# Defending against Stegomalware in Deep Neural Networks with Permutation Symmetry

arXiv: https://arxiv.org/abs/2509.20399 · HTML: https://mlsanity.com/paper/2509.20399/

## Key facts

- Cited by 2 papers in the map (data through 14 Oct 2026).
- Builds on 8 of its 21 references that are in the map.
- First posted on arXiv 23 Sep 2025.

## Builds on (most cited first, 8 of 8)

- [Attention Is All You Need](https://mlsanity.com/paper/1706.03762/) (2017)
- [Deep Residual Learning for Image Recognition](https://mlsanity.com/paper/1512.03385/) (2015)
- [Fine-Pruning: Defending Against Backdooring Attacks on Deep Neural Networks](https://mlsanity.com/paper/1805.12185/) (2018)
- [A Survey of Model Compression and Acceleration for Deep Neural Networks](https://mlsanity.com/paper/1710.09282/) (2017)
- [SteganoGAN: High Capacity Image Steganography with GANs](https://mlsanity.com/paper/1901.03892/) (2019)
- [EvilModel 2.0: Bringing Neural Network Models into Malware Attacks](https://mlsanity.com/paper/2109.04344/) (2021)
- [Stegomalware: A Systematic Survey of MalwareHiding and Detection in Images, Machine LearningModels and Research Challenges](https://mlsanity.com/paper/2110.02504/) (2021)
- [Summoning Demons: The Pursuit of Exploitable Bugs in Machine Learning](https://mlsanity.com/paper/1701.04739/) (2017)

## Built on by (most cited first, 2 of 2)

- [Permutation-Based Stegomalware in Large Language Models: Threats and Countermeasures](https://mlsanity.com/paper/2609.16193/) (2026)
- [High-Capacity Robust Medical Image Exfiltration via Neural Network Weight Replacement](https://mlsanity.com/paper/2609.31726/) (2026)

## Abstract (arXiv)

Deep neural networks are being utilized in a growing number of applications, both in production systems and for personal use. Network checkpoints are as a consequence often shared and distributed on various platforms to ease the development process. This work considers the threat of neural network stegomalware, where malware is embedded in neural network checkpoints at a negligible cost to network accuracy. This constitutes a significant security concern, but is nevertheless largely neglected by the deep learning practitioners and security specialists alike. We propose the first effective countermeasure to these attacks. In particular, we show that state-of-the-art neural network stegomalware can be efficiently and effectively neutralized through shuffling the column order of the weight- and bias-matrices, or equivalently the channel-order of convolutional layers. We show that this effectively corrupts payloads that have been embedded by state-of-the-art methods in neural network steganography at no cost to network accuracy, outperforming competing methods by a significant margin. We then discuss possible means by which to bypass this defense, additional defense methods, and advocate for continued research into the security of machine learning systems.