EXE-Bench: hand-engineered features beat deep nets for Windows malware once you test across time and adversaries.

The benchmark scores performance, temporal robustness, adversarial robustness and endpoint inference cost into one comparable number, on the argument that existing evaluations use inconsistent splits, skip temporal analysis and ignore content-injection attacks. Result cuts against the field's default: domain knowledge instilled through feature engineering resists both time and adversarial attack, while most deep networks look excellent immediately post-deployment and degrade. (arXiv 2607.24177)