# Creating Valid Adversarial Examples of Malware

arXiv: https://arxiv.org/abs/2306.13587 · HTML: https://mlsanity.com/paper/2306.13587/

## Key facts

- Cited by 3 papers in the map (data through 14 Oct 2026).
- Builds on 19 of its 40 references that are in the map.
- First posted on arXiv 23 Jun 2023.

## Builds on (most cited first, 19 of 19)

- [Proximal Policy Optimization Algorithms](https://mlsanity.com/paper/1707.06347/) (2017)
- [Explaining and Harnessing Adversarial Examples](https://mlsanity.com/paper/1412.6572/) (2014)
- [Playing Atari with Deep Reinforcement Learning](https://mlsanity.com/paper/1312.5602/) (2013)
- [OpenAI Gym](https://mlsanity.com/paper/1606.01540/) (2016)
- [The Limitations of Deep Learning in Adversarial Settings](https://mlsanity.com/paper/1511.07528/) (2015)
- [EMBER: An Open Dataset for Training Static PE Malware Machine Learning Models](https://mlsanity.com/paper/1804.04637/) (2018)
- [Malware Detection by Eating a Whole EXE](https://mlsanity.com/paper/1710.09435/) (2017)
- [Generating Adversarial Malware Examples for Black-Box Attacks Based on GAN](https://mlsanity.com/paper/1702.05983/) (2017)
- [Adversarial Malware Binaries: Evading Deep Learning for Malware Detection in Executables](https://mlsanity.com/paper/1803.04173/) (2018)
- [Learning to Evade Static PE Machine Learning Malware Models via Reinforcement Learning](https://mlsanity.com/paper/1801.08917/) (2018)
- [Functionality-preserving Black-box Optimization of Adversarial Windows Malware](https://mlsanity.com/paper/2003.13526/) (2020)
- [RLlib: Abstractions for Distributed Reinforcement Learning](https://mlsanity.com/paper/1712.09381/) (2017)
- [Survey of Machine Learning Techniques for Malware Analysis](https://mlsanity.com/paper/1710.08189/) (2017)
- [Explaining Vulnerabilities of Deep Learning to Adversarial Malware Binaries](https://mlsanity.com/paper/1901.03583/) (2019)
- [Deceiving End-to-End Deep Learning Malware Detectors using Adversarial Examples](https://mlsanity.com/paper/1802.04528/) (2018)
- [Automated Poisoning Attacks and Defenses in Malware Detection Systems: An Adversarial Machine Learning Approach](https://mlsanity.com/paper/1706.04146/) (2017)
- [A Comparison of Static, Dynamic, and Hybrid Analysis for Malware Detection](https://mlsanity.com/paper/2203.09938/) (2022)
- [MERLIN -- Malware Evasion with Reinforcement LearnINg](https://mlsanity.com/paper/2203.12980/) (2022)
- [Binary Black-box Evasion Attacks Against Deep Learning-based Static Malware Detectors with Adversarial Byte-Level Language Model](https://mlsanity.com/paper/2012.07994/) (2020)

## Built on by (most cited first, 3 of 3)

- [Adversarial Co-Evolution of Malware and Detection Models: A Bilevel Optimization Perspective](https://mlsanity.com/paper/2604.22569/) (2026)
- [Adversarial Malware Generation in Linux ELF Binaries via Semantic-Preserving Transformations](https://mlsanity.com/paper/2604.22639/) (2026)
- [Building an Adversarial Malware Dataset by Family and Type: Generation, Evasion, and Poisoning Evaluation](https://mlsanity.com/paper/2605.25937/) (2026)

## Abstract (arXiv)

Machine learning is becoming increasingly popular as a go-to approach for many tasks due to its world-class results. As a result, antivirus developers are incorporating machine learning models into their products. While these models improve malware detection capabilities, they also carry the disadvantage of being susceptible to adversarial attacks. Although this vulnerability has been demonstrated for many models in white-box settings, a black-box attack is more applicable in practice for the domain of malware detection. We present a generator of adversarial malware examples using reinforcement learning algorithms. The reinforcement learning agents utilize a set of functionality-preserving modifications, thus creating valid adversarial examples. Using the proximal policy optimization (PPO) algorithm, we achieved an evasion rate of 53.84% against the gradient-boosted decision tree (GBDT) model. The PPO agent previously trained against the GBDT classifier scored an evasion rate of 11.41% against the neural network-based classifier MalConv and an average evasion rate of 2.31% against top antivirus programs. Furthermore, we discovered that random application of our functionality-preserving portable executable modifications successfully evades leading antivirus engines, with an average evasion rate of 11.65%. These findings indicate that machine learning-based models used in malware detection systems are vulnerable to adversarial attacks and that better safeguards need to be taken to protect these systems.