RAMP: Reversing Adversarial Perturbations to Strengthen Clean-Label Backdoor Attacks against Malware Detectors
RAMP uses reversed adversarial perturbations to strengthen clean-label backdoors against malware detectors.
RAMP is a research method for strengthening clean-label backdoor attacks against deep-learning malware detectors that are fine-tuned on newly collected samples. Instead of only designing a stronger trigger, it shifts benign programs toward the malware region of feature space, then applies those changes through functionality-preserving binary edits so samples keep benign labels. A genetic algorithm optimizes the reversed perturbations under black-box access. Experiments report substantially higher attack success than trigger-only baselines, especially at low poisoning ratios, with clean-data accuracy maintained, and the method can be combined with existing trigger designs.
- Targets clean-label poisoning of malware detectors updated on crowdsourced samples.
- Shifts benign binaries toward the malware feature region before trigger injection.
- A genetic algorithm optimizes perturbations under black-box detector access.
- Reported gains are largest at low poisoning rates while clean accuracy holds.
Full article176 words · extracted from arxiv.org · click to collapse
Deep learning-based malware detectors are commonly updated by fine-tuning on newly collected samples, but this practical update pipeline also creates an attack surface for training-time backdoor attacks. In realistic crowdsourced data collection, however, strict label vetting typically restricts attackers to the clean-label setting, in which poisoned samples must retain benign labels and functionality, making effective backdoor injection substantially harder. We present a new attack perspective based on feature-space manipulation: instead of relying solely on stronger trigger designs or selecting benign samples that are naturally similar to malware, we deliberately construct benign programs whose representations shift toward the malware region before trigger injection, thereby creating stronger feature-label conflicts during training. Based on this insight, we propose RAMP, an attack enhancement method that uses a genetic algorithm to optimize reversed adversarial perturbations under black-box access and then injects them through functionality-preserving binary manipulations. Extensive experiments show that RAMP substantially improves attack effectiveness over trigger-only baselines, with especially pronounced gains at low poisoning ratios, while maintaining accuracy on clean data. Moreover, RAMP can be combined with advanced trigger designs.
Text extracted automatically; images, tables and formatting may be missing. Original: https://arxiv.org/abs/2609.27422