Malaika: Understanding Malware through Triple-Grounded Agent Reasoning

Malaika is a multi-agent framework for malware understanding that outperforms existing LLM-based analysis frameworks on Android malware analysis. It uses domain grounding to constrain behavioral hypotheses, semantic grounding to locate associated program evidence, and knowledge grounding to complete behavior attribution with externally verifiable threat knowledge. Comparisons with malware analysis systems and frontier agent frameworks show that grounded reasoning conclusions are more precise and auditable, and ablation experiments support the grounding hypotheses.