1. In a computing environment, a method performed at least in part on at least one processor, comprising: receiving, by at least one processor, a malware-related query at a backend service; processing data corresponding to the malware-related query at the backend service, including via updateable detection logic that is not revealed outside of the backend service, to determine whether the data corresponding to the malware-related query corresponds to detected malware; returning a corresponding result in response to the query indicating whether the data corresponding to the malware-related query corresponds to detected malware; and providing noise that changes the result to indicate that the data corresponding to the malware-related query does not correspond to detected malware when the processing determined that the malware-related query does correspond to detected malware.