] Report exact LLM-as-a-judge prompt/model for RQ and any agreement with human spot-checks; RQ is a primary Table I metric.
  3. [Figure 1; Section II] Figure 1 is helpful but dense; a short caption walkthrough of which edges are missing in static CG would improve accessibility.
  4. [Throughout] Standardize naming (Malaika vs. Malaika spacing) and expand a few acronyms on first use in the evaluation section for non-Android readers.

Circularity Check

0 steps flagged

No circular derivation: empirical systems paper; claims rest on external benchmarks and ablations, not inputs renamed as predictions.

full rationale

Malaika is an empirical multi-agent systems paper, not a first-principles derivation. The central claim—that domain, semantics, and knowledge grounding are complementary for reliable malware behavior reconstruction—is advanced as a design hypothesis and tested via report-level metrics on MalEval, structured ATT&CK attribution on a 20-sample subset, ablations, and comparisons to third-party frontier harnesses (Codex, Claude Code) and prior pipelines. There is no equation chain in which a fitted quantity is re-labeled a prediction, no uniqueness theorem imported from the authors to forbid alternatives, and no ansatz smuggled in via self-citation. Self-citations to MalEval and LAMD are prior systems/benchmarks from overlapping authors used as baselines and evaluation substrate; that is normal and does not force Malaika’s reported gains by construction. ATT&CK technique IDs are retrieved from an external MITRE Mobile index, not defined from the paper’s own outputs. Metric and GT limitations (family-level G(f), LLM-as-a-judge, budget-coupled ablations) are validity concerns, not circularity. The derivation chain is therefore self-contained against external evaluation; score 0 with empty steps.

Axiom & Free-Parameter Ledger

4 free parameters · 5 axioms · 2 invented entities

The central claim rests on empirical systems assumptions rather than free mathematical constants: that static Android artifacts plus tool-mediated LLM exploration can support behavior-level conclusions; that family-level ATT&CK references and LLM-as-judge scores are adequate evaluation proxies; and that fixed operational limits (batching, early stop, retrieval depth) do not dominate the measured grounding effects. Invented entities are design constructs (the three groundings and role split), not physical postulates.

free parameters (4)
  • explorer-reviewer batch size / early-stop threshold
    Processes up to five parallel threads and cancels remaining work after five Reviewer-accepted malicious findings; fixed before evaluation but still a hand-chosen operating point that shapes coverage and cost.
  • ATT&CK dense-retrieval top-k
    Retriever returns top-10 techniques per behavior query; this ranking cutoff affects which attributions are available to Explorer/Reviewer.
  • candidate ranking by sensitive API/string count
    Prioritizes analysis targets by total associated sensitive APIs and suspicious strings, biasing which behaviors are inspected first under budget limits.
  • backend decoding settings
    Primary runs use DeepSeek-V3.2 with temperature 0; frontier baselines use specified reasoning-effort settings that are configuration choices, not derived quantities.
axioms (5)
  • domain assumption Static artifacts (manifest, decompiled code, call graph, sensitive APIs, strings) plus adaptive tool use are sufficient to reconstruct many security-relevant Android behaviors for evaluation purposes.
    Core semantics-grounding premise in Sections III.D and VII; paper acknowledges misses for runtime, dynamic loading, and native code.
  • ad hoc to paper Family-level documented ATT&CK technique sets G(f) are a conservative proxy for judging per-sample technique attributions P(a).
    Explicitly adopted in Section IV.A.4 because reliable per-sample technique GT is unavailable; case study later shows GT-GAP false positives.
  • domain assumption LLM-as-a-judge report quality and related MalEval metrics track human-useful malware-understanding quality.
    Used as primary report-level metrics following MalEval; construct-validity threat noted in Section VII.
  • ad hoc to paper Removing one grounding component while keeping the rest isolates that component’s contribution, despite concurrent cost/token changes.
    Ablation interpretation in RQ2 treats metric drops as complementary failure modes; Table II shows large budget differences across ablations.
  • domain assumption MITRE ATT&CK Mobile is an appropriate external vocabulary for standardized behavioral attribution.
    Knowledge-grounding design in Section III.E and evaluation Section IV.A.4.
invented entities (2)
  • Tri-grounding (domain / semantics / knowledge) as necessary complementary mechanisms no independent evidence
    purpose: Organize the claim that reliable malware reasoning needs analyst-style process constraints, program-evidence localization, and external threat-knowledge attribution.
    Central conceptual invention of the paper; supported only by this system’s ablations and comparisons, not by independent theory outside the manuscript.
  • Malaika Explorer–Reviewer–Summarizer multi-agent harness no independent evidence
    purpose: Operationalize the three groundings into an auditable Android malware analysis workflow.
    New system architecture; independent evidence would require external replications or deployments not present here.

pith-pipeline@v1.1.0-grok45 · 22961 in / 3560 out tokens · 53419 ms · 2026-07-13T04:52:17.189452+00:00 · methodology

0 comments
read the original abstract

Recent LLM-based systems have shown promising capabilities for security-focused code analysis. Malware understanding, however, poses a distinct challenge: analysts must reconstruct high-level malicious behaviors under partial observability from sparse, dispersed evidence intertwined with benign functionality. While static analysis can expose security-relevant signals, the central challenge is not merely identifying suspicious code, but determining whether the evidence sufficiently supports an auditable behavior-level conclusion. We formulate malware understanding as a grounded reasoning problem and argue that reliable behavior reconstruction requires three complementary forms of grounding. Domain grounding constrains how behavior hypotheses are generated and evaluated, semantics grounding localizes and connects supporting program evidence, and knowledge grounding supports behavioral attribution through externally verifiable threat knowledge. To study this hypothesis, we present Malaika, a multi-agent framework that operationalizes the three grounding mechanisms through analyst-inspired reasoning, tool-mediated evidence localization, and retrieval-based behavioral attribution. We instantiate Malaika for Android malware analysis and evaluate it on malware-understanding tasks. Results show that Malaika improves analysis quality over prior LLM-based malware-analysis frameworks and demonstrate that reliability depends not only on model capability but also on the reasoning process. In particular, comparisons against malware-analysis systems and frontier agentic frameworks show that grounding-aware reasoning produces more precise and auditable conclusions. Ablation studies further support the grounding hypothesis. These findings suggest that grounding-aware reasoning provides a principled foundation for reliable malware understanding and, more broadly, for evidence-grounded software analysis.

Figures

Figures reproduced from arXiv: 2607.09179 by Lorenzo Cavallaro, Xingzhi Qian, Xinran Zheng, Yiling He.

Figure 1
Figure 1. Figure 1: Motivating example of fragmented behavior reconstruc [PITH_FULL_IMAGE:figures/full_fig_p003_1.png] view at source ↗
Figure 2
Figure 2. Figure 2: Architecture of Malaika. Malaika analyzes a program by combining three forms of grounding: Domain grounding structures reasoning as a role-specialized multi-agent workflow, Semantics grounding extracts program facts and localizes security-relevant regions, and Knowledge grounding provides on-demand threat knowledge based on observed behavior. behavior hypotheses, but these hypotheses are not directly accep… view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

47 extracted references · 11 linked inside Pith

  1. [1]

    Drebin: Effective and explainable detection of android malware in your pocket

    D. Arp, M. Spreitzenbarth, M. Hubner, H. Gascon, K. Rieck, and C. Siemens, “Drebin: Effective and explainable detection of android malware in your pocket.” inNdss, vol. 14, no. 1. San Diego, CA, 2014, pp. 23–26

    2014

  2. [2]

    Adversarial examples for malware detection,

    K. Grosse, N. Papernot, P. Manoharan, M. Backes, and P. McDaniel, “Adversarial examples for malware detection,” inComputer Security– ESORICS 2017: 22nd European Symposium on Research in Computer Security, Oslo, Norway, September 11-15, 2017, Proceedings, Part II

    2017

  3. [3]

    Springer, 2017, pp. 62–79

    2017

  4. [4]

    Msdroid: Identifying malicious snippets for android malware detection,

    Y . He, Y . Liu, L. Wu, Z. Yang, K. Ren, and Z. Qin, “Msdroid: Identifying malicious snippets for android malware detection,”IEEE Transactions on Dependable and Secure Computing, vol. 20, no. 3, pp. 2025–2039, 2022

    2025

  5. [5]

    CADE: Detecting and explaining concept drift samples for security applications,

    L. Yang, W. Guo, Q. Hao, A. Ciptadi, A. Ahmadzadeh, X. Xing, and G. Wang, “CADE: Detecting and explaining concept drift samples for security applications,” in30th USENIX Security Symposium (USENIX Security 21). USENIX Association, Aug. 2021, pp. 2327–2344. [Online]. Available: https://www.usenix.org/conference/ usenixsecurity21/presentation/yang-limin

    2021

  6. [6]

    Continuous learning for android malware detection,

    Y . Chen, Z. Ding, and D. Wagner, “Continuous learning for android malware detection,” in32nd USENIX Security Symposium (USENIX Security 23), 2023, pp. 1127–1144

    2023

  7. [7]

    Learn- ing temporal invariance in android malware detectors,

    X. Zheng, S. Yang, E. C. Ngai, S. Jana, and L. Cavallaro, “Learn- ing temporal invariance in android malware detectors,”arXiv preprint arXiv:2502.05098, 2025

    Pith/arXiv arXiv 2025

  8. [8]

    Finer: Enhancing state-of-the- art classifiers with feature attribution to facilitate security analysis,

    Y . He, J. Lou, Z. Qin, and K. Ren, “Finer: Enhancing state-of-the- art classifiers with feature attribution to facilitate security analysis,” in Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security, 2023, pp. 416–430

    2023

  9. [9]

    Llms cannot reliably identify and reason about security vulnerabilities (yet?): A comprehensive evaluation, framework, and benchmarks,

    S. Ullah, M. Han, S. Pujar, H. Pearce, A. Coskun, and G. Stringhini, “Llms cannot reliably identify and reason about security vulnerabilities (yet?): A comprehensive evaluation, framework, and benchmarks,” in 2024 IEEE symposium on security and privacy (SP). IEEE, 2024, pp. 862–880

    2024

  10. [10]

    Llm4vuln: A unified evaluation framework for decoupling and enhanc- ing llms’ vulnerability reasoning,

    Y . Sun, D. Wu, Y . Xue, H. Liu, W. Ma, L. Zhang, Y . Liu, and Y . Li, “Llm4vuln: A unified evaluation framework for decoupling and enhanc- ing llms’ vulnerability reasoning,”arXiv preprint arXiv:2401.16185, 2024

    Pith/arXiv arXiv 2024

  11. [11]

    Beyond Classification: Evaluating LLMs for Fine-Grained Automatic Malware Behavior Auditing,

    X. Zheng, X. Qian, Y . He, S. Yang, and L. Cavallaro, “Beyond Classification: Evaluating LLMs for Fine-Grained Automatic Malware Behavior Auditing,”arXiv preprint arXiv:2509.14335, 2025

    arXiv 2025

  12. [12]

    Ex- ploring large language models for semantic analysis and categorization of android malware,

    B. J. Walton, M. E. Khatun, J. M. Ghawaly, and A. Ali-Gombe, “Ex- ploring large language models for semantic analysis and categorization of android malware,” in2024 Annual Computer Security Applications Conference Workshops (ACSAC Workshops). IEEE, 2024, pp. 248–254

    2024

  13. [13]

    Lamd: Context- driven android malware detection and classification with llms,

    X. Qian, X. Zheng, Y . He, S. Yang, and L. Cavallaro, “Lamd: Context- driven android malware detection and classification with llms,” in2025 IEEE Security and Privacy Workshops (SPW). IEEE, 2025, pp. 126– 136

    2025

  14. [14]

    Evaluating large language models trained on code,

    M. Chen, J. Tworek, H. Jun, Q. Yuan, H. P. D. O. Pinto, J. Kaplan, H. Edwards, Y . Burda, N. Joseph, G. Brockmanet al., “Evaluating large language models trained on code,”arXiv preprint arXiv:2107.03374, 2021

    Pith/arXiv arXiv 2021

  15. [15]

    Making frontier cybersecurity capabilities available to de- fenders with claude code security,

    Anthropic, “Making frontier cybersecurity capabilities available to de- fenders with claude code security,” https://www.anthropic.com/news/ claude-code-security, Feb. 2026, accessed: 2026-04-14

    2026

  16. [16]

    Cyber safety – codex — openai developers,

    OpenAI, “Cyber safety – codex — openai developers,” https: //developers.openai.com/codex/concepts/cyber-safety, 2026, accessed: 2026-04-14

    2026

  17. [17]

    Assessing claude mythos preview’s cybersecurity capabilities,

    N. Carlini, N. Cheng, M. M. Keane Lucas, M. Nasr, V . Prabhushankar, W. Xiao, H. Angulu, E. B. Asher, J. Bow, K. Bradwellet al., “Assessing claude mythos preview’s cybersecurity capabilities,”Claude Red Team Report, 2026

    2026

  18. [18]

    Promp- taudit: Auditing prompt sensitivity in llm-based vulnerability detection,

    S. J. Camarato, Y . Hmaiti, M. Ghadamian, and D. Mohaisen, “Promp- taudit: Auditing prompt sensitivity in llm-based vulnerability detection,” arXiv preprint arXiv:2605.24171, 2026

    Pith/arXiv arXiv 2026

  19. [19]

    Evaluating llms for obfuscation detection and classification in android apps,

    L. Ferrari, M. Alecci, J. Samhi, T. Bissyande, J. Klein, M. Ceccato, and L. Verderame, “Evaluating llms for obfuscation detection and classification in android apps,”arXiv preprint arXiv:2606.14233, 2026

    arXiv 2026

  20. [20]

    Swe-agent: Agent-computer interfaces enable automated soft- ware engineering,

    J. Yang, C. E. Jimenez, A. Wettig, K. Lieret, S. Yao, K. Narasimhan, and O. Press, “Swe-agent: Agent-computer interfaces enable automated soft- ware engineering,”Advances in Neural Information Processing Systems, vol. 37, pp. 50 528–50 652, 2024

    2024

  21. [21]

    Openhands: An open platform for ai software developers as generalist agents,

    X. Wang, B. Li, Y . Song, F. F. Xu, X. Tang, M. Zhuge, J. Pan, Y . Song, B. Li, J. Singhet al., “Openhands: An open platform for ai software developers as generalist agents,” inInternational Conference on Learning Representations, vol. 2025, 2025, pp. 65 882–65 919

    2025

  22. [22]

    Learning to locate and describe vulnerabilities,

    J. Zhang, S. Liu, X. Wang, T. Li, and Y . Liu, “Learning to locate and describe vulnerabilities,” in2023 38th IEEE/ACM International Conference on Automated Software Engineering (ASE). IEEE, 2023, pp. 332–344

    2023

  23. [23]

    Veritas: A semantically grounded agentic framework for memory corruption vulnerability detection in binaries,

    X. Zheng, A. Pesoli, M. Valleri, S. Jana, and L. Cavallaro, “Veritas: A semantically grounded agentic framework for memory corruption vulnerability detection in binaries,”arXiv preprint arXiv:2605.15097, 2026

    Pith/arXiv arXiv 2026

  24. [24]

    Appcon- text: Differentiating malicious and benign mobile app behaviors using context,

    W. Yang, X. Xiao, B. Andow, S. Li, T. Xie, and W. Enck, “Appcon- text: Differentiating malicious and benign mobile app behaviors using context,” in2015 IEEE/ACM 37th IEEE International Conference on Software Engineering, vol. 1, 2015, pp. 303–313

    2015

  25. [25]

    Semantics-aware android mal- ware classification using weighted contextual api dependency graphs,

    M. Zhang, Y . Duan, H. Yin, and Z. Zhao, “Semantics-aware android mal- ware classification using weighted contextual api dependency graphs,” inProceedings of the 2014 ACM SIGSAC conference on computer and communications security, 2014, pp. 1105–1116

    2014

  26. [26]

    Call graph soundness in android static analysis,

    J. Samhi, R. Just, T. F. Bissyand ´e, M. D. Ernst, and J. Klein, “Call graph soundness in android static analysis,” inProceedings of the 33rd ACM SIGSOFT International Symposium on Software Testing and Analysis, 2024, pp. 945–957

    2024

  27. [27]

    Beyond the TESSERACT: Trustworthy Dataset Curation for Sound Evaluations of Android Malware Classifiers,

    T. Chow, M. D’Onghia, L. Linhardt, Z. Kan, D. Arp, L. Cavallaro, and F. Pierazzi, “Beyond the TESSERACT: Trustworthy Dataset Curation for Sound Evaluations of Android Malware Classifiers,” inIEEE Conference on Secure and Trustworthy Machine Learning (SaTML), 2026

    2026

  28. [28]

    LangGraph: Build resilient language agents as graphs,

    LangChain, Inc., “LangGraph: Build resilient language agents as graphs,” https://github.com/langchain-ai/langgraph, 2026, accessed: 2026-06-17

    2026

  29. [29]

    Androguard: Reverse engineering and pentesting for android applications,

    Androguard Team, “Androguard: Reverse engineering and pentesting for android applications,” https://github.com/androguard/androguard, 2024, accessed: 2026-06-17

    2024

  30. [30]

    Billion-scale similarity search with gpus,

    J. Johnson, M. Douze, and H. J ´egou, “Billion-scale similarity search with gpus,”IEEE transactions on big data, vol. 7, no. 3, pp. 535–547, 2019

    2019

  31. [31]

    Deepseek-v3 technical report,

    A. Liu, B. Feng, B. Xue, B. Wang, B. Wu, C. Lu, C. Zhao, C. Deng, C. Zhang, C. Ruanet al., “Deepseek-v3 technical report,”arXiv preprint arXiv:2412.19437, 2024

    Pith/arXiv arXiv 2024

  32. [32]

    Identifying adversary tactics and techniques in malware binaries with an llm agent,

    Z. Xuan, X. Xu, M. Zheng, L. Z.-H. Tan, J. Guo, T. Zhang, L. Yu, C. Wang, and X. Zhang, “Identifying adversary tactics and techniques in malware binaries with an llm agent,”arXiv preprint arXiv:2602.06325, 2026

    arXiv 2026

  33. [33]

    Detecting hallucinations in large language models using semantic entropy,

    S. Farquhar, J. Kossen, L. Kuhn, and Y . Gal, “Detecting hallucinations in large language models using semantic entropy,”Nature, vol. 630, no. 8017, pp. 625–630, 2024

    2024

  34. [34]

    Tesseract: Eliminating experimental bias in malware classification across space and time (extended version),

    Z. Kan, S. McFadden, D. Arp, F. Pendlebury, R. Jordaney, J. Kinder, F. Pierazzi, and L. Cavallaro, “Tesseract: Eliminating experimental bias in malware classification across space and time (extended version),” arXiv preprint arXiv:2402.01359, 2024

    Pith/arXiv arXiv 2024

  35. [35]

    {TESSERACT}: Eliminating experimental bias in malware classifi- cation across space and time,

    F. Pendlebury, F. Pierazzi, R. Jordaney, J. Kinder, and L. Cavallaro, “{TESSERACT}: Eliminating experimental bias in malware classifi- cation across space and time,” in28th USENIX security symposium (USENIX Security 19), 2019, pp. 729–746

    2019

  36. [36]

    On the reliability and stability of selective methods in malware classification tasks,

    A. Herzog, A. Eusebi, and L. Cavallaro, “On the reliability and stability of selective methods in malware classification tasks,”arXiv preprint arXiv:2505.22843, 2025

    arXiv 2025

  37. [37]

    Trident: Improving malware detection with llms and behavioral features,

    R. Saul, J. Jiang, E. Chia, and D. Wagner, “Trident: Improving malware detection with llms and behavioral features,”arXiv preprint arXiv:2605.00297, 2026

    Pith/arXiv arXiv 2026

  38. [38]

    Sense and sensitivity: Examining the influence of semantic recall on long context code understanding,

    A. ˇStorek, M. Gupta, S. Hajizadeh, P. Srivastava, and S. Jana, “Sense and sensitivity: Examining the influence of semantic recall on long context code understanding,” inProceedings of the 64th Annual Meeting of the Association for Computational Linguistics (V olume 1: Long Papers), 2026, pp. 480–498

    2026

  39. [39]

    Repoaudit: An au- tonomous llm-agent for repository-level code auditing,

    J. Guo, C. Wang, X. Xu, Z. Su, and X. Zhang, “Repoaudit: An au- tonomous llm-agent for repository-level code auditing,” inInternational Conference on Machine Learning. PMLR, 2025, pp. 21 083–21 100

    2025

  40. [40]

    Locagent: Graph-guided llm agents for code localization,

    Z. Chen, R. Tang, G. Deng, F. Wu, J. Wu, Z. Jiang, V . Prasanna, A. Cohan, and X. Wang, “Locagent: Graph-guided llm agents for code localization,” inProceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (V olume 1: Long Papers), 2025, pp. 8697–8727

    2025

  41. [41]

    {PATCHAGENT}: A practical program repair agent mimicking human expertise,

    Z. Yu, Z. Guo, Y . Wu, J. Yu, M. Xu, D. Mu, Y . Chen, and X. Xing, “{PATCHAGENT}: A practical program repair agent mimicking human expertise,” in34th USENIX Security Symposium (USENIX Security 25), 2025, pp. 4381–4400

    2025

  42. [42]

    Patchpilot: A cost-efficient software engineering agent with early attempts on formal verification,

    H. Li, Y . Tang, S. Wang, and W. Guo, “Patchpilot: A cost-efficient software engineering agent with early attempts on formal verification,” arXiv preprint arXiv:2502.02747, 2025

    Pith/arXiv arXiv 2025

  43. [43]

    Masdroid: A multi- agent system for enhancing the analysis of android malware,

    X. Wei, Z. Yu, L. Liu, D. Sun, W. Li, and Y . Wang, “Masdroid: A multi- agent system for enhancing the analysis of android malware,” inICASSP 2026 - 2026 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), 2026, pp. 14 147–14 151

    2026

  44. [44]

    Mard: A multi-agent framework for robust android malware detection,

    X. Zeng, Y . Xian, S. Liu, X. Mou, Y . Li, L. Cui, and B. Li, “Mard: A multi-agent framework for robust android malware detection,”arXiv preprint arXiv:2604.25264, 2026

    Pith/arXiv arXiv 2026

  45. [45]

    Androsem: Semantics-guided, llm-based interpretable static android malware detec- tion,

    H. Dai, T. Qu, L. Sun, B. Jiang, S. Shang, and H. Xu, “Androsem: Semantics-guided, llm-based interpretable static android malware detec- tion,” https://github.com/AlexAshlake/AndroSem, accessed: 2026-06-07

    2026

  46. [46]

    Equipping agents for the real world with agent skills,

    Anthropic, “Equipping agents for the real world with agent skills,” https://www.anthropic.com/engineering/ equipping-agents-for-the-real-world-with-agent-skills, 2025, accessed: 2026-06-17

    2025

  47. [47]

    Skillsbench: Benchmarking how well agent skills work across diverse tasks,

    X. Li, W. Chen, Y . Liu, S. Zheng, X. Chen, Y . He, Y . Li, B. You, H. Shen, J. Sunet al., “Skillsbench: Benchmarking how well agent skills work across diverse tasks,”arXiv preprint arXiv:2602.12670, 2026

    Pith/arXiv arXiv 2026