# Analysis of Label-Flip Poisoning Attack on Machine Learning Based Malware Detector

arXiv: https://arxiv.org/abs/2301.01044 · HTML: https://mlsanity.com/paper/2301.01044/

## Key facts

- Cited by 11 papers in the map (data through 14 Oct 2026).
- Placed in Backdoor and data poisoning attacks, one of 12 directions in LLM safety and security.
- Builds on 19 of its 52 references that are in the map.
- First posted on arXiv 3 Jan 2023.

## Placed in

- LLM safety and security / [Backdoor and data poisoning attacks](https://mlsanity.com/safety/backdoor-and-data-poisoning-attacks/)

## Builds on (most cited first, 19 of 19)

- [Intriguing properties of neural networks](https://mlsanity.com/paper/1312.6199/) (2013)
- [Towards Federated Learning at Scale: System Design](https://mlsanity.com/paper/1902.01046/) (2019)
- [How To Backdoor Federated Learning](https://mlsanity.com/paper/1807.00459/) (2018)
- [Poison Frogs! Targeted Clean-Label Poisoning Attacks on Neural Networks](https://mlsanity.com/paper/1804.00792/) (2018)
- [Towards Poisoning of Deep Learning Algorithms with Back-gradient Optimization](https://mlsanity.com/paper/1708.08689/) (2017)
- [Generating Adversarial Malware Examples for Black-Box Attacks Based on GAN](https://mlsanity.com/paper/1702.05983/) (2017)
- [Adversarial Malware Binaries: Evading Deep Learning for Malware Detection in Executables](https://mlsanity.com/paper/1803.04173/) (2018)
- [Poisoning Attacks to Graph-Based Recommender Systems](https://mlsanity.com/paper/1809.04127/) (2018)
- [Generative Poisoning Attack Method Against Neural Networks](https://mlsanity.com/paper/1703.01340/) (2017)
- [Exploring Adversarial Examples in Malware Detection](https://mlsanity.com/paper/1810.08280/) (2018)
- [Data Poisoning Attack against Knowledge Graph Embedding](https://mlsanity.com/paper/1904.12052/) (2019)
- [Explaining Vulnerabilities of Deep Learning to Adversarial Malware Binaries](https://mlsanity.com/paper/1901.03583/) (2019)
- [A Unified Framework for Data Poisoning Attack to Graph-based Semi-supervised Learning](https://mlsanity.com/paper/1910.14147/) (2019)
- [MaMaDroid: Detecting Android Malware by Building Markov Chains of Behavioral Models](https://mlsanity.com/paper/1612.04433/) (2016)
- [A Survey on Adversarial Attacks for Malware Analysis](https://mlsanity.com/paper/2111.08223/) (2021)
- [Biometric Backdoors: A Poisoning Attack Against Unsupervised Template Updating](https://mlsanity.com/paper/1905.09162/) (2019)
- [Poisoning Attacks on Cyber Attack Detectors for Industrial Control Systems](https://mlsanity.com/paper/2012.15740/) (2020)
- [Online Data Poisoning Attack](https://mlsanity.com/paper/1903.01666/) (2019)
- [Expansion of Cyber Attack Data From Unbalanced Datasets Using Generative Techniques](https://mlsanity.com/paper/1912.04549/) (2019)

## Built on by (most cited first, 11 of 11)

- [Data and Model Poisoning Backdoor Attacks on Wireless Federated Learning, and the Defense Mechanisms: A Comprehensive Survey](https://mlsanity.com/paper/2312.08667/) (2023)
- [Fast Adversarial Label-Flipping Attack on Tabular Data](https://mlsanity.com/paper/2310.10744/) (2023)
- [Trust Under Siege: Label Spoofing Attacks against Machine Learning for Android Malware Detection](https://mlsanity.com/paper/2503.11841/) (2025)
- [Explainable but Vulnerable: Adversarial Attacks on XAI Explanation in Cybersecurity Applications](https://mlsanity.com/paper/2510.03623/) (2025)
- [How to Design and Deliver Courses for Higher Education in the AI Era: Insights from Exam Data Analysis](https://mlsanity.com/paper/2308.02441/) (2023)
- [Timber! Poisoning Decision Trees](https://mlsanity.com/paper/2410.00862/) (2024)
- [Robustness of Selected Learning Models under Label-Flipping Attack](https://mlsanity.com/paper/2501.12516/) (2025)
- [Gray-Box Poisoning of Continuous Malware Ingestion Pipelines](https://mlsanity.com/paper/2605.04698/) (2026)
- [A Security-Oriented Lifecycle Model for Large Language Model Systems](https://mlsanity.com/paper/2608.03626/) (2026)
- [Online AutoML: Evaluating Poisoning Attacks on Cost-Utility Adversarial Training Defence Strategy for IoT Networks](https://mlsanity.com/paper/2610.05810/) (2026)
- [Space Over Statistic, Retraining Over Ranking: Auditing Training Labels Under Label-Only Backdoors](https://mlsanity.com/paper/2610.13051/) (2026)

## Abstract (arXiv)

With the increase in machine learning (ML) applications in different domains, incentives for deceiving these models have reached more than ever. As data is the core backbone of ML algorithms, attackers shifted their interest toward polluting the training data. Data credibility is at even higher risk with the rise of state-of-art research topics like open design principles, federated learning, and crowd-sourcing. Since the machine learning model depends on different stakeholders for obtaining data, there are no reliable automated mechanisms to verify the veracity of data from each source. Malware detection is arduous due to its malicious nature with the addition of metamorphic and polymorphic ability in the evolving samples. ML has proven to solve the zero-day malware detection problem, which is unresolved by traditional signature-based approaches. The poisoning of malware training data can allow the malware files to go undetected by the ML-based malware detectors, helping the attackers to fulfill their malicious goals. A feasibility analysis of the data poisoning threat in the malware detection domain is still lacking. Our work will focus on two major sections: training ML-based malware detectors and poisoning the training data using the label-poisoning approach. We will analyze the robustness of different machine learning models against data poisoning with varying volumes of poisoning data.