# EvilModel 2.0: Bringing Neural Network Models into Malware Attacks

arXiv: https://arxiv.org/abs/2109.04344 · HTML: https://mlsanity.com/paper/2109.04344/

## Key facts

- Cited by 13 papers in the map (data through 14 Oct 2026).
- Builds on 13 of its 60 references that are in the map.
- First posted on arXiv 9 Sep 2021.

## Builds on (most cited first, 13 of 13)

- [Adam: A Method for Stochastic Optimization](https://mlsanity.com/paper/1412.6980/) (2014)
- [Joint Face Detection and Alignment using Multi-task Cascaded Convolutional Networks](https://mlsanity.com/paper/1604.02878/) (2016)
- [A Survey of Deep Learning Techniques for Autonomous Driving](https://mlsanity.com/paper/1910.07738/) (2019)
- [The Malicious Use of Artificial Intelligence: Forecasting, Prevention, and Mitigation](https://mlsanity.com/paper/1802.07228/) (2018)
- [Generating Adversarial Malware Examples for Black-Box Attacks Based on GAN](https://mlsanity.com/paper/1702.05983/) (2017)
- [Learning to Evade Static PE Machine Learning Malware Models via Reinforcement Learning](https://mlsanity.com/paper/1801.08917/) (2018)
- [The Threat of Offensive AI to Organizations](https://mlsanity.com/paper/2106.15764/) (2021)
- [PassGAN: A Deep Learning Approach for Password Guessing](https://mlsanity.com/paper/1709.00440/) (2017)
- [Steganographic Generative Adversarial Networks](https://mlsanity.com/paper/1703.05502/) (2017)
- [EvilModel: Hiding Malware Inside of Neural Network Models](https://mlsanity.com/paper/2107.08590/) (2021)
- [Hydras and IPFS: A Decentralised Playground for Malware](https://mlsanity.com/paper/1905.11880/) (2019)
- [Encrypted and Covert DNS Queries for Botnets: Challenges and Countermeasures](https://mlsanity.com/paper/1909.07099/) (2019)
- [DeepC2: AI-powered Covert Command and Control on OSNs](https://mlsanity.com/paper/2009.07707/) (2020)

## Built on by (most cited first, 13 of 13)

- [PeaTMOSS: A Dataset and Initial Analysis of Pre-Trained Models in Open-Source Software](https://mlsanity.com/paper/2402.00699/) (2024)
- [Impacts and Risk of Generative AI Technology on Cyber Defense](https://mlsanity.com/paper/2306.13033/) (2023)
- [Do You Trust Your Model? Emerging Malware Threats in the Deep Learning Ecosystem](https://mlsanity.com/paper/2403.03593/) (2024)
- [PickleBall: Secure Deserialization of Pickle-based Machine Learning Models (Extended Report)](https://mlsanity.com/paper/2508.15987/) (2025)
- [On the Steganographic Capacity of Selected Learning Models](https://mlsanity.com/paper/2308.15502/) (2023)
- [A Survey on the Application of Generative Adversarial Networks in Cybersecurity: Prospective, Direction and Open Research Scopes](https://mlsanity.com/paper/2407.08839/) (2024)
- [On the (In)Security of Loading Machine Learning Models](https://mlsanity.com/paper/2509.06703/) (2025)
- [Defending against Stegomalware in Deep Neural Networks with Permutation Symmetry](https://mlsanity.com/paper/2509.20399/) (2025)
- [PeaTMOSS: Mining Pre-Trained Models in Open-Source Software](https://mlsanity.com/paper/2310.03620/) (2023)
- [SafePickle: Robust and Generic ML Detection of Malicious Pickle-based ML Models](https://mlsanity.com/paper/2602.19818/) (2026)
- [Model X-Ray: Detection of Hidden Malware in AI Model Weights using Few Shot Learning](https://mlsanity.com/paper/2409.19310/) (2024)
- [MEASER: Malware embedding attacks on open-source LLMs](https://mlsanity.com/paper/2510.10486/) (2025)
- [Permutation-Based Stegomalware in Large Language Models: Threats and Countermeasures](https://mlsanity.com/paper/2609.16193/) (2026)

## Abstract (arXiv)

Security issues have gradually emerged with the continuous development of artificial intelligence (AI). Earlier work verified the possibility of converting neural network models into stegomalware, embedding malware into a model with limited impact on the model's performance. However, existing methods are not applicable in real-world attack scenarios and do not attract enough attention from the security community due to performance degradation and additional workload. Therefore, we propose an improved stegomalware EvilModel. By analyzing the composition of the neural network model, three new methods for embedding malware into the model are proposed: MSB reservation, fast substitution, and half substitution, which can embed malware that accounts for half of the model's volume without affecting the model's performance. We built 550 EvilModels using ten mainstream neural network models and 19 malware samples. The experiment shows that EvilModel achieved an embedding rate of 48.52%. A quantitative algorithm is proposed to evaluate the existing embedding methods. We also design a trigger and propose a threat scenario for the targeted attack. The practicality and effectiveness of the proposed methods were demonstrated by experiments and analyses of the embedding capacity, performance impact, and detection evasion.