safety security
The Defense Used AI Offline and Verified Logic at Runtime
ORCAGen builds malware-specific deception playbooks before deployment, keeping generated reasoning outside runtime enforcement.
Summary
ORCAGen builds malware-specific deception playbooks before deployment, keeping generated reasoning outside runtime enforcement.
ORCAGen combines a curated knowledge base, retrieval and structured prompts to construct and test malware-specific deception strategies offline. Only verified orchestration logic is enforced at runtime. Its evaluation covered synthesized scenarios and 150 real malware samples across keyloggers, information stealers and ransomware, comparing execution, refinement effort, hallucinations, effectiveness and overhead across several models. GPT-5.5 needed the fewest refinements and had no observed hallucinated APIs in those tests; Gemini 3.5 Flash had the lowest response time and runtime overhead. Those findings are limited to the evaluated scenarios. The design puts validation between a generator’s proposal and a defense action rather than asking a model to improvise every response.
Why it matters
ORCAGen builds malware-specific deception playbooks before deployment, keeping generated reasoning outside runtime enforcement.
Limits and context
- Only verified orchestration logic is enforced at runtime.
Key claims
ORCAGen builds malware-specific deception playbooks before deployment, keeping generated reasoning outside runtime enforcement.
Qualification: Only verified orchestration logic is enforced at runtime.
Evidence: source-2026-10-09-015
Sources
- arXiv preprint 2610.12415, original v1arXiv / submitting research authors · primary research
Corrections
No corrections have been recorded for this story.