Google · Security · Filed May 18, 2026 · USPTO published Sep 17, 2026 · Sep 17 release

Google Patents a Malware Detector That Rewrites Code to Catch Hidden Threats

Malware authors are good at hiding. Google's new patent describes a technique that flips the switches inside suspicious code to force it to reveal what it's really doing.

By Patentlyze Team · Updated Sep 18, 2026 · 3 min read

A malware detection system tests executable code by modifying branch instructions within multiple testing environments. Drawing from patent filing US 2026/0278094 A1. — A malware detection system tests executable code by modifying branch instructions within multiple testing environments.All 8 drawings ↓

Publication number: US 2026/0278094 A1(US20260278094A1)
Applicant: Google LLC
Filed · Published: May 18, 2026 · Sep 17, 2026
Inventors: Joshua Aaron Mason
Status when we published: Waiting for an examiner
Document: 20 claims
US classification: 726/24
Parent application: Continuation of 18/673,304 (filed May 23, 2024)(18673304)

How Google's code-rewriting malware trap works

Most security scanners test software by running it and watching what happens. The problem is that sophisticated malware often checks its surroundings first: if it thinks it's being watched, it behaves perfectly. Security researchers call this "evasion," and it has become one of the harder problems in keeping computers safe.

Google's patent takes a different approach. Instead of just watching the code run, a system would reach inside the program and change the decision points, the moments where the code asks "should I do this or that?" By flipping those choices, the system forces the program down paths it would normally avoid, which is often where the malicious behavior is hiding.

If the modified version does something different from the unmodified version, that's a red flag. The system can then take protective action, like quarantining the file or blocking it entirely, before it ever reaches a real user.

From the filing · CLAIM 1

… modifying, by the at least one processing device, first one or more of the branch instructions of the executable code to alter execution behavior of the executable code …

Translation: The system alters the program's jump commands to change how it runs.

How altered branch instructions expose hidden behavior

At a technical level, programs are full of branch instructions (think of them as "if-then" forks in the road: if condition A is true, go left; otherwise, go right). Malware writers exploit these forks to hide dangerous code behind conditions that are almost never triggered in a security testing environment.

Google's method works in three stages:

Identify the branch instructions inside suspicious executable code.
Modify one or more of those branches to force the program down alternate paths it would normally skip.
Compare the behavior of the modified version against the unmodified version inside a sandboxed testing environment (an isolated container where nothing the code does can harm a real system).

If the two runs produce different behavior, that gap is treated as evidence of intentional evasion. The assumption is that legitimate software generally shouldn't behave radically differently when its internal decision logic is shuffled. Malware, by contrast, is specifically engineered to behave one way when it thinks it's being tested and another way when it isn't.

When a mismatch is detected, the system triggers preventative actions, which the patent broadly defines as blocking, quarantining, or flagging the file for further review.

What this means for catching evasive malware

For the average person, this kind of detection would happen invisibly inside a cloud security service or an operating system's built-in antivirus layer. You'd never see the process, but you'd benefit from it: the malware that would have slipped past a standard scan by playing dead gets caught because it can't hide from a test that forces it to show its hand.

Google keeps filing on behavioral malware detection, and this patent sits in that broader effort to catch threats that evade signature-based tools (the traditional kind that just match files against a known list of bad actors). That list is always one step behind. A system that provokes hidden behavior rather than simply recognizing known patterns is a fundamentally different bet.

Google's 721st filing in our Google coverage since May adds to a privacy thread that includes fake datasets from real data and ad context privacy checks.

Editorial take

The benefit you'd feel from this is subtle but real: fewer moments where a harmful program slipped through your security software by acting innocent during the check and then doing damage afterward. That gap, between how a program behaves when it's being watched and what it actually does when left alone, is how a lot of modern attacks succeed.

Google's approach here is to force a program to show more of itself before it ever runs on your device, by nudging it down paths it might have been hiding. The practical result, if this works as described, is that your security tools catch more threats earlier, without you needing to do anything differently.

The honest limit is that a patent describes an idea, not a finished feature. Turning this into something that runs reliably on millions of files without flagging legitimate software is still hard engineering work, and that work hasn't been shown here.

Source: US 2026/0278094 A1 at the USPTO (PDF). Full patent text and figures are in the official publication.

Get our take in your Top Stories

Liked this breakdown? Add Patentlyze as a preferred source on Google, and our plain-English take shows up more often in your Top Stories the next time Google patent news breaks.

Add Patentlyze on Google One click.

There are more where this came from

We read every patent application Big Tech publishes and send you the ones worth knowing. Plain English, free, every week.