Open access

Certified Adversarial Robustness of End-to-End Malware Detectors via (De)Randomized Smoothing

Daniel Gibert Luca Demetrio Giulio Zizzo Quan Le Jordi Planes B. Biggio

May 2024 · ACM Transactions on Privacy and Security · Vol 29, pp. 1 - 30 · 4 citations · 41 references

Computer Science

TL;DR

A novel deterministic certification schema based on (de)randomized smoothing that guarantees that each chunk either contains or does not contain an adversarial perturbation, enabling it to handle manipulations occurring at arbitrary locations within the program and compute deterministic estimates of the perturbation magnitude required to evade detection.

Abstract

End-to-end machine learning malware detectors are vulnerable to adversarial EXEmples, carefully-crafted malicious programs that evade detection through minimal perturbations. Such attacks typically operate by either replacing unused content (patch attacks), or injecting new patterns (content-injection attacks). To counter these attacks, recent research has focused on certification methods for end-to-end models that aim to prove robustness guarantees within bounded perturbation sizes. However, existing approaches (i) are not robust against content-injection manipulations and (ii) provide only probabilistic guarantees for perturbations that are negligible relative to the overall program size. Hence, in this article we address these limitations through a novel deterministic certification schema based on (de)randomized smoothing. Our defense splits each executable into non-overlapping chunks and classifies them independently. The final decision is obtained via majority voting across all chunks, ensuring that localized modifications, such as injected or patched code, influence only a limited subset of chunks and have minimal impact in the overall classification. This design guarantees that each chunk either contains or does not contain an adversarial perturbation, enabling us to (i) handle manipulations occurring at arbitrary locations within the program, and (ii) compute deterministic estimates of the perturbation magnitude required to evade detection. We demonstrate the effectiveness of our certification schema through extensive experimental analysis, comparing our defense against a range of state-of-the-art attacks and defenses. The results show that our approach achieves unmatched robustness across all tested attack scenarios, substantially outperforming competing defenses.

DOI arXiv Semantic Scholar

Read PDF

Similar papers

Preprint Sep 2026

Windows Malware Detector as a Compound AI System: Trade-Offs in Accuracy, Efficiency, and Adversarial Robustness

Industrial Windows malware detectors are commonly described as Compound AI Systems composed of multiple heterogeneous components, including rule-based mechanisms as well as machine-learning-based static and dynamic analyses. However, due to industrial secrecy and limited public disclosure, the internal architectures of these systems can only be inferred, rendering systematic evaluations of detection accuracy, computational costs, and adversarial robustness largely infeasible. In contrast, academic research provides reproducible and transparent evaluation methodologies, but typically investigates individual detection components in isolation. To bridge the gap between academic research and industrial practice, and inspired by state-of-the-art industrial architectures for Windows malware detection, we propose a novel methodology that (i) explicitly balances the trade-off among detection performance, computational requirements, and robustness, and introduces (ii) system-level threat models that capture how attackers exploit different degrees of knowledge to evade the entire Compound AI System rather than isolated detectors. Experiments conducted on real-world data demonstrate that the Compound AI System training time can be reduced and responsiveness improved while incurring only a marginal loss in detection performance. Leveraging our threat modeling, we show that increasingly knowledgeable attackers craft more effective adversarial examples, revealing the system's strengths and weaknesses, degrading its responsiveness, and exposing a direct trade-off between efficiency and robustness. Finally, we translate these trade-offs into take-home messages and deployment guidelines, helping practitioners to select the system that best matches their operational constraints.

Andrea Ponte, Luca Demetrio, Luca Oneto et al. · 0 citations

Aug 2026

Enhancing robustness of deep learning-based malware detection against adversarial attacks

This paper introduces DefendMal, a novel framework that synergistically combines Denoise Autoencoder with Sequence Squeezing, a Context-aware Adversarial Generator (CAG-AdvGAN), Projected Gradient Descent (PGD) adversarial training, and a Positive–Negative Detector with Variational Autoencoder (PNDetector-VAE) to enhance robustness against evolving adversarial threats.

Dennis Benedict Crasta, Vikash Kumar · Journal of Computer Virology... · 0 citations

GRASP: Hard-Label Black-Box Malware Evasion with Higher Success, Fewer Queries, and Smaller Perturbations

Gradient-seeded Reinforcement Learning And Stealthy Pruning (GRASP), a three-stage framework that tackles challenges of adversarial attacks on machine learning-based malware detectors, and out-performs baselines, achieving higher attack success with fewer queries and smaller file-size inflation.

Yutong Liu, Jianting Ning, Qi Feng et al. · 0 citations

#machine learning Preprint Aug 2026

REPLICANT: Learning Policies for Evading and Hardening Malware Detectors

This work presents Replicant, a deep reinforcement learning framework that learns the realistic task of evasion under a strict label-only black-box threat model and demonstrates that learning the task of evasion not only results in stronger attack performance but provides a better signal for hardening malware detectors.

Shae McFadden, Ilias Tsingenopoulos, Mario D'Onghia et al. · 0 citations

Open access Aug 2026

Adversarially Robust Hardware Trojan Detection with Synthetic Data Augmentation

This paper evaluates the robustness of the Support Vector Machine (SVM) classifier, a leading algorithm in state-of-the-art HT detection frameworks, under gradient-based adversarial attacks, and highlights the need to reframe hardware security evaluations beyond nominal accuracy toward adversarial robustness.

Ashutosh Ghimire, Lingwei Chen, Cole Castronova et al. · Journal of electronic testin... · 0 citations

Jul 2026

EXE-Bench: Ranking the Tradeoffs of AI-based Windows Malware Detectors for Real-World Usability

ExE-Bench assesses performance, temporal and adversarial robustness, and computational overhead, aggregating them into a single score for direct and fair model comparison, and highlights how evaluations conducted only after deployment are suboptimal and unable to provide a complete picture of their performance.

Andrea Ponte, Daniel Gibert, M. Kozák et al. · arXiv.org · 0 citations