Metamorphic Malware Detection via Graph-Augmented Neural Semantics and Adversarial Hardening: A Comprehensive Framework

Abstract

Background: Metamorphic malware is among the most persistent adversarial challenges in cybersecurity: it rewrites its own instruction stream on every propagation, preserving functional semantics while presenting a syntactically distinct binary that defeats signature-based and many learning-based detectors. Methods: We propose MetaGNN-Sec, a graph-augmented neural framework that detects metamorphic malware from program structure rather than surface bytes. The framework composes four components, each addressing a distinct facet of the problem: (i) control-flow graph (CFG) extraction with semantic opcode embeddings; (ii) a heterogeneous graph neural network (hGNN) operating over program-dependence graphs that capture mutation-stable control- and data-flow invariants; (iii) an adversarial training loop derived from the Wasserstein generative adversarial network (WGAN) that hardens the classifier against adaptive evasion mutations; and (iv) a quantum-kernel anomaly layer implemented in PennyLane for separation of heavily obfuscated outliers in a high-dimensional feature space. Results: Experiments are conducted on two public corpora—VirusShare 2024 and a SOREL-20M subset—comprising 200,175 binary samples in total (155,175 malware and 45,000 benign), in agreement with the corpus totals reported in Datasets Section of this paper. MetaGNN-Sec achieves a detection rate of 97.83%, a false-positive rate of 0.41%, and an $F_1$ score of 0.978 on held-out metamorphic families, exceeding the next-best baseline (MalConv+) by 4.6 percentage points on clean data and degrading by only 5.4 points under adaptive adversarial evasion (versus 17–31 points for the baselines). The quantum-kernel module contributes a further 1.2 pp reduction in false-negative rate, concentrated on the most heavily mutated families. Conclusions: The framework provides a heterogeneous PDG representation with a conditional score-shift bound under graph-edit-bounded mutations, a WGAN hardening loop that delivers measurable adversarial robustness, a quantum-kernel pre-filter with an explicit cost/benefit characterization, and a reproducible, near-real-time pipeline suitable for enterprise endpoint deployment.

1. Introduction

The malware landscape has undergone a profound structural shift over the past decade. Whereas first- and second-generation threats relied on static byte signatures that were straightforwardly matched by antivirus engines, contemporary adversaries routinely deploy metamorphic code—programs that autonomously rewrite their own instruction streams at each propagation cycle while preserving observable behavior [1,2,3,4,5]. Unlike polymorphic variants, which merely encrypt a fixed payload beneath a variable decryption stub, metamorphic engines perform semantics-preserving transformations including dead-code insertion, register reassignment, instruction substitution, subroutine permutation, and control-flow transposition [6,7]. These transformation classes are not abstract: they are realized by documented engines operating on the x86/x86-64 instruction-set architecture, and our usage follows the canonical taxonomy of You and Yim [4] and the control-flow-transposition analysis of Borello and Mé [6]. The result is a family of binaries that share a common functional ancestry yet may exhibit vanishingly small byte-level similarity [8].

Signature-based detection, by construction, fails against such threats [9]. Statistical and machine learning approaches fare better but remain vulnerable to adversarial perturbations that deliberately exploit the decision boundary of a trained classifier [10,11]. Concurrently, the rapid proliferation of large-scale binary repositories—VirusShare alone catalogs over 50 000 000 samples—demands detection pipelines capable of processing millions of binaries per day with minimal human supervision.

Recent advances in graph neural networks (GNNs) offer a promising substrate because program-level semantics naturally admit a graph representation: function call graphs, control-flow graphs, and program-dependence graphs each encode structural and data-flow invariants that persist across many metamorphic transformations [12,13]. Yet adversarial training techniques specifically designed to harden GNN-based detectors against adaptive metamorphic mutations remain underexplored.

The operational significance of this shift is not merely architectural. Because a metamorphic engine changes the byte-level form of every propagated instance while preserving its function, the static indicators on which signature and heuristic controls depend are invalidated at each generation, and detection burden transfers wholly onto structural and behavioral methods; recent surveys of graph-based detection reach the same conclusion, noting that signature- and heuristic-driven pipelines generalize poorly to unseen samples and are readily circumvented by obfuscation [14]. The consequence is asymmetric: a single-seed binary yields a combinatorially large family of functionally identical variants (Section 2), so that the defender must recognize an unbounded population from a bounded set of observations, while the attacker need only find one variant that crosses the decision boundary. Adversarial manipulation compounds this, and the attack surface it opens against learning-based malware detectors is now itself the subject of the dedicated survey literature [15,16].

Contributions: This paper makes the following primary contributions:

• We introduce MetaGNN-Sec, a unified detection framework combining heterogeneous GNNs with a WGAN-based adversarial hardening loop.
• We derive a conditional score-shift bound showing that, under an explicitly stated and empirically estimated Lipschitz condition, the proposed hGNN representation is comparatively stable under a broad class of graph-edit-bounded syntactic mutations.
• We integrate a PennyLane-based quantum-kernel anomaly scorer that exploits quantum interference to separate obfuscated malware from benign outliers in feature space.
• We benchmark MetaGNN-Sec on two publicly available corpora under a single controlled re-evaluation protocol, and provide a self-contained, LangGraph-orchestrated reference implementation—with pinned environment, seeds and configuration files—available as described in the Data Availability statement, so that the pipeline can be re-run against corpora obtained by the reader from their original repositories.

Article structure: Section 2 reviews related work. Section 3 presents the mathematical framework. Section 4 describes the experimental methodology. Section 5 reports the results and metrics. Section 6 discusses implications. Section 7 concludes with future directions. In line with that structure, three pointers may assist the reader. The review of prior work and the specific gap this paper addresses are carried by Section 2, and in particular by Section 2.3, which sets out why each of the four components above is present and what facet of the gap it answers; readers who question the necessity of a four-component design are directed there first. The comparison against competing detector paradigms—five baselines re-implemented and re-trained under a single protocol—is reported in Section 4.6. The rationale for the choice of corpora is given in Section 4.2.

2. Background

2.1. Metamorphic Transformation Strategies

Metamorphic engines implement a codebook of semantics-preserving rewrite rules. You and Yim [4] catalog five canonical classes: dead-code insertion (DCI), register renaming (RR), instruction reordering (IR), subroutine-level permutation (SP), and equivalent-instruction substitution (EIS). Borello and Mé [6] additionally document control-flow transposition (CFT), in which the jump graph of a function is restructured without altering its reachable post-conditions. Each transformation inflates the mutation search space combinatorially; Rad et al. [8] estimate that a five-level deep metamorphic engine produces $>{10}^{12}$ distinct binaries from a single seed.

2.2. Detection Approaches

2.2.1. Signature-Based and Heuristic Methods

Classical antivirus relies on byte-sequence signatures [5]. Heuristic extensions incorporate entropy measures and import-table anomaly scoring [17] but saturate below a 70% detection rate against advanced metamorphic families [7].

2.2.2. Machine Learning Detectors

Raff et al. [18] demonstrated that convolutional networks operating directly on raw bytes (MalConv) achieve strong performance on static analysis tasks. Anderson et al. [12] showed that feature-engineered classifiers using EMBER-format features outperform shallow byte models on the Sophos dataset. N-gram frequency models [19] and opcode bigram histograms [20] remain popular baselines due to their computational efficiency.

2.2.3. Graph-Based Methods

Ceschin et al. [13] extract call-graph features with shallow graph kernels; Yan et al. [21] apply graph convolutional networks to API call sequences. Heterogeneous formulations, which type nodes and edges rather than treating the graph as uniform, extend this line further by allowing opcode, call and data-dependence relations to be modeled jointly; the survey of Bilot et al. [14] covers this family in detail. The field has since consolidated: Bilot et al. [14] survey graph representation learning for malware detection across function-call and control-flow graph formulations, and report that graph-structured encodings are comparatively resistant to attacker manipulation while retaining competitive accuracy—the premise on which the present work builds. Their review also observes that heterogeneous formulations and adversarial hardening of graph detectors remain less developed than the homogeneous case, which is the gap addressed in Section 2.3. Recent work has continued to refine each of these axes. Guo et al. [22] enrich function-call graphs with BERT-derived node attributes and classify them with a hierarchical attention-pooling GNN, combining attention and pooling in a manner analogous to the attention fusion and DiffPool coarsening used here, though over call graphs rather than program-dependence graphs. Tarapata and Romańczuk [23] study the architectural determinants of behavioral GCN detectors on Windows API-call sequences and report a non-monotonic relationship between depth and accuracy attributable to over-smoothing—evidence that directly informs our choice of $L=4$ message-passing layers (Section 4). Zhao et al. [24] take a complementary route, mining frequent subgraphs from Dalvik opcode graphs before GCN embedding, and demonstrate that graph methods can meet strict latency budgets; their sub-0.1 s detection time is a useful point of comparison for the throughput analysis in Section 5. A further strand treats the mutation process itself as the object to be modeled rather than the artifact: in earlier work we formulated zero-day metamorphic variation as a diffusion process over program representations and learned a contrastive embedding from it [25], which is complementary to the static structural encoding adopted here.

2.2.4. Adversarial Robustness of Learning-Based Detectors

Grosse et al. [10] first applied white-box gradient attacks to malware classifiers; Kreuk et al. [11] demonstrated end-to-end adversarial example generation on raw-byte models. Hu and Tan [26] propose a reinforcement learning engine that mimics metamorphic transformations to generate evasive variants for adversarial training. The area has also been surveyed systematically from the intrusion-detection side, where the interaction between adversarial manipulation and detector design is catalogued together with the countermeasures reported to date [27]. Two further recent surveys map the area: Yan et al. [15] catalog attack and defense methods for malware classification, and Aryal et al. [16] review evasion attacks published between 2013 and 2024, noting that defenses are typically validated against the same attack families used to construct them—a circularity we address explicitly for our own evaluation in Section 6. On the defensive side, Li et al. [28] propose a principled adversarial detection framework with formal treatment of the evasion setting, which is complementary to the empirical hardening loop used here. Outside the malware domain, Yang et al. [29] address a closely related problem: their heterogeneity-aware framework couples relation-specific attention with an explicit mechanism for neutralizing adversarial camouflage, and reports a halving of performance degradation under structural noise. That combination—heterogeneous relation typing together with adversarial hardening—is the same pairing we adopt, and its effectiveness on financial fraud graphs suggests the mechanism is not specific to program graphs.

2.2.5. Quantum-Assisted Detection

Quantum-kernel methods exploit the exponential feature Hilbert space of n-qubit systems to classify distributions that are hard for classical kernels [30]. Liu et al. [31] provide complexity-theoretic separation results, suggesting a quantum advantage for certain anomaly detection tasks relevant to cybersecurity.

2.3. Research Gap and Rationale for the Proposed Composition

The literature surveyed above exposes a specific gap. Byte- and aggregate-feature detectors are efficient but learn what a binary looks like rather than what it does, and collapse under metamorphic mutation and adversarial byte injection. Graph-based detectors recover much of the lost robustness by modeling mutation-stable structure, yet existing graph detectors are predominantly homogeneous and are not hardened against an adaptive adversary that crafts graph perturbations within a semantics-preserving budget; adversarial-training techniques tailored to GNN-based metamorphic detection remain underexplored. Finally, on the most heavily obfuscated families the latent graph representations become dense and nearly linearly inseparable, which limits any single classical decision surface.

MetaGNN-Sec is designed so that each component answers one facet of this gap, and the combination—not any single part—produces the result. The heterogeneous program-dependence graph representation (Section 3) adds data-dependence and call relations on top of control flow, capturing invariants that survive register renaming and instruction reordering. The WGAN adversarial-hardening loop exposes the encoder to semantics-preserving graph perturbations during training, shrinking the exploitable region around the decision boundary. The quantum-kernel anomaly layer provides an exponentially high-dimensional feature map in which heavily obfuscated outliers separate more cleanly from the benign cluster. The ablation in Section 5 confirms that no single component dominates, establishing that the integration itself is the source of the gain. The design principle is therefore one of minimal sufficient composition: each component is retained only because its removal degrades performance measurably (the ablation study in Section 5), and none is included for its own sake. We regard the complexity of the framework as answerable to that test, and we report the cost side of it explicitly—parameter count, memory footprint and throughput in Section 5, and the quantum layer’s cost/benefit characterization in Section 6.

3. Mathematical Framework

3.1. Program-Dependence Graph Representation

Let $\mathcal{B}$ denote a binary executable. A control-flow graph (CFG) is extracted as $G_{\mathrm{cfg}}=(V_b,E_b)$, where each node $v\in V_b$ represents a basic block, and $(v_i,v_j)\in E_b$ iff execution can transfer from block $v_i$ to block $v_j$. (Here “iff” is the standard mathematical abbreviation for “if and only if,” denoting logical equivalence (⇔): the left-hand statement holds exactly when the right-hand statement holds, and conversely. For example, the edge $(v_i,v_j)$ belongs to $E_b$ whenever execution can transfer from $v_i$ to $v_j$, and, equally, the presence of $(v_i,v_j)$ guarantees that such a transfer is possible; no edge is included for any other reason.)

The program-dependence graph (PDG) enriches the CFG with data-flow edges, as stated in Equation (1):

$$G_{\mathrm{pdg}}=\left(V_b,E_b\cup E_d\right),$$

(1)

where $E_d=\{(v_i,v_j)\mid \mathrm{a}\mathrm{definition}\mathrm{in}{v}_i\mathrm{reaches}\mathrm{a}\mathrm{use}\mathrm{in}{v}_j\}$. Node features are assembled as shown in Equation (2), which concatenates semantic, statistical and structural descriptors for each basic block:

$${\mathbf{x}}_v=\left[{\varphi }_{\mathrm{op}}\left(v\right)\parallel {\varphi }_{\mathrm{stat}}\left(v\right)\parallel {\varphi }_{\mathrm{cfg}}\left(v\right)\right]\in {\mathbb{R}}^d,$$

(2)

where ${\varphi }_{\mathrm{op}}$ is a learned opcode embedding (dimension 128), ${\varphi }_{\mathrm{stat}}$ encodes block-level statistics (instruction count, entropy; dim 16), and ${\varphi }_{\mathrm{cfg}}$ captures structural descriptors (in-degree, out-degree, dominator depth; dim 8).

3.2. Heterogeneous Graph Neural Network

We define a three-relation heterogeneous graph $\mathcal{G}=(V,E,\mathcal{R})$ with relation set $\mathcal{R}=\{\mathit{cfg},\mathit{data},\mathit{call}\}$. The l-th message-passing layer computes, for each relation $r\in \mathcal{R}$, the relation-specific update of Equation (3):

$${\mathbf{h}}_v^{(l,r)}=\sigma \left({\mathbf{W}}_r^{\left(l\right)}{\mathbf{h}}_v^{(l-1)}+\sum _{u\in {\mathcal{N}}_r\left(v\right)}{\displaystyle \frac{1}{|{\mathcal{N}}_r\left(v\right)|}}{\mathbf{M}}_r^{\left(l\right)}{\mathbf{h}}_u^{(l-1)}\right),$$

(3)

where ${\mathbf{W}}_r^{\left(l\right)},{\mathbf{M}}_r^{\left(l\right)}\in {\mathbb{R}}^{d^{\prime }\times d}$ are learnable matrices, and ${\mathcal{N}}_r\left(v\right)$ is the neighborhood of v under relation r. The per-relation representations are fused via the soft attention mechanism of Equation (4), which learns how much weight each relation should carry at each node:

$${\mathbf{h}}_v^{\left(l\right)}=\sum _{r\in \mathcal{R}}{\alpha }_r^v{\mathbf{h}}_v^{(l,r)},{\alpha }_r^v={\displaystyle \frac{\exp \left({\mathbf{q}}^{\top }\tanh \left(\mathbf{K}{\mathbf{h}}_v^{(l,r)}\right)\right)}{{\sum }_{r^{\prime }}\exp \left({\mathbf{q}}^{\top }\tanh \left(\mathbf{K}{\mathbf{h}}_v^{(l,r^{\prime })}\right)\right)}},$$

(4)

with global attention vector $\mathbf{q}$ and projection $\mathbf{K}$. The graph-level representation is then obtained by hierarchical pooling, Equation (5):

$${\mathbf{z}}_{\mathcal{G}}=\mathrm{D}\mathrm{I}\mathrm{F}\mathrm{F}\mathrm{P}\mathrm{O}\mathrm{O}\mathrm{L}\left({\left\{{\mathbf{h}}_v^{\left(L\right)}\right\}}_{v\in V},G\right)\in {\mathbb{R}}^{d_g}.$$

(5)

3.3. Conditional Score-Shift Bound

Before the formal statement, it is worth saying plainly what this subsection does and does not establish. The intuition it formalizes is simple: if two programs are structurally similar, and the classifier does not react disproportionately to small structural differences, then a semantics-preserving rewrite cannot move the classifier’s score very far. Definition 1 makes “structurally similar” precise by bounding two quantities—a graph-edit distance and a Weisfeiler–Lehman kernel distance—and Proposition 1 converts that into a bound on the score displacement. This is the argument for why a structural representation should survive metamorphism where a byte-level one does not; Section 3.4 then measures the same quantities on a fully specified example, and readers who prefer the concrete treatment may go there first and return.

Two terms used throughout this paper must be kept distinct, since conflating them would overstate what is claimed. A conditional score-shift bound is the analytical statement developed here: it constrains how far the classifier’s output can move under a $(k,\delta )$-bounded, semantics-preserving transformation, and it holds only conditionally—on the Lipschitz assumption below, which is estimated empirically rather than derived from the architecture in closed form. Adversarial robustness, by contrast, is used in this paper exclusively to denote an empirically measured quantity: the detection rate retained under adaptive evasion, reported in Section 5 and Table 6. The first is an explanatory bound on score displacement; the second is a measurement of detection performance under attack. Neither implies the other, and the bound below is not a certificate of the robustness reported later.

Definition 1.

A metamorphic transformation $\tau :\mathcal{B}\to \mathcal{B}$ is$(k,\delta )$-bounded if its induced graph-edit distance satisfies $\mathrm{GED}(G_{\tau \left(\mathcal{B}\right)},G_{\mathcal{B}})\le k$ and the Weisfeiler–Lehman subtree kernel distance satisfies $\parallel K_{\mathrm{WL}}(G_{\tau \left(\mathcal{B}\right)},·)-K_{\mathrm{WL}}(G_{\mathcal{B}},·){\parallel }_{\infty }\le \delta$.

Proposition 1

(Conditional score-shift bound). Let $f_{\theta }:\mathcal{G}\to [0,1]$ be the hGNN classifier, and suppose that on the region of graph space under consideration $f_{\theta }$ is Λ-Lipschitz with respect to the Weisfeiler–Lehman kernel metric, i.e., $|f_{\theta }\left(G\right)-f_{\theta }\left(G^{\prime }\right)|\le \Lambda \parallel K_{\mathrm{WL}}(G,·)-K_{\mathrm{WL}}(G^{\prime },·){\parallel }_{\infty }$ for all $G,G^{\prime }$ in that region. Then, under a $(k,\delta )$-bounded transformation τ, the shift in classification score satisfies

$$|f_{\theta }\left(G_{\tau \left(\mathcal{B}\right)}\right)-f_{\theta }\left(G_{\mathcal{B}}\right)|\le \Lambda \delta .$$

(6)

Proof. 

Immediate: by the Lipschitz assumption, $|f_{\theta }\left(G_{\tau \left(\mathcal{B}\right)}\right)-f_{\theta }\left(G_{\mathcal{B}}\right)|\le \Lambda \parallel K_{\mathrm{WL}}(G_{\tau \left(\mathcal{B}\right)},·)-K_{\mathrm{WL}}(G_{\mathcal{B}},·){\parallel }_{\infty }$, and the $(k,\delta )$-boundedness of $\tau$ bounds the kernel-distance term by $\delta$ directly, from which (6) follows.    □

Remark 1.

The graph-edit budget k does not appear in (6); its role is to delimit the class of admissible structural edits (the operational semantics-preservation budget enforced by the adaptive-evasion protocol of Section 4.7) and, empirically, to control δ: because metamorphic edits are local, a k-bounded edit perturbs $O\left(k\right)$ of the $\left|V\right|$ WL-refinement labels, so the normalized kernel distance contracts approximately as $k/\left|V\right|$ on realistic whole-binary PDGs. Section 3.4 makes this dilution effect exact on a fully specified example. An earlier version of this manuscript stated the bound as $\Lambda \sqrt{2k\delta }$ via an intermediate inequality relating the graph-edit and kernel budgets; since Definition 1 already bounds the kernel distance by δ, the direct form (6) is both simpler and tighter, and we adopt it throughout.

• Scope and caveats. Equation (6) should be read as a design principle—motivating constraining $\Lambda$ via spectral normalization [32] and minimizing $\delta$ during training—rather than as a formal certificate of adversarial robustness. The empirical robustness reported in Section 5 is the operative evidence for the framework’s resilience; this proposition explains why graph representations are comparatively stable and is not a worst-case security proof. We state the result as a conditional bound for that reason, and we draw the reader’s attention to three limitations that bound its force. First, the Lipschitz constant $\Lambda$ is not derived from the architecture in closed form; it is estimated empirically (we measure $\Lambda \approx 3.1$ on the held-out set, Section 6), so the bound is only as reliable as that estimate and may be violated locally where the empirical estimate understates the true constant. Second, the bound constrains the score shift under semantics-preserving, $(k,\delta )$-bounded edits; it does not certify a fixed decision margin, and it says nothing about transformations that exceed the budget or that alter program semantics. Third, the inequality assumes the WL kernel faithfully reflects the relevant structural distance, which holds approximately rather than exactly. Taken together, these three limitations are why the result is offered as an explanation of observed stability rather than as a guarantee of it, and why the operative evidence for the framework’s resilience remains the adaptive-evasion measurement of Section 5 rather than this proposition.

3.4. A Worked Metamorphic Example

To ground the invariance argument in a concrete case—and to make the difference between surface-level and structural representations measurable rather than asserted—we trace a single-seed routine through two levels of metamorphic transformation and report, for each level, the exact distance seen by four representations: a surface opcode n-gram view (the information available to byte- and sequence-level detectors), the control-flow graph-edit distance, the Weisfeiler–Lehman (WL) kernel distance that drives Proposition 1, and the preservation of block-level def–use chains (the data-flow signal unique to the PDG). Every number below is computed by construction from the fully specified listings and graphs and is reproducible from a short script included in the reference archive (Data Availability).

The seed $F_0$ is a 32-bit array-checksum routine of three basic blocks (initialize accumulator; loop body accumulating and decrementing a counter; store and return). Level ${\tau }_1$ applies two of the mildest transformation classes—register renaming (RR: eax→edx, ecx→ebx) and dead-code insertion (DCI: three semantic-NOP idioms such as xchg edx,edx and lea r9,[r9+0]). Level ${\tau }_2$ additionally applies the two deepest classes—equivalent-instruction substitution (EIS: xor r,r→sub r,r, dec→sub 1, test→or) and control-flow transposition (CFT: branch inversion plus splitting the loop body into two blocks). Both levels preserve the routine’s input–output semantics.

Three points follow directly from

Table 1. Representation-level distance from the seed $F_0$ under two semantics-preserving metamorphic levels, computed exactly from the specification in Section 3.4. Lower surface similarity means the transformation defeats the corresponding representation; the WL distance is the quantity bounded by $\delta$ in Proposition 1. The final row embeds the mutated routine in a realistic whole-binary PDG ($\left|V\right|\approx {10}^3$), showing the dilution effect of the Remark. * The starred bound exceeds the trivial range $[0,1]$ of the classifier score and therefore certifies nothing at that scale; this is discussed in the text immediately below.

Representation/Quantity	${\mathit{F}}_0\to {\mathit{\tau }}_1$	${\mathit{F}}_0\to {\mathit{\tau }}_2$
Surface opcode 3-gram similarity (full instr., Jaccard)	0.00	0.00
Surface opcode 3-gram similarity (mnemonic-only, Jaccard)	0.21	0.06
CFG graph-edit distance (GED)	0	7
Def–use chains preserved (of 3)	3/3	3/3
WL kernel distance $\delta$ (function alone, $\left|V\right|$ = 3)	0.00	0.73
Predicted score-shift bound $\Lambda \delta$ ($\Lambda$ = 3.1)	0.00	2.27 *
WL kernel distance $\delta$ (embedded, $\left|V\right|$ ≈ ${10}^3$)	0.00	<$0.001$
Predicted score-shift bound $\Lambda \delta$ (embedded)	0.00	<$0.01$

. First, the surface view collapses immediately: at the full-instruction level the 3-gram overlap with the seed is already zero after the mildest transformation, which is precisely why byte- and sequence-level detectors lose the family under metamorphism. Second, the data-flow signal is fully preserved at both levels—all three block-level def–use chains survive under the optimal block mapping—so a representation that encodes def–use edges (the PDG) retains a discriminative structure that a CFG-only or byte-only representation does not; this is the concrete mechanism behind the CFG-only ablation reported in Section 5. Third, the WL distance behaves exactly as Proposition 1 and its Remark predict: on the bare three-block function, the deep ${\tau }_2$ edit registers a large $\delta =0.73$ (the starred bound 2.27 is vacuous, i.e., it exceeds the trivial range $[0,1]$ of the score and so certifies nothing at that scale), but once the same edit is embedded in a realistic whole-binary PDG of $\sim {10}^3$ blocks the normalized WL distance falls below ${10}^{-3}$ and the bound tightens to $<0.01$. The worked example therefore illustrates both the promise and the stated limit of the analysis: the bound is informative for local edits diluted across a full program graph, and uninformative for edits considered in isolation on a tiny graph—consistent with the empirical 5.4 pp adversarial drop in Section 5 rather than with any claim of a vanishing score shift.

3.5. WGAN-Based Adversarial Hardening

To harden $f_{\theta }$ against adaptive adversaries, we train a generator $G_{\varphi }$ that produces adversarial graph perturbations. The Wasserstein objective, Equation (7), couples the critic’s Wasserstein estimate to the classification loss so that generated perturbations remain informative:

$$\underset{\varphi }{\min }\underset{\parallel D_{\psi }{\parallel }_L\le 1}{\max }{\mathbb{E}}_{G\sim p_{\mathrm{real}}}\left[D_{\psi }\left(G\right)\right]-{\mathbb{E}}_{z\sim p_z}\left[D_{\psi }\left(G_{\varphi }\left(z\right)\right)\right]+{\lambda }_{\mathrm{cls}}{\mathcal{L}}_{\mathrm{cls}}(\theta ;G_{\varphi }\left(z\right)),$$

(7)

where $D_{\psi }$ is the 1-Lipschitz critic and ${\mathcal{L}}_{\mathrm{cls}}$ is the binary cross-entropy classification loss. The gradient penalty enforcing the Lipschitz constraint on the critic is given by Equation (8):

$${\mathcal{L}}_{\mathrm{GP}}={\lambda }_{\mathrm{gp}}{\mathbb{E}}_{\widehat{G}}\left[{\left(\parallel {\nabla }_{\widehat{G}}{D}_{\psi }\left(\widehat{G}\right){\parallel }_2-1\right)}^2\right],$$

(8)

with $\widehat{G}$ sampled uniformly between real and generated graphs.

3.6. Quantum-Kernel Anomaly Layer

For a feature vector $\mathbf{z}\in {\mathbb{R}}^{d_q}$ (projected from ${\mathbf{z}}_{\mathcal{G}}$), we define a quantum feature map $\Phi :{\mathbb{R}}^{d_q}\to \mathcal{H}$ via a parameterized circuit $U\left(\mathbf{z}\right)|\mathbf{0}\rangle$. The quantum kernel, Equation (9), is the squared overlap of the two encoded states:

$${\kappa }_Q(\mathbf{z},{\mathbf{z}}^{\prime })={\left|\langle \mathbf{0}\left|U^{†}\left(\mathbf{z}\right)U\left({\mathbf{z}}^{\prime }\right)\right|\mathbf{0}\rangle \right|}^2.$$

(9)

An anomaly score is then derived, in Equation (10), as the distance to the kernel-space centroid of the benign training cluster:

$$s\left(\mathbf{z}\right)=1-{\displaystyle \frac{1}{|C_0|}}\sum _{{\mathbf{z}}_i\in C_0}{\kappa }_Q(\mathbf{z},{\mathbf{z}}_i),$$

(10)

where $C_0$ is the set of benign training samples. Samples with $s\left(\mathbf{z}\right)>{\tau }_Q$ (tuned on a held-out validation set) are escalated to the hGNN classifier for a final verdict.

4. Experiments and Methods

4.1. Architecture Overview

Figure 1 illustrates the end-to-end MetaGNN-Sec pipeline. The architecture is organized into three functionally distinct stages separated by the dashed adversarial feedback arrow.

• Pre-processing stage: A raw binary enters the pipeline and is disassembled by Radare2, producing an assembly stream from which the CFG and PDG are built (Algorithm 1). The node features ${\mathbf{x}}_v$ (Equation (2)) are assembled from BPE opcode embeddings, block-level statistics, and structural descriptors. This stage is CPU-bound and takes approximately 0.8 ms per binary on average.
• hGNN encoder stage: The heterogeneous graph is passed through four message-passing layers that interleave relation-specific aggregation, soft attention fusion (Equation (4)), and DiffPool coarsening (Equation (5)), reducing the graph to a fixed-dimensional embedding ${\mathbf{z}}_{\mathcal{G}}\in {\mathbb{R}}^{256}$. This stage accounts for 71% of the total inference time and is GPU-bound.
• Detection head: The embedding is consumed by two parallel branches. The binary classifier $f_{\theta }$ produces a posterior malware probability. Simultaneously, ${\mathbf{z}}_{\mathcal{G}}$ is projected to ${\mathbb{R}}^8$ and passed to the quantum-kernel layer, which computes the centroid anomaly score s (Equation (10)). A sample scoring $s\le 0.30$ is fast-rejected as benign without invoking $f_{\theta }$, saving computation on clearly benign files. The dashed red arrow denotes the WGAN adversarial feedback loop: during training, the critic $D_{\psi }$ receives embeddings of real and WGAN-generated adversarial graphs, driving the encoder to produce representations that are invariant to admissible metamorphic mutations.

Algorithm 1 PDG construction from the binary executable
Input: Binary $\mathcal{B}$, BPE vocabulary $\mathcal{V}$, max block length $L_{\max }=1024$
Output: PDG $G_{\mathrm{pdg}}=(V_b,E_b\cup E_d\cup E_{\mathrm{call}})$ with node features
1: Analyze $\mathcal{B}$ with $\mathrm{R}\mathrm{ADARE}2$; enumerate functions $\mathcal{F}$
2: Initialize $V_b\leftarrow \mathsf{\varnothing }$,$E_b\leftarrow \mathsf{\varnothing }$,$E_d\leftarrow \mathsf{\varnothing }$
3: for each function $f\in \mathcal{F}$ do
4:      for each basic block $B_i\in \mathrm{B}\mathrm{ASIC}\mathrm{B}\mathrm{LOCKS}\left(f\right)$ do
5:           ${\mathbf{o}}_i\leftarrow \mathrm{BPET}\mathrm{OKENIZE}(\mathrm{O}\mathrm{PCODES}\left(B_i\right),\mathcal{V},L_{\max })$
6:           ${\mathbf{x}}_{B_i}\leftarrow [\mathrm{E}\mathrm{MBED}\left({\mathbf{o}}_i\right)\parallel {\varphi }_{\mathrm{stat}}\left(B_i\right)\parallel {\varphi }_{\mathrm{cfg}}\left(B_i\right)]$	▹ Equation (2)
7:           $V_b\leftarrow V_b\cup \left\{B_i\right\}$
8:      end for
9:      $E_b\leftarrow E_b\cup \mathrm{CFGE}\mathrm{DGES}\left(f\right)$
10:      for $(B_i,B_j)\in \mathrm{A}\mathrm{NG}\mathrm{RD}\mathrm{EF}\mathrm{U}\mathrm{SE}\left(f\right)$ do
11:           $E_d\leftarrow E_d\cup \left\{(B_i,B_j)\right\}$
12:      end for
13: end for
14: return  $G_{\mathrm{pdg}}=(V_b,E_b\cup E_d\cup \mathrm{C}\mathrm{ALL}\mathrm{E}\mathrm{DGES}\left(\mathcal{F}\right),\left\{{\mathbf{x}}_{B_i}\right\})$

4.2. Datasets

Two publicly available repositories were used:

• VirusShare-2024 [33]: 143,812 malware samples spanning 12 metamorphic families (G2, NGVCK, Evol, Zperm, and eight additional) plus 45,000 benign Windows PE binaries drawn from the Windows 10/11 system partition.
• SOREL-20M [34]: 11,363 Windows PE binaries drawn from the Sophos/ReversingLabs production-scale corpus (collected 2017–2019), selected to provide polymorphic and proto-metamorphic samples spanning diverse malware families for cross-era evaluation; SOREL-20M samples carry high-quality labels derived from multiple vendor sources and are publicly available via AWS S3.

• Rationale for corpus selection. Many public malware repositories exist, and the choice of these two was made on three stated criteria rather than on availability alone. First, temporal separation: the two corpora are drawn from different collection windows (2024 against 2017–2019), which permits the cross-era evaluation reported below and mitigates the temporal experimental bias cataloged by Arp et al. [35]. Second, label quality: SOREL-20M carries consensus labels derived from multiple vendor sources, which bounds the label-inaccuracy exposure discussed in Section 4.9; VirusShare does not, and we record that asymmetry rather than average over it. Third, public obtainability: both are retrievable by any reader—VirusShare on free registration, SOREL-20M via AWS S3—so the evaluation can be repeated independently, which a proprietary or internally collected corpus would not permit. The twelve VirusShare families were fixed by prevalence in the collection window before any model was trained, so that family selection could not be tuned to favor the proposed method (Section 4.8). We note the corresponding limitation in Section 6: both corpora share collection and labeling pipelines, so they do not constitute a fully independent cross-dataset test, and we do not present them as one. Samples were partitioned 70/15/15 (train/validate/test) stratified by family and year. Crucially, the partition is also disjoint by seed lineage: variants generated from a common seed binary are confined to a single split, so that no train/test leakage can arise from shared ancestry.

  Table 2. Dataset summary. “Meta” denotes metamorphic; “Poly” denotes polymorphic. DR—detection rate of baseline AV (VirusTotal consensus, March 2025).

  Dataset	Samples	Malware	Benign	Type	Baseline DR (%)
  VirusShare-2024	188,812	143,812	45,000	Meta/Poly	79.3
  SOREL-20M (subset)	11,363	11,363	—	Poly/Meta	68.4
  Total	200,175	155,175	45,000	Mixed	78.7

  summarizes the corpus statistics.

4.3. Pre-Processing Pipeline

Raw PE and ELF binaries are disassembled with Radare2 (v5.9.2) to extract assembly instruction streams. CFGs are exported in DOT format and imported into a Python graph-building module. Opcode sequences of length $\le 1024$ instructions are tokenized with a byte pair encoding (BPE) vocabulary of 8192 tokens. PDG construction augments the CFG with def–use chains computed by a lightweight dataflow analyzer built on top of angr [36]. All binaries analyzed are x86/x86-64 PE executables, and opcode mnemonics are interpreted under that instruction-set architecture. Algorithm 1 summarizes the full PDG extraction procedure.

4.4. Model Architecture and Hyperparameters

The hGNN uses $L=4$ message-passing layers with a hidden dimension $d^{\prime }=256$. DiffPool [37] clusters nodes into $\lceil \left|V\right|/4\rceil$ super-nodes per layer. The WGAN critic is a 4-layer MLP with spectral normalization; ${\lambda }_{\mathrm{gp}}=10$, ${\lambda }_{\mathrm{cls}}=5$. The quantum anomaly layer uses $n=8$ qubits with an instantaneous quantum polynomial (IQP) embedding circuit [30] with a depth of 2 implemented in PennyLane v0.35. The threshold ${\tau }_Q=0.62$ was chosen to yield $\le 1\%$ false-positive rate on the validation set. All hyperparameters were tuned via Bayesian optimization (Optuna v3.6) over 200 trials. Algorithms 2 and 3 give the hGNN forward pass and the hyperparameter search procedure, respectively.

Algorithm 2 hGNN encoder forward pass
Input: $\mathcal{G}=(V,E,\mathcal{R})$, features $\left\{{\mathbf{x}}_v\right\}$, learnable $\{{\mathbf{W}}_r^{\left(l\right)},{\mathbf{M}}_r^{\left(l\right)},\mathbf{q},\mathbf{K}\},L=4$
Output: Graph embedding ${\mathbf{z}}_{\mathcal{G}}\in {\mathbb{R}}^{d_g}$
1: ${\mathbf{h}}_v^{\left(0\right)}\leftarrow {\mathbf{x}}_v$ for all v
2: for $l=1$ to L do
3:      for $r\in \{\mathit{cfg},\mathit{data},\mathit{call}\}$ do
4:           ${\mathbf{h}}_v^{(l,r)}\leftarrow \sigma \left({\mathbf{W}}_r^{\left(l\right)}{\mathbf{h}}_v^{(l-1)}+\frac{1}{|{\mathcal{N}}_r\left(v\right)|}{\sum }_{u\in {\mathcal{N}}_r\left(v\right)}{\mathbf{M}}_r^{\left(l\right)}{\mathbf{h}}_u^{(l-1)}\right)$	▹ Equation (3)
5:      end for
6:      ${\alpha }_r^v\leftarrow {\mathrm{S}\mathrm{OFTMAX}}_r\left({\mathbf{q}}^{\top }\tanh \left(\mathbf{K}{\mathbf{h}}_v^{(l,r)}\right)\right)$; ${\mathbf{h}}_v^{\left(l\right)}\leftarrow {\sum }_r{\alpha }_r^v{\mathbf{h}}_v^{(l,r)}$	▹ Equation (4)
7:      $\mathcal{G}\leftarrow \mathrm{D}\mathrm{IFF}\mathrm{P}\mathrm{OOL}(\mathcal{G},\lceil |V|/4\rceil )$	▹ Hierarchical coarsening
8: end for
9: return ${\mathbf{z}}_{\mathcal{G}}\leftarrow \mathrm{R}\mathrm{EAD}\mathrm{O}\mathrm{UT}\left(\left\{{\mathbf{h}}_v^{\left(L\right)}\right\}\right)$	▹ Equation (5)

Algorithm 3 Bayesian hyperparameter search (Optuna TPE, T = 200 trials)
Input: Search space $\Lambda$, validation set ${\mathcal{D}}_{\mathrm{val}}$, budget T = 200
Output: Optimal config ${\lambda }^{*}$
1: Initialize Optuna study: TPESampler, MedianPruner
2: for trial $t=1$ to T do
3:      ${\lambda }_t\leftarrow \mathrm{TPES}\mathrm{AMPLE}(\Lambda ,{\left\{({\lambda }_s,v_s)\right\}}_{s<t})$	▹ Suggest: $d^{\prime }\in \{128,256,512\}$, $L\in \{2\dots 5\}$, lr,
${\lambda }_{\mathrm{gp}}$, ${\lambda }_{\mathrm{cls}}$, ${\tau }_Q$
4:      for epoch $e=1$ to 5 do
5:        Train one epoch; report $F_1^{\mathrm{val}}$ to pruner
6:        if ShouldPrune$(t,e)$ then raise TeialPruned
7:        end if
8:      end for
9:      $v_t\leftarrow F_1^{\mathrm{val}}$ after full 5-epoch warm-up
10: end for
11: return ${\lambda }^{*}\leftarrow \arg {\max }_t{v}_t$	▹ Best: $d^{\prime }$ = 256, L = 4, ${\lambda }_{\mathrm{gp}}$ = 10, ${\lambda }_{\mathrm{cls}}$ = 5, ${\tau }_Q$ = 0.62

4.5. Hardware Configuration

All experiments were conducted on a single workstation with the following configuration:

• CPU: Intel Xeon W-3345 @ 3.0 GHz, 24 cores/48 threads.
• GPU: $2\times$ NVIDIA RTX 4090 (24 GB GDDR6X each), NVLink bridge.
• RAM: 256 GB DDR5-4800 ECC.
• Storage: 4 TB Samsung 990 Pro NVMe SSD (RAID-0).
• OS: Ubuntu 22.04 LTS, CUDA 12.3, cuDNN 8.9.7.
• Software: Python 3.11, PyTorch 2.2, PyTorch Geometric 2.5, PennyLane 0.35, LangGraph 0.1.7, R 4.3.2.

Training the full MetaGNN-Sec model required approximately 18 h on this hardware. The dual RTX 4090 configuration with NVLink bridge enables unified GPU memory addressing across both devices, which is essential for batching large heterogeneous graphs whose node counts can exceed 50,000 basic blocks in complex binaries. Data-parallel training was implemented using PyTorch’s DistributedDataParallel module, with the WGAN critic and hGNN encoder updated synchronously across both GPUs. The high-bandwidth DDR5-4800 ECC memory was necessary to hold the full VirusShare-2024 pre-processed graph dataset (≈180 GB in memory after PDG construction), avoiding repeated disk reads during training epochs. Algorithm 4 gives the complete training loop.

Algorithm 4 MetaGNN-Sec end-to-end training loop
Input: ${\mathcal{D}}_{\mathrm{tr}},{\mathcal{D}}_{\mathrm{val}}$, hyperparams ${\lambda }^{*}$, max epochs E = 100, patience P = 10, $n_{\mathrm{critic}}=5$
Output: Trained $f_{{\theta }^{*}}$, critic $D_{{\psi }^{*}}$, generator $G_{{\varphi }^{*}}$
1: Initialize $f_{\theta }$, $D_{\psi }$, $G_{\varphi }$; ${\mathrm{best}}_{F_1}\leftarrow 0$; $\mathrm{wait}\leftarrow 0$
2: for epoch $e=1$ to E do
3:      for each mini-batch $\mathcal{B}\subset {\mathcal{D}}_{\mathrm{tr}}$ do
4:           for $j=1$ to $n_{\mathrm{critic}}$ do	▹ Critic update
5:                ${\mathbf{z}}_r\leftarrow f_{\theta }.Enc\left(\mathcal{B}\right)$; ${\mathbf{z}}_f\leftarrow f_{\theta }.Enc\left(G_{\varphi }\left(\mathcal{B}\right)\right)$
6:                ${\mathcal{L}}_C\leftarrow D_{\psi }\left({\mathbf{z}}_f\right)-D_{\psi }\left({\mathbf{z}}_r\right)+{\mathcal{L}}_{\mathrm{GP}}({\mathbf{z}}_r,{\mathbf{z}}_f)$	▹ Equations (7) and (8)
7:                Update $\psi \leftarrow \psi -\eta {\nabla }_{\psi }{\mathcal{L}}_C$
8:          end for	▹ Generator + classifier update
9:          ${\mathbf{z}}_a\leftarrow f_{\theta }.Enc\left(G_{\varphi }\left(\mathcal{B}\right)\right)$
10:          $\mathcal{L}\leftarrow -D_{\psi }\left({\mathbf{z}}_a\right)+{\lambda }_{\mathrm{cls}}BCE(f_{\theta }.Cls\left({\mathbf{z}}_a\right),y)$
11:          Update $(\theta ,\varphi )\leftarrow (\theta ,\varphi )-\eta {\nabla }_{\theta ,\varphi }\mathcal{L}$
12:      end for
13:      $F_1\leftarrow Eval(f_{\theta },{\mathcal{D}}_{\mathrm{val}})$
14:      if $F_1>{\mathrm{best}}_{F_1}$ then
15:          $({\theta }^{*},{\psi }^{*},{\varphi }^{*})\leftarrow (\theta ,\psi ,\varphi )$; ${\mathrm{best}}_{F_1}\leftarrow F_1$; $\mathrm{wait}\leftarrow 0$
16:      else
17:          $\mathrm{wait} +=1$
18:          if $\mathrm{wait}\ge P$ then break
19:          end if
20:      end if
21: end for
22: return $f_{{\theta }^{*}}$, $D_{{\psi }^{*}}$, $G_{{\varphi }^{*}}$

4.6. Baselines

We compared MetaGNN-Sec against five baselines spanning three detector paradigms—raw-byte, feature-engineered, and graph-based—chosen to isolate the contribution of each architectural decision.

• (B1) MalConv+ [18] extends the original MalConv architecture with a gated attention mechanism over the raw byte sequence, enabling the model to focus on discriminative subregions of the executable without truncation at fixed windows. MalConv+ operates directly on files up to 2 MB and requires no manual feature engineering, making it the strongest purely byte-level baseline and a representative of the class of detectors most widely deployed in production endpoint agents.
• (B2) EMBER-RF [12] trains a gradient-boosted random forest on the 2381-dimensional EMBER feature vector, encoding byte-value histograms, import table statistics, section entropy profiles, and string-length distributions. Its very high throughput (38,500 samples/s) and low memory footprint (0.8 M parameters) make it a widely used production baseline, but its aggregate representation discards all structural and ordering information.
• (B3) GCN-CFG [21] applies a homogeneous graph convolutional network to the control-flow graph, with per-node features derived from opcode n-gram histograms. This baseline directly quantifies the marginal gain from adding data flow (PDG) edges and heterogeneous relation typing to a plain CFG representation, isolating the structural enrichment axis.
• (B4) HMIL (heterogeneous multiple-instance learning) is a baseline we implemented ourselves rather than one taken from a single published system. It constructs a heterogeneous graph jointly embedding opcode and API-call nodes with multiple edge types, and pools family-level evidence with multiple-instance learning in the sense of Dietterich et al. [38], following the general heterogeneous-graph approach surveyed in [14]. We include it because it is the strongest non-adversarially hardened graph configuration in our comparison and the closest in representational power to MetaGNN-Sec: it shares heterogeneous relation typing but has neither the WGAN hardening loop nor the quantum anomaly layer, so the margin over B4 isolates the contribution of those two components. Because B4 is our own construction rather than a third-party system, we do not present the comparison against it as a comparison against published prior art; the published baselines are B1–B3 and B5.
• (B5) QSVM [30] fits a support vector machine using the quantum kernel ${\kappa }_Q$ evaluated over EMBER feature vectors rather than graph embeddings. This baseline isolates the quantum feature map’s contribution when applied to classical aggregate representations, separating the quantum vs. graph-structural axes and confirming whether quantum advantage requires the structural input or holds more broadly.

4.7. Evaluation Protocol

Performance is measured on the held-out test split via the detection rate (DR), false-positive rate (FPR), false-negative rate (FNR), $F_1$ score, area under the ROC curve (AUC-ROC), and area under the precision–recall curve (AUC-PR). For the avoidance of doubt, on the held-out test set the detection rate is defined as the true-positive rate over the malicious class and therefore coincides with recall; equivalently, $\mathrm{DR}=1-\mathrm{FNR}$. We use the term “Detection Rate” throughout for operational familiarity, but every reported DR may be read directly as recall. We additionally report adversarial robustness as the DR after exposing each detector to 500 adaptively generated evasive variants per metamorphic family (produced by the trained WGAN generator). The statistical significance of pairwise differences is assessed with a two-sided Wilcoxon signed-rank test ($\alpha =0.05$). Algorithm 5 formalizes the adaptive evasion protocol.

4.8. Reproducibility and Benchmark Consistency

To make every reported number independently verifiable, we fix and disclose the full experimental configuration. All experiments use a fixed global random seed (seed=1337) propagated to Python, NumPy, PyTorch, and CUDA, with deterministic cuDNN kernels enabled; the exact package versions (PyTorch 2.2.1, PyTorch Geometric 2.5.0, PennyLane 0.35, Optuna 3.6, Radare2 v5.9.2, angr 9.2) are pinned in an environment lock file bundled with the code (see Data Availability). The reference implementation, configuration files and seeds are made available on request so that the results reported in Section 5 can be regenerated from corpora the reader obtains independently; we do not distribute the corpora or any derived sample set, for the licensing and malware-handling reasons given in the Data Availability statement. To facilitate verification during peer review, the implementation (installable with one command and accompanied by an automated test suite) can be supplied to the editor and reviewers through the editorial office on request. As detailed in the Data Availability statement, the archive is not deposited in a public repository because portions of the implementation share components with proprietary digital-forensic tooling subject to contractual confidentiality; it is instead made available privately, in full, from the corresponding author on reasonable request so that the reported results can be regenerated end-to-end.

Algorithm 5 Adaptive evasion evaluation protocol
Input: Detector $f_{\theta }$ WGAN generator $G_{\varphi }$, malware test set $\mathcal{T}$, variants K = 500, budget
$(k_{\max },{\delta }_{\max })$
Output: Adversarial detection rate ${\mathrm{DR}}_{\mathrm{adv}}$
1: $\mathrm{evaded}\leftarrow 0$
2: for each $(G_i,1)\in \mathcal{T}$ do
3:      $\mathrm{success}\leftarrow \mathtt{False}$
4:      for $k=1$to K do
5:        ${\tilde{G}}_i\leftarrow G_{\varphi }(G_i,\mathbf{z}),\mathbf{z}\sim \mathcal{N}(\mathbf{0},\mathbf{I})$
6:        if $\mathrm{GED}({\tilde{G}}_i,G_i)>k_{\max }$ or WLDist$({\tilde{G}}_i,G_i)>{\delta }_{\max }$ or not ExecEquiv$({\tilde{G}}_i,G_i)$
then
7:         continue	▹ Reject invalid mutation
8:        end if
9:        if $\sigma \left(f_{\theta }\left({\tilde{G}}_i\right)\right)<0.5$ then
10:         $\mathrm{success}\leftarrow \mathtt{True}$; break
11:        end if
12:      end for
13:      if success then $\mathrm{evaded}+=1$
14:      end if
15: end for
16: return ${\mathrm{DR}}_{\mathrm{adv}}=1-\mathrm{evaded}/\left|\mathcal{T}\right|$

Three measures guard against the benchmark-consistency concerns that affect malware-detection studies. First, all five baselines were re-implemented and re-trained under an identical protocol—the same train/validate/test split, the same feature-extraction front end where applicable, and the same early-stopping and hyperparameter-search budget—rather than quoting numbers from heterogeneous prior publications; this is what makes the cross-method comparison in Section 5 like-for-like. We note for completeness that B1–B3 and B5 correspond to published systems, whereas B4 is our own heterogeneous configuration (Section 4.6), included as an ablation-style reference point rather than as a claim about third-party prior art. Second, family selection was fixed in advance: the twelve VirusShare families were chosen by prevalence in the 2024 collection window before any model was trained, and the SOREL-20M subset was drawn to supply out-of-window polymorphic/proto-metamorphic samples, so that family choice could not be tuned to flatter the proposed model. Third, every headline difference is accompanied by a significance test (two-sided Wilcoxon signed-rank, $\alpha =0.05$) and bootstrap confidence intervals ($n=\mathrm{10,000}$), reported alongside the point estimates. We emphasize that the strong margins in Section 5 are reported on held-out metamorphic families under a controlled, single-protocol re-evaluation, and we caution the reader that they should be interpreted in that light rather than as a claim of universal superiority; the external-validation limitations in Section 6 bound the scope of these claims.

4.9. Relation to Established Experimental Pitfalls

Because learning-based security evaluations are known to be susceptible to a recurring set of methodological errors, we assess our design explicitly against the ten pitfalls cataloged by Arp et al. [35], stating both the measures we take and the pitfalls we cannot fully retire.

Sampling bias and spatial/temporal experimental bias are the most consequential here. We mitigate temporal bias by drawing the two corpora from different collection windows (VirusShare-2024 and the 2017–2019 SOREL-20M subset) and by stratifying the split by year; the seed-lineage-disjoint partition (Section 4.2) removes the near-duplicate leakage that inflates many malware benchmarks. We do not, however, claim these measures eliminate sampling bias: both corpora share collection and labeling pipelines, so a fully independent cross-dataset test remains necessary and is identified as a prerequisite for deployment-grade claims (Section 6). Data snooping is controlled by fixing family selection in advance and confining all hyperparameter searches (Algorithm 3) to the validation split, with the test split touched once. Inappropriate baselines are addressed by re-implementing and re-training all five baselines under one protocol rather than quoting heterogeneous published numbers. Inappropriate performance measures are addressed by reporting FPR, FNR, AUC-PR, and per-family rates alongside the headline detection rate, and by pairing every headline difference with a significance test and bootstrap interval.

The base-rate fallacy deserves explicit quantification, because a detection rate of $97.83\%$ at an FPR of $0.41\%$ can read more favorably than operational reality warrants. At the enterprise scanning volume that we cite elsewhere ($5\times {10}^5$ files/day), the daily false-positive load and the resulting precision depend sharply on the true malware prevalence in the stream, as

Table 3. Base-rate analysis of the MetaGNN-Sec operating point (DR = 97.83%, FPR = 0.41%) at $5\times {10}^5$ files/day, as a function of true malware prevalence in the scanned stream. PPV—positive predictive value (precision).

Prevalence	Malware/Day	False Pos./Day	True Pos./Day	PPV
1.0%	5000	2030	4892	0.707
0.1%	500	2048	489	0.193
0.01%	50	2050	49	0.023

shows. At a plausible enterprise prevalence of $0.1\%$, the same operating point yields on the order of 2000 false alerts per day against roughly 490 true detections—a precision near 0.19, i.e., about four false alarms for every true one. This does not undermine the comparative results (every baseline is scored identically, and MetaGNN-Sec’s $0.41\%$ FPR is the lowest among them), but it does bound the operational reading of the absolute numbers: a low FPR is necessary but not sufficient, and a deployment would require either a higher-prevalence pre-filtered stream or a downstream triage stage. We report these figures rather than the headline rate alone precisely because the base-rate fallacy is easy to commit implicitly.

Two pitfalls we can only partially address, and we flag them as such. The lab-only setting pitfall applies: robustness is measured with an internal WGAN generator over a fixed mutation taxonomy, so performance against external, previously unseen obfuscators is not established here (Section 6). Label inaccuracy is reduced by using SOREL-20M’s multi-vendor consensus labels but cannot be eliminated for the VirusShare portion. We make these residual exposures explicit rather than treating the controlled-protocol results as evidence of universal superiority.

5. Results

5.1. Overall Detection Performance

Table 4. Overall detection performance on the held-out test set (VirusShare-2024 + SOREL-20M subset). The best result per column in bold. †: statistically significant improvement over B4 ($p<0.01$, Wilcoxon test).

Method	DR (%)	FPR (%)	FNR (%)	${\mathit{F}}_1$	AUC-ROC	AUC-PR
B1 MalConv+	91.42	2.31	8.58	0.912	0.961	0.947
B2 EMBER-RF	89.74	1.88	10.26	0.899	0.958	0.941
B3 GCN-CFG	93.17	1.63	6.83	0.933	0.971	0.956
B4 HMIL	93.24	1.22	6.76	0.942	0.974	0.963
B5 QSVM	85.06	3.45	14.94	0.843	0.933	0.917
MetaGNN-Sec †	97.83	0.41	2.17	0.978	0.994	0.991

reports detection metrics on the combined test set. MetaGNN-Sec achieves the highest performance across all six metrics, attaining a detection rate of 97.83%, an $F_1$ score of 0.978, and an AUC-ROC of 0.994. As shown by the ablation in Section 5.5, the quantum anomaly layer accounts for a 1.22 pp FNR reduction relative to the graph-only configuration, concentrated on the most heavily obfuscated third-tier families (

Table 5. The per-family detection rate (%) on the VirusShare-2024 test set. Families are sorted by MetaGNN-Sec DR (descending). n = number of test samples per family.

Family	n	MalConv+	GCN-CFG	HMIL	MetaGNN-Sec	Δ vs. B4
G2	2145	96.4	97.2	97.5	99.3	+1.8
NGVCK	1873	87.6	93.4	94.1	98.7	+4.6
Zperm	1632	83.2	91.8	92.7	98.1	+5.4
Evol	1404	79.4	88.9	90.3	97.6	+7.3
MetaFour	1221	88.1	93.7	94.5	98.2	+3.7
VSTF-III	1088	81.3	89.4	91.2	96.9	+5.7
DeepMorph	943	76.8	85.5	87.3	95.8	+8.5
Chameleon-2	812	74.2	83.1	85.7	95.1	+9.4
Mean	1390	83.4	90.4	91.7	97.5	+5.8

).

Several observations stand out. First, the two raw-byte methods (B1, B2) trail substantially in DR and AUC-PR, confirming that byte-level representations are insufficient when metamorphic engines alter instruction sequences. Among graph-based baselines, GCN-CFG (B3) and HMIL (B4) improve by approximately 2–3 pp over the byte-level methods, validating the structural representation hypothesis, yet both remain below 94% DR—a gap that MetaGNN-Sec closes by a further 4.6 pp through heterogeneous edge modeling and adversarial hardening. The quantum SVM baseline (B5) performs worst overall, likely because it operates on EMBER aggregate features rather than graph structure, limiting its ability to capture the invariant subgraphs characteristic of each metamorphic family.

The improvement of MetaGNN-Sec over B4 (HMIL) is statistically significant across all metrics ($p<0.01$, two-sided Wilcoxon signed-rank test), and the confidence interval on AUC-ROC difference is $[0.018,0.022]$ (bootstrap, $n=\mathrm{10,000}$). The precision–recall AUC of 0.991 indicates that the classifier maintains high precision even at recall levels above 99%, which is critical in operational environments where analyst capacity is limited.

5.2. Per-Family Detection Rates

Table 5 breaks down detection performance by metamorphic family on the VirusShare-2024 test partition. Three distinct tiers emerge. The first tier (G2, NGVCK, MetaFour) comprises families whose transformation engines rely primarily on register renaming and dead-code insertion—transformations that alter syntax but leave the PDG topology largely intact. MetaGNN-Sec detects these at ≥98.7%, and even the byte-level baseline B1 achieves above 87%, suggesting residual byte-level invariants persist.

The second tier (Zperm, Evol, VSTF-III) applies instruction reordering and subroutine permutation, in addition to the above, producing more substantial CFG edits. MetaGNN-Sec retains above 96.9% DR on all three; the margin over HMIL widens to 5–7 pp, consistent with the heterogeneous data-flow edges capturing def–use relationships that survive reordering transformations.

The third tier (DeepMorph, Chameleon-2) employs full control-flow transposition and equivalent-instruction substitution—the deepest transformation class. These are the hardest families for all methods: MalConv+ drops to 74.2% on Chameleon-2. MetaGNN-Sec still achieves $\ge 95.1\%$ on this tier, with the largest per-family margins over HMIL (+8.5 and +9.4 pp, respectively), demonstrating that the WGAN adversarial hardening loop disproportionately benefits the detection of heavily mutated variants. The ROC comparison in Section 5.8 shows that MetaGNN-Sec dominates the entire operating range.

5.3. Adversarial Robustness

Table 6. The detection rate (%) under adaptive adversarial evasion (500 variants per family, WGAN generator). “Drop”—absolute decrease from clean test set.

Method	Clean DR	Adv. DR	Drop	Adv. FPR	Adv. ${\mathit{F}}_1$
B1 MalConv+	91.42	61.3	$-30.1$	2.8	0.658
B2 EMBER-RF	89.74	58.7	$-31.0$	2.4	0.631
B3 GCN-CFG	93.17	72.4	$-20.8$	1.9	0.748
B4 HMIL	93.24	76.1	$-17.1$	1.6	0.779
MetaGNN-Sec	97.83	92.4	$-\mathbf{5.4}$	0.7	0.927

reports the detection rate after adaptive evasion using the WGAN-generated mutation set (500 variants per family). The results expose a striking asymmetry between clean-data performance and adversarial robustness across methods. The byte-level detectors (B1, B2) suffer the largest absolute drops of 30–31 pp, reducing their operational DR to below 62%—a level approaching random chance for a balanced dataset. This collapse is consistent with the known vulnerability of convolutional byte models to adversarial byte injection [11]: a small number of carefully placed NOPs or byte padding can shift the model’s score decisively.

Graph-based methods are inherently more resilient because mutations must respect the $(k_{\max },{\delta }_{\max })$ budget to remain semantics-preserving (Algorithm 5), limiting the degree to which the graph topology can be altered. Nevertheless, GCN-CFG and HMIL still drop by 17–21 pp under evasion, indicating that a determined adaptive attacker can construct graph perturbations within the validity budget that shifts homogeneous GNN representations enough to cross the decision boundary.

MetaGNN-Sec degrades by only 5.4 pp, retaining an adversarial DR of 92.4% and $F_1$ of 0.927. This resilience arises from two synergistic mechanisms: (i) the WGAN hardening loop exposes the hGNN encoder to adversarially perturbed graphs during training, shrinking the exploitable region around the decision boundary, and (ii) the heterogeneous relation structure means an attacker must simultaneously fool three edge types, dramatically increasing the mutation budget required for a successful evasion. The $3.1\times$ improvement in robustness drop compared with B4 (5.4 vs. 17.1 pp) underscores that adversarial training is not merely complementary but essential for deployment-grade metamorphic detection.

5.4. Cross-Dataset Generalization

The results reported so far are obtained on held-out partitions of the two corpora used for training (VirusShare-2024 and the SOREL-20M subset). To probe whether the framework generalizes beyond that ecosystem—the concern that good in-corpus classification does not by itself establish effectiveness of the approach—we additionally evaluate the frozen MetaGNN-Sec model, without any retraining or fine-tuning, on two external corpora it never saw during training: BODMAS [39] and MOTIF [40]. These corpora are drawn from collection and labeling pipelines independent of VirusShare and SOREL-20M, so they test cross-provenance generalization rather than merely cross-partition performance.

Two design choices make this a conservative test. First, for BODMAS we adopt a temporal split in the spirit of time-aware malware evaluation [35]: samples are partitioned by first-seen date, and the model—trained only on earlier data—is judged on the later time window, so the reported figures reflect decay across time, not an in-distribution re-test. Second, MOTIF is a labeled malware-only benchmark; it therefore measures detection rate (recall) and false-negative rate directly, but does not admit a false-positive rate or AUC (there is no benign class), and we report only the metrics that are well defined rather than manufacturing a benign comparison set. Both corpora are ingested through the same PDG-extraction and featurization front end used for the primary experiments, so the comparison is like-for-like at the representation level. The evaluation harness and the data loaders that implement this protocol are included in the reference archive (Data Availability).

Because the corresponding measurements are not part of the evidence base of this paper, no cross-dataset figures are reported here and none of the claims made in this manuscript rest on them. The contribution of this subsection is the protocol and its implementation: the split definitions, the metric set admissible for each corpus, and the loaders and harness required to execute it, all released in the reference archive (Data Availability). The empirical claims of the paper are confined throughout to the in-corpus results of Table 4, Table 5, Table 6 and

Table 7. Ablation study. Each row removes one component of MetaGNN-Sec. “w/o”—without. DR and $F_1$ on the full test set.

Configuration	DR (%)	FPR (%)	FNR (%)	${\mathit{F}}_1$
Full MetaGNN-Sec	97.83	0.41	2.17	0.978
w/o heterogeneous edges	95.12	0.68	4.88	0.951
w/o WGAN hardening	96.41	0.53	3.59	0.963
w/o quantum layer	96.61	0.55	3.39	0.965
w/o DiffPool	94.83	0.74	5.17	0.947
w/o opcode embeddings	93.47	0.92	6.53	0.935
CFG only (no PDG)	92.68	1.04	7.32	0.927

, and the scope limits recorded in Section 6 state plainly that out-of-ecosystem generalization is not established by the evidence presented here.

5.5. Ablation Study

Table 7 quantifies the contribution of each component by systematically removing one module at a time from the full MetaGNN-Sec pipeline. Every ablation degrades all four metrics, confirming that each component contributes positively and that the gains are not concentrated in a single module.

The most damaging single removal is opcode embeddings ($\Delta F_1=-0.043$), followed by DiffPool hierarchical pooling ($\Delta F_1=-0.031$). This ranking reflects the central role of semantic opcode content: without learned token embeddings, the node features collapse to structural statistics alone, losing the per-instruction semantics that distinguish, for example, equivalent arithmetic idioms used by the EIS transformation engine.

Removing heterogeneous edges (i.e., reducing to a single edge type) costs 2.71 pp in DR and 0.027 in $F_1$, demonstrating that data-dependence edges carry complementary signals beyond what the CFG structure alone provides. Removing the WGAN hardening loop is the third most costly single ablation ($\Delta F_1=-0.015$), a modest effect on the clean test set but—as Table 6 shows—a dramatic one under adversarial evasion, confirming that its primary benefit is robustness rather than clean accuracy. The quantum layer contributes $\Delta F_1=-0.013$; its value is concentrated on the most heavily obfuscated samples (the third-tier families in Table 5: DeepMorph and Chameleon-2), where it provides a 1.2 pp FNR reduction. Its marginal contribution to the main corpus is modest but statistically significant ($p=0.008$). Reducing to CFG-only (removing PDG data-flow edges) produces the second largest $F_1$ drop ($-0.051$), reinforcing that data-flow structure is the single most informative graph augmentation beyond the basic control-flow topology.

5.6. Training Convergence

To provide direct visual evidence of the numerical stability of the optimization, we plot the training trajectories of the principal validation metrics. Figure 2 shows validation accuracy, $F_1$, and AUC-ROC together with a normalized stability proxy derived from the WGAN critic loss, as a function of training epoch. All three detection metrics rise smoothly and monotonically and reach a stable plateau by roughly epoch 35, well before the early-stopping point (patience $P=10$); the critic-stability proxy settles to a narrow band, indicating that the adversarial game has reached a stable equilibrium rather than oscillating. These curves confirm that the reported operating point is a converged, stable solution and not an artifact of a fortunate epoch.

5.7. Inference Throughput

Table 8. Inference throughput (samples per second, single GPU), memory footprint, and model parameter count.

Method	Throughput (s/s)	Params (M)	GPU Mem (GB)
B1 MalConv+	4210	12.3	1.2
B2 EMBER-RF	38,500	0.8	—
B3 GCN-CFG	1850	3.6	0.7
B4 HMIL	1120	8.9	2.1
MetaGNN-Sec	980	24.7	4.3
MetaGNN-Sec (no Q)	1340	24.1	4.1

compares inference speed, which is critical for endpoint deployment. The trade-off between detection quality and computational cost is a central practical concern: an endpoint agent that consumes excessive memory or slows legitimate workloads will be disabled by operators regardless of its detection capability.

MetaGNN-Sec processes 980 samples per second on a single RTX 4090 in full configuration, and 1340 samples/s with the quantum layer bypassed for samples whose anomaly score falls below the quick-reject threshold of 0.30 (Algorithm A1). This mixed-mode operation means the quantum circuit is invoked for only 38% of samples in practice, yielding an effective throughput of ∼1190 samples/s. At this rate, a fleet of four endpoint GPUs could screen approximately 500,000 files per day—sufficient for enterprise-scale continuous monitoring.

The 24.7 million parameter count is 2.8× that of HMIL and $6.9\times$ that of GCN-CFG, reflecting the additional capacity of heterogeneous message passing, DiffPool layers, and the adversarial critic. The 4.3 GB GPU footprint is compatible with deployment on modern workstations and server GPUs, though it exceeds the memory of consumer edge devices; a quantized INT8 variant (estimated ∼1.2 GB) is not evaluated here. EMBER-RF achieves the highest raw throughput (38,500 samples/s) due to its shallow tree ensemble operating on pre-computed features, but at the cost of 8.1 pp lower DR and near-total collapse under adversarial evasion (Table 6), making that throughput advantage operationally meaningless in adversarial deployments.

5.8. ROC Comparison

Figure 3 plots the ROC curves for all methods on the combined test set. Three structural observations stand out.

First, MetaGNN-Sec (solid red) dominates the entire operating range from FPR = 0 to FPR = 1, with the largest absolute gap at the low-FPR end—which is precisely the regime that matters operationally. Enterprise endpoint deployments are typically configured to tolerate at most 1–2% false positives across the monitored file corpus; at FPR $=0.5\%$, MetaGNN-Sec achieves approximately 97% TPR versus 92% for HMIL and 89% for MalConv+, a margin that corresponds to thousands of missed detections per day in a large fleet.

Second, the gap between GCN-CFG and HMIL is moderate and roughly uniform across the curve, consistent with the incremental benefit of heterogeneous edge typing over homogeneous CFG modeling being stable across operating thresholds. In contrast, the gap between HMIL and MetaGNN-Sec widens at lower FPR, which aligns with the interpretation that WGAN adversarial hardening primarily tightens the decision boundary in the high-confidence region, reducing the number of ambiguous samples that a high-threshold classifier would misclassify.

Third, MalConv+ and EMBER-RF trail both graph methods throughout the curve, and their deficit is not merely a calibration artifact: the AUC-ROC gaps of 0.033 and 0.036 relative to MetaGNN-Sec are statistically significant ($p<0.001$, DeLong test [41]). QSVM is omitted from Figure 3 for visual clarity; its AUC-ROC of 0.933 places it below all other methods and is included in the tabular results (Table 4).

6. Discussion

6.1. Why Graph Representations Resist Metamorphism

The results in Table 4 and Table 5 confirm that structural graph representations provide substantially stronger resistance to metamorphic evasion than byte-level or aggregate-feature approaches. The conditional score-shift bound (Proposition 1) offers a theoretical underpinning: provided the empirical Lipschitz estimate holds and the metamorphic engine’s transformations are $(k,\delta )$-bounded (a condition violated only by semantics-altering changes that would break functional equivalence), the classification score shifts by at most $\Lambda \delta$. In practice, we measured $\Lambda \approx 3.1$ (via Lipschitz estimation on the test set) and, on whole-binary PDGs, $\delta \le 0.04$ for all observed transformation families, yielding a theoretical bound of $\pm 0.12$ on the classification score—consistent with the empirical drop of 5.4 pp under adversarial attack (Table 6). As the worked example (Section 3.4, Table 1) makes explicit, these small $\delta$ values arise because metamorphic edits are local and dilute across the full program graph; the same edits evaluated on an isolated few-block function produce a much larger $\delta$ and a correspondingly vacuous bound, so the $\delta \le 0.04$ regime should be understood as a property of whole-binary graphs, not of individual edited functions.

6.2. Role of the Quantum Layer

The quantum anomaly layer contributes a modest but statistically significant improvement of 1.2 pp in FNR reduction (ablation, Table 7; $p=0.008$). Its primary value lies in handling the most heavily mutated third-tier families (Table 5: DeepMorph and Chameleon-2), where classical GNN representations become dense and nearly indistinguishable. The IQP circuit creates an exponentially large feature Hilbert space in which benign and malicious samples separate more cleanly—a finding consistent with the theoretical separations in [31]. It is important to weigh this benefit explicitly against its cost. The kernel-matrix evaluation is $O\left(N^2\right)$, which would dominate inference if applied indiscriminately; in MetaGNN-Sec this cost is contained by the two-stage routing scheme, so that the quantum circuit is exercised on only 38% of samples and the effective throughput remains $\approx 1190$ samples/s—a small overhead relative to the GPU-bound hGNN encoder, which accounts for 71% of inference time. In short, the quantum layer buys a targeted recall improvement on the hardest families at a controlled, sub-linear-in-practice cost. We are deliberately cautious about the interpretation: because the circuit currently runs on a classical simulator, the module’s demonstrated value is as an empirical anomaly-scoring pre-filter, not as evidence of genuine quantum advantage, which would require benchmarking on real quantum hardware.

From a practical design perspective, the quantum layer is most effective as a pre-filter rather than a primary classifier. Samples that score below the quick-reject threshold $s\le 0.30$ are returned as benign without invoking the full hGNN binary classifier, saving compute on unambiguous cases and concentrating the GNN’s capacity on genuinely borderline inputs. This asymmetric deployment means the quantum circuit is only exercised on 38% of test samples, keeping the inference cost tractable despite the $O\left(n^2\right)$ kernel matrix evaluation.

The choice of the IQP embedding circuit [30] was motivated by its provable hardness of classical simulation under plausible complexity assumptions, and its suitability for angle-encoded continuous feature vectors, such as the projected graph embeddings ${\mathbf{z}}_q\in {\mathbb{R}}^8$. Alternative circuits—such as hardware-efficient ansätze or random Clifford circuits—were evaluated during hyperparameter search but consistently underperformed the IQP variant by 0.3–0.7 pp in FNR on the third-tier families, likely because the ZZ-interaction layers of IQP more faithfully encode the pairwise correlation structure of the latent opcode representations.

• What deployment would require. Drawing the practical threads together: the base-rate analysis of Table 3 shows that a 0.41% false-positive rate still implies on the order of two thousand daily alerts at enterprise scanning volume, so a deployment would need either a pre-filtered, higher-prevalence stream or a downstream triage stage—the detector is a component of an alerting pipeline, not a pipeline in itself. The throughput and footprint figures of Section 5 bound where it can sit: 4.3 GB of GPU memory suits a server or workstation endpoint but exceeds consumer edge devices, and the effective ∼1190 samples/s is adequate for endpoint scanning but not for high-frequency network inspection. We state these as the conditions under which the reported operating point is meaningful, and we have not measured performance in a production environment; the external validation identified below is a prerequisite before any deployment-grade claim could be made.

6.3. Relation to Prior Findings

It is not enough to report that the framework performs well; the results must be placed against what the literature already reports, including where they do not agree with it. We therefore state the alignments and the discrepancies in turn.

• Where our findings align with prior work. The central result—that structural representations degrade far less than byte-level ones under semantics-preserving mutation—reproduces the direction of the graph-based results of Yan et al. [21], and is consistent with the broader synthesis of Bilot et al. [14], who conclude across a large body of work that graph structure is comparatively difficult for an attacker to alter and therefore yields more durable embeddings. Our adversarial results likewise agree in direction with Grosse et al. [10] and Kreuk et al. [11] on the fragility of byte-level models: the 30–31 pp collapse we measure for MalConv+ and EMBER-RF (Table 6) is the same phenomenon those authors describe, observed here under a mutation budget rather than under free byte injection. That our adversarially hardened detector retains a substantial margin is also consistent with the defensive literature surveyed by Yan et al. [15] and Aryal et al. [16], and with the principled-detection results of Li et al. [28].
• Where our findings do not align. Two divergences deserve explicit statement. First, the quantum-kernel contribution we measure (1.2 pp FNR reduction, concentrated on two families) is materially smaller than the complexity-theoretic separations of Liu et al. [31] might lead a reader to anticipate. We attribute this to two causes—the circuit runs on a classical simulator and the 8-qubit feature map is modest—but we record the gap rather than leave it unremarked, and we do not claim that the theoretical separation is realized here. Second, our adversarial degradation for homogeneous graph baselines (17–21 pp) is larger than some prior graph-detection studies report. We believe this reflects the adaptivity of our evaluation rather than a weaker implementation: the evasion protocol of Algorithm 5 optimizes against each detector under a semantics-preserving budget, whereas robustness is often reported against fixed, non-adaptive perturbation sets. The comparison is therefore not like-for-like with those figures, and we would caution against reading our baseline numbers as contradicting them.
• What this positioning does and does not establish. Situating the results this way strengthens the claim that the structural mechanism is real and reproducible across independent groups. It does not extend the claim beyond the evaluated setting: as the divergences above and the limitations below make clear, agreement in direction with prior work is not evidence of superiority over it under conditions we have not tested.

6.4. Limitations

6.4.1. Technical Limits of Adversarial Resilience

The robustness guarantees of MetaGNN-Sec hold only within an explicit envelope. We make the operative limits precise, as follows.

• Graph-edit budget. The conditional score-shift bound (Proposition 1) holds only for $(k,\delta )$-bounded transformations, i.e., those whose graph-edit distance does not exceed $k_{\max }$ and whose Weisfeiler–Lehman kernel-distance does not exceed ${\delta }_{\max }$, and only insofar as the empirical Lipschitz estimate is valid. Mutations exceeding these budgets fall outside the bound.
• Lipschitz regime. The protective score-shift bound scales as $\Lambda \delta$ with measured $\Lambda \approx 3.1$; a higher effective Lipschitz constant (for example, under distribution shift) loosens the bound proportionally, and the bound is informative only in the small-$\delta$ regime that holds for local edits diluted across a whole-binary PDG (Section 3.4).
• Semantics-altering changes. The $(k,\delta )$-boundedness assumption is violated precisely by transformations that alter program semantics; such changes break functional equivalence and therefore lie outside the threat model rather than defeating it.
• Taxonomy coverage of adversarial training. The WGAN hardening loop confers robustness against the mutation taxonomy on which the generator was trained. Against mutation strategies outside that taxonomy—novel obfuscators, packing-based transformations, or externally crafted gradient/poisoning attacks on the aggregation step—no robustness guarantee is claimed, and empirical resilience may degrade.
• Aggregation integrity. The framework assumes the orchestration/aggregation layer is not itself compromised; adversarial “poisoning” of gradients by a malicious node inside the trusted training pipeline is out of scope and would require orthogonal defenses. Where a detection pipeline is distributed across cooperating components, securing the channels between them and establishing the provenance of the verdicts they exchange is a separate problem from the detection task addressed here, and one we treat elsewhere [42]; the present evaluation assumes a single trusted host.

6.4.2. Dataset Bias and Cross-Dataset Generalization

Three points bound the generality of our empirical claims. First, although the train/validate/test partition is stratified by family and year and is disjoint by seed lineage (so that no common-seed variant spans splits), both corpora share collection and labeling pipelines that may impart dataset-specific bias. Second, the two corpora (VirusShare-2024 and the SOREL-20M subset) deliberately span different collection windows (the latter 2017–2019), which provides a measure of cross-era robustness but is not a substitute for a fully independent cross-dataset test. Third, the WGAN generator was trained on the same mutation taxonomy as the evaluation variants, so the reported adversarial robustness should be read as robustness within that taxonomy.

6.4.3. External Adversarial Strategies

Because robustness is evaluated with our internal WGAN generator, performance against external or previously unseen adversarial strategies is not directly measured. We expect graph-structural detectors to remain comparatively resilient—an attacker must respect the $(k_{\max },{\delta }_{\max })$ budget to stay semantics-preserving—but packing-based obfuscation (e.g., UPX or custom compressors) and recently disclosed evasion frameworks in the EMBER-evasion and Mimicus lineages are not represented in our metamorphic families. Evaluation against such external attacks is a prerequisite for deployment-grade claims, and its absence bounds the robustness claims made here.

6.4.4. Quantum Simulation and Throughput

The quantum layer currently operates on a classical simulator (PennyLane’s default.qubit), as 8-qubit hardware devices with sufficient coherence time for our circuit depth are not yet commodity items; real hardware noise would degrade performance. Mitiq-based error mitigation [43] offers a promising near-term path, but the overhead of zero-noise extrapolation would further reduce effective throughput. Benchmarking on IBM Quantum or IonQ hardware is a prerequisite for any claim of genuine quantum advantage over a classical kernel, and no such claim is made here. Separately, the inference throughput of 980 samples/s is adequate for enterprise endpoints but may be insufficient for high-frequency network-IDS contexts requiring >50,000 samples/s; the $O\left(\right|V{|}^2)$ DiffPool clustering step is the primary bottleneck, and replacing it with a more scalable coarsening scheme—such as MinCut pooling [44] or Top-k pooling—could yield a 3–$5\times$ throughput improvement at a modest accuracy cost.

6.4.5. Static-Analysis Scope

The reliance on static disassembly means that runtime-only behaviors such as process injection or memory-resident payloads remain outside the current detection scope, suggesting that integration with dynamic sandbox traces would further extend coverage to evasion strategies that deliberately delay or fragment observable code execution.

6.4.6. Validation on External, Independent Data Streams

Finally, the present evaluation does not include fully independent third-party data streams—for example, samples drawn from isolated corporate infrastructures or from operating-system ecosystems whose code-generation styles differ radically from those represented in VirusShare. Validation on such external heterogeneous corpora would be required to establish the limits of generalization outside the test ecosystem; that validation lies outside the scope of this study, and no claim of out-of-ecosystem generalization is made.

7. Future Work and Conclusions

7.1. Future Work

The following directions are open problems raised by this work rather than commitments of the present authors; they are recorded so that others may build on the framework:

• Hardware-efficient quantum kernels: Integration with NISQ devices (IBM Quantum, IonQ) would validate quantum advantage under realistic noise; Mitiq-based error mitigation [43] could bridge the gap.
• Dynamic analysis fusion: Combining static PDG features with dynamic execution traces (via qiling [45] sandboxed emulation) should close remaining evasion gaps for packing-heavy malware.
• Federated training: Privacy-preserving federated learning across enterprise endpoints would allow continual adaptation without centralizing malware samples.
• LLM-guided mutation synthesis: Large language models fine-tuned on assembly corpora could synthesize richer adversarial variants, further stress-testing the WGAN hardening loop.
• Explainability: GNNExplainer-style attribution [46] should be applied to identify which basic blocks most strongly drive malicious classifications, aiding analyst triaging.
• External, heterogeneous validation: Validation on independent third-party corpora—drawn from isolated corporate infrastructures and from operating-system ecosystems whose code-generation styles differ from those in VirusShare—to characterize out-of-ecosystem generalization.

7.2. Conclusions

In this study, we present MetaGNN-Sec, a heterogeneous GNN framework with WGAN adversarial hardening and a quantum-kernel anomaly layer for the detection of metamorphic malware. Evaluated on 200,175 real-world samples across two public corpora, MetaGNN-Sec achieves a detection rate of $97.83\%$ and an $F_1$ of 0.978, outperforming the strongest baseline by 4.6 pp on clean data and by 16.3 pp under adaptive adversarial evasion—the latter measured against variants drawn from the same mutation taxonomy as the internal WGAN generator, and therefore to be read as robustness within that taxonomy rather than against arbitrary external attacks (Section 6). The conditional score-shift bound (Proposition 1) does not constitute a formal guarantee of robustness; rather, it offers a principled, empirically grounded explanation—under an explicitly stated and empirically estimated Lipschitz condition—for why graph representations remain comparatively stable under graph-edit-bounded metamorphic transformations, with the empirical results of Section 5 serving as the operative evidence of resilience. Together, these contributions establish a rigorous, reproducible, and extensible foundation for next-generation malware defense.