Cloudflare’s GNN Detects Evasive Storefront Attacks in Under 0.3 Seconds

Published September 18, 2026

Three figures monitor a scanning beam illuminating hidden red code paths in a vast digital network.

Graph-Based Analysis of Malicious Code

Cloudflare’s Graph Neural Network (GNN) analyzes JavaScript not as flat text, but as a structured graph that maps syntax trees and code symbols. This approach exposes what calls what, revealing buried attacker logic and external communication attempts that traditional scanners might miss. By reasoning through the code structure, the system identifies evasive client-side attacks that could otherwise quietly siphon revenue or hijack clicks on modern storefronts.

High-Volume Processing and Speed

The Cloudflare Page Shield system assesses approximately 3.5 billion scripts per day, equating to roughly 40,000 scripts per second. The machine learning model generates a probability score for each script, transforming the output into a scale from 1 to 99 where lower scores indicate likely malicious activity. Crucially, this inferencing process completes in under 0.3 seconds, allowing for real-time protection without significant latency impacts on user experience.

Multi-Agent LLM Verification

Scripts flagged as malicious by the GNN, representing less than 0.3% of all analyzed traffic, are routed to a lightweight Large Language Model (LLM) on Workers AI for a second opinion. The system spins up multiple agents in fresh, independent sessions to analyze the same suspicious script simultaneously. These agents can utilize restricted JavaScript evaluators to unpack small code snippets and reveal concealed behavior that static analysis might overlook.

Weighted Voting and Label Distribution

Each LLM agent assigns a label from four categories: benign, payment skimming (Magecart), other malware, or cryptomining. These labels function as votes weighted by the model’s score in the Artificial Analysis Intelligence Index to produce a final probability distribution.

Human Review and Model Feedback

Human reviewers only need to examine scripts that are flagged as malicious or lack a clear two-thirds majority in the voting process. The resulting label distributions from these reviews are fed back into GNN training, helping the model distinguish ever more nuanced cases over time. This continuous feedback loop ensures the system adapts to new attack vectors while minimizing the workload for security analysts.

Practical Implications for Storefronts

This layered defense protects against specific threats like after-hours affiliate-commission hijackers that use mobile device and time gates to intercept clicks. By preventing attribution hijacking, the system ensures sales are credited to the correct referral accounts rather than malicious actors. The combination of high-speed GNN screening and LLM verification provides a robust shield for e-commerce platforms facing sophisticated client-side attacks.

Agentic Tool Access and Snippet Evaluation

The multi-agent verification process extends beyond static analysis by granting agents access to restricted tools within their independent sessions. When necessary, these agents utilize a restricted JavaScript evaluator to unpack small code snippets, allowing them to reveal concealed behavior that might otherwise remain hidden in obfuscated payloads. This agentic capability ensures that the LLMs do not merely read text but actively test specific segments of suspicious scripts. By operating in fresh, isolated environments, each agent maintains independence while leveraging these tools to provide a more accurate second opinion on the flagged code.