A paper posted to arXiv this week demonstrates a practical attack against large language models used for malware analysis, and the results are stark. The technique, called ALIBI, flips the verdict on malicious binaries by embedding a convincing but entirely false story inside the file itself.
LLMs are increasingly used in malware triage. They read static evidence from a binary and produce analyst-facing summaries and verdicts. The same reasoning capability that makes them useful for this job also introduces a new attack surface. ALIBI exploits it by adding a small, non-executed read-only section to a compiled binary. That section contains a coherent narrative claiming the file is a legitimate security product. It does not change the binary's imports or executable behavior. It only changes what the model reads.
How the cover story works
Instead of issuing direct instructions to the model, ALIBI reframes suspicious evidence as expected behavior of a benign endpoint security tool. The narrative sits in a section the binary never executes, so traditional analysis tools see nothing wrong. But when an LLM reads the binary during triage, it encounters the false story and treats it as context.
On a frozen set of 50 malicious PE samples, the attack flipped 30 of the 35 samples that baseline analysis had correctly identified as malicious on Gemini 2.5 Pro. GPT-5.5 Pro and Claude Opus 4.7 produced substantial severity downgrades with significant confidence reductions, even when the final verdict labels stayed the same. The model still thought the files were less dangerous than they actually were.
The attack transfers to ELF binaries. On that format, Gemini flipped 16 of 40 malicious samples to benign.
Existing defenses fall short
The researchers tested a verification-guided defense prompt designed to make the model check claims against observed evidence. It roughly halved the benign verdicts, but 42.9% of malicious samples still reached a benign classification. The prompt alone is not enough.
The paper argues that LLM malware analyzers need provenance checks that separate verified facts from attacker-controlled claims. A narrative embedded in a binary is an attacker-controlled claim. The model should not trust it without corroboration, and right now it does.
What this means for defenders
The core problem is straightforward. LLMs read text, and attackers can put text inside binaries. The text does not need to execute. It does not need to alter behavior. It only needs to exist in a place the model will read it, and it needs to sound plausible.
For teams using LLMs in malware triage, the paper is a warning that the model's reasoning can be steered by content the attacker controls. The binary's actual behavior, the imports, the syscall patterns, the network calls, those are facts. A narrative section claiming the file is benign is a claim. Current models do not reliably distinguish between the two.
The practical takeaway is that LLM-based analysis should be treated as one signal among several, not as a final verdict. And any system that feeds binaries to an LLM for triage should consider stripping non-executable sections or at minimum flagging attacker-controlled text as untrusted. The defense prompt helps but leaves too many samples misclassified to be relied on alone.
The paper also raises a broader question about trust in AI-generated security assessments. If an attacker can embed a convincing explanation inside the thing being analyzed, and the analyzer believes it, the tool is not just failing to detect malware. It is being actively deceived by it.