Empirical Analysis of Evasion and Poisoning Against Malware Data Drift Detection

David Lie; Mingyue Yang; Nicolas Papernot

Empirical Analysis of Evasion and Poisoning Against Malware Data Drift Detection

T0 review · 2 major / 5 minor · reviewed 2026-08-05 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read The paper claims that data drift detectors' unique design makes evasion and poisoning attacks against malware classifiers behave differently, with larger perturbations or more poisoning samples sometimes decreasing combined attack success.

desk verdict Genuinely new evasion result against CAE-based drift detectors, but the poisoning half rests on an unverified selection assumption that a referee should force the authors to address. read the letter →

arxiv 2608.03642 v2 pith:N4V2EAEQ submitted 2026-08-04 cs.CR

Mingyue Yang , David Lie , Nicolas Papernot This is my paper · ORCID

classification cs.CR

keywords malwareclassificationdatadriftdetectionevasionattackspoisoningcontrastiveautoencoderCADETranscendentattacksuccessrate

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper studies what happens when an attacker tries to fool a malware classifier that is paired with a data drift detector. It shows that the detector's own design, particularly a contrastive autoencoder embedding space, can make attacks that work well against a plain classifier much less effective against the combined system. Larger evasion perturbations and larger numbers of poisoning samples can actually lower the overall attack success rate, because the crafted samples get pushed away from the benign region and are flagged as drifted. The finding matters because it suggests a defender may get a partial, geometry-based resilience simply by using such drift detectors, and it warns attackers that their attack budgets are not monotonically effective.

What carries the argument

Contrastive autoencoder (CAE) embedding space: an encoder projects inputs to a low-dimensional space where samples of the same class cluster together via a contrastive loss, while a reconstruction loss preserves input detail. CADE measures drift as distance to the class centroid in this space; Transcendent builds an SVM on the same space and uses conformal p-values to define a credibility-confidence score. Since the detector select top-k drifted samples for human review, an attack succeeds only if the crafted sample is not among them. The paper's key observation is that the CAE's geometry and reconstruction objective push large-perturbation or heavily poisoned samples away from the benign cl

What would settle it

Run the evasion attack on Androzoo with a CAE-based CADE victim, sweeping the perturbation limit from 50 to 500 while holding all other settings fixed; if the combined attack success rate never falls as the limit increases, the claimed non-monotonicity is refuted. A second falsifying test is a poisoning run in which the victim inserts only top-k drifted samples from a mix of attacker and normal samples, to see whether the all-poisoning assumption drives the observed decrease.

Watch

Extended reading notes

Core claim

Against a malware classifier alone, attack success grows as the attacker spends more perturbation budget or inserts more poisoning samples. But when a data drift detector with a contrastive autoencoder (CAE) is placed in front of the classifier, the combined attack success rate can decrease as the attack budget grows. The CAE embedding space, trained with contrastive and reconstruction losses, treats over-perturbed or backdoor-triggered samples as novel patterns and moves them away from the benign class centroid; CADE and Transcendent then give these samples high drift scores, sending them to a human analyst for inspection. The same geometric effect appears in both CADE and Transcendent with

Load-bearing premise

The poisoning results assume that every sample the victim inserts into the retraining set is an attacker's crafted poisoning sample; if the drift detector would mostly filter such samples out in practice, the measured poisoning trends would not apply.

Editorial extensions

If this is right

Attack success against a classifier-plus-drift-detector system is not monotonic in the attacker's perturbation budget or poisoning count; beyond a point, more attack effort backfires.
A defender using CADE or Transcendent with a CAE gains a partial, geometry-based resilience against large evasion perturbations and large-scale backdoor poisoning.
Surrogate model choice matters: perturbations generated with cross-entropy loss often achieve lower combined success against CAE-based detectors than perturbations that explicitly target the CAE's benign centroid.
The reconstruction-loss effect grows as the embedding space shrinks, making embedding dimensionality a relevant security configuration for the defender.
Attackers who want reliable success must solve a joint optimization that accounts for the drift detector's score, not just the classifier's confidence.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

The same geometric effect likely applies to other autoencoder-based out-of-distribution detectors, suggesting a general principle: embedding-space drift detectors can act as a cap on adversarial distortion.
A natural testable extension is to directly optimize a perturbation that also minimizes the drift score; the paper's results predict this would restore monotonic attack success at higher computational cost.
The all-poisoning assumption is a best case for the attacker; if drift detectors filter a large fraction of crafted samples in real retraining data, the reported poisoning trends may understate defender resilience.
The interaction between embedding dimension and attack success hints that defenders could tune the embedding capacity as a security parameter, rather than only for detection accuracy.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

The one result worth knowing before you read it: attacks against malware classifiers do not transfer cleanly to classifier-plus-drift-detector pipelines. The paper shows that against CADE and Transcendent with CAE backbones, larger evasion perturbations can reduce combined attack success, because the CAE embedding pushes over-perturbed samples away from the benign centroid. That is a real, non-obvious empirical finding, and the distance-to-centroid measurements in the appendix back up the mechanism. The evasion story holds up across two datasets, multiple architectures, and 30 trials.

The poisoning half is where I have a real objection, and it matches the stress-test note. The paper says, in Section 3, 'our experiments assume all samples inserted to form the new training set are poisoning samples from the attacker.' That bypasses the drift detector's selection step entirely. For the attack to work in practice, the attacker's benign-plus-trigger samples have to be among the top-k drifted samples picked by the unpoisoned detector. The authors never measure whether those candidates actually get selected. If the detector's OOD or cred+conf scoring filters them out, the poisoning attack fails before the CAE reconstruction-loss story even starts, and the observed decrease in ASR with more inserted samples is an artifact of forced insertion. This is a load-bearing gap, not a cosmetic one. The paper is transparent about the assumption, which I appreciate, but transparency doesn't make the premise realistic.

Other soft spots are minor in comparison: no code or data release, and the figures lack error bars even though standard deviations are reported in tables. Those are addressable in revision.

Serious referee? Yes. The evasion result alone justifies peer review, and the poisoning question, once the selection step is actually tested, could be a solid contribution. The paper deserves a round of revision where the authors either fix the poisoning threat model or explicitly scope the claim to post-selection retraining. I'd take it for a reading group and would cite the evasion finding if I were working on drift detection.

Send it to review.

Referee Report

2 major / 5 minor

Summary. The paper empirically studies evasion and clean-label backdoor poisoning attacks against two malware data drift detectors (CADE and Transcendent) combined with an MLP malware classifier, using the Bodmas and Androzoo datasets. The authors generate universal perturbations/triggers from surrogate MLP or CAE models and evaluate attack success under varying perturbation limits, feature budgets, top-k selection thresholds, and numbers of poisoning samples. The central claim is that unique characteristics of data drift detectors, especially CAE embedding geometry and reconstruction loss, cause attacks against the combined system to behave differently than against the classifier alone: larger perturbations and more poisoning samples can decrease the combined attack success rate. Appendix tables report CAE distance-to-centroid and anomaly-score measurements used to support the proposed mechanism.

Significance. If the results hold, the paper identifies a practically relevant, non-obvious phenomenon: malware classifiers and data drift detectors interact adversarially with attack budgets, and a defender may gain partial geometry-based resilience from CAE-based drift detection. The study's strengths include the use of two public malware datasets, repeated trials (30 runs), multiple surrogate and victim architectures, and the inclusion of appendix measurements that directly support the proposed CAE-capacity explanation. The paper also makes its threat-model assumptions explicit. However, because the poisoning experiments bypass the drift detector's selection step, the poisoning half of the central claim is currently conditional on an unverified assumption, and the lack of uncertainty visualization on the main ASR curves weakens support for the non-monotonicity claim.

major comments (2)

[§3 Retrain/Poison Victim Models; §4.2 Scenario 2] The poisoning experiments assume that 'all samples inserted to form the new training set are poisoning samples from the attacker.' The victim's actual mechanism, however, inserts the top-k most drifted samples from the future selection set as ranked by the unpoisoned drift detector. The paper never measures whether the backdoored benign candidates would be selected: that is, whether their CADE OOD scores or Transcendent cred+conf scores place them among the top k. If the detector filters these candidates out, the poisoning attack fails regardless of the CAE's retrained behavior, and the decreasing ASR shown in Figures 3-4 is an artifact of forced insertion. This is load-bearing for the poisoning half of the central claim. Please measure the drift-score ranks of the candidate poisoning samples against the future selection set under the initial unpoisoned detector, and re-run the poisoning
[§5.2, §5.3, Figures 1-4] The main empirical support for the central non-monotonicity claim is the shape of the combined-ASR curves, but the figures show no error bars, confidence intervals, or significance tests, even though the experiments were repeated 30 times. Standard deviations are reported for the classification-only results in Table 2, but not for the combined detector+classifier ASR values plotted in Figures 1-4. Without an indication of run-to-run variability, the reader cannot determine whether a reported decrease (for example, from 100% to 95%) is meaningful or within noise. Please add error bars or confidence intervals to the combined ASR plots, and ideally a paired statistical test for the decreases that are claimed to be non-monotonic.

minor comments (5)

[§3 Datasets] Typo: 'evalution' should be 'evaluation' in the paragraph beginning 'For comparable evalution results...'.
[§2 T ranscend and T ranscendent] The text has an unusual spacing artifact: 'T ranscend' in the section header and first sentence. Please correct.
[Algorithm 1, line 9] The line 'CAE encoder, benign centroid = model' is ambiguous as written; clarify that the surrogate CAE model provides both an encoder and a stored benign-class centroid.
[§5.1 Evaluation Metrics] The definitions involving s_k would be clearer if you first define s_k as the k-th most drifted sample by the relevant score, then write the set cardinality conditions.
[Appendix, Tables 5-6] The distance/anomaly tables are useful but are presented without interpretation. Add one or two sentences explaining how the monotonic increase in average distance (e.g., for poisoned CAE 512-128-32-8) maps to the ASR decrease in Section 5.3.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the paper's results are empirical measurements against independently trained victim models; the poisoning assumption limits scope but is not circular.

full rationale

The paper's central claims are empirical: it measures attack success rates against victim malware classifiers and drift detectors (CADE, Transcendent) trained on standard public datasets (Androzoo, Bodmas). The attacker's surrogate models are trained on a strict 10% subset of the victim's training data, and the success metrics are defined directly from victim model outputs (MLP prediction, CADE OOD score, Transcendent cred+conf score) rather than from the attack's own parameters. No 'prediction' is derived from a fitted parameter: the non-monotonic ASR curves are observed outcomes of running optimizations against surrogate models and evaluating against victim models. The CAE-based explanation (reconstruction loss forcing triggered samples away from the benign centroid) is supported by direct measurements of distances and anomaly scores in the appendix, not by reusing the attack objective as the evaluation metric. The paper does not invoke a uniqueness theorem, and the citations to prior drift-detection works (CADE, Transcendent) are genuine external systems, not self-citations of the current authors' unpublished claims. The explicit poisoning assumption—'our experiments assume all samples inserted to form the new training set are poisoning samples from the attacker'—is a threat-model simplification that bypasses the drift detector's selection step. This limits the ecological validity of the poisoning results, but it is a stated conditional assumption, not a circular derivation: the results describe what happens when such samples are forcibly inserted, and do not claim to predict detector selection. Therefore the derivation chain is self-contained and the paper contains no significant circularity.

Assumptions & free parameters 3 free parameters · 4 assumptions · 0 invented entities

The paper is an empirical study and introduces no new mathematical parameters or fitted constants. The listed free parameters are experimental controls. The axioms cover the transferability assumption, the idealized poisoning setup, feature-realizability assumptions borrowed from prior work, and the mechanistic explanation for the CAE behavior.

free parameters (3)

Top-k drift detection budget (k) = 500 (200 in one poisoning experiment)
Chosen by the experimenter to define the drift evasion criterion. A larger k makes evasion harder; this is an experimental control, not a fitted parameter.
Perturbation limit for Bodmas = 0.25, 0.5, 0.75, 1.0 (post-scaling)
Hand-selected range to study attack budget. Directly influences the attack success curves and is an independent variable, not a fitted constant.
Perturbation limit (feature count) for Androzoo = 200 or 1000 most significant features
Selected via RFE with logistic regression using attacker-known data. The choice of feature count changes the attack surface and is an experimental setting.

assumptions (4)

domain assumption Attacks computed on surrogate models transfer to the victim models under the stated restricted knowledge.
Section 3 'Attacker Knowledge' assumes the attacker knows only 10% of the training data and builds surrogate models; the entire attack evaluation relies on transferability, which is standard in this literature but not guaranteed.
ad hoc to paper In the poisoning scenario, all samples inserted into the victim's retraining set are attacker-controlled and are among the top-k drifted samples.
Section 3 'Retrain/Poison Victim Models' explicitly states this simplification to isolate the poisoning effect. It is an idealized assumption that may not hold if the drift detector filters out the poisoning samples.
domain assumption Feature modifications preserve malware functionality and do not break file formats under the stated restrictions (Bodmas: 17 modifiable features; Androzoo: all features incrementable to 1).
Section 3 'Feature Restrictions to Keep Malware Functionality' states these restrictions, following prior work [14]. The realism of these restrictions is assumed, not verified by the paper.
ad hoc to paper The CAE embedding distance and the reconstruction loss are sufficient to explain the observed attack success patterns.
The explanation for decreasing ASR with larger perturbations or more poisoning samples is tied to the CAE's reconstruction loss and limited embedding space. The paper provides supporting measurements, but this is a mechanistic hypothesis rather than a proven causal model.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Empirical Analysis of Evasion and Poisoning Against Malware Data Drift Detection." pith.science (2026). https://pith.science/paper/N4V2EAEQ

@misc{pith2026260803642,
  author       = {Pith},
  title        = {Pith review of: Empirical Analysis of Evasion and Poisoning Against Malware Data Drift Detection},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/N4V2EAEQ}},
  note         = {Machine review of arXiv:2608.03642}
}

read the original abstract

As concept drift due to malware evolution presents challenges for malware classification, machine learning-based data drift detection tools are developed to mitigate this problem. These data drift detector tools are designed for a different purpose and built with different techniques compared to malware classifiers. Although evasion and poisoning attacks against machine learning-based malware classifiers can cause misclassification of malware samples, it is not clear how these attacks work against data drift detectors and malware classifiers in combination. This work investigates the effect of evasion and poisoning attacks on the data drift detector along with the malware classifier. We demonstrate how unique characteristics of data drift detectors cause attacks against malware classifiers to work differently against them.