PaperlayerView exact revision on arXiv

Source-linked AI summary

RAMP: Reversing Adversarial Perturbations to Strengthen Clean-Label Backdoor Attacks against Malware Detectors

Jinwen Xin, Dongni Zhang, Chenyang Wang, Jianming Fu, Ming Tang, Guojun Peng

arXiv:2609.27422v1cs.CR

TL;DR

Fine-tuning malware detectors on newly collected binaries creates a training-time backdoor attack surface. RAMP shifts benign samples toward the malware region before trigger injection and improves attack effectiveness over trigger-only baselines while maintaining clean-data accuracy.

  • Problem

    Updating malware detectors on newly collected binaries creates a training-time backdoor attack surface, including attacks that make trigger-embedded malware classify as benign.

    Source: §1 · pp. 1–2

  • Method

    RAMP uses a genetic algorithm to optimize reversed adversarial perturbations, shifting benign executables toward the malware region before injecting them through functionality-preserving binary manipulations.

    Source: §1 · pp. 2–3

  • Results

    RAMP consistently improves attack effectiveness over trigger-only baselines while maintaining high accuracy on clean data.

    Source: §1 · p. 3, §7 · p. 16

  • Takeaways & Limitations

    RAMP's benefit extends to state-of-the-art fixed-trigger and dynamic-trigger designs, complementing existing trigger strategies.

    Source: §1 · p. 3, §7 · p. 16

    The adversary has score-based black-box access, with no knowledge of the detector's architecture, parameters, or gradients, but can query it and observe maliciousness scores.

    Source: §3.2 · p. 6

Abstract

from arXiv · show

Deep learning-based malware detectors are commonly updated by fine-tuning on newly collected samples, but this practical update pipeline also creates an attack surface for training-time backdoor attacks. In realistic crowdsourced data collection, however, strict label vetting typically restricts attackers to the clean-label setting, in which poisoned samples must retain benign labels and functionality, making effective backdoor injection substantially harder. We present a new attack perspective based on feature-space manipulation: instead of relying solely on stronger trigger designs or selecting benign samples that are naturally similar to malware, we deliberately construct benign programs whose representations shift toward the malware region before trigger injection, thereby creating stronger feature-label conflicts during training. Based on this insight, we propose RAMP, an attack enhancement method that uses a genetic algorithm to optimize reversed adversarial perturbations under black-box access and then injects them through functionality-preserving binary manipulations. Extensive experiments show that RAMP substantially improves attack effectiveness over trigger-only baselines, with especially pronounced gains at low poisoning ratios, while maintaining accuracy on clean data. Moreover, RAMP can be combined with advanced trigger designs.

1 Introduction

Clean-label constraints make backdoor learning difficult because poisoned samples retain benign labels and features. RAMP shifts benign executables toward malware in feature space before trigger injection, improving attack success while maintaining clean-data accuracy.

1 Introduction

  • Strict label vetting typically restricts crowdsourced poisoning to clean-label attacks, where benign labels and features make triggers harder to learn.Stronger triggers can be difficult to realize in executables, while selecting naturally malware-similar benign samples requires feature-representation knowledge and sample availability.Source: §1 · p. 2
  • RAMP shifts benign executables toward the malware region before trigger injection, creating stronger feature-label conflict during fine-tuning.The same trigger can then act as a consistent shortcut for the benign label.Source: §1 · p. 2
  • A genetic algorithm optimizes byte-level reversed adversarial perturbations under black-box access, starting from random initialization.The perturbations are injected into benign binaries using padding and shift, while the trigger is embedded in the DOS header.Source: §1 · pp. 2–3
  • RAMP substantially improves attack success over trigger-only baselines, especially at low poisoning ratios, while maintaining clean-data accuracy.It also combines with advanced fixed-trigger and dynamic-trigger designs.Source: §1 · p. 3
  • The resulting poisoned binaries remain structurally valid and preserve benign-label consistency under external antivirus inspection.Representative defense approaches provide limited protection.Source: §1 · p. 3

2 Related Work

Deep learning on raw binaries reduces reliance on handcrafted features but depends on large-scale training data and periodic updates. Related backdoor work targets trigger design or sample selection, while functionality-preserving executable manipulations inform this paper’s setting.

2.1 Malware Detection

  • Deep-learning detectors learn from raw binary content, but reliance on large-scale training data and periodic updates creates additional attack surfaces.Earlier models include MalConv and grayscale-image approaches, followed by architectures using attention.Source: §2.1 · p. 4

2.2 Adversarial Manipulation of Malware Detectors

  • Clean-label backdoor attacks preserve poisoned samples’ original labels, making them more stealthy but substantially harder to execute effectively [24].Unlike label-poisoning attacks, they cannot directly enforce the target association by flipping labels.Source: Backdoor Attacks · p. 4
  • Prior backdoor work strengthens trigger patterns or selects malware-similar benign samples, whereas this work constructs more influential poisoned samples.Functionality-preserving PE manipulations from evasion research are closely related to the executable setting [3,29].Source: Backdoor Attacks · p. 4, Adversarial Evasion Attacks · p. 5

3 Preliminaries

PE files use headers and section metadata to map file contents into memory, leaving some file bytes outside runtime semantics. The threat model considers poisoning newly collected Windows PE samples during detector fine-tuning under clean-label and score-based black-box constraints.

3.1 PE File Format

  • PE headers and section-table metadata determine how executable sections are stored on disk and mapped into memory.Because the loader uses header metadata rather than copying the file sequentially, not all file bytes are semantically relevant to runtime behavior.Source: §3.1 · p. 5

3.2 Threat Model

  • The threat model assumes a pretrained raw-byte Windows PE detector is fine-tuned on newly collected samples.The adversary may inject a limited number of crafted samples and alter them through functionality-preserving manipulations, but cannot change labels or control updating.Source: §3.2 · p. 5
  • The attack aims to make trigger-embedded malware appear benign after updating while preserving clean-sample performance.The figure depicts functionality-preserving injection by shifting section offsets after inserting perturbation bytes.Source: §3.2 · p. 5, Figure 2 · p. 6
  • The adversary has score-based black-box access, without knowledge of the detector’s architecture, parameters, or gradients.They can query the detector before updating and observe maliciousness scores.Source: §3.2 · p. 6

4 Attack Definition

RAMP targets the fine-tuning pipeline by optimizing benign samples before trigger injection, then submitting them as clean-label poisons. The updated detector is intended to classify trigger-embedded malware as benign while retaining predictive performance on clean samples.

4 Attack Definition

  • The attack operates in a fine-tuning pipeline where a pretrained raw-byte malware detector is updated using a newly collected dataset.The defender minimizes empirical risk on that dataset.Source: §4 · p. 6
  • RAMP’s first step applies functionality-preserving adversarial optimization to a benign sample through black-box queries to the target detector.The perturbation is iteratively updated to reduce the detector’s confidence in the benign label, subject to disjoint perturbation and trigger positions.Source: §4 · pp. 6–7
  • The attacker injects a trigger into the optimized sample and submits the resulting benign-labeled poison for inclusion in the fine-tuning dataset.The poisoning objective encourages the updated model to associate the trigger with the benign label.Source: §4 · p. 7
  • At inference, the attacker applies the trigger to malware, which the backdoored model classifies as benign.The attack objective also seeks to preserve predictive performance on clean samples.Source: §4 · pp. 6–7

5 Detailed Attack Design

RAMP’s core component optimizes reversed perturbations under black-box access, then injects them into executable binaries without overlapping the trigger region. The design combines a genetic search with functionality-preserving PE manipulations.

5.1 Black-box Adversarial Optimization

  • The genetic algorithm searches for perturbations under black-box access, evaluates candidate fitness, and evolves the population through selection, crossover, and mutation before returning the best candidate.Random-byte initialization avoids malware-specific content that could undermine clean-label consistency or create shared non-trigger patterns across poisoned samples.Source: §5.1 · p. 8

5.2 Functionality-Preserving Injection

  • The perturbation and trigger occupy disjoint input regions, preventing the perturbation from overwriting the trigger and allowing different trigger designs to be combined with RAMP.The default trigger uses modifiable DOS-header bytes while preserving the MZ magic number and e_lfanew pointer.Source: §5.2 · pp. 8–10
  • RAMP injects optimized perturbation bytes through padding or shift operations designed to preserve executable functionality and PE structural consistency.Padding uses slack or non-mapped regions; shift creates a controllable region by shifting the first section and updating affected offsets.Source: §5.2 · p. 9

6 Evaluation

RAMP is evaluated as a clean-label backdoor attack enhancement across malware detectors, advanced triggers, sample validity, ablations, and defenses. It improves attack success while largely preserving clean-data accuracy, but the evaluated defenses provide limited protection.

6.1 Experiment Setup

  • The evaluation uses a balanced dataset of 40,000 Windows PE files, tests MalConv and MalConvGCG, and measures attack success rate and clean-data accuracy.The dataset comprises 20,000 malware and 20,000 benign samples, split 80%/20%; the default trigger is a 96-byte random sequence.Source: Dataset · p. 10, Target Models · p. 10, Evaluation Metrics · p. 10

6.2 Attack Effectiveness

6.3 Validation of Functionality and Label Consistency.

6.4 Ablation Study

  • On MalConv, random-byte initialization with optimization achieves the highest ASR across poison rates; random-byte injection alone shows no clear improvement, while malware-content initialization performs worst and reduces CDA.At least five AV engines flagged 97% of malware-content samples versus 1% of RandInit samples, despite similar average model scores.Source: Perturbation Content Source · p. 14, Figure 5 · p. 15

6.5 Mitigation

  • STRIP fails to detect RAMP, Fine-Pruning reduces ASR by about 7 percentage points, and ABL's ASR reductions accompany severe CDA losses.After Fine-Pruning, ASR remains 88.6% on MalConv and 14.9% on MalConvGCG; ABL leaves CDA at 55.95% or 50.00% in its reported settings.Source: Fine-Pruning · pp. 15–16, STRIP · p. 15

7 Conclusion

RAMP uses reversed adversarial perturbations to create malware-oriented benign executables for clean-label poisoning. Experiments report improved attack effectiveness while retaining clean-data accuracy and executable validity.

7 Conclusion

  • RAMP consistently improves attack effectiveness over trigger-only baselines while maintaining high clean-data accuracy.Its benefit extends to state-of-the-art fixed-trigger and dynamic-trigger designs; poisoned samples preserve executable validity and largely retain benign-label consistency under external AV inspection.Source: §7 · p. 16
  • The attack constructs malware-oriented benign executables through black-box adversarial optimization and functionality-preserving binary injection.The conclusion identifies feature-space manipulation of benign executables as an underexplored attack dimension.Source: §7 · p. 16

A More Experimental Details

The supplied experimental-details passages identify an aggregate-results table and a feature-distribution visualization.

A More Experimental Details

  • Table 3 aggregates attack results across five random seeds, reporting ASR as µ ± σ and CDA as an average across seeds.PR denotes poison rate, and Clean Acc. denotes clean model accuracy.Source: Table 3 · p. 17
  • Figure 6 visualizes feature distributions of trigger-only and RAMP poisoned samples in the pretrained MalConv model using t-SNE.Source: Figure 6 · p. 17

B More Defense Results

The supplied defense-results passages specify STRIP evaluation and the configurations used for Fine-Pruning and ABL against RAMP.

B More Defense Results

  • Figure 7 compares STRIP prediction-entropy distributions on clean and RAMP-poisoned inputs, using 200 test samples per group.Each sample receives 20 perturbed variants created by appending benign overlays; µ denotes mean entropy.Source: Figure 7 · p. 18
  • Fine-Pruning prunes 30% of low-activation convolutional channels, then fine-tunes on clean data for five epochs at a 5 × 10^-5 learning rate.Table 4 reports ASR drop in percentage points.Source: Table 4 · p. 18
  • ABL is evaluated against RAMP in the clean-label DOS setting with a random 96-byte trigger and a 1% poison rate.Table 5 specifies a 1% isolation ratio, γ = 0.5, and 20/10/5 epochs for isolation, fine-tuning, and unlearning, respectively.Source: Table 5 · p. 18

Related papers

Loading 2609.27422v1…