MAGMA is a Retrieval-Augmented Generation framework for malware detection that decouples analysis into semantic code retrieval and probabilistic verification. The system uses dual-stream embeddings over assembly and pseudo-code to isolate critical functions, then employs multiple reasoning agents with non-deterministic sampling to produce two metrics: Function Evidence Strength and Evidence Conflict Score (Shannon entropy of predictions). High entropy serves as a signal for structural ambiguity, enabling a reject-option policy that achieves 98.4% detection rate.
Main takeaways:
- Using ensemble entropy as a proxy for epistemic uncertainty enables the system to flag ambiguous cases rather than making unreliable predictions
- The approach addresses evasion attacks by expressing uncertainty, unlike monolithic classifiers
- Dual-stream embedding helps separate decision-critical functions from dead code noise