A common requirement across organizations is to have a tool that can identify file types based on their contents, particularly in the cybersecurity domain where magic numbers and file extensions can not be trusted. While existing tools work well in practice, there is plenty of room for improvement either in terms of computational load and time for detection in the case of model based tools like Magika or in terms of accuracy of detection in the case of file parsing tools that use programming language constructs. In this study, we propose a neural network model for identification of types of text content files, especially source code, that is more accurate and faster than other available tools. Our experiments on open-source files indicate that it is not only more accurate on average for text-content file-type identification, but also approximately four times faster than Magika, while being 28% smaller in size.
Figures & tables
Fig. 1: Magika model architecture from [ 1 ] . It works on three byte sequences extracted from the start, middle, and end of the files. The numbers next to the layers’ names indicate the size of their outputs.
Fig. 2: The dual-input convolutional neural network architecture of the Labeler model. The first three rows of blocks show how file contents are processed and the remaining blocks show the layers in the neural network model. The initial layers: embedding, spatial dropout, and 1-D Convolution, followed by layer normalization and dropout process, share the parameters, though they process the two token sequences separately.
Fig. 3: Inference time benchmarked by setting Labeler to use one CPU core only, without any such limitation on Magika. To measure Labeler inference times, a random byte array is generated of 8 Kb size and fed to a Rust implementation of the custom tokenizer the output of which is fed to the neural network model. Similarly, to measure Magika’s inference times, a random byte array of size 1.5 Kb is generated and passed as input to the Python interface of Magika. The average time taken for hundred thousand such calls is shown here
Metrics
Labeler
Magika
Macro F1
0.9804
0.9057
Weighted F1
0.982
0.921
Inference time per file
1.05 ms
3.85 ms
Model parameters size
715 Kb
1 Mb
TABLE I: Summary of performance metrics comparing Labeler and Magika. Labeler demonstrates superior accuracy with both macro and weighted F1-scores. Most significantly, Labeler has 3.7x faster inference speed even when it is limited to use a single CPU core, unlike Magika.
Language
Train Size
Test Size
F1-Score
Labeler
Magika
actionscript
103768
11497
0.9895
-
applescript
11214
1246
0.9730
-
asp
65067
7259
0.9881
0.4893
assembly
178619
19981
0.9896
0.9171
batchfile
188072
20967
0.9565
0.9207
TABLE II: Performance comparison for some of the supported file types. Bold values indicate the best results. – indicate unsupported types.
Fig. 4: Distribution of F1 score for the different file types. As seen, Labeler has a much narrower distribution than Magika. Both model gave least F1-scores for “text” file type. However, for other types, the results for Labeler show an F1-Score of at least 0.94.
Fig. 5: Improvement in precision and recall of Labeler with increase in training set size. Even with a very low number of files per type in the training set, Labeler quickly produces a higher accuracy than Magika using all available training data. This shows our method has excellent sample efficiency for rare and future new file types.
Fig. 6: Relation of precision and recall for the rarest five file types (DM, COBOL, R, VHDL, and Objective-C++) with increase in training set size. The drop in recall beyond a size of 50000 is likely due to the fact that all these types have less than 50000 files in the original training set.
File-type classification underlies many workflows like malware triage, forensic carving, packet inspection, and storage indexing. Learned systems such as Google's Magika assume whole-file access at a known offset, so they break on the inputs many of these tasks actually produce, like a single packet payload, a header-less carved fragment, a random disk block, or a chunked upload. We introduce MimeLens, a family of small BERT-style encoders pretrained on binary content from windows sampled at a uniformly random offset within each file, with no privileged head-of-file position, in standard- and short-context variants. A byte chunk goes in from anywhere in a file, no header needed and no fixed size; out comes one of libmagic's 125 MIME labels. On the clean head of complete files, MimeLens beats Magika v1.1 by +10.7 pp top-1 on libmagic-labeled data, and it keeps classifying where Magika cannot: from a single mid-stream UDP packet, and more than twice as accurately as libmagic and Magika on random mid-file disk blocks. The cost is latency: MimeLens runs roughly one to two orders of magnitude slower per sample on CPU than Magika, though it matches on consumer GPUs or in batch. All trained checkpoints are released on Hugging Face (mjbommar/mimelens-001-*).
We present FindMyText, an open-source Python package designed to efficiently assess whether a given text appears, in part or in full, within a text corpus. The tool builds on prior techniques for document fingerprinting, but extends them with a novel mechanism to explicitly capture sequences of matching fingerprints. By identifying such chains, the tool can more reliably detect near-verbatim copies of a given text rather than mere textual similarities. This makes FindMyText particularly suited for verifying the presence of copyrighted material in a corpus. Leveraging a distributed, disk-based indexing framework, the system scales to large web-crawled datasets. Using a new benchmark for evaluating text containment methods, we show that FindMyText outperforms alternative approaches across three datasets (ArXiv papers, Wikipedia, and generic web content).
Lars Henry Berge Olsen, Pierre Lison, Martin Jullum +1
Machine-generated text (MGT) detection requires identifying structurally invariant signals across generation models, rather than relying on model-specific fingerprints. In this respect, we hypothesize that while large language models excel at local semantic consistency, their autoregressive nature results in a specific kind of structural fragility compared to human writing. We propose Luminol-AIDetect, a novel, zero-shot statistical approach that exposes this fragility through coherence disruption. By applying a simple randomized text-shuffling procedure, we demonstrate that the resulting shift in perplexity serves as a principled, model-agnostic discriminant, as MGT displays a characteristic dispersion in perplexity-under-shuffling that differs markedly from the more stable structural variability of human-written text. Luminol-AIDetect leverages this distinction to inform its decision process, where a handful of perplexity-based scalar features are extracted from an input text and its shuffled version, then detection is performed via density estimation and ensemble-based prediction. Evaluated across 8 content domains, 11 adversarial attack types, and 18 languages, Luminol-AIDetect demonstrates state-of-the-art performance, with gains up to 17x lower FPR while being cheaper than prior methods.
Lucio La Cava, Andrea Tagarelli
DIMES Dept., University of Calabria v. P. Bucci 44Z, 87036 Rende, CS, Italy