LLMalMorph: LLM Morphing Techniques

• LLMalMorph is a heterogeneous motif that transforms LLM systems, inputs, or behaviors through techniques like parameter merging, architectural metamorphosis, and metamorphic mutation.
• Its methodologies include automated search in transformation spaces, zero-shot model adaptations, and rigorously tested mutation pipelines that enhance reliability and performance.
• Applications span generating malware variants, detecting morphing attacks, cross-modal image registration, and influencing agent behavior in cybersecurity.

LLMalMorph most directly names the framework introduced in “LLMalMorph: On The Feasibility of Generating Variant Malware using Large-Language-Models” (Akil et al., 12 Jul 2025), but adjacent literature uses closely related labels such as “LLM-Morph” for multimodal deformable image registration (Ma et al., 2024) and “LLMORPH” for automated metamorphic testing (Cho et al., 24 Mar 2026). This suggests that LLMalMorph is best understood not as a single standardized method, but as a heterogeneous research motif at the intersection of LLMs and morphing. In this literature, “morphing” can denote parameter-space model merging, architectural metamorphosis, metamorphic mutation of specifications or tests, biometric morphing attack detection, malware variant generation, or persistent behavior steering through poisoned memory.

1. Scope and meanings of “morphing” in LLM research

The literature grouped around LLMalMorph uses the term “morph” in several technically distinct ways. In model-centric work, it denotes transformation of model parameters or topology; in software engineering, it denotes metamorphic mutation of prompts, specifications, or tests; in biometric security, it denotes detection of face morphing attacks; and in adversarial security, it denotes either source-level malware variant generation or long-term behavior manipulation of tool-augmented agents. A separate mathematical-morphology lineage studies exact discrete local operators for binary images and clarifies that “morphology” can also refer to Boolean-lattice operator structure rather than LLM prompting or multimodal reasoning (Marcondes et al., 2023).

Usage of “morph”	Representative paper	Core object
Parameter-space merge search	(Li et al., 2024)	Merge configuration
Architectural metamorphosis	(Novikov, 26 Nov 2025)	Dense MLP to static MoE
Multimodal registration	(Ma et al., 2024)	Cross-modal feature alignment
Metamorphic mutation/testing	(Akhond et al., 23 Nov 2025)	Specifications and tests
Morphing attack detection	(Shekhawat et al., 21 May 2025)	Bona fide vs morphed faces
Malware variant generation	(Akil et al., 12 Jul 2025)	Source-code rewrites
Memory-based behavior morphing	(Zhang et al., 24 May 2026)	Tool-selection policy

This breadth has two implications. First, the commonality is not a single algorithmic primitive, but a recurrent idea of transforming an LLM system, its inputs, or its downstream behavior while preserving, redistributing, or subverting some target property. Second, the literature repeatedly shifts between literal image morphs, symbolic metamorphic relations, and parameter or policy morphisms. Any rigorous use of the term therefore requires domain qualification.

2. Parameter-space and architectural morphing

A prominent line of work treats LLM morphing as transformation in parameter space. “It’s Morphing Time: Unleashing the Potential of Multiple LLMs via Multi-objective Optimization” formalizes model merging as a black-box multi-objective optimization problem over merge configurations built on top of sparse task-vector pipelines such as DARE+TIES. The decision vector $\boldsymbol{x}$ denotes a merge configuration, the objective vector $\boldsymbol{f}(\boldsymbol{x})$ denotes task losses or negative task scores, and search is conducted by parallel multi-objective Bayesian optimization with qEHVI over C-EVAL validation and $1\%$ of GSM8K train. On three homologous Qwen1.5-7B descendants, MM-MO reports 71.4 on C-EVAL, 66.56 on GSM8K, and 56.09 on HumanEval, exceeding Task Arithmetic, TIES, DARE+TIES, and each individual source model; however, the paper does not specify the exact merge-parameter notation, BO budget, batch size, or a formal final-selection rule (Li et al., 2024).

A stricter notion of morphing appears in “MLPMoE: Zero-Shot Architectural Metamorphosis of Dense LLM MLPs into Static Mixture-of-Experts,” where a dense gated MLP is rewritten as

$$\mathrm{MLPMoE}(x)=\sum_{b=1}^{B}\alpha_b\, W^{(b)}_{\text{down}}\Big[\phi(W^{(b)}_{\text{gate}}x)\odot (W^{(b)}_{\text{up}}x)\Big].$$

The transformation is exact when the intermediate dimension is partitioned consistently, all branches are summed, and $\alpha_b=1$. The method is training-free, deterministic, and post hoc. On Qwen2.5-0.5B-Instruct and DeepSeek-R1-Distill-Llama-8B, the zero-shot conversion changes proxy perplexity by less than $0.05$ percent, while Fractal Fade and Compensated Pruning expose branchwise sparsity and branch removal. The paper is explicit that vanilla MLPMoE does not reduce activated parameters per token and currently increases wall-clock generation time because all branches are still computed and no optimized sparse kernels are used (Novikov, 26 Nov 2025).

MoRA extends the same morphing logic to multimodal molecular reasoning by making parameter adaptation instance-specific rather than task-static. Instead of projecting a molecular graph into token space alone, a frozen graph encoder and a trainable Molecule-Aware Weight Generator produce molecule-specific low-rank updates that are injected into a frozen Vicuna-7B via $$\hat{\mathbf{W}}=\mathbf{W}+\mathbf{W}_{\text{mol}}$$. On forward reaction prediction, retrosynthesis, molecular captioning, and QM9 property prediction, MoRA reports Exact $0.697$ on forward reaction prediction and average QM9 MAE $0.0038$, corresponding to a $14.1\%$ relative improvement over UniMoT on reaction exact match and a $\boldsymbol{f}(\boldsymbol{x})$0 relative MAE reduction over UniMoT. The paper also reports that dynamic instance-specific adaptation preserves GSM8K and MMLU performance better than static task-oriented adaptation, while noting ambiguities in the mapping from $\boldsymbol{f}(\boldsymbol{x})$1 distilled queries to all adapted layers and components (Yin et al., 14 Oct 2025).

Across these papers, morphing is primarily a change in model realization rather than a change in downstream task definition. The recurrent pattern is a move away from a single closed-form merge or adapter toward a searchable, decomposable, or instance-conditioned transformation space.

3. Metamorphic mutation, specification reformulation, and testing

A second line of work uses “morphing” in the software-testing sense of metamorphic variation. “LLM Assisted Coding with Metamorphic Specification Mutation Agent” proposes CodeMetaAgent, an MR-driven pipeline with four modules—Mutator, Reviewer, Generator, and Evaluator—that treats metamorphic relations as proactive operators for specification refinement and test generation rather than only as post hoc validators. For code generation and bug fixing, the Mutator applies Negation, Translation, Redefining in steps, and Paraphrasing to obtain semantically aligned variants $\boldsymbol{f}(\boldsymbol{x})$2, which the Reviewer filters with Sentence-BERT at threshold $\boldsymbol{f}(\boldsymbol{x})$3 and up to three regeneration iterations. For test generation, the framework uses Variable Swapping, Input Permutation, Algebraic/Distributive Transformation, Domain-specific Subset, and Incremental Data Transformation, validating generated tests against an oracle implementation. On HumanEval-Pro, MBPP-Pro, and SWE-Bench_Lite, the framework improves Pass@1 by up to 17 points, increases bug-resolution rate from $\boldsymbol{f}(\boldsymbol{x})$4 to $\boldsymbol{f}(\boldsymbol{x})$5 in the reported SWE-Bench_Lite case study, and reaches branch coverage up to $\boldsymbol{f}(\boldsymbol{x})$6 on MBPP-Pro. The paper’s own analysis identifies MR3, “redefining in steps,” as the strongest individual mutation and MR1, negation, as the riskiest (Akhond et al., 23 Nov 2025).

“LLMORPH: Automated Metamorphic Testing of LLMs” generalizes this logic from coding assistants to NLP systems. It implements 36 metamorphic relations across context-based QA, NLI, continuous sentiment analysis, and relation extraction, and supports both function-based and LLM-based transformations, optional verifications, semantic comparison via paraphrase-MiniLM-L6-v2 with thresholds $\boldsymbol{f}(\boldsymbol{x})$7 and $\boldsymbol{f}(\boldsymbol{x})$8, and numerical equivalence with a $\boldsymbol{f}(\boldsymbol{x})$9 error window. The evaluation spans GPT-4, Llama3, and Hermes 2 over SQuAD2, SNLI, SST2, and RE-DOCRED, producing 561,267 test executions and an average failure rate of $1\%$0. The paper is explicit that metamorphic violations are not guaranteed defects: manual analysis of 937 oracle violations indicates that many arise from intrinsic limitations of MT for NLP, which is why the tool outputs structured JSON for downstream triage rather than a binary defect certificate (Cho et al., 24 Mar 2026).

These papers converge on a specific interpretation of LLMalMorph: controlled mutation of the problem statement or input distribution in order to expose instability, recover latent constraints, or construct stronger partial oracles.

4. Cross-modal visual alignment and morph forensics

In computer vision and medical imaging, morphing is tied to cross-modal alignment and to literal image morphs. “LLMs for Multimodal Deformable Image Registration” introduces LLM-Morph, a 3D coarse-to-fine MDIR framework that uses a CNN encoder, two LLM Encoding Blocks with $1\%$1, LoRA updates on Q/K/V inside pretrained LLaMA-3-8B layers, and four decoding adapters that transform LLM-encoded tokens into multi-scale visual features and deformation fields. Training is semi-supervised with

$1\%$2

using Dice-based supervision on warped labels and an $1\%$3 smoothness regularizer. On Abdomen MR-CT, LLM-Morph reports Dice $1\%$4, $1\%$5 of $1\%$6, and HD95 $1\%$7, outperforming VoxelMorph, TransMorph, and MambaMorph; on SR-Reg it reports Dice $1\%$8 and HD95 $1\%$9. The paper also shows that removing the LLM Encoding Blocks, replacing them with trainable ViT modules, using only one LEB, or removing LoRA each degrades performance, while leaving runtime, parameter count, and augmentation details unspecified (Ma et al., 2024).

In biometric security, “Towards Zero-Shot Differential Morphing Attack Detection with Multimodal LLMs” studies differential morphing attack detection with paired face images. Using real biometric data from 54 individuals, 50 bona fide–bona fide pairs, 150 bona fide–morphed pairs, CoT-style prompting, three inference rounds per pair, average probability scoring, and logical OR fusion over binary decisions, it compares ChatGPT-4o and Gemini in a zero-shot D-MAD setup. ChatGPT-4o reports MACER/BPCER/HTER of $$\mathrm{MLPMoE}(x)=\sum_{b=1}^{B}\alpha_b\, W^{(b)}_{\text{down}}\Big[\phi(W^{(b)}_{\text{gate}}x)\odot (W^{(b)}_{\text{up}}x)\Big].$$0 on LMA, $$\mathrm{MLPMoE}(x)=\sum_{b=1}^{B}\alpha_b\, W^{(b)}_{\text{down}}\Big[\phi(W^{(b)}_{\text{gate}}x)\odot (W^{(b)}_{\text{up}}x)\Big].$$1 on PIPE, and $$\mathrm{MLPMoE}(x)=\sum_{b=1}^{B}\alpha_b\, W^{(b)}_{\text{down}}\Big[\phi(W^{(b)}_{\text{gate}}x)\odot (W^{(b)}_{\text{up}}x)\Big].$$2 on MIPGAN2, whereas Gemini reports $$\mathrm{MLPMoE}(x)=\sum_{b=1}^{B}\alpha_b\, W^{(b)}_{\text{down}}\Big[\phi(W^{(b)}_{\text{gate}}x)\odot (W^{(b)}_{\text{up}}x)\Big].$$3, $$\mathrm{MLPMoE}(x)=\sum_{b=1}^{B}\alpha_b\, W^{(b)}_{\text{down}}\Big[\phi(W^{(b)}_{\text{gate}}x)\odot (W^{(b)}_{\text{up}}x)\Big].$$4, and $$\mathrm{MLPMoE}(x)=\sum_{b=1}^{B}\alpha_b\, W^{(b)}_{\text{down}}\Big[\phi(W^{(b)}_{\text{gate}}x)\odot (W^{(b)}_{\text{up}}x)\Big].$$5 respectively. The paper’s qualitative conclusion is that Gemini is more verbally disciplined and explanation-consistent, while ChatGPT-4o is more forensically effective but more prone to failure-to-answer behavior (Shekhawat et al., 21 May 2025).

“Emergent Morphing Attack Detection in Open Multi-modal LLMs” moves to single-image MAD and open-weight models. It evaluates 19 open-source MLLMs with a fixed binary JSON prompt, Dlib face cropping with a 12.5% margin, deterministic inference, and yes/no logit extraction from final-step decoder probabilities. The best model, LLaVA1.6-Mistral-7B, achieves average EER $$\mathrm{MLPMoE}(x)=\sum_{b=1}^{B}\alpha_b\, W^{(b)}_{\text{down}}\Big[\phi(W^{(b)}_{\text{gate}}x)\odot (W^{(b)}_{\text{up}}x)\Big].$$6 and average BSCER@MACER(5\%) $$\mathrm{MLPMoE}(x)=\sum_{b=1}^{B}\alpha_b\, W^{(b)}_{\text{down}}\Big[\phi(W^{(b)}_{\text{gate}}x)\odot (W^{(b)}_{\text{up}}x)\Big].$$7, surpassing the self-supervised baseline SelfMAD at $$\mathrm{MLPMoE}(x)=\sum_{b=1}^{B}\alpha_b\, W^{(b)}_{\text{down}}\Big[\phi(W^{(b)}_{\text{gate}}x)\odot (W^{(b)}_{\text{up}}x)\Big].$$8 EER and $$\mathrm{MLPMoE}(x)=\sum_{b=1}^{B}\alpha_b\, W^{(b)}_{\text{down}}\Big[\phi(W^{(b)}_{\text{gate}}x)\odot (W^{(b)}_{\text{up}}x)\Big].$$9 BSCER@MACER(5\%) by 23% and 21% respectively. The paper further reports that medium models are generally strongest, that performance does not scale monotonically with parameter count, and that exact alternate prompt texts and exact token-variant aggregation details are not fully specified (Ivanovska et al., 17 Feb 2026).

Taken together, these papers show that in the visual domain LLMalMorph spans both constructive alignment—using LLMs as cross-modal feature spaces—and forensic discrimination—using multimodal LLMs to detect whether an image or image pair is bona fide or morphed.

5. Cybersecurity, malware variation, and behavior steering

The title-bearing paper, “LLMalMorph: On The Feasibility of Generating Variant Malware using Large-Language-Models,” defines LLMalMorph as a semi-automated framework for source-level malware mutation. It uses Tree-sitter to extract function definitions, global variables, struct or class definitions, compiler directives, and headers; constructs prompts of the form $\alpha_b=1$0 for one selected function at a time; rewrites that function with Codestral-22B through Ollama under one of six strategies—Code Optimization, Code Quality and Reliability, Code Reusability, Code Security, Code Obfuscation, or Windows API-Specific Transformation—and incrementally merges transformed functions back into C/C++ Windows malware projects. The evaluation covers 10 malware samples and 618 compiled variants. Reported VirusTotal results include a baseline-to-average drop from $\alpha_b=1$1 to $\alpha_b=1$2 on Exeinfector, average rates of $\alpha_b=1$3 on Fungus and $\alpha_b=1$4 on RansomWar, and MalGraph attack success rates up to $\alpha_b=1$5 for Optimization on Fungus and $\alpha_b=1$6 for Security on Babuk. Functionality preservation among evasive variants is measured via normalized API-call LCS with threshold $\alpha_b=1$7, reaching $\alpha_b=1$8 on VirusTotal and $\alpha_b=1$9 on Hybrid Analysis for RedPetya. The paper repeatedly stresses that the system is not fully automated: compilation errors, dependency resolution, API misuse, incomplete code generation, and cryptographic-library integration often required human debugging (Akil et al., 12 Jul 2025).

MemMorph expands the notion of morphing from code transformation to agent-policy manipulation. It attacks tool-augmented LLM agents with long-term memory by injecting three crafted records into a memory store of 300 benign records, yielding a 1% poison rate. The attack models likely future queries, constructs factual, episodic, and policy-style memory records, and optimizes only the payload under retrieval, fluency, and utility constraints so that the agent will select an attacker-preferred risky tool instead of the expected safe tool. Across 3 benchmarks, 10 backbone LLMs, and 3 memory modules, MemMorph reaches up to $0.05$0 attack success rate, outperforms the strongest baseline by up to 25%, remains effective in indirect poisoning with only a 9.9% average ASR drop, and still achieves $0.05$1 ASR under the strongest tested defense, Memory Auditor. The component ablations are especially revealing: removing anchors mainly harms indirect poisoning, using a single style instead of factual-plus-episodic-plus-policy records sharply lowers ASR, and removing block scoping collapses indirect-poisoning ASR from $0.05$2 to $0.05$3 (Zhang et al., 24 May 2026).

In this security-oriented literature, LLMalMorph no longer means only “generate a variant.” It also denotes altering the effective behavior policy of an agentic system through persistent contextual priors.

6. Recurring design patterns, limitations, and research directions

Several common design patterns recur across this literature. One is the replacement of a single fixed transformation with a search process over structured transformation spaces: merge recipes in MM-MO, branch decompositions in MLPMoE, prompt and test mutations in CodeMetaAgent, or memory payload optimization in MemMorph. Another is reliance on partial or proxy objectives rather than direct end-task oracles, such as C-EVAL validation plus $0.05$4 GSM8K train for merge search, proxy perplexity for zero-shot MoE conversion, and API-sequence similarity with threshold $0.05$5 for malware functionality preservation (Li et al., 2024).

The literature is also marked by reproducibility gaps. MM-MO omits the number of Bayesian optimization iterations, batch size $0.05$6, and total evaluated configurations; LLM-Morph does not report total parameter count, FLOPs, runtime, or inference speed; D-MAD does not quantify a precise global failure-to-answer percentage and does not provide a controlled prompt ablation table; the open-source S-MAD study leaves unspecified the exact aggregation function over token variants and the exact alternate prompt texts used in prompt ablation (Ma et al., 2024).

Cost and systems overhead are persistent constraints. MLPMoE exposes latent modularity but is slower than the dense baseline because all branches are still executed and sparse kernels are absent; CodeMetaAgent improves coding accuracy but uses roughly four times more input and five times more output tokens than direct generation; LLMalMorph for malware remains semi-automated because multi-file compilation and debugging are not reliably solvable by the model alone; and MemMorph assumes white-box access to the memory module $0.05$7 and focuses on single-step tool selection rather than full multi-step recovery or oversight (Novikov, 26 Nov 2025).

The broadest conceptual lesson is therefore limited but clear. This literature suggests that “LLMalMorph” is not one technique but a family of transformation-centric approaches in which LLM systems are morphed at the level of weights, architecture, input specification, multimodal evidence, code structure, or persistent memory. The most mature results so far are empirical rather than unifying: MM-MO shows that automated search over merge configurations can outperform hand-chosen settings; MLPMoE shows that exact dense-to-static-MoE metamorphosis is possible post hoc; CodeMetaAgent and LLMORPH show that metamorphic mutation can improve reliability analysis and coding performance; multimodal LLMs show nontrivial zero-shot capability in morphing attack detection; and LLMalMorph plus MemMorph show that the same transformation logic can be used offensively, either to generate malware variants or to reshape agent tool use. What remains unresolved is whether these lines will converge into a single research program, or remain a cluster of domain-specific uses of the same metaphor.