Multi-View Decompilation for LLM-Based Malware Classification

Technical Summary: Multi-View Decompilation for LLM-Based Malware Classification

Problem Statement
Malware analysts frequently rely on decompiled pseudo-C code to inspect compiled binaries when source code is unavailable. While Large Language Models (LLMs) have shown promise in automating the classification of such decompiled code as benign or malicious, existing pipelines typically rely on a single decompiler's output. The authors argue this assumption is fragile because decompilation is a lossy, heuristic process. Different tools make distinct choices regarding control-flow recovery, variable naming, type inference, and expression simplification. Consequently, a single decompiler view may obscure malicious behaviors or introduce tool-specific artifacts that mislead an LLM, while another tool might expose the same behavior more clearly.

Methodology
To investigate whether multiple decompiler views provide complementary evidence, the authors constructed a balanced benchmark of 100 C programs (50 benign utilities and 50 malicious samples covering families like Mirai, MyDoom, and rootkits). Each program was compiled into a 64-bit x86 ELF object file and decompiled using two widely used open-source tools: Ghidra and RetDec.

The study evaluated a panel of five instruction-tuned LLMs (including GPT-5.4-mini, Claude Haiku 4.5, Llama-3.3-70B, Qwen3-35B, and Gemini-2.5-flash-lite) across three prompting settings:

1. Single-View: The LLM classifies the output of either Ghidra or RetDec independently.
2. Multi-View: The LLM receives both decompiled views in a single prompt, instructed to treat them as complementary representations of the same binary.
3. Disagreement-Triggered Consensus: The system runs single-view predictions first; if they agree, that label is accepted. If they disagree, a multi-view prompt is triggered to resolve the conflict.

The evaluation focused on the malicious class, prioritizing recall and F1 score, as false negatives (missing malware) are particularly costly in triage scenarios.

Key Results

• Decompiler Variability: The choice of decompiler significantly impacts classification performance. No single tool was universally superior; for instance, Ghidra yielded better results for Qwen and GPT models, while RetDec performed better for Llama-3.3-70B.
• Performance Gains: The Multi-View setting consistently outperformed single-view baselines across most model families. It improved the malicious-class F1 score by up to +13.9 points (for Gemini-2.5-flash-lite) and +7.9 points (for Llama-3.3-70B) compared to the best single-view result.
• Mechanism of Improvement: The gains were primarily driven by increased recall. Analysis of prediction disagreements showed that when one decompiler obscured malicious behavior (leading to a false negative), the other often exposed sufficient evidence for the LLM to correctly identify the sample as malicious.
• Model Efficiency: The multi-view approach was particularly effective for smaller, lower-cost models, allowing them to close the performance gap with larger, more expensive models (e.g., Gemini Pro).
• Consensus Rule: The disagreement-triggered consensus rule was competitive but generally did not outperform direct multi-view prompting, suggesting that the benefit of combining views extends beyond just resolving explicit disagreements.

Significance and Contributions
The paper makes three primary contributions:

1. A Curated Benchmark: A dataset of matched Ghidra and RetDec outputs for 100 benign and malicious C programs, enabling reproducible evaluation of decompiler variability.
2. A Multi-View Formulation: A novel pipeline that treats multiple decompiler outputs as complementary evidence rather than relying on a single canonical representation.
3. Empirical Validation: Evidence that decompiler diversity is a simple, training-free method to improve LLM-based malware triage.

Significance Claims
The authors position this work as a practical solution for real-world malware triage. They emphasize that multi-decompiler prompting improves detection rates (specifically recall) without requiring model training, access to source code, or complex ensemble architectures. By leveraging existing open-source decompilers and off-the-shelf LLMs, this approach offers a cost-effective way to mitigate the "fragile" nature of single-view decompilation, ensuring that malicious behaviors obscured by one tool's heuristics are not missed.

Limitations
The authors acknowledge several constraints:

• The benchmark uses relocatable object files (.o) rather than full executables, which may not fully capture the context of deployed binaries.
• The study assumes clean decompilation; it does not evaluate performance against heavily obfuscated, packed, or anti-decompilation-hardened binaries.
• The findings are based on two specific decompilers (Ghidra and RetDec) and may vary with proprietary tools or a larger number of views.