Trigger Value Selection in Clean-Label Malware Backdoors: An Effectiveness-Detectability Analysis
Researchers show trigger-value choice changes success and detectability of clean-label backdoors in malware classifiers.
The paper treats trigger-value selection as its own design factor in clean-label backdoor poisoning of feature-based malware classifiers. It evaluates LightGBM on EMBER 2018 and a Win64 PE subset of EMBER 2024, comparing rare-value, SHAP-based, frequency-bounded, co-occurrence-aware, and quantile-based selectors. Aggressive selectors such as MinPopulation and CountAbsSHAP reach high attack success, especially under distribution-based sampling, but Isolation Forest detects them more readily. CorrCountAbsSHAP and Quantile95 lower poison recall while keeping useful attack effectiveness.
- Clean-label poisons keep original labels in malware-classifier training data.
- LightGBM evaluated on EMBER 2018 and an EMBER 2024 Win64 PE subset.
- MinPopulation and CountAbsSHAP raise success but are easier for Isolation Forest to catch.
- CorrCountAbsSHAP and Quantile95 reduce poison recall while retaining effectiveness.
From the original article
1 min read at arxiv.orgClean-label backdoor poisoning is a threat to machine learning-based malware classifiers because poisoned samples can be inserted into training data without changing their labels. Previous explanation-guided attacks mainly focus on selecting important trigger features, but the values assigned to these features can also affect the attack behavior.
By Tri Budi Sabdo Utomo · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.