Decompiled Malware Classification (Ghidra): leaderboard
Metric: Malicious-class F1 (%; 100 C programs, 50 benign utilities and 50 malware samples, compiled with gcc -O2 and stripped; the model reads the Ghidra decompilation and returns a benign or malicious label after a brief rationale; mean of five runs at temperature 0.6). Source: arxiv.org. Saturation forecast: Around December 2026. 6 models tracked.
Top models
| # | Model | Score |
|---|---|---|
| 1 | Claude Haiku 4.5 | 88.9 |
| 2 | Gemini 2.5 Pro | 83.7 |
| 3 | Qwen 3.6 35B A3B | 79.5 |
| 4 | Llama 3.3 70B Instruct | 75 |
| 5 | Gemini 2.5 Flash Lite | 75 |
| 6 | GPT-5.4 Mini | 71.8 |
Interactive version: theaggregate.ai/benchmark?slug=decompiled-malware-classification-ghidra · How It Works · Data refreshed daily, snapshot 2026-09-26.