mlsanityData to 7 Oct 2026

Functionality-preserving Black-box Optimization of Adversarial Windows Malware

arXiv 2003.13526 ↗First posted 30 Mar 2020cs.CRcited by 58

Not on the map. Why?

Abstract (arXiv)

Windows malware detectors based on machine learning are vulnerable to adversarial examples, even if the attacker is only given black-box query access to the model. The main drawback of these attacks is that: (i) they are query-inefficient, as they rely on iteratively applying random transformations to the input malware; and (ii) they may also require executing the adversarial malware in a sandbox at each iteration of the optimization process, to ensure that its intrusive functionality is preserved. In this paper, we overcome these issues by presenting a novel family of black-box attacks that are both query-efficient and functionality-preserving, as they rely on the injection of benign content - which will never be executed - either at the end of the malicious file, or within some newly-created sections. Our attacks are formalized as a constrained minimization problem which also enables optimizing the trade-off between the probability of evading detection and the size of the injected payload. We empirically investigate this trade-off on two popular static Windows malware detectors, and show that our black-box attacks can bypass them with only few queries and small payloads, even when they only return the predicted labels. We also evaluate whether our attacks transfer to other commercial antivirus solutions, and surprisingly find that they can evade, on average, more than 12 commercial antivirus engines. We conclude by discussing the limitations of our approach, and its possible future extensions to target malware classifiers based on dynamic analysis.

Key facts. Cited by 58 papers in the map (data through 7 Oct 2026). First posted on arXiv 30 Mar 2020.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 9; 2022: 8; 2023: 15; 2024: 12; 2025: 6; 2026: 8.

58 papers.

Sort:

By area:

  1. 2021The Threat of Offensive AI to Organizationscited by 37
  2. 2021Adversarial Attacks against Windows PE Malware Detection: A Survey of the State-of-the-Artcited by 18
  3. 2023RS-Del: Edit Distance Robustness Certificates for Sequence Classifiers via Randomized Deletioncited by 17
  4. 2021Why Adversarial Reprogramming Works, When It Fails, and How to Tell the Differencecited by 13
  5. 2021EvadeDroid: A Practical Evasion Attack on Machine Learning for Black-box Android Malware Detectioncited by 13
  6. 2022MERLIN -- Malware Evasion with Reinforcement LearnINgcited by 10
  7. 2021The Hammer and the Nut: Is Bilevel Optimization Really Needed to Poison Linear Classifiers?cited by 9
  8. 2022Quo Vadis: Hybrid Machine Learning Meta-Model based on Contextual and Behavioral Malware Representationscited by 9
  9. 2021Mate! Are You Really Aware? An Explainability-Guided Testing Framework for Robustness of Malware Detectorscited by 7
  10. 2022Efficient Malware Analysis Using Metric Embeddingscited by 6
  11. 2023PAD: Towards Principled Adversarial Malware Detection Against Evasion Attackscited by 5
  12. 2023Towards a Practical Defense against Adversarial Attacks on Deep Learning-based Malware Detectors via Randomized Smoothingcited by 5
38 more
  1. 2023A Comparison of Adversarial Learning Techniques for Malware Detectioncited by 5
  2. 2024Assessing the Impact of Packing on Machine Learning-Based Malware Detection and Classification Systemscited by 5
  3. 2021Single-Shot Black-Box Adversarial Attacks Against Malware Detectors: A Causal Language Model Approachcited by 4
  4. 2023The Adaptive Arms Race: Redefining Robustness in AI Securitycited by 4
  5. 2024A Robust Defense against Adversarial Attacks on Deep Learning-based Malware Detectors via (De)Randomized Smoothingcited by 4
  6. 2024SLIFER: Investigating Performance and Robustness of Malware Detection Pipelinescited by 4
  7. 2026Adversarial News and Lost Profits: Manipulating Headlines in LLM-Driven Algorithmic Tradingcited by 4
  8. 2021Mal2GCN: A Robust Malware Detection Approach Using Deep Graph Convolutional Networks With Non-Negative Weightscited by 3
  9. 2022StratDef: Strategic Defense Against Adversarial Attacks in ML-based Malware Detectioncited by 3
  10. 2023DRSM: De-Randomized Smoothing on Malware Classifier Providing Certified Robustnesscited by 3
  11. 2023Creating Valid Adversarial Examples of Malwarecited by 3
  12. 2023The Power of MEME: Adversarial Malware Creation with Model-Based Reinforcement Learningcited by 3
  13. 2023Raze to the Ground: Query-Efficient Adversarial HTML Attacks on Machine-Learning Phishing Webpage Detectorscited by 3
  14. 2023Burning the Adversarial Bridges: Robust Windows Malware Detection Against Binary-level Mutationscited by 3
  15. 2024How to Train your Antivirus: RL-based Hardening through the Problem-Spacecited by 3
  16. 2024Multi-Fidelity Bayesian Optimization With Across-Task Transferable Max-Value Entropy Searchcited by 3
  17. 2022Practical Attacks on Machine Learning: A Case Study on Adversarial Windows Malwarecited by 2
  18. 2023Combining Generators of Adversarial Malware Examples to Increase Evasion Ratecited by 2
  19. 2024Large Language Models are Few-shot Generators: Proposing Hybrid Prompt Algorithm To Generate Webshell Escape Samplescited by 2
  20. 2024On the Lack of Robustness of Binary Function Similarity Systemscited by 2
  21. 2022Stealing and Evading Malware Classifiers and Antivirus at Low False Positive Conditionscited by 1
  22. 2023ModSec-AdvLearn: Countering Adversarial SQL Injections with Robust Machine Learningcited by 1
  23. 2023A Malware Classification Survey on Adversarial Attacks and Defencescited by 1
  24. 2024Evading Deep Learning-Based Malware Detectors via Obfuscation: A Deep Reinforcement Learning Approachcited by 1
  25. 2024Machine Learning for Windows Malware Detection and Classification: Methods, Challenges and Ongoing Researchcited by 1
  26. 2024A New Formulation for Zeroth-Order Optimization of Adversarial EXEmples in Malware Detectioncited by 1
  27. 2024On the Effectiveness of Adversarial Training on Malware Classifierscited by 1
  28. 2025On the Security Risks of ML-based Malware Detection Systems: A Surveycited by 1
  29. 2025Empirical Quantification of Spurious Correlations in Malware Detectioncited by 1
  30. 2025Demystifying the Role of Rule-based Detection in AI Systems for Windows Malware Detectioncited by 1
  31. 2021A Comparison of State-of-the-Art Techniques for Generating Adversarial Malware Binariescited by 0
  32. 2022Instance Attack:An Explanation-based Vulnerability Analysis Framework Against DNNs for Malware Detectioncited by 0
  33. 2022Multi-view Representation Learning from Malware to Defend Against Adversarial Variantscited by 0
  34. 2023Effectiveness of Moving Target Defenses for Adversarial Attacks in ML-based Malware Detectioncited by 0
  35. 2023ATWM: Defense against adversarial malware based on adversarial trainingcited by 0
  36. 2024Certified Adversarial Robustness of Machine Learning-based Malware Detectors via (De)Randomized Smoothingcited by 0
  37. 2025Certifiably robust malware detectors by designcited by 0
  38. 2025Efficient Adversarial Malware Defense via Trust-Based Raw Override and Confidence-Adaptive Bit-Depth Reductioncited by 0

50 most cited of 58 All 58 (JSON)