[Misdetection] pptx file misdetected as xlsb

[snypelife]

What should the file have been detected as? What has the file been misdetected as?
PPTX files are being mistaken as XLSB binary workbooks.

Please link or attach the misdetected file below (Do NOT upload PII!)
Will attempt to get a scrubbed/non-sensitive reproduction file put together.

Additional context

Versions impacted:

• 1.0.1 (python)
• 1.0.0 (node)
• 0.6.3 (python)

Methods used:

• Python
• nodejs

Parameters:

• each prediction mode
• local file and file stream

[reyammer]

thanks for reporting, appreciated! If you get to have some file you can share we can add it to our regression suite for our next training round. Thanks!

[argotechnica]

@reyammer Let me know if you'd prefer a new issue opened for this, but I am actually having the opposite problem: XLSM is being detected as PPTX. Tested on Python v1.0.1.

Unfortunately, I'm not able to share my files, but here's what I noticed:

• Starting with a "bad" XLSM file that detects as PPTX, I found a reliable workaround: opening the XLSM in Excel and clicking "Save." Any time I do this (while changing nothing in the file itself), the file reliably detects as XLSM, though with a low model confidence: Unknown binary data (unknown) [Low-confidence model best-guess: Microsoft Excel 2007+ document (document), score=0.376]
• XLSM files, like other Office 2007+ files, are just ZIP files containing XML etc., so I extracted the "bad" and "good" XLSM and diffed the resulting folders. The only difference I could find between them that seemed meaningful was the presence in the bad file of persons data stored in \xl\persons\person.xml. This data seemed to serve no purpose in my file (and was stripped when clicking "Save" in Excel). Its contents were simply: <?xml version="1.0" encoding="UTF-8" standalone="yes"?><personList xmlns="http://schemas.microsoft.com/office/spreadsheetml/2018/threadedcomments" xmlns:x="http://schemas.openxmlformats.org/spreadsheetml/2006/main"/>. The document had no comments in it, threaded or otherwise. The person data was referenced in the XLSM's \[Content_Types].xml file entry (<Override PartName="/xl/persons/person.xml" ContentType="application/vnd.ms-excel.person+xml" />), and also in \xl\_rels\workbook.xml.rels (<Relationship Id="rId23" Type="http://schemas.microsoft.com/office/2017/10/relationships/person" Target="persons/person.xml" />).
• In addition to opening and clicking "Save" in Excel to "fix" the file, manually editing the file to remove all this person data and saving the ZIP and renaming to XLSM also results in the file detecting as XLSM.
• On the other hand, if I take "bad" file and fix it, then add comments to it, then even if I delete all comments (leaving empty person data again), the file continues to be detected fine as XLSM. I don't know why saving my "bad" file results in the person data being stripped out, while saving my "fixed" file after adding and deleting comments does not strip this data.

This suggests that the model may have learned that the presence of comments at any point in the history of an Office document is predictive of the file being a PPTX, or at least not an XLSM. In future test sets, maybe you could try adding comments (as well as adding and then deleting all comments, which leaves behind the empty person data) to XLSM and other Office files, including PPTX.

For what it's worth, another theory relating back to the "PPTX is detecting as XLSM" issue might be that the model is learning that the presence of binary data (like embedded JPEGs in PPTX, or embedded VBA in XLSM) is predictive of PPTX or XLSM depending on some property like size. In an enterprise setting, VBA might grow very large, which might make it look more like an embedded audio/video/image. Note that VBA can also exist in PPTX. Perhaps the training data could be updated to include variations of binary data and/or VBA across different Office file formats.