Gray-Box Poisoning of Continuous Malware Ingestion Pipelines

• URL: http://arxiv.org/abs/2605.04698v1
• Date: Wed, 06 May 2026 09:49:23 GMT
• Title: Gray-Box Poisoning of Continuous Malware Ingestion Pipelines
• Abstract summary: This work investigates a realistic gray-box poisoning threat model targeting modern malware detection pipelines.<n>We generate problem-space adversarial binaries through functionality-preserving manipulations.<n>We evaluate the impact of these poisoned samples when ingested into a defender's training set for a LightGBM malware detection model.
• Score: 0.0
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Modern malware detection pipelines rely on continuous data ingestion and machine learning to counter the high volume of novel threats. This work investigates a realistic gray-box poisoning threat model targeting these pipelines. Using the secml_malware framework, we generate problem-space adversarial binaries through functionality-preserving manipulations, specifically Import Address Table (IAT) and section injections. We evaluate the impact of these poisoned samples when ingested into a defender's training set for a LightGBM malware detection model. Our empirical results demonstrate that subtle IAT-based perturbations enable compact poisoning samples that significantly degrade detection recall. These findings illustrate the inherent challenge of developing low-visibility adversarial perturbations that maintain high poisoning efficacy within continuous learning systems. We further evaluate a defense mechanism based on a homogeneous ensemble, which successfully identifies and filters up to 95.6% of poisoning attempts while maintaining a high retention rate for legitimate data. These findings emphasize the necessity of robust pre-ingestion validation in production pipelines.

Related papers

• Robustness of Anomaly Detection Models for Industrial Control Systems under Training-Time Data Contamination [3.7391021139771325]
  This paper evaluates the robustness of offline ICS anomaly-detection pipelines on the Secure Water Treatment benchmark under training-time contamination.<n>We assess 11 heterogeneous anomaly detectors under three contamination strategies: random injection, similarity-targeted injection, and feature-noise injection.<n>The results show that robustness is strongly model-dependent and cannot be predicted from clean-data performance alone.
  arXiv  Detail & Related papers  (2026-08-24T17:49:36Z)
• Detect, Unlearn, Restore: Defending Text Summarization Models Against Data Poisoning [2.9148458734058913]
  Training-time data poisoning poses a significant threat to large language models deployed for abstractive text summarization.<n>We present a unified post-hoc defense framework for detecting and remediating fine-tuning-stage poisoning in summarization models.<n>Our results indicate that fine-tuning-time poisoning leaves persistent structural artifacts, enabling practical detection and post-deployment recovery without full retraining.
  arXiv  Detail & Related papers  (2026-06-24T17:12:42Z)
• PoiCGAN: A Targeted Poisoning Based on Feature-Label Joint Perturbation in Federated Learning [9.902374988830413]
  Federated Learning (FL) is applied in industrial image classification.<n>A major limitation of existing poisoning attack methods is their difficulty in bypassing model performance tests.<n>We propose a targeted poisoning attack, PoiCGAN, based on feature-label collaborative perturbation.<n>Our method achieves an attack success rate 83.97% higher than baseline methods, with a less than 8.87% reduction in the main task's accuracy.
  arXiv  Detail & Related papers  (2026-03-24T13:08:53Z)
• Detecting Stealthy Data Poisoning Attacks in AI Code Generators [1.1371178703578924]
  We present a systematic study on the effectiveness of existing poisoning detection methods under a stealthy threat model.<n>We perform targeted poisoning on three DL models (CodeBERT, CodeT5+, AST-T5), and evaluate spectral signatures analysis, activation clustering, and static analysis as defenses.<n>Our results show that all methods struggle to detect triggerless poisoning, with representation-based approaches failing to isolate poisoned samples and static analysis suffering false positives and false negatives.
  arXiv  Detail & Related papers  (2025-08-29T14:00:06Z)
• PoisonCatcher: Revealing and Identifying LDP Poisoning Attacks in IIoT [13.68394346583211]
  Local Differential Privacy (LDP) is widely adopted in the Industrial Internet of Things (IIoT) due to its lightweight, decentralized, and scalable.<n>This work proposes a LDP poisoning defense for IIoT in the resource-rich aggregator.
  arXiv  Detail & Related papers  (2024-12-20T09:26:50Z)
• Unlearnable Examples Detection via Iterative Filtering [84.59070204221366]
  Deep neural networks are proven to be vulnerable to data poisoning attacks. It is quite beneficial and challenging to detect poisoned samples from a mixed dataset. We propose an Iterative Filtering approach for UEs identification.
  arXiv  Detail & Related papers  (2024-08-15T13:26:13Z)
• Towards Understanding the Robustness of Diffusion-Based Purification: A Stochastic Perspective [65.10019978876863]
  Diffusion-Based Purification (DBP) has emerged as an effective defense mechanism against adversarial attacks.<n>In this paper, we propose that the intrinsicity in the DBP process is the primary factor driving robustness.
  arXiv  Detail & Related papers  (2024-04-22T16:10:38Z)
• On Practical Aspects of Aggregation Defenses against Data Poisoning Attacks [58.718697580177356]
  Attacks on deep learning models with malicious training samples are known as data poisoning. Recent advances in defense strategies against data poisoning have highlighted the effectiveness of aggregation schemes in achieving certified poisoning robustness. Here we focus on Deep Partition Aggregation, a representative aggregation defense, and assess its practical aspects, including efficiency, performance, and robustness.
  arXiv  Detail & Related papers  (2023-06-28T17:59:35Z)
• Exploring Model Dynamics for Accumulative Poisoning Discovery [62.08553134316483]
  We propose a novel information measure, namely, Memorization Discrepancy, to explore the defense via the model-level information. By implicitly transferring the changes in the data manipulation to that in the model outputs, Memorization Discrepancy can discover the imperceptible poison samples. We thoroughly explore its properties and propose Discrepancy-aware Sample Correction (DSC) to defend against accumulative poisoning attacks.
  arXiv  Detail & Related papers  (2023-06-06T14:45:24Z)
• Exploring the Limits of Model-Targeted Indiscriminate Data Poisoning Attacks [31.339252233416477]
  We introduce the notion of model poisoning reachability as a technical tool to explore the intrinsic limits of data poisoning attacks towards target parameters. We derive an easily computable threshold to establish and quantify a surprising phase transition phenomenon among popular ML models. Our work highlights the critical role played by the poisoning ratio, and sheds new insights on existing empirical results, attacks and mitigation strategies in data poisoning.
  arXiv  Detail & Related papers  (2023-03-07T01:55:26Z)
• Temporal Robustness against Data Poisoning [69.01705108817785]
  Data poisoning considers cases when an adversary manipulates the behavior of machine learning algorithms through malicious training data. We propose a temporal threat model of data poisoning with two novel metrics, earliness and duration, which respectively measure how long an attack started in advance and how long an attack lasted.
  arXiv  Detail & Related papers  (2023-02-07T18:59:19Z)
• Accumulative Poisoning Attacks on Real-time Data [56.96241557830253]
  We show that a well-designed but straightforward attacking strategy can dramatically amplify the poisoning effects. Our work validates that a well-designed but straightforward attacking strategy can dramatically amplify the poisoning effects.
  arXiv  Detail & Related papers  (2021-06-18T08:29:53Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.