Research map / Adversarial robustness and security / Certified and empirical robustness
DRSM: De-Randomized Smoothing on Malware Classifier Providing Certified Robustness
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes DRSM, a certified defense for raw-byte malware detectors that adapts de-randomized smoothing via window ablation over MalConv, and releases the PACE benign executable dataset.
Problem
Evasion attacks on raw-byte static malware detectors (e.g., MalConv) lack certified robustness, and existing defenses (non-negative weights, adversarial training) cost accuracy or only cover specific attacks.
Approach
Redesign de-randomized smoothing for executables by splitting the byte sequence into non-overlapping windows, training/applying a MalConv base classifier per ablated window, and taking a majority vote so a contiguous perturbation can only flip a bounded number of votes.
Key results
- DRSM-4 achieves 98.18% test standard accuracy versus 98.61% for MalConv and 88.36% for MalConv (NonNeg).
- DRSM-24 reaches 53.97% certified accuracy at perturbation budget Δ=2 on the test set.
- Under white-box FGSM Append, ASR drops from 82.50% on MalConv to 10.00% on DRSM-4 and 1.00% on DRSM-12 and above.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| add window ablation with majority voting (DRSM-4) | MalConv · PACE test set | standard accuracy: 98.61 -> 98.18 | Hurt |
| constrain last-layer weights to be non-negative | MalConv · PACE test set | standard accuracy: 98.61 -> 88.36 | Hurt |
| increase ablated-sequence count from 4 to 24 (ablation) | DRSM · PACE test set | standard accuracy: 98.18 -> 90.24 | Hurt |
| increase ablated-sequence count from 4 to 24 (ablation) | DRSM · PACE test set, Δ=2 | certified accuracy: 12.2 -> 53.97 | Helped |
| add window ablation with 8 ablated sequences | MalConv · White-box FGSM Append | attack success rate: 82.50 -> 7.00 | Helped |
| increase ablated-sequence count from 4 to 8 (ablation) | DRSM · White-box FGSM Append | attack success rate: 10.00 -> 7.00 | Helped |
| add window ablation with 16 ablated sequences | MalConv · White-box DOS Extension | attack success rate: 98.00 -> 2.00 | Helped |
| add window ablation with 16 ablated sequences | MalConv · White-box Disp | attack success rate: 89.50 -> 5.50 | Helped |
| add window ablation with 8 ablated sequences | MalConv · Black-box GAMMA | attack success rate: 24.00 -> 1.50 | Helped |
| increase ablated-sequence count from 4 to 8 (ablation) | DRSM · White-box Header Field Modification | attack success rate: 10.00 -> 17.00 | Hurt |
Surprising findings
- MalConv (NonNeg) was more vulnerable than MalConv to query-based black-box attacks such as GAMMA (45.50% vs 24.00% ASR).
- A MalConv model trained on Ember+VTFeed misclassified 12.22% of benign files from the newer PACE dataset, indicating benign-distribution drift.
Limitations
- Standard accuracy drops for larger numbers of windows (DRSM-24 at 90.24%).
- Smoothed classifier is non-differentiable, so attacks must target base classifiers.
- PACE malware samples are only available upon request; VTFeed is not publicly accessible.
Experimental setup
Datasets: Ember VTFeed PACE
Benchmarks: PACE test set VTFeed
Metrics: standard accuracy certified accuracy attack success rate
Baselines: MalConv MalConv (NonNeg)
Builds on: MalConv de-randomized smoothing randomized smoothing
Closest papers by meaning
- Certifying Language Model Robustness with Fuzzed Randomized Smoothing: An Efficient Defense Against Backdoor Attacks (ICLR 2025 · similarity 0.84)
- Provable Robustness against Backdoor Attacks via the Primal-Dual Perspective on Differential Privacy (NeurIPS 2026 · similarity 0.82)
- Demystifying Poisoning Backdoor Attacks from a Statistical Perspective (ICLR 2024 · similarity 0.82)
- Closing the Gap: Achieving Better Accuracy-Robustness Tradeoffs against Query-Based Attacks (AAAI 2024 · similarity 0.82)
- HoneypotNet: Backdoor Attacks Against Model Extraction (AAAI 2025 · similarity 0.82)
- Effects of Exponential Gaussian Distribution on (Double Sampling) Randomized Smoothing (ICML 2024 · similarity 0.82)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.