MARS compares direct classification with claim scoring on 1,195 PE/ELF binaries: direct classification is more accurate across all six models, while retained claims enable policy replay
MARS is a malware triage framework for PE and ELF binaries that, with a shared evidence collector and identical static evidence bundles, compares direct LLM classification against structured behavioral claims scored by a fixed policy; across 1,195 binaries, 1,001 near-duplicate clusters, and six models, direct classification is more accurate for all six models with paired advantages of 3.7 to 20.9 percentage points, while the claim path retains the policy inputs and permits replay and policy revision without another model call.