PaperlayerView exact revision on arXiv

Source-linked AI summary

Trigger Value Selection in Clean-Label Malware Backdoors: An Effectiveness-Detectability Analysis

Tri Budi Sabdo Utomo, Kazushi Okamoto, Koki Karube, Kei Harada, Atsushi Shibata

arXiv:2610.21269v1cs.CR

TL;DR

Clean-label malware backdoors can poison training data without changing sample labels, and the effects of trigger value selection have been less systematically analyzed. This paper compares value selectors and benign-sample strategies for feature-based malware classifiers, finding that value choices shape the effectiveness–detectability trade-off.

  • Problem

    Trigger value selection has been less systematically analyzed, although assigned values can affect attack success and detectability in clean-label malware backdoors.

    Source: §I · p. 1

  • Method

    The study compares trigger value-selection strategies on feature-based malware classifiers, evaluating attack and sanitizer outcomes under random and malware-similar benign sampling.

    Source: §I · pp. 1–2

  • Results

    On EMBER 2018 under distribution-based sampling, CorrCountAbsSHAP reduced poison recall from 99.71% to 1.13% versus CountAbsSHAP while retaining 79.33% ASR; aggressive selectors had high ASR and poison recall.

    Source: B. Detectability Profiles · p. 5, §VI · p. 6

  • Takeaways & Limitations

    Trigger value selection shapes the effectiveness–detectability profile, and distribution-based sampling generally improves ASR without removing value-selection effects.

    Source: §VI · p. 6

    The study evaluates feature-space triggers only with LightGBM classifiers and two PE malware datasets, without realizing triggers in executable binaries.

    Source: §VI · p. 6

Abstract

from arXiv · show

Clean-label backdoor poisoning is a threat to machine learning-based malware classifiers because poisoned samples can be inserted into training data without changing their labels. Previous explanation-guided attacks mainly focus on selecting important trigger features, but the values assigned to these features can also affect the attack behavior. In this paper, we study trigger value selection as an independent design factor in clean-label backdoor attacks against feature-based malware classifiers. We evaluate several value-selection strategies on EMBER 2018 and a Win64 PE subset of EMBER 2024 using LightGBM classifiers. We compare rare-value, SHAP-based, frequency-bounded, co-occurrence-aware, and quantile-based selectors under random and distribution-based malware-similar benign sampling. The results show that aggressive selectors such as MinPopulation and CountAbsSHAP can achieve high attack success rate, especially under distribution-based sampling, but they are also easier to detect by sanitization methods such as Isolation Forest. In contrast, selectors such as CorrCountAbsSHAP and Quantile95 can reduce poison recall while keeping useful attack effectiveness. These findings show that trigger value selection is not merely an implementation detail, but an important design choice that shapes the effectiveness and detectability profile of clean-label malware backdoor attacks.

I. INTRODUCTION

Clean-label backdoors can be planted in benign-labeled training samples and evade notice when clean-sample performance remains normal. This work isolates trigger value selection to examine its effects on attack effectiveness and detectability, including under malware-similar benign sampling.

  • Attackers can embed triggers in benign-labeled training samples, potentially making triggered malware appear benign while clean-sample performance remains normal.This creates an attack surface in retraining pipelines that use external or crowdsourced threat feeds.Source: §I · p. 1
  • Once trigger features are fixed, assigned values can affect both attack success and detectability: rare values may strengthen learning but create distinctive patterns, while benign-like or co-occurring values may blend in but weaken the backdoor.Source: §I · p. 1
  • The study compares rare-value, SHAP-based, frequency-bounded, co-occurrence-aware, prototype-based, and quantile-based selectors as an independent design factor.Source: §I · pp. 1–2
  • The evaluation measures clean accuracy, attack success, and sanitizer-based detectability across random and malware-similar benign sampling.The introduction identifies malware-similar sampling as distribution-based distance sampling following PMSB.Source: §I · p. 2

II. BACKGROUND AND RELATED WORK

The section identifies clean-label backdoor attacks, sampling strategies, and defenses as background relevant to analyzing trigger value selection.

  • The background review covers clean-label backdoor poisoning, sampling strategies, and defenses relevant to the trigger value-selection analysis.Source: §II · p. 2

A. Clean-Label Backdoor Poisoning Attacks

Prior work uses explanation-guided triggers in clean-label malware backdoors, while poisoning-target selection is another factor that can affect attack effectiveness.

A. Clean-Label Backdoor Poisoning Attacks

  • Severi et al. use SHAP scores to select influential trigger features and strategies including MinPopulation, CountAbsSHAP, and CombinedSHAP to assign values, while poisoned samples retain benign labels.Source: A. Clean-Label Backdoor Poisoning… · p. 2

B. Sampling Strategies in Clean-Label Malware Poisoning

  • Selecting malware-similar benign samples as poisoning targets can improve attack effectiveness, and PMSB evaluates whether value-selection effects persist across target-selection strategies.The described similarity measures include feature-based, distribution-based, and contribution-space distance.Source: B. Sampling Strategies in Clean-Label… · p. 2

C. Defenses and Detectability

The paper uses representative sanitization defenses to assess how trigger value choices affect poisoned-sample detectability, within a pipeline that selects features and values before poisoning and retraining.

C. Defenses and Detectability

  • Representative sanitization defenses assess how value-selection strategies affect poisoned-sample detectability, against a background of defenses based on anomalies, shared feature-space directions, prediction disagreement, and clustering.Source: C. Defenses and Detectability · p. 2

A. Attack Pipeline

  • A trigger is a set of selected feature-value assignments that overwrite the corresponding values in an input sample to produce a triggered sample.Source: A. Attack Pipeline · p. 2
  • The pipeline trains a clean baseline, uses SHAP to select feasible trigger features, chooses their values, injects the trigger into benign samples without changing labels, and retrains the classifier.Source: A. Attack Pipeline · pp. 2–3

B. Trigger Value Selection Strategies

The section treats trigger values as a separate design choice once trigger features are fixed, grouping selectors by the signals used to choose values. It compares frequency and distribution, SHAP contribution, and co-occurrence or prototype support.

B. Trigger Value Selection Strategies

  • With trigger features fixed, value selectors choose the assigned values and test whether different signals change the effectiveness–detectability relationship.The evaluated signals include frequency or distribution, SHAP contribution, and co-occurrence or prototype support.Source: B. Trigger Value Selection Strategies · p. 3

1) Frequency- and Quantile-based Selectors:

  • Rare-value, frequency-bounded, and quantile-based selectors test how rarity or empirical position in benign data affects trigger profiles.Quantile95 is reported in the main tables because it gave the strongest and most consistent results among Quantile05, Quantile50, and Quantile95.Source: 1) Frequency- and Quantile-based… · p. 3

2) SHAP-based Selectors:

  • Magnitude-based SHAP selectors choose values with low absolute class-specific contributions, while negative malware-class SHAP values push decisions toward benign.The magnitude-based approach follows the intuition of CountAbsSHAP.Source: 2) SHAP-based Selectors · p. 3
  • Signed SHAP selectors choose values expected to push predictions toward benign and test whether this direction improves trigger strength or detectability over magnitude-only criteria.Source: 2) SHAP-based Selectors · p. 3

3) Co-occurrence- and Prototype-based Selectors:

Co-occurrence-aware selection seeks feature-value combinations that occur naturally together in benign samples, while the experimental setup varies value selection with other attack components held fixed. The evaluation uses two Win64 PE datasets, compares sampling strategies, and measures attack effectiveness and sanitizer detectability.

3) Co-occurrence- and Prototype-based Selectors:

  • Co-occurrence-aware selection preserves relationships among chosen values to align triggers with naturally occurring benign patterns.This follows CombinedSHAP’s intuition of greedily selecting feature-value pairs consistent with benign samples.Source: 3) Co-occurrence- and Prototype-based… · p. 3

IV. EXPERIMENTAL SETUP

  • The experiments use LightGBM and hold classifier family, trigger-feature selection, and poisoning protocol fixed while varying only the value selector.This design isolates the effect of value selection on attack effectiveness and sanitizer-based detectability.Source: §IV · p. 3
  • EMBER 2018 and EMBER 2024 Win64 use balanced labeled training subsets of 120,000 and 208,000 rows, respectively, with complete labeled test splits of 200,000 and 240,000 rows.The representations contain 2,381 and 2,568 features, respectively; unlabeled EMBER 2018 rows are unused.Source: §IV · p. 3
  • The study targets Win64 PE classifiers, uses 17 and 19 feasible trigger features, compares random with PMSB-style distribution-based benign sampling, and reports its main comparison at 1% poisoning.Triggers are evaluated in feature space and are not validated by modifying executable PE binaries.Source: §IV · p. 3
  • Attack effectiveness is measured by clean accuracy and ASR, while sanitizer detectability is measured primarily by poison recall.Higher poison recall benefits defenders by removing more poisoned samples but can prevent the backdoor from being learned during retraining.Source: §IV · p. 4
  • Isolation Forest, HDBSCAN, and Spectral Signature are evaluated, but the main tables report Isolation Forest as a representative sanitizer baseline.HDBSCAN and Spectral Signature check whether qualitative trends are consistent across sanitizers.Source: §IV · p. 4

A. Effect of Value Selection on ASR

Under distribution-based sampling, MinPopulation and CountAbsSHAP reach very high ASR on both datasets. Extended selectors also produce high ASR, with results varying by selector and dataset.

A. Effect of Value Selection on ASR

  • The reported 1% poison-rate results are means and standard deviations across three runs, with ASR and poison recall used to compare value selectors.Source: A. Effect of Value Selection on ASR · p. 4
  • 97.94% and 98.87% ASR on EMBER 2018, and 99.14% and 99.04% on EMBER 2024 Win64, are achieved by MinPopulation and CountAbsSHAP, respectively, under distribution-based sampling.These results are reported at a 1% poison rate; Table II presents EMBER 2018 results using Isolation Forest.Source: A. Effect of Value Selection on ASR · p. 4, Table II · p. 4
  • 79.33% and 98.85% ASR are achieved by CorrCountAbsSHAP on EMBER 2018 and EMBER 2024 Win64, while Quantile95 achieves 93.74% and 92.73%, respectively, under distribution-based sampling.CombinedSHAP and BenignPrototype generally achieve lower ASR, particularly under random sampling.Source: A. Effect of Value Selection on ASR · p. 4

B. Detectability Profiles

The effectiveness–detectability comparison shows that selector choice changes how much attack success is retained as sanitizers identify poisoned samples. CorrCountAbsSHAP and Quantile95 offer lower poison recall than the most aggressive selectors while preserving useful ASR.

B. Detectability Profiles

  • Figure 2 plots ASR/evasion against poison recall at a 1% poison rate; its upper-left region denotes effective attacks that are harder to detect.Each point is the mean across three repeated runs for EMBER 2018 or EMBER 2024 Win64.Source: B. Detectability Profiles · p. 4, Figure 2 · p. 5
  • CombinedSHAP and BenignPrototype can lower poison recall at substantial ASR cost, while FreqBoundedSigned has an intermediate profile and LowSignedSHAP combines high ASR with very high poison recall.Source: B. Detectability Profiles · p. 5
  • Under distribution-based sampling, CorrCountAbsSHAP reduces poison recall from 99.71% to 1.13% on EMBER 2018 and from 100.00% to 10.34% on EMBER 2024 Win64 versus CountAbsSHAP, while retaining 79.33% and 98.85% ASR, respectively.Source: B. Detectability Profiles · p. 5
  • Quantile95 achieves 93.74% ASR with 6.33% poison recall on EMBER 2018 and 92.73% ASR with 29.09% poison recall on EMBER 2024 Win64.MinPopulation and CountAbsSHAP achieve approximately 98–99% ASR but approximately 99–100% poison recall.Source: B. Detectability Profiles · p. 5
  • HDBSCAN and Spectral Signature generally reproduce the pattern of greater exposure for MinPopulation, CountAbsSHAP, and LowSignedSHAP, and lower poison recall with useful ASR for CorrCountAbsSHAP and Quantile95.Across datasets, HDBSCAN poison recall is 64.13–76.75% for MinPopulation and CountAbsSHAP versus 26.50–43.70% for CorrCountAbsSHAP and Quantile95; Spectral Signature shows 58.71–97.67% versus 0.79–9.81%, respectively.Source: B. Detectability Profiles · p. 5

C. Effect of Sampling Strategy

Distribution-based distance sampling improves attack success, especially on EMBER 2024 Win64, but value selection still shapes the effectiveness–detectability profile. Malware-similar benign samples are closer to the decision boundary, while sample and value selection govern distinct parts of the attack.

C. Effect of Sampling Strategy

  • Distribution-based distance sampling consistently improves ASR over random sampling, especially on EMBER 2024 Win64.The improvement is consistent with poisoning malware-similar benign samples that are closer to the decision boundary.Source: C. Effect of Sampling Strategy · p. 5
  • Malware-similar benign samples closer to the decision boundary make it easier for the model to associate the trigger with the benign class.Source: C. Effect of Sampling Strategy · p. 5
  • Even with distribution-based sampling, selectors differ in ASR and poison recall because sample selection and value selection control distinct parts of the attack.Sampling determines which benign samples are poisoned; value selection determines the trigger pattern learned from them.Source: C. Effect of Sampling Strategy · p. 6

VI. CONCLUSION

Across the evaluated malware datasets, trigger values affect both attack success and sanitizer-based detectability, and distribution-based sampling generally improves ASR without eliminating value-selection differences. The study identifies feature-space evaluation on LightGBM classifiers and two PE datasets as a scope limitation.

VI. CONCLUSION

  • Across EMBER 2018 and EMBER 2024 Win64, MinPopulation and CountAbsSHAP achieved high ASR, particularly under distribution-based distance sampling.CorrCountAbsSHAP and Quantile95 also maintained useful attack effectiveness with fixed trigger features.Source: §VI · p. 6
  • MinPopulation and CountAbsSHAP achieved high ASR but were detected at high rates by Isolation Forest, while CorrCountAbsSHAP and Quantile95 reduced poison recall while preserving useful attack effectiveness.The results indicate that the strongest trigger is not necessarily the most practical when sanitization can remove poisoned samples.Source: §VI · p. 6
  • Distribution-based distance sampling generally improved ASR, especially on EMBER 2024 Win64, but did not remove the effect of value selection.Sample selection determines which benign samples are poisoned; value selection determines the trigger pattern learned by the classifier.Source: §VI · p. 6
  • The study evaluates feature-space trigger values, without realizing triggers in executable PE binaries, and tests only LightGBM classifiers and two PE malware datasets.Source: §VI · p. 6

Related papers

Loading 2610.21269v1…