# Adversarial Perturbations Against Deep Neural Networks for Malware Classification

arXiv: https://arxiv.org/abs/1606.04435 · HTML: https://mlsanity.com/paper/1606.04435/

## Key facts

- Cited by 42 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 14 Jun 2016.

## Built on by (most cited first, 30 of 42)

- [RL with KL penalties is better viewed as Bayesian inference](https://mlsanity.com/paper/2205.11275/) (2022)
- [Adversarial Example Detection for DNN Models: A Review and Experimental Comparison](https://mlsanity.com/paper/2105.00203/) (2021)
- [Deep Learning for Android Malware Defenses: a Systematic Literature Review](https://mlsanity.com/paper/2103.05292/) (2021)
- [Security and Privacy for Artificial Intelligence: Opportunities and Challenges](https://mlsanity.com/paper/2102.04661/) (2021)
- [Learning Security Classifiers with Verified Global Robustness Properties](https://mlsanity.com/paper/2105.11363/) (2021)
- [Towards Reliable Evaluation and Fast Training of Robust Semantic Segmentation Models](https://mlsanity.com/paper/2306.12941/) (2023)
- [Towards a Robust and Trustworthy Machine Learning System Development: An Engineering Perspective](https://mlsanity.com/paper/2101.03042/) (2021)
- [Residue-Based Natural Language Adversarial Attack Detection](https://mlsanity.com/paper/2204.10192/) (2022)
- [MalProtect: Stateful Defense Against Adversarial Query Attacks in ML-based Malware Detection](https://mlsanity.com/paper/2302.10739/) (2023)
- [OFEI: A Semi-black-box Android Adversarial Sample Attack Framework Against DLaaS](https://mlsanity.com/paper/2105.11593/) (2021)
- [Mate! Are You Really Aware? An Explainability-Guided Testing Framework for Robustness of Malware Detectors](https://mlsanity.com/paper/2111.10085/) (2021)
- [Robust Classification Under ℓ0 Attack for the Gaussian Mixture Model](https://mlsanity.com/paper/2104.02189/) (2021)
- [Artificial Neural Network for Cybersecurity: A Comprehensive Review](https://mlsanity.com/paper/2107.01185/) (2021)
- [Adversarial Artifact Detection in EEG-Based Brain-Computer Interfaces](https://mlsanity.com/paper/2212.00727/) (2022)
- [StratDef: Strategic Defense Against Adversarial Attacks in ML-based Malware Detection](https://mlsanity.com/paper/2202.07568/) (2022)
- [DRLDO: A novel DRL based De-ObfuscationSystem for Defense against Metamorphic Malware](https://mlsanity.com/paper/2102.00898/) (2021)
- [Enhancing Robustness of Neural Networks through Fourier Stabilization](https://mlsanity.com/paper/2106.04435/) (2021)
- [Improving Robustness of Malware Classifiers using Adversarial Strings Generated from Perturbed Latent Representations](https://mlsanity.com/paper/2110.11987/) (2021)
- [Neural Network Verification as Piecewise Linear Optimization: Formulations for the Composition of Staircase Functions](https://mlsanity.com/paper/2211.14706/) (2022)
- [Exploring the Vulnerabilities of Machine Learning and Quantum Machine Learning to Adversarial Attacks using a Malware Dataset: A Comparative Analysis](https://mlsanity.com/paper/2305.19593/) (2023)
- [Boosting Few-Pixel Robustness Verification via Covering Verification Designs](https://mlsanity.com/paper/2405.10924/) (2024)
- [LSDAT: Low-Rank and Sparse Decomposition for Decision-based Adversarial Attack](https://mlsanity.com/paper/2103.10787/) (2021)
- [Efficient and Robust Classification for Sparse Attacks](https://mlsanity.com/paper/2201.09369/) (2022)
- [SeqNet: An Efficient Neural Network for Automatic Malware Detection](https://mlsanity.com/paper/2205.03850/) (2022)
- [On deceiving malware classification with section injection](https://mlsanity.com/paper/2208.06092/) (2022)
- [Interpreting GNN-based IDS Detections Using Provenance Graph Structural Features](https://mlsanity.com/paper/2306.00934/) (2023)
- [Aligning language models with human preferences](https://mlsanity.com/paper/2404.12150/) (2024)
- [Comprehensive Survey on Adversarial Examples in Cybersecurity: Impacts, Challenges, and Mitigation Strategies](https://mlsanity.com/paper/2412.12217/) (2024)
- [On the Security Risks of ML-based Malware Detection Systems: A Survey](https://mlsanity.com/paper/2505.10903/) (2025)
- [ADAPT: A Pseudo-labeling Approach to Combat Concept Drift in Malware Detection](https://mlsanity.com/paper/2507.08597/) (2025)

## Abstract (arXiv)

Deep neural networks, like many other machine learning models, have recently been shown to lack robustness against adversarially crafted inputs. These inputs are derived from regular inputs by minor yet carefully selected perturbations that deceive machine learning models into desired misclassifications. Existing work in this emerging field was largely specific to the domain of image classification, since the high-entropy of images can be conveniently manipulated without changing the images' overall visual appearance. Yet, it remains unclear how such attacks translate to more security-sensitive applications such as malware detection - which may pose significant challenges in sample generation and arguably grave consequences for failure. In this paper, we show how to construct highly-effective adversarial sample crafting attacks for neural networks used as malware classifiers. The application domain of malware classification introduces additional constraints in the adversarial sample crafting problem when compared to the computer vision domain: (i) continuous, differentiable input domains are replaced by discrete, often binary inputs; and (ii) the loose condition of leaving visual appearance unchanged is replaced by requiring equivalent functional behavior. We demonstrate the feasibility of these attacks on many different instances of malware classifiers that we trained using the DREBIN Android malware data set. We furthermore evaluate to which extent potential defensive mechanisms against adversarial crafting can be leveraged to the setting of malware classification. While feature reduction did not prove to have a positive impact, distillation and re-training on adversarially crafted samples show promising results.