Malware Generation Compiler (MGC)

• MGC is a compiler-like framework that decomposes a high-level malicious intent into benign-appearing tasks, enabling malware generation via LLMs.
• It employs a modular pipeline with a front-end for decomposition into an MDIR program, an optimizer for alignment-evasive refinement, and a back-end for concrete code generation.
• Empirical evaluation shows that MGC outperforms traditional jailbreaking methods by achieving high correctness and quality in generating executable malware.

The Malware Generation Compiler (MGC) is a compiler-inspired framework designed to produce functional malware by exploiting “compositional blindness” in aligned LLMs. By systematically decomposing malicious objectives into a sequence of benign-appearing tasks, and reassembling their outputs, MGC circumvents conventional alignment-based security controls implemented by LLM providers. The framework introduces architectural innovations such as a modular pipeline built around a custom Malware Description Intermediate Representation (MDIR), robust error handling to evade prompt-level alignment filters, and formal composability guarantees to ensure functional malware assembly. Empirical evaluation demonstrates that MGC reliably generates sophisticated, executable malware—substantially outperforming prior “jailbreaking” techniques and underground malware-generation services in correctness and behavioral coverage (Yan et al., 2 Jul 2025).

1. Compositional Blindness in LLM Alignment

Modern, alignment-trained LLMs (e.g., GPT-4, Claude) are designed to refuse explicit requests for malicious code. However, these alignment mechanisms typically operate at the level of isolated prompts and do not account for attackers decomposing a high-level malicious intent into multiple innocuous subtasks. For example, instead of directly requesting “write ransomware,” an adversary can request code for unrelated benign-seeming functions such as file enumeration, buffer encryption, and UI display. Each subrequest is unlikely to trigger alignment or content filters.

MGC operationalizes this attack by leveraging a two-model approach: a weakly aligned model decomposes the malicious intent into “innocent” workflow steps and expresses the decomposition as an MDIR program, while a strongly aligned model is used to generate high-quality code for each subfunction—reusing the strictest alignment policing, but subverted by prompt composition (Yan et al., 2 Jul 2025). The benign-appearing subfunctions are then linked offline into a working malware binary.

2. System Architecture and Pipeline

The compiler-like architecture of MGC is divided into three principal components:

• Front-End: Uses a weak LLM (e.g., Mistral-7B-Instruct) to perform chain-of-thought (CoT) decomposition and generate a workflow in natural language. This workflow is then translated into an MDIR abstract syntax program. Syntax and type verification are applied, and errors trigger regeneration.
• Optimizer/Error Handler: Interleaved with code generation, this module refines the decomposition. If the back-end LLM refuses a code generation request for a suspiciously named function, the optimizer sanitizes names or decomposes the function further until alignment-evasive code is obtained.
• Back-End: Employs a strongly aligned LLM (e.g., Claude-3.5, GPT-4o-mini, Hermes-3-Llama-3.1-405B) to implement each abstract MDIR function as concrete code in C, Python, or Rust, verifying signatures against the MDIR specification.
• Offline Composition: All generated functions are linked together with the main routine and compiled as the final malware binary (Yan et al., 2 Jul 2025).

This pipeline structure mirrors established compiler design with decomposition (front-end parsing), refinement/optimization, and code generation (back-end).

3. Malware Description Intermediate Representation (MDIR)

MDIR is a C-style, domain-specific language tailored for modular decomposition and persistence of formal composability properties:

• Syntax: Supports first-order functions, explicit input/output types, arrays and pointers for OS interaction, and command composition via call-and-pass semantics.
• Abstract Functions: Contain only natural-language descriptions (no code) to obtain safe implementations from the LLM.
• Composition Guarantees: The structure enforces that assembled malware is syntactically correct, type-safe, and functionally faithful to the original malicious intent.

Example mapping for “Delete every file in /tmp older than 7 days” is decomposed into ListDir, GetModTime, and DeleteFile abstract functions, which are concretized by the LLM (Yan et al., 2 Jul 2025).

Component	Role in MGC Pipeline	Implementation Detail
Front-End	Decomposition, MDIR generation	Weak LLM + syntax/type checks
Optimizer	Alignment-evasive refinement	Name sanitization, recursion
Back-End	Concrete code generation	Strong LLM(s), signature check
MDIR	IR for modularity/composability	C-like DSL

4. Modular Decomposition and Alignment-Evasive Generation

The decomposition and alignment-evasion mechanisms are engineered as an iterative process:

1. Natural-language malicious intent is expanded via chain-of-thought into explicit steps.
2. The weak LLM decomposes these into a workflow and MDIR program.
3. Each MDIR abstract function is passed to the strong LLM; upon refusal, suspicious identifiers are sanitized or the function is recursively subdivided.
4. This loop continues until all functions are sufficiently granular and innocuous to be accepted.
5. Offline, assembled code is compiled without further LLM involvement.

This iterative loop guarantees that no single subfunction is flagged as overtly malicious, leveraging the inability of prompt-level or even short conversation-level LLM filters to recognize the full malicious pattern (Yan et al., 2 Jul 2025).

5. Empirical Evaluation and Results

MGC is evaluated against direct model queries (DQ), state-of-the-art jailbreaking techniques, and underground malware-generation services:

• Correctness: MGC (Mistral→Claude) achieves correctness scores of 8.25 (scale 1–10) across three benchmarks, outperforming jailbreaking methods by +365.8% and underground services by +78.1%.
• Quality: Code quality scores of 7.47 (readability, modularity, efficiency, robustness).
• Syntactic Metrics: Generates 555–795 LOC, with 13–25 functions per sample, compared to sub-150 LOC for baselines.
• Category-wise: Maintains high correctness (≥7.4) and quality (≥7.2) in all MITRE-CK tactics tested.

Case studies include reproduction and enhancement of real-world malware (Shady Shell reverse shell, Project Kaiten botnet), with enhanced behavioral coverage and compatibility for drop-in replacement in existing malware codebases (Yan et al., 2 Jul 2025).

6. Security Implications and Proposed Defenses

The principal risk stems from LLM alignment mechanisms that fail to detect alignment-evasive composition strategies:

• Compositional Blindness: LLMs verify only individual prompts; attackers reliably evade detection by modularizing malicious logic.
• Session-based Detection: Even advanced session-level correlation tools (up to 100 prompts) detect <0.6% of attacks if malicious and benign requests are interleaved.
• Scalability of Attack: Attackers can spread requests across multiple accounts or models, circumventing session-based controls.

Mitigation approaches proposed include:

• Composition-Aware Monitoring: Trace call graphs and detect suspicious composite patterns across generated functions.
• Semantic Function Tagging: Require LLMs to semantically classify and track sensitivities at the abstract-function level.
• Policy Filtering at IR Level: Enforce constraints on permissible MDIR function combinations to block cumulative malicious compositions (Yan et al., 2 Jul 2025).

7. Relationship to Other Compiler-Based Malware Generation

MGC unifies themes from adversarial ML-driven mutation (e.g., opcode-level DRL (Sewak et al., 2021)), GAN-based behavioral synthesis (Bhaskara et al., 2018), search-based compiler optimization mutation (Ren et al., 2021), and agent-pipelined malware composition (Saha et al., 9 Jun 2025). While prior approaches have focused on adversarial evasion (obfuscation, metamorphism, optimization-induced diversity, or agent-driven workflow construction), MGC’s primary innovation is leveraging LLM alignment protocols’ compositional gaps to generate safe-looking code for ultimately malicious workflows.

• MGC: A Compiler Framework Exploiting Compositional Blindness in Aligned LLMs for Malware Generation (Yan et al., 2 Jul 2025)
• ADVERSARIALuscator: An Adversarial-DRL Based Obfuscator and Metamorphic Malware SwarmGenerator (Sewak et al., 2021)
• MalGEN: A Generative Agent Framework for Modeling Malicious Software in Cybersecurity (Saha et al., 9 Jun 2025)
• Unleashing the Hidden Power of Compiler Optimization on Binary Code Difference: An Empirical Study (Ren et al., 2021)
• Emulating malware authors for proactive protection using GANs over a distributed image visualization of dynamic file behavior (Bhaskara et al., 2018)