Evaluation Dataset for Bounded LLM Adjudication in Hybrid Malware Triage

Bounded Adjudication and Claim-Level Verification for Hybrid Malware Triage" (Shaw, 2026). Contains the frozen evidence bundles (deterministic tool findings, extracted IOCs, EMBER classifier scores, and gate decisions) that three LLM adjudicators — two local models (qwen3:8b, gemma4:12b) and one frontier model (Gemini 3.1 Pro) — were shown during evaluation, the dataset manifest (sha256/label/source/split, no filesystem paths), and the raw per-sample experiment outputs across all four evaluation axes (main accuracy, adversarial robustness, calibration/reliability, claim-level verification), plus the aggregated statistics report the paper's tables and figures are drawn from.

No malware executables are included — only derived metadata, extracted structural/behavioral findings, and model output. All indicators of compromise (URLs, IP addresses) that were copied verbatim out of real malware samples during analysis have been defanged (hxxp://, bracketed dots) before deposit; see DATASET_CARD.md for the exact methodology. Full schema and provenance documentation is in DATASET_CARD.md at the root of this deposit.