RAMP: Reversing Adversarial Perturbations to Strengthen Clean-Label Backdoor Attacks against Malware Detectors
RAMP uses reversed adversarial perturbations to strengthen clean-label backdoors against malware detectors.
RAMP is a research method for strengthening clean-label backdoor attacks against deep-learning malware detectors that are fine-tuned on newly collected samples. Instead of only designing a stronger trigger, it shifts benign programs toward the malware region of feature space, then applies those changes through functionality-preserving binary edits so samples keep benign labels. A genetic algorithm optimizes the reversed perturbations under black-box access. Experiments report substantially higher attack success than trigger-only baselines, especially at low poisoning ratios, with clean-data accuracy maintained, and the method can be combined with existing trigger designs.
- Targets clean-label poisoning of malware detectors updated on crowdsourced samples.
- Shifts benign binaries toward the malware feature region before trigger injection.
- A genetic algorithm optimizes perturbations under black-box detector access.
- Reported gains are largest at low poisoning rates while clean accuracy holds.
From the original article
1 min read at arxiv.orgDeep learning-based malware detectors are commonly updated by fine-tuning on newly collected samples, but this practical update pipeline also creates an attack surface for training-time backdoor attacks.
By Jinwen Xin · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.