ALIBI misleads LLM malware classifiers with fake product descriptions; verification prompts still leave errors

The 78ResearchLab team submitted the ALIBI preprint on September 17, examining how malicious files can use plausible product descriptions to mislead language models performing initial classification. The study also appeared on a technical research aggregation site; the core evidence still comes from the authors’ experiments, and the aggregated coverage provided no independent replication. [Paper](https://arxiv.org/abs/2609.19722), [research listing](https://mindpattern.ai/f/26109)

The test pipeline first extracts metadata, imported symbols, and printable strings from binaries, then passes them to a model for assessment. ALIBI adds non-executing, read-only content that supplies a fabricated security-product context for suspicious behavior, leading the model to interpret existing risk indicators as legitimate functionality. The study focuses on how attacker-controlled descriptions become trusted evidence; the model does not directly read the entire executable, nor does it necessarily receive text telling it to ignore instructions. [Method and threat model](https://arxiv.org/html/2609.19722v1)

Of 50 malicious Windows PE samples, Gemini 2.5 Pro initially classified 35 as malicious; after the descriptions were added, it reclassified 30 of those as benign. GPT-5.5 Pro and Claude Opus 4.7 issued no benign verdicts on the same set of 35 samples, but their risk assessments still showed downgrades. This comparison uses a denominator selected through Gemini’s results and cannot be treated as an overall security ranking of the three models. [Evaluation results](https://arxiv.org/html/2609.19722v1)

A separate defense experiment reran conditions with and without verification prompts using the same snapshot, reducing false benign classifications from 29/35 to 15/35; the former differs from the main experiment by one sample. The results support the usefulness of reminding models to question files’ descriptions of themselves, but the protection remains incomplete. The authors propose having a preprocessor check signatures, provenance, and structure, then supply verified facts separately from the files’ own claims; the complete pipeline has not yet been tested. [Defense results](https://arxiv.org/html/2609.19722v1)

For security tool developers, this suggests that evaluations should track not only whether the final label is correct, but also whether risk rankings decline and which text is used to support conclusions. Conflicting product descriptions could be added to regression tests to observe whether models request external evidence. Extractor and model versions should also be held fixed to avoid mistaking preprocessing differences for model defenses. If classification results determine the order of human investigations, evaluations should also measure whether downgraded samples are consequently handled later.

The study uses a limited sample set and covers only a specific static analysis workflow. Its results cannot be generalized to bypassing all antivirus tools or dynamic sandboxes, and models’ self-reported confidence scores cannot be treated as calibrated probabilities. A useful next step is to test whether adding genuinely verifiable provenance fields can sustain the defense’s effectiveness across different malware families and extraction workflows. [Study limitations](https://arxiv.org/html/2609.19722v1)