Multimodal AI Framework Tackles Android Malware with 90% Accuracy Without Fine-Tuning

Android malware continues to evolve faster than security systems can adapt. Traditional machine learning models struggle when malware tactics shift over time, while current AI-based detectors often miss threats by focusing on narrow code analysis or single lines of evidence.

The Challenge: Concept Drift and Limited Evidence#

Existing detection approaches face a fundamental problem: their performance degrades as malware developers change their techniques. Machine learning classifiers trained on historical threats tend to rely on features whose patterns shift unpredictably. Meanwhile, recent large language model (LLM) approaches, though capable of semantic reasoning without retraining, typically examine only isolated aspects of malware behavior—such as code structure alone—leaving gaps that sophisticated attacks can exploit.

Moirae's Multimodal Solution#

Researchers have developed Moirae, a framework that combines multiple AI agents working together to analyze different dimensions of suspicious app behavior simultaneously. Rather than depending on a single type of evidence, Moirae monitors:

• Visual deception tactics — spotting UI tricks designed to mislead users
• State transitions — tracking how an app's interface shifts and evolves
• Runtime API calls — observing the hidden operations an app performs in the background

The system uses ReAct-based agents (reasoning + acting loops) to synthesize these complementary views into a unified verdict. By examining both user-facing interfaces and backend operations together, Moirae can catch malware that tries to hide through obfuscation or misdirection.

Strong Results on Unseen Data#

Moirae achieved 90.06% accuracy when tested on Android malware samples it had never encountered, from time periods and distributions different from its training data. Crucially, the system worked without fine-tuning—a sign of robust generalization. The framework outperformed state-of-the-art baselines, demonstrating that multimodal, collaborative reasoning can counter the shifting nature of malware threats more effectively than traditional single-modal approaches.

The research was submitted to arXiv on August 28, 2026.