1. In a computing environment, a method performed at least in part on at least one processor, comprising, receiving a malware-related query at a backend service, processing data associated with the malware-related query at the backend service, including via updateable detection logic that is not revealed outside of the backend service, to determine whether the data associated with the malware-related query corresponds to detected malware, and returning a corresponding result in response to the query indicating whether the data associated with the malware-related query corresponds to detected malware.