# Gray-Box Poisoning of Continuous Malware Ingestion Pipelines

arXiv: https://arxiv.org/abs/2605.04698 · HTML: https://mlsanity.com/paper/2605.04698/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 6 of its 16 references that are in the map.
- First posted on arXiv 6 May 2026.

## Builds on (most cited first, 6 of 6)

- [Functionality-preserving Black-box Optimization of Adversarial Windows Malware](https://mlsanity.com/paper/2003.13526/) (2020)
- [Automated Poisoning Attacks and Defenses in Malware Detection Systems: An Adversarial Machine Learning Approach](https://mlsanity.com/paper/1706.04146/) (2017)
- [EMBER2024 -- A Benchmark Dataset for Holistic Evaluation of Malware Classifiers](https://mlsanity.com/paper/2506.05074/) (2025)
- [A Survey on Adversarial Attacks for Malware Analysis](https://mlsanity.com/paper/2111.08223/) (2021)
- [Analysis of Label-Flip Poisoning Attack on Machine Learning Based Malware Detector](https://mlsanity.com/paper/2301.01044/) (2023)
- [MAB-Malware: A Reinforcement Learning Framework for Attacking Static Malware Classifiers](https://mlsanity.com/paper/2003.03100/) (2020)

## Abstract (arXiv)

Modern malware detection pipelines rely on continuous data ingestion and machine learning to counter the high volume of novel threats. This work investigates a realistic gray-box poisoning threat model targeting these pipelines. Using the secml_malware framework, we generate problem-space adversarial binaries through functionality-preserving manipulations, specifically Import Address Table (IAT) and section injections. We evaluate the impact of these poisoned samples when ingested into a defender's training set for a LightGBM malware detection model. Our empirical results demonstrate that subtle IAT-based perturbations enable compact poisoning samples that significantly degrade detection recall. These findings illustrate the inherent challenge of developing low-visibility adversarial perturbations that maintain high poisoning efficacy within continuous learning systems. We further evaluate a defense mechanism based on a homogeneous ensemble, which successfully identifies and filters up to 95.6% of poisoning attempts while maintaining a high retention rate for legitimate data. These findings emphasize the necessity of robust pre-ingestion validation in production pipelines.