Decompiled Malware Classification (Multi-View): leaderboard
Malware triage from decompiled code (Turkmen and Raina, 2026): 100 C programs, 50 benign utilities with malware-like idioms and 50 malware samples, are compiled with gcc -O2, stripped and decompiled, and the model labels each benign or malicious after a brief rationale while reading the Ghidra and RetDec pseudo-C together in one prompt. Malicious-class F1 in percent, mean of five runs at temperature 0.6; higher is better.
Metric: Malicious-class F1 (%; 100 C programs, 50 benign utilities and 50 malware samples, compiled with gcc -O2 and stripped; the model reads both decompilations in one prompt and returns a benign or malicious label after a brief rationale; mean of five runs at temperature 0.6). Source: arxiv.org. Saturation forecast: Not forecast. 6 models tracked.
Top models
| # | Model | Score | Overall rank |
|---|---|---|---|
| 1 | Claude Haiku 4.5 | 92.5 | #568 |
| 2 | Llama 3.3 70B Instruct | 88.9 | #1353 |
| 3 | Gemini 2.5 Flash Lite | 88.9 | #958 |
| 4 | Gemini 2.5 Pro | 85.4 | #262 |
| 5 | GPT-5.4 Mini | 79.5 | #389 |
| 6 | Qwen 3.6 35B A3B | 78 | #461 |
No result here: #1 Claude Fable 5.2, #2 Gemini 4 Carbon, #5 Claude Opus 5.5.
Interactive version: theaggregate.ai/benchmark?slug=decompiled-malware-classification-multi-view · How It Works · Data refreshed daily, snapshot 2026-11-12.