# A survey on practical adversarial examples for malware classifiers

arXiv: https://arxiv.org/abs/2011.05973 · HTML: https://mlsanity.com/paper/2011.05973/

## Key facts

- Cited by 5 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 6 Nov 2020.

## Built on by (most cited first, 5 of 5)

- [Adversarial Attacks against Windows PE Malware Detection: A Survey of the State-of-the-Art](https://mlsanity.com/paper/2112.12310/) (2021)
- [MERLIN -- Malware Evasion with Reinforcement LearnINg](https://mlsanity.com/paper/2203.12980/) (2022)
- [How to Train your Antivirus: RL-based Hardening through the Problem-Space](https://mlsanity.com/paper/2402.19027/) (2024)
- [Certifiably robust malware detectors by design](https://mlsanity.com/paper/2508.10038/) (2025)
- [Latent Stability Analysis of Malware Representations Under Feature-Space Perturbations](https://mlsanity.com/paper/2607.24896/) (2026)

## Abstract (arXiv)

Machine learning based solutions have been very helpful in solving problems that deal with immense amounts of data, such as malware detection and classification. However, deep neural networks have been found to be vulnerable to adversarial examples, or inputs that have been purposefully perturbed to result in an incorrect label. Researchers have shown that this vulnerability can be exploited to create evasive malware samples. However, many proposed attacks do not generate an executable and instead generate a feature vector. To fully understand the impact of adversarial examples on malware detection, we review practical attacks against malware classifiers that generate executable adversarial malware examples. We also discuss current challenges in this area of research, as well as suggestions for improvement and future research directions.