aiqbench analysis
This research introduces a byte-native LLM capable of directly analyzing raw executable binaries, addressing the limitations of standard models that cannot process low-level data. By employing a bespoke tokenizer and domain-specific training, the model achieves high accuracy in malware classification and architecture identification, suggesting that specialized vocabulary expansion is critical for security applications. The current deployment to a limited analyst group indicates this is an emerging tool rather than a production-ready solution, highlighting the need for further validation before broader adoption.
Large Byte Model: Teaching Language Models About Compiled Code
arXiv:2606.02834v1 Announce Type: cross Abstract: Malware analysis starts with the raw bytes of an executable program, and tools to "lift" these to higher-level representations, such as assembly, are expensive and subject to error. Large Language Models (LLMs) cannot process raw byte representations and answer questions about them. To this end, we present the first byte-native LLM. Based on a vocabulary expansion technique using a bespoke byte tokenizer, such a model is capable of responding to complex questions about malware binaries, with accuracies ranging from 69% for malware family classification to 98% for architecture classification. Our findings indicate that providing domain knowledge during training is essential for this application -- off-the-shelf models lack both accuracy and insight. We've deployed this emerging solution to a limited number of analysts to gather feedback for further improvements.
Abstract:Malware analysis starts with the raw bytes of an executable program, and tools to "lift" these to higher-level representations, such as assembly, are expensive and subject to error. Large Language Models (LLMs) cannot process raw byte representations and answer questions about them. To this end, we present the first byte-native LLM. Based on a vocabulary expansion technique using a bespoke byte tokenizer, such a model is capable of responding to complex questions about malware binaries, with accuracies ranging from 69% for malware family classification to 98% for architecture classification. Our findings indicate that providing domain knowledge during training is essential for this application -- off-the-shelf models lack both accuracy and insight. We've deployed this emerging solution to a limited number of analysts to gather feedback for further improvements.
Cryptography and Security (cs.CR); Artificial Intelligence (cs.AI)
arXiv:2606.02834 [cs.CR]
(or arXiv:2606.02834v1 [cs.CR] for this version)
https://doi.org/10.48550/arXiv.2606.02834 Focus to learn more arXiv-issued DOI via DataCite (pending registration)
arXivLabs is a framework that allows collaborators to develop and share new arXiv features directly on our website.
Both individuals and organizations that work with arXivLabs have embraced and accepted our values of openness, community, excellence, and user data privacy. arXiv is committed to these values and only works with partners that adhere to them.
Have an idea for a project that will add value for arXiv's community? Learn more about arXivLabs.
Full text under the publisher's open licence · 226 words
Related coverage
SLATE: Are AI-Generated Slides Educationally Effective? A Benchmark for Language Teaching Quality and Learner Knowledge Acquisition
arXiv · Sep 9, 2026
TeachArena: Are Language Agents Ready for Realistic Teaching Work?
arXiv · Aug 5, 2026
IKS-Instruct: A 24,000-Example Multilingual Dataset for Teaching Language Models Indian Knowledge Systems
arXiv · Jul 28, 2026
Query Feedback and Teaching for Stable and Certifiable Language Generation
arXiv · Oct 22, 2026