# Adversarial Deep Ensemble: Evasion Attacks and Defenses for Malware Detection

arXiv: https://arxiv.org/abs/2006.16545 · HTML: https://mlsanity.com/paper/2006.16545/

## Key facts

- Cited by 33 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 30 Jun 2020.

## Built on by (most cited first, 30 of 33)

- [Deep Learning for Android Malware Defenses: a Systematic Literature Review](https://mlsanity.com/paper/2103.05292/) (2021)
- [Adversarial Robustness with Non-uniform Perturbations](https://mlsanity.com/paper/2102.12002/) (2021)
- [EvadeDroid: A Practical Evasion Attack on Machine Learning for Black-box Android Malware Detection](https://mlsanity.com/paper/2110.03301/) (2021)
- [Efficient Query-Based Attack against ML-Based Android Malware Detection under Zero Knowledge Setting](https://mlsanity.com/paper/2309.01866/) (2023)
- [Targeted Attacks on Timeseries Forecasting](https://mlsanity.com/paper/2301.11544/) (2023)
- [OFEI: A Semi-black-box Android Adversarial Sample Attack Framework Against DLaaS](https://mlsanity.com/paper/2105.11593/) (2021)
- [AttackGNN: Red-Teaming GNNs in Hardware Security Using Reinforcement Learning](https://mlsanity.com/paper/2402.13946/) (2024)
- [Invisible Backdoor Attack against Self-supervised Learning](https://mlsanity.com/paper/2405.14672/) (2024)
- [Can We Leverage Predictive Uncertainty to Detect Dataset Shift and Adversarial Examples in Android Malware Detection?](https://mlsanity.com/paper/2109.09654/) (2021)
- [PAD: Towards Principled Adversarial Malware Detection Against Evasion Attacks](https://mlsanity.com/paper/2302.11328/) (2023)
- [Towards Making Deep Learning-based Vulnerability Detectors Robust](https://mlsanity.com/paper/2108.00669/) (2021)
- [On the Detection of Adaptive Adversarial Attacks in Speaker Verification Systems](https://mlsanity.com/paper/2202.05725/) (2022)
- [Beyond Detection: Unveiling Fairness Vulnerabilities in Abusive Language Models](https://mlsanity.com/paper/2311.09428/) (2023)
- [MalPurifier: Enhancing Android Malware Detection with Adversarial Purification against Evasion Attacks](https://mlsanity.com/paper/2312.06423/) (2023)
- [Level Up with ML Vulnerability Identification: Leveraging Domain Constraints in Feature Space for Robust Android Malware Detection](https://mlsanity.com/paper/2205.15128/) (2022)
- [Model Attribution in LLM-Generated Disinformation: A Domain Generalization Approach with Supervised Contrastive Learning](https://mlsanity.com/paper/2407.21264/) (2024)
- [Defending against Adversarial Malware Attacks on ML-based Android Malware Detection Systems](https://mlsanity.com/paper/2501.13782/) (2025)
- [False Alarms, Real Damage: Adversarial Attacks Using LLM-based Models on Text-based Cyber Threat Intelligence Systems](https://mlsanity.com/paper/2507.06252/) (2025)
- [MaMaDroid2.0 -- The Holes of Control Flow Graphs](https://mlsanity.com/paper/2202.13922/) (2022)
- [A Transferable and Automatic Tuning of Deep Reinforcement Learning for Cost Effective Phishing Detection](https://mlsanity.com/paper/2209.09033/) (2022)
- [A Malware Classification Survey on Adversarial Attacks and Defences](https://mlsanity.com/paper/2312.09636/) (2023)
- [CARE: Ensemble Adversarial Robustness Evaluation Against Adaptive Attackers for Security Applications](https://mlsanity.com/paper/2401.11126/) (2024)
- [MASKDROID: Robust Android Malware Detection with Masked Graph Representations](https://mlsanity.com/paper/2409.19594/) (2024)
- [On the Effectiveness of Adversarial Training on Malware Classifiers](https://mlsanity.com/paper/2412.18218/) (2024)
- [On the Security Risks of ML-based Malware Detection Systems: A Survey](https://mlsanity.com/paper/2505.10903/) (2025)
- [Attacking Deep Learning AI Hardware with Universal Adversarial Perturbation](https://mlsanity.com/paper/2111.09488/) (2021)
- [Adversarial Patterns: Building Robust Android Malware Classifiers](https://mlsanity.com/paper/2203.02121/) (2022)
- [Discretization-based ensemble model for robust learning in IoT](https://mlsanity.com/paper/2307.08955/) (2023)
- [On the Effectiveness of Adversarial Samples against Ensemble Learning-based Windows PE Malware Detectors](https://mlsanity.com/paper/2309.13841/) (2023)
- [Improving Adversarial Robustness in Android Malware Detection by Reducing the Impact of Spurious Correlations](https://mlsanity.com/paper/2408.16025/) (2024)

## Abstract (arXiv)

Malware remains a big threat to cyber security, calling for machine learning based malware detection. While promising, such detectors are known to be vulnerable to evasion attacks. Ensemble learning typically facilitates countermeasures, while attackers can leverage this technique to improve attack effectiveness as well. This motivates us to investigate which kind of robustness the ensemble defense or effectiveness the ensemble attack can achieve, particularly when they combat with each other. We thus propose a new attack approach, named mixture of attacks, by rendering attackers capable of multiple generative methods and multiple manipulation sets, to perturb a malware example without ruining its malicious functionality. This naturally leads to a new instantiation of adversarial training, which is further geared to enhancing the ensemble of deep neural networks. We evaluate defenses using Android malware detectors against 26 different attacks upon two practical datasets. Experimental results show that the new adversarial training significantly enhances the robustness of deep neural networks against a wide range of attacks, ensemble methods promote the robustness when base classifiers are robust enough, and yet ensemble attacks can evade the enhanced malware detectors effectively, even notably downgrading the VirusTotal service.