Databricks Injects Domain Knowledge for LLM Malware Triage

Databricks researchers unveiled a new technique that uses pre-computed domain knowledge to dramatically improve how large language models detect hidden binary malware in npm packages. Examining a dataset of 11,413 package-versions, the team found that while 96.2% of npm malware conceals payloads in JavaScript or fetches them externally, 3.8% (432 package-versions) ship compiled binaries. These binary-bearing packages proved twice as prone to triage failure compared to source-only samples, failing to trigger decisive malicious verdicts 14.4% of the time versus 6.2%.

To solve this, Databricks developed static capability profiles that evaluate binaries using YARA, Semgrep, and custom binary analysis. When threshold rules fire, the system injects an 1,800-token evidence summary directly into the prompt before the model reasons. Tested across nine models—including budget options like GPT-5.4-nano, Gemma 3 12B, Llama 3.1 8B, Qwen3-Next 80B, GLM 5.3 Flash, Claude Haiku 4.5, and Gemini 3.5 Flash, alongside baselines Claude Sonnet 4.6, Kimi K3, and Claude Opus 4.6—the injection eliminated systematic failure modes.

Without capability profiles, cheap models failed 50% of test scans (35 of 70) at the escalation threshold and 73% at the malicious bar, tripping over failure modes like rationalization (37%), confabulation (23%), dismissal (22%), and hedging (16%). With profiles enabled, 91% of those failures recovered, dropping the escalation failure rate to 4% (3 of 70) and bringing budget model accuracy in line with premium models like Sonnet 4.6 and Kimi K3. Only GPT-5.4-nano retained residual failures on three payloads.

In real-world testing against 425 OSV-confirmed malicious binary package-versions and 2,449 benign packages, the pipeline achieved 0.77 precision, 0.81 recall, and an F1 score of 0.79, maintaining a low 4.25% false-positive rate. For security engineering teams, this approach demonstrates that injecting static analysis evidence into prompts allows affordable, smaller models to achieve enterprise-grade malware detection without requiring costly model retraining or expensive frontier LLM subscriptions.