Quantifiable Uncertainty: A Stochastic Consensus Multi-Agent RAG Framework for Robust Malware Detection

arXiv 2605.08385 ↗First posted 8 May 2026cs.CRcited by 0

On the map: Retrieval-augmented generation → Privacy and security of RAG

Abstract (arXiv)

While contemporary deep learning malware detectors define a dominant defense paradigm, their sophistication also exposes them to novel structural evasion attacks, a limitation we attribute to their inherent inability to express epistemic uncertainty. To address this challenge, we present MAGMA, a Retrieval-Augmented Generation (RAG) framework that decouples malware analysis into semantic code retrieval and probabilistic verification. In contrast to monolithic classifiers, MAGMA employs a dual-stream embedding scheme over assembly and pseudo-code representations to isolate Decision-Critical Functions (DCFs) from the noise of dead code. We further introduce a Stochastic Consistency Ensemble, in which multiple instances of the same reasoning agent independently evaluate the retrieval set under non-deterministic sampling. From this ensemble, we derive two complementary metrics: Function Evidence Strength (FES), a weighted aggregation of retrieval confidence, and the Evidence Conflict Score (ECS), defined as the Shannon entropy of the ensemble's predictive distribution. We show that elevated ECS values serve as an effective proxy for structural ambiguity, enabling the system to implement a principled ``reject-option'' policy. Extensive evaluation demonstrates that MAGMA achieves a 98.4% detection rate, substantially exceeding existing solutions.

Key facts. No citing papers in the map yet (data through 14 Oct 2026). Placed in Privacy and security of RAG, one of 15 directions in Retrieval-augmented generation. Builds on 17 of its 45 references that are in the map. First posted on arXiv 8 May 2026.

Builds on

17 of 45 references.

References · 17

2015Deep Residual Learning for Image Recognitioncited by 52,096
2022Chain-of-Thought Prompting Elicits Reasoning in Large Language Modelscited by 12,459
2022Self-Consistency Improves Chain of Thought Reasoning in Language Modelscited by 5,708
2015Dropout as a Bayesian Approximation: Representing Model Uncertainty in Deep Learningcited by 4,448
2016Simple and Scalable Predictive Uncertainty Estimation using Deep Ensemblescited by 3,926
2021Asleep at the Keyboard? Assessing the Security of GitHub Copilot's Code Contributionscited by 431
2018Why ReLU networks yield high-confidence predictions far away from the training data and how to mitigate the problemcited by 323
2018EMBER: An Open Dataset for Training Static PE Malware Machine Learning Modelscited by 165
2017Malware Detection by Eating a Whole EXEcited by 115
2018TESSERACT: Eliminating Experimental Bias in Malware Classification across Space and Timecited by 108
2020Dos and Don'ts of Machine Learning in Computer Securitycited by 102
2020Functionality-preserving Black-box Optimization of Adversarial Windows Malwarecited by 58

5 more

2020Transcending Transcend: Revisiting Malware Classification in the Presence of Concept Driftcited by 53
2020SOREL-20M: A Large Scale Benchmark Dataset for Malicious PE Detectioncited by 49
2017Android Malware Detection using Deep Learning on API Method Sequencescited by 4
2025Applying Graph Analysis for Unsupervised Fast Malware Fingerprintingcited by 1
2026AsmRAG: LLM-Driven Malware Detection by Retrieving Functionally Similar Assembly Codecited by 1

Built on by

Not cited yet.

Similar, not cited

Close in wording, no citation either way