Hyeongjun Choi and coauthors claim ALIBI's non-executed security-product narratives cause frontier LLM malware analyzers to downgrade malicious binaries without changing executable behavior, exposing a need to separate attacker-controlled explanations from verified analysis evidence.

state: seedheat: mediumuncertainty: mediumconvergesscott: mediumagentic-security malware-analysis prompt-injectionHyeongjun ChoiWonyoung JungHaehoon SeoSungyup Nam

What is this?

The supplied case describes ALIBI (Adversarial Legitimacy Injection in Binaries), attributed to Hyeongjun Choi, Wonyoung Jung, Haehoon Seo, and Sungyup Nam: an attack that inserts a false security-product narrative into a non-executed, read-only binary section to influence LLM malware assessments without changing executable behavior. The case claims this makes frontier LLM analyzers downgrade malicious binaries, but the supplied web results do not identify ALIBI or corroborate its authorship, experimental results, or behavior-preservation claim. The snippets establish only broader context: LLMs are studied for malware analysis, reverse engineering, and static and dynamic analysis assistance.

Why it matters to Scott

ALIBI’s claimed verdict manipulation converges with Scott’s Security Reviewer Method requirement for independently checkable attack paths and offers a concrete adversarial test for his WordPress Security Review: can attacker-authored legitimacy narratives cause findings to be downgraded despite unchanged executable behavior? This is a distinct development from the radar’s repository-injection coverage, but the supplied snippets do not corroborate ALIBI’s results or behavior preservation, nor establish transfer from binary analysis to Scott’s source-review workflow.

ip:source.security-reviewer-method-ebookip:concept.taint-trackingdev:project.wordpress-security-reviewdev:concept.claim-bounded-adversarial-verificationradar:repository-content-agent-injectionradar:concept.prompt-injection

queries asked of Scott's wikis

agent harness trust boundaries attacker-controlled content
verified tool evidence versus natural-language explanations
indirect prompt injection code review repository metadata
security evaluation semantic manipulation behavior preservation
agent memory wiki provenance untrusted source contamination

Measured heat

now 0 pts/hpeak 0 pts/hcomments 0/hpeers p14momentum: steady2 platformsage 602h

points/hour across evidence · reading as of 2026-10-12 02:59:37.977291+11:00 · deterministic, not a model opinion

How the heat travelled

09-16 14:00	⭐ origin echo-reconstructed	ALIBI adds a non-executed read-only section containing a false security-product narrative; the authors report 30 of 35 baseline-malicious PE Hyeongjun Choi, Wonyoung Jung, Haehoon Seo, Sungyup Nam on paper (echo) · attributed from hn.story.49752647	—
09-18 11:07	first on hacker news · published · +45.1h	Alibi: Adversarial Legitimacy Injection in Binaries Against LLM Malware sbulaev	—
09-18 11:07	amplified on hacker news 👑	hn.story.49752647 sbulaev	peak 1 · 0 comments · 106% of case engagement
09-18 11:21	our radar first saw it · +45.4h	discovery anchor: hn.story.49752647	—

pace: p9 vs 1032 stories at the 336h mark (now 602h old) — behind addom-local-coding-harness (0.5x)

Evidence (2) — ⭐ canonical anchor

source	object	author	score	comments
🟧 hn	Alibi: Adversarial Legitimacy Injection in Binaries Against LLM Malware Retrieved article excerpt Open article · Retrieved 2026-09-18T11:22:20.242754+00:00 # Computer Science > Cryptography and Security arXiv:2609.19722 (cs) [Submitted on 17 Sep 2026] # Title:ALIBI: Adversarial Legitimacy Injection in Binary Input against LLM Malware Analyzers Authors:[Hyeongjun Choi](https://arxiv.org/search/cs?searchtype=author&query=Choi,+H), [Wonyoung Jung](https://arxiv.org/search/cs?searchtype=author&query=Jung,+W), [Haehoon Seo](https://arxiv.org/search/cs?searchtype=author&query=Seo,+H), [Sungyup Nam](https://arxiv.org/search/cs?searchtype=author&query=Nam,+S) View a PDF of the paper titled ALIBI: Adversarial Legitimacy Injection in Binary Input against LLM Malware Analyzers, by Hyeongjun Choi and 3 other authors [View PDF](https://arxiv.org/pdf/2609.19722) [HTML (experimental)](https://arxiv.org/html/2609.19722v1) > Abstract:Large language models are being integrated into malware triage workflows as reasoning components that summarize static evidence and produce analyst-facing verdicts. This paper shows that the same reasoning capability introduces a new attack surface. We present ALIBI, a semantic cover story attack against frontier LLM-based malware analyzers. ALIBI adds a small, non-executed read-only section to a compiled binary, containing a coherent but false security product narrative, without altering imports or executable behavior. Instead of issuing direct instructions to the model, it reframes suspicious evidence as expected behavior of a benign endpoint security tool. On a frozen PE set of 50 malicious samples, the payload flips 30 of the 35 baseline-malicious samples to benign on Gemini 2.5 Pro, while GPT-5.5 Pro and Claude Opus 4.7 produce substantial severity downgrades with significant confidence reductions even when verdict labels are preserved. The attack transfers to ELF binaries, where Gemini flips 16 of 40. A verification-guided defense prompt roughly halves the benign verdicts, but 42.9 percent of malicious samples still reach benign. LLM malware analyzers therefore require provenance checks that separate verified facts from attacker-controlled claims, not narrative trust. \| \| \| --- \| \| Comments: \| \| Subjects: \| Cryptography and Security (cs.CR); Machine Learning (cs.LG) \| \| Cite as: \| [arXiv:2609.19722](https://arxiv.org/abs/2609.19722) [cs.CR] \| \| \| (or [arXiv:2609.19722v1](https://arxiv.org/abs/2609.19722v1) [cs.CR] for this version) \| \| \| <https://doi.org/10.48550/arXiv.2609.19722> Focus to learn more arXiv-issued DOI via DataCite (pending registration) \| ## Submission history From: Hyeongjun Choi [[view email](https://arxiv.org/show-email/31b05231/2609.19722)] [v1] Thu, 17 Sep 2026 05:27:59 UTC (140 KB) Full-text links: ## Access Paper: View a PDF of the paper titled ALIBI: Adversarial Legitimacy Injection in Binary Input against LLM Malware Analyzers, by Hyeongjun Choi and 3 other authors - [View PDF](https://arxiv.org/pdf/2609.19722) - [HTML (experimental)](https://arxiv.org/html/2609.19722v1) - [TeX Source](https://arxiv.org/src/2609.19722) [view license](http://arxiv.org/licenses/nonexclusive-distrib/1.0/ "Rights to this article") ### Current browse context: cs.CR [< prev](https://arxiv.org/prevnext?id=2609.19722&function=prev&context=cs.CR "previous in cs.CR (accesskey p)") \| [next >](https://arxiv.org/prevnext?id=2609.19722&function=next&context=cs.CR "next in cs.CR (accesskey n)") [new](https://arxiv.org/list/cs.CR/new) \| [recent](https://arxiv.org/list/cs.CR/recent) \| [2026-09](https://arxiv.org/list/cs.CR/2026-09) Change to browse by: [cs](https://arxiv.org/abs/2609.19722?context=cs) [cs.LG](https://arxiv.org/abs/2609.19722?context=cs.LG) ### References & Citations - [NASA ADS](https://ui.adsabs.harvard.edu/abs/arXiv:2609.19722) - [Google Scholar](https://scholar.google.com/scholar_lookup?arxiv_id=2609.19722) - [Semantic Scholar](https://api.semanticscholar.org/arXiv:2609.19722) export BibTeX citation Loading... ## BibTeX formatted citation × loading... Data provided by: ### Bookmark [BibSonomy](http://www.bibsonomy.org/BibtexHandler?requTask=upload&url=https://arxiv.org/abs/2609.19722&description=ALIBI: Adversarial Legitimacy Injection in Binary Input against LLM Malware Analyzers "Bookmark on BibSonomy") [Reddit](https://reddit.com/submit?url=https://arxiv.org/abs/2609.19722&title=ALIBI: Adversarial Legitimacy Injection in Binary Input against LLM Malware Analyzers "Bookmark on Reddit") Bibliographic Tools # Bibliographic and Citation Tools Bibliographic Explorer Toggle Bibliographic Explorer ([What is the Explorer?](https://info.arxiv.org/labs/showcase.html#arxiv-bibliographic-explorer)) Connected Papers Toggle Connected Papers ([What is Connected Papers?](https://www.connectedpapers.com/about)) Litmaps Toggle Litmaps ([What is Litmaps?](https://www.litmaps.co/)) scite.ai Toggle scite Smart Citations ([What are Smart Citations?](https://www.scite.ai/)) Code, Data, Media # Code, Data and Media Associated with this Article alphaXiv Toggle alphaXiv ([What is alphaXiv?](https://alphaxiv.org/)) Links to Code Toggle CatalyzeX Code Finder for Papers ([What is CatalyzeX?](https://www.catalyzex.com)) DagsHub Toggle DagsHub ([What is DagsHub?](https://dagshub.com/)) GotitPub Toggle Gotit.pub ([What is GotitPub?](http://gotit.pub/faq)) Huggingface Toggle Hugging Face ([What is Huggingface?](https://huggingface.co/huggingface)) ScienceCast Toggle ScienceCast ([What is ScienceCast?](https://sciencecast.org/welcome)) Demos # Demos Replicate Toggle Replicate ([What is Replicate?](https://replicate.com/docs/arxiv/about)) Spaces Toggle Hugging Face Spaces ([What is Spaces?](https://huggingface.co/docs/hub/spaces)) Spaces Toggle TXYZ.AI ([What is TXYZ.AI?](https://txyz.ai)) Related Papers # Recommenders and Search Tools Link to Influence Flower Influence Flower ([What are Influence Flowers?](https://influencemap.cmlab.dev/)) Core recommender toggle CORE Recommender ([What is CORE?](https://core.ac.uk/services/recommender)) - Author - Venue - Institution - Topic About arXivLabs # arXivLabs: experimental projects with community collaborators arXivLabs is a framework that allows collaborators to develop and share new arXiv features directly on our website. Both individuals and organizations that work with arXivLabs have embraced and accepted our values of openness, community, excellence, and user data privacy. arXiv is committed to these values and only works with partners that adhere to them. Have an idea for a project that will add value for arXiv's community? [Learn more about arXivLabs](https://info.arxiv.org/labs/index.html). [Which authors of this paper are endorsers?](https://arxiv.org/auth/show-endorsers/2609.19722) \| Disable MathJax ([What is MathJax?](https://info.arxiv.org/help/mathjax.html))	sbulaev	1	0
🟧 echo.paper ⭐	ALIBI adds a non-executed read-only section containing a false security-product narrative; the authors report 30 of 35 baseline-malicious PE	Hyeongjun Choi, Wonyoung Jung, Haehoon Seo, Sungyup Nam	—	—

source

object

author

score

comments

🟧 hn

Alibi: Adversarial Legitimacy Injection in Binaries Against LLM Malware

Retrieved article excerpt

Open article · Retrieved 2026-09-18T11:22:20.242754+00:00

# Computer Science > Cryptography and Security

**arXiv:2609.19722** (cs)

[Submitted on 17 Sep 2026]

# Title:ALIBI: Adversarial Legitimacy Injection in Binary Input against LLM Malware Analyzers

Authors:[Hyeongjun Choi](https://arxiv.org/search/cs?searchtype=author&query=Choi,+H), [Wonyoung Jung](https://arxiv.org/search/cs?searchtype=author&query=Jung,+W), [Haehoon Seo](https://arxiv.org/search/cs?searchtype=author&query=Seo,+H), [Sungyup Nam](https://arxiv.org/search/cs?searchtype=author&query=Nam,+S)

View a PDF of the paper titled ALIBI: Adversarial Legitimacy Injection in Binary Input against LLM Malware Analyzers, by Hyeongjun Choi and 3 other authors

[View PDF](https://arxiv.org/pdf/2609.19722)
[HTML (experimental)](https://arxiv.org/html/2609.19722v1)
> Abstract:Large language models are being integrated into malware triage workflows as reasoning components that summarize static evidence and produce analyst-facing verdicts. This paper shows that the same reasoning capability introduces a new attack surface. We present ALIBI, a semantic cover story attack against frontier LLM-based malware analyzers. ALIBI adds a small, non-executed read-only section to a compiled binary, containing a coherent but false security product narrative, without altering imports or executable behavior. Instead of issuing direct instructions to the model, it reframes suspicious evidence as expected behavior of a benign endpoint security tool. On a frozen PE set of 50 malicious samples, the payload flips 30 of the 35 baseline-malicious samples to benign on Gemini 2.5 Pro, while GPT-5.5 Pro and Claude Opus 4.7 produce substantial severity downgrades with significant confidence reductions even when verdict labels are preserved. The attack transfers to ELF binaries, where Gemini flips 16 of 40. A verification-guided defense prompt roughly halves the benign verdicts, but 42.9 percent of malicious samples still reach benign. LLM malware analyzers therefore require provenance checks that separate verified facts from attacker-controlled claims, not narrative trust.

|  |
| --- |
| Comments: |
| Subjects: | Cryptography and Security (cs.CR); Machine Learning (cs.LG) |
| Cite as: | [arXiv:2609.19722](https://arxiv.org/abs/2609.19722) [cs.CR] |
|  | (or  [arXiv:2609.19722v1](https://arxiv.org/abs/2609.19722v1) [cs.CR] for this version) |
|  | <https://doi.org/10.48550/arXiv.2609.19722> Focus to learn more  arXiv-issued DOI via DataCite (pending registration) |

## Submission history

From: Hyeongjun Choi [[view email](https://arxiv.org/show-email/31b05231/2609.19722)]   
 **[v1]**
Thu, 17 Sep 2026 05:27:59 UTC (140 KB)

Full-text links:

## Access Paper:

View a PDF of the paper titled ALIBI: Adversarial Legitimacy Injection in Binary Input against LLM Malware Analyzers, by Hyeongjun Choi and 3 other authors

- [View PDF](https://arxiv.org/pdf/2609.19722)
- [HTML (experimental)](https://arxiv.org/html/2609.19722v1)
- [TeX Source](https://arxiv.org/src/2609.19722)

[view license](http://arxiv.org/licenses/nonexclusive-distrib/1.0/ "Rights to this article")

### Current browse context:

cs.CR

[< prev](https://arxiv.org/prevnext?id=2609.19722&function=prev&context=cs.CR "previous in cs.CR (accesskey p)")
  |   
[next >](https://arxiv.org/prevnext?id=2609.19722&function=next&context=cs.CR "next in cs.CR (accesskey n)")

[new](https://arxiv.org/list/cs.CR/new)
 | 
[recent](https://arxiv.org/list/cs.CR/recent)
 | [2026-09](https://arxiv.org/list/cs.CR/2026-09)

Change to browse by:

[cs](https://arxiv.org/abs/2609.19722?context=cs)  
[cs.LG](https://arxiv.org/abs/2609.19722?context=cs.LG)

### References & Citations

- [NASA ADS](https://ui.adsabs.harvard.edu/abs/arXiv:2609.19722)
- [Google Scholar](https://scholar.google.com/scholar_lookup?arxiv_id=2609.19722)
- [Semantic Scholar](https://api.semanticscholar.org/arXiv:2609.19722)

export BibTeX citation
Loading...

## BibTeX formatted citation

×

loading...

Data provided by:

### Bookmark

[BibSonomy](http://www.bibsonomy.org/BibtexHandler?requTask=upload&url=https://arxiv.org/abs/2609.19722&description=ALIBI: Adversarial Legitimacy Injection in Binary Input against LLM Malware Analyzers "Bookmark on BibSonomy")
[Reddit](https://reddit.com/submit?url=https://arxiv.org/abs/2609.19722&title=ALIBI: Adversarial Legitimacy Injection in Binary Input against LLM Malware Analyzers "Bookmark on Reddit")



Bibliographic Tools

# Bibliographic and Citation Tools

Bibliographic Explorer Toggle

Bibliographic Explorer *([What is the Explorer?](https://info.arxiv.org/labs/showcase.html#arxiv-bibliographic-explorer))*

Connected Papers Toggle

Connected Papers *([What is Connected Papers?](https://www.connectedpapers.com/about))*

Litmaps Toggle

Litmaps *([What is Litmaps?](https://www.litmaps.co/))*

scite.ai Toggle

scite Smart Citations *([What are Smart Citations?](https://www.scite.ai/))*

Code, Data, Media

# Code, Data and Media Associated with this Article

alphaXiv Toggle

alphaXiv *([What is alphaXiv?](https://alphaxiv.org/))*

Links to Code Toggle

CatalyzeX Code Finder for Papers *([What is CatalyzeX?](https://www.catalyzex.com))*

DagsHub Toggle

DagsHub *([What is DagsHub?](https://dagshub.com/))*

GotitPub Toggle

Gotit.pub *([What is GotitPub?](http://gotit.pub/faq))*

Huggingface Toggle

Hugging Face *([What is Huggingface?](https://huggingface.co/huggingface))*

ScienceCast Toggle

ScienceCast *([What is ScienceCast?](https://sciencecast.org/welcome))*

Demos

# Demos

Replicate Toggle

Replicate *([What is Replicate?](https://replicate.com/docs/arxiv/about))*

Spaces Toggle

Hugging Face Spaces *([What is Spaces?](https://huggingface.co/docs/hub/spaces))*

Spaces Toggle

TXYZ.AI *([What is TXYZ.AI?](https://txyz.ai))*

Related Papers

# Recommenders and Search Tools

Link to Influence Flower

Influence Flower *([What are Influence Flowers?](https://influencemap.cmlab.dev/))*

Core recommender toggle

CORE Recommender *([What is CORE?](https://core.ac.uk/services/recommender))*

- Author
- Venue
- Institution
- Topic


About arXivLabs

# arXivLabs: experimental projects with community collaborators

arXivLabs is a framework that allows collaborators to develop and share new arXiv features directly on our website.

Both individuals and organizations that work with arXivLabs have embraced and accepted our values of openness, community, excellence, and user data privacy. arXiv is committed to these values and only works with partners that adhere to them.

Have an idea for a project that will add value for arXiv's community? [**Learn more about arXivLabs**](https://info.arxiv.org/labs/index.html).

[Which authors of this paper are endorsers?](https://arxiv.org/auth/show-endorsers/2609.19722) |
Disable MathJax ([What is MathJax?](https://info.arxiv.org/help/mathjax.html))

sbulaev

🟧 echo.paper ⭐

ALIBI adds a non-executed read-only section containing a false security-product narrative; the authors report 30 of 35 baseline-malicious PE

Hyeongjun Choi, Wonyoung Jung, Haehoon Seo, Sungyup Nam

—

Interpretation history

2026-09-18T11:26:21Z
grounded: converges/medium — ALIBI’s claimed verdict manipulation converges with Scott’s Security Reviewer Method requirement for independently checkable attack paths and offers a concrete
2026-09-18T11:22:56Z
case created — A first-party paper supplies a bounded attack mechanism and quantitative results with direct implications for AI-assisted defensive tooling.

Decision trace

10-02 20:58review_dormantscheduled targets exhausted or 28 quiet days
10-02 20:58drop_targetsquiet through full ladder or over cap 8
09-18 21:26groundALIBI’s claimed verdict manipulation converges with Scott’s Security Reviewer Method requirement for independently checkable attack paths and offers a concrete adversarial test for his WordPress Secur
09-18 21:22createA first-party paper supplies a bounded attack mechanism and quantitative results with direct implications for AI-assisted defensive tooling.