Black Hat Session: Training Specialist Models: Automating Malware Development

You get what you optimize for.

The current trajectory of major AI research labs emphasizes training large language models (LLMs) optimized with verifiable rewards in broadly applicable domains such as mathematics and competitive programming. However, this generalist approach neglects niche applications, especially those explicitly restricted by major providers, including security testing and AV/EDR evasion. Such tasks present unique opportunities suited to smaller teams and independent researchers.

This presentation discusses reinforcement learning (RL) fine-tuning for LLMs tailored to highly specialized tasks, using evasive malware development as a case study. A new 7-billion parameter model demonstrating significant performance improvements over state-of-the-art generalist models on AV/EDR evasion tasks will be released alongside the Briefing.