🤖 machine learning

Gray-Box Poisoning of Continuous Malware Ingestion Pipelines

This contribution investigates gray-box poisoning attacks on continuous malware ingestion pipelines via functionality-preserving binary manipulations to degrade detection recall rates and simultaneously demonstrates that a homogeneous ensemble defense can effectively filter up to 95.6% of such adversarial samples.

Original authors: Jan Dolejš, Martin Jureček, Róbert Lórencz

Published 2026-05-07

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Jan Dolejš, Martin Jureček, Róbert Lórencz

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine a massive, automated factory that sorts millions of packages daily. Its task is to detect and flag dangerous "bad packages" (malware) while allowing "good packages" (safe files) to pass through. To keep pace with the sheer volume of new threats, this factory does not employ human inspectors but rather a superintelligent robot (a machine learning model) that learns by studying examples of good and bad packages.

This article examines a insidious method to break this robot by deceiving it during its learning process.

The Scenario: The "Gray-Box" Trick

The researchers envisioned a scenario in which a malicious actor (the attacker) aims to sabotage the factory's robot. They do not possess the robot's secret blueprints (which would constitute a "White-Box" attack), but they have a very good understanding of how the robot thinks because they own a similar robot. This is referred to as a "Gray-Box" attack.

The attacker's goal is not merely to sneak a single bad package past the robot; they want to poison the robot's brain so that it forgets how to recognize bad packages in the future.

The Attack: "Cosmetic Surgery" on Bad Files

To deceive the robot, the attacker cannot simply change the name of the bad file or delete the virus; that would impair its functionality. Instead, they perform "cosmetic surgery" on the file.

Imagine a malicious file as a suspicious-looking person in disguise. The attacker makes tiny, invisible changes to the disguise so that the robot's sensors do not trigger an alarm, while the person remains dangerous inside.

The Tools: They used a special toolkit named secml_malware.
The Techniques:
1. IAT Injections: Imagine sticking a few harmless-looking stickers onto a suspicious envelope. The envelope still contains a bomb, but the stickers make it appear as though it belongs to a specific, trusted group.
2. Section Injections: Imagine gluing a few extra pages of a boring, harmless-looking story into a dangerous book. The book still contains the dangerous instructions, but the additional pages confuse the scanner.

The researchers found that adding just a few of these "stickers" (specifically 2 Import Address Table injections) was sufficient to make the bad files appear 30% more like good files to the robot.

The Result: The Robot Becomes Confused

When the factory robot was retrained with these "poisoned" examples (bad files labeled as good), it began to become confused.

The Damage: The robot's ability to catch bad files decreased significantly. It began to let dangerous packages slip through the cracks.
The Catch: The more drastic the changes were (adding many stickers or pages), the easier it was for the robot to recognize the file as "suspicious" even before training. The attacker had to find a "sweet spot": change enough to deceive the robot, but not so much that the file looks obviously strange.

The Defense: The "Second Opinion" Team

The researchers did not just highlight the problem; they tested a solution. They set up a homogeneous ensemble that functions like a team of three different security guards at the factory gate.

Guard 1 checks the weight and shape of the file (distribution).
Guard 2 reads the text inside (content).
Guard 3 examines the structure and binding (structure).

For a file to be allowed into the training room, all three guards must agree that it looks safe.

The Result:

The "poisoned" files attempting to sneak in were intercepted by this guard team in 95.6% of cases.
Crucially, this team did not accidentally filter out good packages; it allowed 84.5% of legitimate files to pass through without issue.

The Conclusion

The article concludes that while malicious actors can successfully "poison" an automated learning system by making tiny, clever changes to malicious files, this is a balancing act. If they change the files too much to hide, they get caught by pre-checks. If they change them too little, the robot learns the wrong lessons.

The best defense is a "team of experts" (the ensemble) that checks the files before allowing the main robot to learn from them. This ensures that the factory's learning process remains clean and reliable.

Technical Summary: Gray-Box Poisoning of Continuous Malware Ingestion Pipelines

Problem Statement

Modern malware detection systems increasingly rely on Machine Learning Operations (MLOps) pipelines that automate the continuous ingestion, feature extraction, and retraining of models to address the high volume of new threats (estimated at approximately 560,000 daily samples). While evasion attacks target models at inference time, this work investigates a more subtle threat: data poisoning within the ingestion pipeline.

In a poisoning scenario, an attacker injects malicious samples into the training data supply chain, effectively "corrupting" the dataset to induce faulty model behavior in future versions. Unlike attack vectors in the feature space that manipulate abstract vectors (which often lack valid executable counterparts due to the inverse feature mapping problem), this work focuses on poisoning in the problem space. The challenge lies in generating adversarial PE (Portable Executable) binaries that preserve malicious functionality while subtly manipulating features to bypass initial inspection and degrade the detection model's performance.

Methodology

Threat Model

The authors formalize a Gray-Box Threat Model, where:

The Defender manages a private training dataset ( $D_T$ ), an ingestion source ( $D_I$ ), and a detection model ( $M_D$ ).
The Attacker has access to public data ( $D_{pub}$ ) and a proxy model ( $M_A$ ) that approximates the Defender's feature extraction mapping ( $\phi$ ).
The attacker generates poisoned samples ( $D_P$ ) to bypass the proxy model and injects them into the ingestion pipeline, aiming to misinterpret malicious samples as benign.

Dataset Construction

The study utilizes a hybrid dataset composed of the following components:

Raw PE Binaries: Sourced from VirusShare, MalShare, and TheZoo, combined with benign OS files.
EMBER2024: A large-scale, feature-based dataset.
The authors deduplicated the data using Trend Micro Locality Sensitive Hash (TLSH) and extracted EMBER-v3 features, neutralizing artifacts such as timestamps. The data was partitioned into four subsets: Defender Training (40%), Input Feed (20%), Oracle (20%), and Holdout (20%).

Adversarial Generation

Using the secml_malware framework, the authors generated adversarial binaries in the problem space employing two primary manipulation strategies:

Import Address Table (IAT) Injections: Inserting entries from benign binaries into the IAT of malicious samples.
Section Injections: Inserting benign code sections into the PE structure.

These manipulations were executed via a heuristic approach (GAMMA strategy) using genetic algorithms, as gradient-based white-box attacks achieved negligible evasion rates due to discontinuities in the feature space.

Defense Mechanism

The proposed defense is a homogeneous ensemble acting as a filter prior to ingestion (Oracle). This middleware consists of three LightGBM models trained on:

Byte distribution.
Content (strings/libraries).
Structural features.
A sample is ingested only if all three models reach a consensus.

Key Results

Attack Effectiveness

The study demonstrates that subtle, functionality-preserving perturbations can significantly degrade model performance when mislabeled as benign:

Evasion Rates: High-intensity attacks (8 IAT and 8 section injections) achieved an evasion rate of 50.8% against the attacker's proxy model.
Poisoning Impact: Upon ingestion into the training dataset with incorrect labels (malicious labeled as benign), subtle manipulations (2 IAT injections) resulted in the most significant degradation of detection recall (a drop from approximately 0.947 to 0.860), suggesting that minimal perturbations lie closer to the decision boundary.
Trade-off: While high-intensity attacks are effective for evasion, they significantly increase file size and are more easily detected by structural oracles.

Defense Performance

The homogeneous ensemble filter proved highly effective:

Filter Efficiency: The combined ensemble successfully filtered 95.6% of high-intensity poisoning attempts (8 IAT/8 section).
Retention: The defense maintained a retention rate of 84.5% for legitimate (clean) data.
Detection Specificity: The structural model was the most effective single component, filtering 94.2% of high-intensity samples, whereas distribution and content models were less effective (25.0% and 18.4%, respectively).

Significance and Claims

The work claims to illustrate the inherent challenge of developing low-visibility adversarial perturbations that maintain high poisoning effectiveness within continuous learning systems. Key findings include:

Stealth vs. Effectiveness: There is a critical trade-off between adversarial stealth and poisoning effectiveness. Subtle, IAT-based perturbations are compact and effective at degrading recall rates but are harder to detect than high-intensity modifications.
Pipeline Vulnerability: Automated ingestion pipelines are vulnerable to supply chain data corruption, necessitating robust validation prior to ingestion.
Defense Capability: A multi-dimensional validation approach using a homogeneous ensemble of oracles can successfully identify and filter the vast majority of poisoning attempts without significantly hindering the ingestion of legitimate data.

The authors note that this is a preliminary evaluation using a reduced subset (12,500 samples) and a single-stage poisoning event. Future work is required to scale to the full hybrid dataset, investigate transferability in full black-box scenarios, and analyze persistent poisoning across multiple continuous intervals.