LLM-Enhanced Hierarchical Heterogeneous Graph Representation Learning for Malicious Python Package Detection

• URL: http://arxiv.org/abs/2607.03350v1
• Date: Fri, 03 Jul 2026 14:05:54 GMT
• Title: LLM-Enhanced Hierarchical Heterogeneous Graph Representation Learning for Malicious Python Package Detection
• Abstract summary: Malicious Python packages have become a major threat to software supply chain ecosystems.<n>Large Language Models (LLMs) have demonstrated strong capabilities in code understanding and semantic reasoning.<n>We propose an LLM-enhanced hierarchical heterogeneous graph representation learning framework for malicious Python package detection.
• Score: 17.848448658813762
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Malicious Python packages have become a major threat to software supply chain ecosystems due to the widespread adoption of open-source repositories such as PyPI. Existing learning-based detection methods struggle to capture the hierarchical organization and heterogeneous interactions among different program entities. Although Large Language Models (LLMs) have demonstrated strong capabilities in code understanding and semantic reasoning, they are rarely integrated with structural program representations for fine-grained malicious behavior analysis. In this paper, we propose an LLM-enhanced hierarchical heterogeneous graph representation learning framework for malicious Python package detection. The framework constructs a hierarchical heterogeneous code graph that explicitly models heterogeneous code entities and different types of structural dependencies. LLMs are further leveraged to infer function-level semantic roles, introducing an additional layer of semantic heterogeneity. Based on this graph, we develop a hierarchical heterogeneous graph neural network that performs type-aware message passing over different node and edge categories, effectively modeling malicious behavior propagation for accurate package-level classification. The framework also incorporates a function-level attribution mechanism which, combined with LLM reasoning, automatically identifies suspicious functions and localizes fine-grained malicious behaviors without human expert intervention. Extensive experiments on real-world datasets show that our framework consistently outperforms traditional machine learning methods, graph-based detectors, and state-of-the-art LLMs across packages with varying sizes and dependency complexities, while providing accurate, robust, and interpretable malicious behavior localization.

Related papers

• Learning Taxonomic Trees with Hierarchical Representation Regularization for Large Multimodal Models [47.868429337792314]
  Large multimodal models (LMMs) often lack taxonomic knowledge, leading to low hierarchical visual recognition (HVR) consistency.<n>We propose Hierarchical Representation Regularization ($HiR2$), a simple plug-and-play regularizer that improves hierarchical consistency in LMMs.<n>$HiR2$ effectively captures taxonomic structures across diverse LMMs and fine-tuning methods.
  arXiv  Detail & Related papers  (2026-07-03T03:16:41Z)
• OFA-MAS: One-for-All Multi-Agent System Topology Design based on Mixture-of-Experts Graph Generative Models [57.94189874119267]
  Multi-Agent Systems (MAS) offer a powerful paradigm for solving complex problems.<n>Current graph learning-based design methodologies often adhere to a "one-for-one" paradigm.<n>We propose OFA-TAD, a one-for-all framework that generates adaptive collaboration graphs for any task described in natural language.
  arXiv  Detail & Related papers  (2026-01-19T12:23:44Z)
• Improving LLM Reasoning with Homophily-aware Structural and Semantic Text-Attributed Graph Compression [55.51959317490934]
  Large language models (LLMs) have demonstrated promising capabilities in Text-Attributed Graph (TAG) understanding.<n>We argue that graphs inherently contain rich structural and semantic information, and that their effective exploitation can unlock potential gains in LLMs reasoning performance.<n>We propose Homophily-aware Structural and Semantic Compression for LLMs (HS2C), a framework centered on exploiting graph homophily.
  arXiv  Detail & Related papers  (2026-01-13T03:35:18Z)
• Towards Efficient LLM-aware Heterogeneous Graph Learning [47.42705995672551]
  We propose an Efficient LLM-Aware framework for heterogeneous graphs.<n>Our proposed ELLA outperforms state-of-the-art methods in the performance and efficiency.
  arXiv  Detail & Related papers  (2025-11-22T05:38:03Z)
• Explaining Fine Tuned LLMs via Counterfactuals A Knowledge Graph Driven Framework [13.533352973355013]
  Low-Rank Adaptation (LoRA) has enabled large language models to acquire domain-specific knowledge with remarkable efficiency.<n>This work introduces a novel framework that explains fine-tuned LLMs via counterfactuals grounded in knowledge graphs.
  arXiv  Detail & Related papers  (2025-09-25T14:37:40Z)
• Actions Speak Louder than Prompts: A Large-Scale Study of LLMs for Graph Inference [7.817259532290553]
  Large language models (LLMs) are increasingly used for text-rich graph machine learning tasks.<n>Despite a surge of interest, the field lacks a principled understanding of the capabilities of LLMs in their interaction with graph data.
  arXiv  Detail & Related papers  (2025-09-23T00:46:21Z)
• GRIL: Knowledge Graph Retrieval-Integrated Learning with Large Language Models [59.72897499248909]
  We propose a novel graph retriever trained end-to-end with Large Language Models (LLMs)<n>Within the extracted subgraph, structural knowledge and semantic features are encoded via soft tokens and the verbalized graph, respectively, which are infused into the LLM together.<n>Our approach consistently achieves state-of-the-art performance, validating the strength of joint graph-LLM optimization for complex reasoning tasks.
  arXiv  Detail & Related papers  (2025-09-20T02:38:00Z)
• Hierarchical knowledge guided fault intensity diagnosis of complex industrial systems [9.830457900441939]
  We propose a hierarchical knowledge guided fault intensity diagnosis framework (HKG) inspired by the tree of thought.<n>The HKG uses graph convolutional networks to map the hierarchical topological graph of class representations into a set of global hierarchical classifiers.<n>In addition, we develop a re-weighted hierarchical knowledge correlation matrix (Re-HKCM) scheme by embedding inter-class hierarchical knowledge into a data-driven statistical correlation matrix.
  arXiv  Detail & Related papers  (2025-08-17T14:22:03Z)
• Explainable Attention-Guided Stacked Graph Neural Networks for Malware Detection [2.6436521007616114]
  We propose a novel stacking ensemble framework for graph-based malware detection and explanation.<n>Our framework improves classification performance while providing insightful interpretations of malware behavior.
  arXiv  Detail & Related papers  (2025-08-13T13:33:02Z)
• Use All The Labels: A Hierarchical Multi-Label Contrastive Learning Framework [75.79736930414715]
  We present a hierarchical multi-label representation learning framework that can leverage all available labels and preserve the hierarchical relationship between classes. We introduce novel hierarchy preserving losses, which jointly apply a hierarchical penalty to the contrastive loss, and enforce the hierarchy constraint.
  arXiv  Detail & Related papers  (2022-04-27T21:41:44Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.