Multi-View Decompilation for LLM-Based Malware Classification

Source: arXiv:2606.20436 · Published 2026-06-18 · By Bercan Turkmen, Vyas Raina

TL;DR

This paper addresses the challenge of automating malware classification using large language models (LLMs) on decompiled binaries. Malware analysts commonly inspect compiled binaries by examining decompiled pseudo-C code since source code is unavailable, but existing LLM pipelines usually rely on a single decompiler’s output. Because decompilers are heuristic and lossy, different tools reveal different program artifacts, potentially affecting classification quality. The authors curate a balanced benchmark of 100 compiled binaries (50 benign, 50 malicious from diverse families) and generate matched pseudo-C views using two open-source decompilers, Ghidra and RetDec. Across five off-the-shelf LLMs from major families, they show that combining both decompiler views via multi-view prompting consistently improves malware-class F1 scores over single-view approaches, mainly by boosting recall on malicious samples. Analysis of prediction disagreements between decompilers reveals complementary error patterns, supporting the hypothesis that multiple imperfect views provide richer evidence. This demonstrates a simple, training-free method for practical malware triage that leverages input representation diversity to enhance LLM-based detection.

Key findings

• Combining Ghidra and RetDec views improves malicious-class F1 by +3.6 to +13.9 percentage points for 4 of 5 tested LLMs vs. the better single decompiler (e.g., gemini-2.5-flash-lite F1 improves +13.9, Llama-3.3-70B +7.9).
• Multi-view classification mainly increases recall on malicious samples, reducing false negatives which are costly in malware triage.
• Decompiler choice materially affects classification: Ghidra performs better for some models (Qwen3, GPT-5.4), RetDec for others (Llama), and no single tool dominates overall.
• Agreement analysis shows Ghidra and RetDec make different errors on the same samples, indicating their views contain complementary but not redundant evidence.
• The disagreement-triggered consensus rule (multi-view prompting only when single-view outputs differ) performs competitively but overall multi-view prompting with a single LLM call is simpler and more effective.
• All tested LLMs, including smaller and lower-cost variants (GPT-5.4-mini, Claude Haiku 4.5, Qwen3-35B), achieve substantial classification performance from decompiled pseudo-C without additional training or finetuning.
• Compiled objects were compiled uniformly with gcc 64-bit Linux -O2 and decompiled with free and open-source Ghidra and RetDec, ensuring real-world relevance and repeatability.
• The dataset and pipeline reflect realistic malware triage ambiguity by including benign programs with overlapping behaviors such as cryptography and networking, making superficial cues ineffective.

Threat model

The threat model consists of malware authors who produce compiled binaries containing malicious behavior aimed at evading detection. The defender sees only stripped, compiled binaries with no source code. The adversary does not employ obfuscation or packing techniques in this study and cannot prevent the binary from being cleanly decompiled by Ghidra or RetDec. The defender relies on LLMs acting on heuristic decompiled pseudo-code representations that may not perfectly reveal program semantics. Adversaries cannot directly manipulate or poison LLM weights or prompt inputs but may attempt subtle evasion by hiding behavior in code constructs that appear benign under some decompiler views.

Methodology — deep read

1. Threat Model & Assumptions: The adversary is a malware author who produces compiled binaries potentially containing malicious behavior (botnet, rootkits, keylogging etc.). The defender aims to detect malicious samples with no access to source code. Obfuscation and anti-decompilation techniques are not modeled; binaries are clean and decompile reliably. The defender cannot observe true source code and relies on heuristically decompiled pseudo-C. The main assumption is that decompilers produce different but partially complementary views of the binary, which an LLM can leverage for classification.

2. Data: The authors curate a benchmark of 100 C programs balanced between 50 benign utilities (parsing, cryptography, networking, monitoring) and 50 malware samples covering a broad range of families and behaviors (Mirai, MyDoom, banking trojans etc.). All programs are compiled on Linux into 64-bit x86 ELF relocatable object files with uniform gcc -O2, -fno-stack-protector, and symbol stripping. Each compiled binary is decompiled with two open-source decompilers, Ghidra and RetDec, generating matched pseudo-C views linked to ground truth labels. This setup isolates decompiler variability as the source of representation differences. All samples remain static, are never executed, and have metadata recorded including source, binary, and decompiled output paths.

3. Architecture / Algorithm: The classifier is an instruction-tuned LLM queried with natural language prompts wrapping one or two pseudo-C views. For single-view, only one decompiler output is prompted; for multi-view, both views are concatenated with instructions that the two are complementary depictions of the same binary. The model outputs a label 0 (benign) or 1 (malicious) with a rationale. No model training or fine-tuning is performed; the LLM is used off-the-shelf. Inputs are raw pseudo-C code string representations from the decompilers.

4. Training Regime: N/A - models are used as zero-shot or few-shot classifiers via prompting, without updating weights. Each sample-setting (model, single/multi-view) is run 5 independent times with temperature fixed at 0.6.

5. Evaluation Protocol: Metrics focus on the malicious class: accuracy, precision, recall, and F1 score. Recall is especially emphasized due to the high cost of missed malicious samples. Five models spanning major families (Google Gemini-2.5-flash-lite, OpenAI GPT-5.4-mini, Anthropic Claude Haiku 4.5, Alibaba Qwen3-35B, Meta Llama-3.3-70B) are tested. Single-view performance is compared across Ghidra and RetDec inputs. Multi-view performance combines both views in one prompt. A disagreement-triggered consensus baseline queries multi-view only when single-view predictions differ. Statistical analysis uses mean and standard deviation over 5 runs.

6. Reproducibility: The benchmark code, metadata, decompiled outputs, and prompts are publicly shared via GitHub. All decompilers used are free and open-source. Models include proprietary systems but their exact frozen weights for all models are not explicitly stated. Dataset is relatively small but carefully curated. No full replication results for largest models or other proprietary decompilers are reported.

Example end-to-end: A sample binary is compiled from source with uniform settings. It is decompiled into pseudo-C with Ghidra and RetDec, yielding two different C-like representations. Each is provided in a prompt to an LLM, which outputs a single-label malware classification with rationale. Single-view results differ across decompilers, causing some errors. A combined multi-view prompt concatenates both versions, allowing the LLM to reconcile discrepancies and make improved classification decisions with better recall and F1.

Technical innovations

• Empirically demonstrating that multi-decompiler pseudo-C inputs provide complementary evidence that improves LLM-based static malware classification over single-view inputs.
• Introducing a benchmark of 100 binaries with matched Ghidra and RetDec decompiled outputs covering both benign utilities and diverse malware families.
• Proposing a simple multi-view prompting scheme that concatenates outputs from multiple decompilers, enabling off-the-shelf LLMs to improve recall without additional training.
• Analyzing disagreement patterns between single-decompiler predictions to show that different decompilers expose distinct semantic artifacts relevant for classification.

Datasets

• Benchmarked compiled binaries — 100 C programs (50 benign, 50 malicious) — curated by authors, source code and decompiled views released on GitHub

Baselines vs proposed

• Qwen3 single-view best (Ghidra only): F1 = 79.5% ± 2.7 vs multi-view combined: F1 = 78.0% ± 0.7
• Llama-3.3 single-view best (RetDec only): F1 = 81.0% ± 2.4 vs multi-view combined: F1 = 88.9% ± 1.3
• Claude Haiku 4.5 single-view best (Ghidra only): F1 = 88.9% ± 1.2 vs multi-view combined: F1 = 92.5% ± 0.9
• Gemini 2.5-flash-lite single-view best (Ghidra only): F1 = 75.0% ± 2.4 vs multi-view combined: F1 = 88.9% ± 2.0
• GPT-5.4-mini single-view best (Ghidra only): F1 = 71.8% ± 2.2 vs multi-view combined: F1 = 79.5% ± 1.6

Limitations

• Dataset uses relocatable object files (.o), not fully linked executables, limiting transferability to whole-binary malware triage scenarios.
• No evaluation on obfuscated, packed, or anti-decompilation hardened binaries, which are common in real-world malware and would challenge current methods.
• Only two decompilers (Ghidra and RetDec) evaluated; results may differ with proprietary tools like IDA Pro or Binary Ninja or with more than two views combined.
• The relatively small dataset of 100 programs limits statistical power and may not capture full malware behavioral diversity.
• LLMs evaluated in zero-shot prompting mode without domain-specific finetuning; potential performance gains through training remain unexplored.
• No formal adversarial robustness testing; the ability of attackers to evade multi-view LLM classification is not investigated.

Open questions / follow-ons

• How does this multi-view approach scale to fully linked executables with more complex control flow and context?
• What is the impact of obfuscation, packing, and anti-decompilation techniques on multi-view LLM classification?
• Can learned or adaptive view selection and evidence aggregation strategies improve upon simple concatenation prompting?
• How robust are multi-view LLM classifiers to adversarially crafted binaries designed to evade detection or exploit LLM weaknesses?

Why it matters for bot defense

For bot-defense engineers or CAPTCHA practitioners interested in malware classification, this work illustrates that leveraging multiple heuristic inputs—here, decompiled pseudo-code from different tools—can improve detection recall even without retraining or complex model changes. The insight that diverse, noisy views of the same underlying artifact can be complementary is relevant for designing more robust classifiers where input preprocessing or feature extraction is lossy or heuristic-dependent. Multi-view prompting could be extended to other domains where multiple imperfect reconstructions or representations of an entity can be combined to reduce blind spots and increase signal fidelity. This approach is attractive as a low-cost, training-free way to boost LLM-based detection pipelines relying on static analysis of binaries or other obfuscated inputs. However, practitioners should be aware of limitations such as handling heavily obfuscated payloads or full executable contexts.

Cite

@article{arxiv2606_20436,
  title={ Multi-View Decompilation for LLM-Based Malware Classification },
  author={ Bercan Turkmen and Vyas Raina },
  journal={arXiv preprint arXiv:2606.20436},
  year={ 2026 },
  url={https://arxiv.org/abs/2606.20436}
}

Read the full paper

• arXiv:2606.20436 (abstract)
• arXiv:2606.20436 (PDF)