PaperlayerView exact revision on arXiv

Source-linked AI summary

Weaponizing Ground Truth: Data Poisoning Attacks by Exploiting Boundary Misalignment Between Antivirus Software and Learning-Based Detectors

Jieshuai Yang, Zhi Wang, Yan Jia, Zhenhua Wu, Jianfei Tang, Chenbin Su, Jingwei Ye, Jianwen Tian, Wanpeng Li

arXiv:2609.31003v1cs.CR

TL;DR

AV-generated labels are widely used to train malware detectors, yet byte-level changes can alter AV verdicts while largely preserving downstream ML representations. Bi-Iocane exploits this mismatch with bidirectional poisoning, achieving 92.08% average attack success in a controlled 13-AV setting with a 0.06% per-target poisoning ratio.

  • Problem

    Malware detectors often use AV-generated labels as training ground truth, although small byte-level changes can flip AV verdicts while largely preserving downstream ML representations.

    Source: §I · p. 1

  • Method

    Bi-Iocane uses AV-sensitive byte rewriting in malware and malware-mimicking byte injection in benign software to flip upstream labels without requiring knowledge of the downstream detector.

    Source: §I · p. 2

  • Results

    92.08% average attack success with a 0.06% per-target poisoning ratio was reported in the controlled 13-AV setting across eight detectors.

    Source: §I · p. 2

  • Takeaways & Limitations

    VirusTotal validation confirms the practical feasibility of defamation poisoning and indicates potential evasion-oriented risk in AV-to-ML labeling pipelines.

    Source: §I · p. 2, §VII · p. 11

    The evaluation focuses on Windows AV-to-ML pipelines, and VirusTotal rewriting reduced malware detections but did not consistently achieve complete evasion.

    Source: B. Limitations and Future Work · p. 10

Abstract

from arXiv · show

Machine-learning (ML)-based malware detectors are commonly trained using labels obtained from antivirus (AV) engines and aggregation services (e.g., VirusTotal). This practice assumes AV-generated labels provide reliable supervision. However, small byte-level modifications can substantially alter AV verdicts while leaving the representations perceived by downstream ML detectors largely unchanged, producing label-feature inconsistencies that can contaminate training datasets and create poisoning opportunities for ML-based malware detection. We present Bi-Iocane, a black-box poisoning framework that exploits the reliance of malware-labeling pipelines on AV-generated labels. Bi-Iocane identifies AV-sensitive bytes and modifies them to induce label changes. It rewrites such bytes in malware to obtain benign labels (evasion-oriented poisoning) and injects malware-associated byte patterns into benign software to obtain malicious labels (defamation-oriented poisoning). These poisoned samples and their lightly modified variants corrupt training data and cause selected targets to be misclassified. We evaluate Bi-Iocane with 13 AV engines simulating AV aggregation services and eight ML detectors. For 30 malware and 30 benign clean targets, Bi-Iocane combines AV-specific manipulations to generate malware-to-benign and benign-to-malware poisoned samples whose all tested AV-based labels are flipped. After these poisoned samples and variants are used for downstream training, the resulting ML models misclassify 92.08% of the original clean targets on average with only a 0.06\% poisoning budget per target. Meanwhile, the poisoned models largely preserve clean-set performance, and six evaluated poisoning defenses show only limited mitigation. VirusTotal evaluation further confirms practical defamation risk and reveals potential evasion risk in real-world AV-to-ML labeling supply chains.

I. INTRODUCTION

Bi-Iocane exploits the mismatch between AV labeling and downstream ML representations to poison malware-detection training data without knowing the target detector. The paper reports high attack success in a controlled multi-AV setting and practical defamation risk in VirusTotal evaluation.

I. INTRODUCTION

  • AV-generated labels are widely used as training ground truth, but small byte changes can flip AV verdicts while largely preserving downstream ML representations.This mismatch creates an upstream labeling vulnerability for dataset builders and detector developers.Source: §I · p. 1
  • Earlier poisoning attacks target downstream representations, while AndroVenom shifts poisoning upstream but relies on a known Android feature blind spot and supports only defamation.Bi-Iocane instead assumes no detector-specific invisible region or feature representation.Source: §I · pp. 1–2
  • Bi-Iocane supports both attack directions: it rewrites AV-sensitive malware bytes for evasion and injects malware-mimicking bytes into benign software for defamation.The resulting samples and lightweight variants carry AV-assigned labels into training, associating nearly unchanged representations with flipped labels.Source: §I · p. 2
  • 92.08% average attack success with a 0.06% per-target poisoning ratio was achieved across eight detectors in the controlled 13-AV setting.Poisoned models had a maximum average F1 decrease of 0.15 percentage points and retained 82.14% average attack success under the strongest of six defenses.Source: §I · p. 2
  • VirusTotal evaluation found practical defamation risk, while rewriting AV-sensitive bytes substantially lowered malware detections and revealed potential evasion risk.The evaluation submitted 30 malware samples rewritten at AV-sensitive byte positions.Source: §I · p. 2
  • The attack exploits an upstream label-supply-chain surface to cause targeted misclassification without knowledge of the target model.The framework is evaluated with 13 AV engines and eight ML-based detectors.Source: §I · p. 2

II. PRELIMINARIES AND THREAT MODEL

AV engines rely substantially on discrete signatures and patterns, whereas ML detectors use aggregated feature representations; localized edits can therefore alter AV labels while leaving ML representations largely unchanged. The threat model places the attacker at the upstream labeling service, with no knowledge of the downstream pipeline.

A. Preliminaries

  • AV engines use signature and pattern matching, while ML malware detectors make decisions from aggregated representations of broader byte regions, program structures, or statistical properties.AV verdicts can serve as labels for downstream training.Source: A. Preliminaries · p. 2
  • Localized changes can disrupt or inject AV-sensitive patterns and flip AV labels while often leaving samples close to their originals in ML feature space.This boundary misalignment is the vulnerability the paper exploits to poison downstream training labels.Source: A. Preliminaries · p. 3
  • Malware-detection datasets use labels from single vendors and multi-AV services, and attacker-submitted samples may later enter training sets with aggregated AV labels.Examples include VirusTotal-derived labels used by EMBER and other detectors, and multi-vendor labels described for BODMAS and SOREL-20M.Source: A. Preliminaries · p. 3

B. Threat Model

  • The attacker may submit modified samples to an AV labeling service and observe its labels, but has no knowledge of the downstream detector or training pipeline.Dataset builders and detector developers collecting these samples and labels are the primary victims.Source: B. Threat Model · p. 3, Figure 1 · p. 3
  • The attacker seeks targeted misclassification of original malware as benign or benign software as malicious while preserving overall clean-set performance.The assumed capability is to perturb executables so AV verdicts flip while downstream ML representations are largely preserved.Source: B. Threat Model · p. 3

III. APPROACH

Bi-Iocane probes upstream antivirus engines for byte locations and sequences that can manipulate their verdicts, then uses them to create poisoned samples for downstream training. Its binary-search procedure locates boundary points by testing progressively smaller file regions and repeating after masking discovered points.

III. APPROACH

  • Bi-Iocane probes malware for boundary points (BPs) and reusable boundary bytes (BBs), then rewrites or injects them to create label-flipped samples for downstream training.The workflow uploads samples and variants to AV-based labeling services, where victims may collect them and their manipulated labels.Source: §III · p. 3, Figure 2 · p. 4

A. Boundary Probing from Upstream AV Engines

1) Boundary Point Probing:

  • Bi-Iocane uses iterative binary search to locate a critical byte, masks each discovered point, and repeats until the sample becomes benign or the maximum number of points is reached.The procedure merges adjacent points into boundary regions for later use.Source: 1) Boundary Point Probing · p. 4

2) Boundary Byte Probing:

Bi-Iocane extracts short, reusable byte sequences around discovered boundary points and tests them in benign samples for malicious AV verdicts. It then uses boundary-byte injection for defamation and boundary-point rewriting for evasion.

2) Boundary Byte Probing:

  • For each boundary point, Bi-Iocane extracts a centered byte sequence and accepts it as a boundary-byte trigger when its malicious-verdict rate on benign validation samples reaches threshold τ.It searches for the shortest qualifying sequence and applies a maximum length limit.Source: 2) Boundary Byte Probing · p. 4
  • A candidate boundary-byte sequence is evaluated by injection into a benign validation set, with section caves and noncode regions prioritized when possible to minimize disruption to functionality and code structure.The implementation uses a validation set of 10 samples and a default triggering-rate threshold of 0.5.Source: 2) Boundary Byte Probing · p. 4

B. Poisoned Sample Generation

3) Poisoned Sample Variant Generation:

Bi-Iocane creates lightweight variants of poisoned files and uploads them with flipped AV labels to labeling services. When downstream models train on these corrupted pairs, similar feature representations can acquire opposite labels and lead to misclassification of original targets.

3) Poisoned Sample Variant Generation:

  • Lightweight variants use one random modification operation per file, such as byte replacement, metadata changes, or structural edits, while maintaining valid PE headers and attributes.Strict functionality preservation is unnecessary because the samples are used for training rather than execution.Source: 3) Poisoned Sample Variant Generation · p. 5

4) Upload to AV-based Labeling Services:

  • Uploaded poisoned samples and variants receive flipped AV-assigned labels and may become available to authorized users for dataset construction and model training.The upload uses boundary knowledge from one or multiple AV engines.Source: 4) Upload to AV-based Labeling Services · p. 5

C. Poisoning Downstream ML-based Detectors

  • Poisoned samples remain close to their originals in downstream feature space, while their AV labels are flipped; Figure 3 shows substantial overlap between original and BP-rewritten malware.The passage describes limited feature changes for both statistical-feature and raw-byte detectors.Source: C. Poisoning Downstream ML-based… · p. 5, Figure 3 · p. 5
  • Training on repeated, near-original representations paired with flipped labels distorts the decision boundary around targets and can cause misclassification of the original unmodified samples.The resulting errors include malware classified as benign and benign software classified as malicious.Source: C. Poisoning Downstream ML-based… · p. 5

IV. EVALUATION

The evaluation examines AV-label reversal, targeted downstream misclassification, clean-set performance, and defense resistance. It uses a large PE dataset and both individual AV engines and a controlled multi-engine labeling setup, with VirusTotal validation noted as representative.

IV. EVALUATION

  • The evaluation asks whether Bi-Iocane flips AV labels with minimal perturbations, induces targeted misclassification at low poisoning ratios, preserves clean-set performance, and resists common defenses.The poisoning evaluation assumes attacker-submitted samples are collected by the victim’s data-acquisition pipeline.Source: §IV · pp. 5–6

1) Dataset:

  • The dataset contains 241,070 PE files, including 120,573 malware and 120,497 benign samples, split into training, validation, and testing sets at a 7:1:2 ratio.The clean test set remains unchanged for evaluating attack success and clean-set performance.Source: 1) Dataset · p. 6

2) Upstream AV-based Labeling Services:

  • Thirteen real-world AV engines provide single-engine label sources and a controlled multi-AV setting approximating aggregation services such as VirusTotal.The setup does not reproduce VirusTotal’s complete 70-plus-engine environment; representative VirusTotal validation is also conducted.Source: 2) Upstream AV-based Labeling Services · p. 6

3) ML-based detectors:

The evaluation spans eight detectors across six feature families, uses label reversal, attack success, poisoning ratio, and clean-set performance metrics, and retrains poisoned models under matched conditions.

3) ML-based detectors:

  • Eight detectors cover six feature families, from handcrafted and raw-byte features to structural, semantic, graph, and image-based representations.This breadth tests generalization across heterogeneous downstream feature spaces rather than one detector-specific weakness.Source: 3) ML-based detectors · p. 6

4) Evaluation Metrics:

  • Four metrics measure AV label reversal, target misclassification, poisoning share, and clean-test precision, recall, and F1.The metrics are Label Reversal Rate, Attack Success Rate, Poisoning Ratio, and Clean-set Performance.Source: 4) Evaluation Metrics · p. 6

5) Experimental Setup:

  • Poisoned models are retrained from scratch with the clean baseline’s architecture, hyperparameters, data split, and epoch limit, then tested on the unchanged clean test set.Clean baselines use recommended configurations, with early stopping based on validation performance.Source: 5) Experimental Setup · p. 6

1) Malware-to-Benign Label Reversal via BP Rewriting:

Bi-Iocane flips AV labels in both directions with small byte perturbations. VirusTotal testing shows defamation feasibility and reduced—but not fully reversed—malware detections.

1) Malware-to-Benign Label Reversal via BP Rewriting:

2) Benign-to-Malware Label Reversal via BB Injection:

3) Real-World Validation on a Multi-AV Aggregation Platform:

  • In 30 samples per class on VirusTotal, BB injection raised benign detections from 0 to 25.90 on average, while BP rewriting lowered malware detections from 52.40 to 29.43 without full reversal.The benign detection increase can cross common malicious-label thresholds; the malware detection decrease does not establish a benign label.Source: 3) Real-World Validation on a Multi-AV… · p. 7
  • A roughly 70-engine estimate suggests 0.063% BP rewriting may be feasible, but VirusTotal query restrictions limit complete evaluation.The estimate does not prove complete evasion on VirusTotal.Source: 3) Real-World Validation on a Multi-AV… · p. 7

C. RQ2: Targeted Poisoning Efficacy

RQ2 tests targeted evasion and defamation on representative and batch targets using single-AV and controlled 13-AV label sources. Bi-Iocane achieves high attack success across both settings, including at low per-target poisoning ratios.

C. RQ2: Targeted Poisoning Efficacy:

  • The batch experiment uses 30 malware and 30 benign targets, each initially correctly labeled and classified, with per-target poisoning ratios from 0.004% to 0.060%.The limited target set is intended to reflect targeted poisoning without excessively distorting the training distribution.Source: C. RQ2: Targeted Poisoning Efficacy · p. 7

1) Single-AV Label Source:

2) Multi-AV Label Source:

  • At a 0.060% per-target poisoning ratio, batch-target ASR reaches 92.08% overall, with 96.66% evasion and 87.50% defamation under 13-AV labels.Five detectors achieve at least 90% ASR in this setting.Source: Table III · p. 8, 2) Multi-AV Label Source · p. 8

1) Single-AV Label Source:

  • Under Microsoft Defender, batch-target ASR rises to 97.92%, including 98.36% evasion and 97.47% defamation, across the reported poisoning-ratio range.At 0.060% per target, six of eight detectors achieve at least 98% ASR.Source: Table III · p. 8, 1) Single-AV Label Source · p. 8

2) Multi-AV Label Source:

  • The controlled multi-AV source combines engine-specific byte manipulations and labels a sample benign only when all 13 engines agree.Aggregation makes manipulation more restrictive; the authors suggest larger combined defamation perturbations may weaken label–representation conflict.Source: 2) Multi-AV Label Source · p. 8

3) Practical Poisoning Implication Analysis:

Bi-Iocane’s targeted poisoning remains effective across target settings and label sources, while poisoned models retain clean-set detection performance close to baseline. The results also indicate practical risk for pipelines using multi-AV labels.

3) Practical Poisoning Implication Analysis:

  • Bi-Iocane’s repeated label–representation conflicts can shift decision boundaries around targets, and its effectiveness extends beyond isolated samples.The authors combine this finding with VirusTotal validation to identify practical defamation risk and potential evasion risk in multi-AV labeling pipelines.Source: 3) Practical Poisoning Implication… · p. 8
  • Bi-Iocane induces targeted evasion and defamation across heterogeneous ML-based detectors under single-AV and multi-AV labeling, with results demonstrating practical defamation risk to pipelines using multi-AV aggregated labels.The complete VirusTotal environment cannot be reproduced.Source: 3) Practical Poisoning Implication… · p. 8

D. RQ3: Model Performance Preservation

  • Poisoned models preserve clean-set performance: average F1 remains 97.28%–97.35% with Microsoft Defender labels and 97.31%–97.37% with 13-AV labels, versus a 97.43% clean baseline.The reported decreases from baseline range from 0.06 to 0.15 percentage points.Source: Table IV · p. 9, D. RQ3: Model Performance Preservation · p. 9

E. RQ4: Resistance to Poisoning Defenses

RQ4 evaluates six poisoning and backdoor defenses at the highest per-target poisoning ratio under Microsoft Defender and 13-AV labeling. The defenses reduce attack success in some cases but do not consistently eliminate targeted poisoning.

E. RQ4: Resistance to Poisoning Defenses

  • The evaluation reuses batch-target settings at the highest per-target poisoning ratio and applies six representative defenses, with filtering methods removing the top 5% suspicious samples per class.DPA instead uses an ensemble with five data partitions.Source: E. RQ4: Resistance to Poisoning Defenses · p. 9
  • After defenses, average ASR remains 82.14%–86.67% under 13-AV labels and 88.54%–93.13% under Microsoft Defender, compared with no-defense baselines of 92.08% and 97.92%, respectively.None of the evaluated defenses consistently eliminates the targeted poisoning effect.Source: E. RQ4: Resistance to Poisoning Defenses · pp. 9–10
  • Some defenses sharply reduce ASR for particular detectors, including SCAn to 66.67% for MalGraph and Loss-Based Filtering to 55.00% for IMCFN under 13-AV labels.Most detector-defense combinations nevertheless retain high ASR close to the no-defense baseline.Source: E. RQ4: Resistance to Poisoning Defenses · p. 10
  • The authors attribute limited mitigation to poisoned samples being valid PE files that remain close to normal samples in downstream feature spaces.Most tested defenses assume separable abnormal patterns such as outlier representations, abnormal loss, or consistent trigger signatures.Source: E. RQ4: Resistance to Poisoning Defenses · p. 10

V. RELATED WORK

The related-work discussion positions Bi-Iocane as an upstream, detector-agnostic alternative to poisoning attacks tied to downstream feature spaces. The paper also outlines data-curation mitigations and boundaries on the evidence, then concludes that AV-to-ML labeling pipelines remain vulnerable.

V. RELATED WORK

  • Unlike detector-targeted attacks, AndroVenom poisons at the upstream AV-labeling stage but depends on Android feature blind spots and supports only defamation, whereas Bi-Iocane is detector-agnostic and bidirectional.Most earlier attacks require knowledge or approximation of the target feature space.Source: §V · p. 10

A. Mitigations

  • Recommended curation steps include tracking provenance, limiting highly similar PE variants, and semantically verifying samples with low AV agreement or abrupt label changes.Multi-AV aggregation alone is not a sufficient defense.Source: A. Mitigations · p. 10

B. Limitations and Future Work

  • The evaluation covers Windows AV engines and PE detectors; VirusTotal rewriting reduced malware detections but did not consistently achieve complete evasion.The authors also assume attacker-submitted samples and their AV labels can enter downstream training sets.Source: B. Limitations and Future Work · p. 10

VII. CONCLUSIONS

  • The conclusion reports both evasion and defamation under single- and multi-AV sources, with limited clean-set impact and continued effectiveness against evaluated defenses.VirusTotal confirms practical defamation feasibility, while reduced malware detections indicate potential evasion risk requiring further study.Source: §VII · p. 11

Related papers

Loading 2609.31003v1…