🤖 machine learning

CAM-Guided Saliency Cutout and Image-Based Malware Classification

This paper investigates the efficacy of CAM-guided saliency cutout for malware image classification using the RawMal-TF dataset, finding that unlike natural images where low-saliency cutout improves performance, saliency-guided cutout strategies actually degrade accuracy for malware, highlighting significant domain differences between the two image types.

Original authors: Yasaman Ebrahimi, Martin Jurecek, Mark Stamp

Published 2026-08-13

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Yasaman Ebrahimi, Martin Jurecek, Mark Stamp

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you are trying to teach a robot to recognize different types of cars by showing it thousands of photos. If you show the robot the exact same picture every time, it might just memorize the background or a specific shiny hubcap instead of learning what makes a car a car. To stop this "memorization," scientists use a trick called dropout. It's like telling the robot, "Okay, now I'm going to hide a part of this picture with a black square. Can you still guess what it is?" This forces the robot to look at the whole picture and learn deeper patterns, not just one lucky spot. This is the heart of Cutout, a technique used to make computer vision models smarter and less likely to fail when they see something new.

But here's the big question: Where should we put that black square? Should we just throw it anywhere randomly, or should we be smart about it? Some researchers thought, "Let's look at the picture and find the most important parts (the 'saliency'), then hide the boring stuff so the robot focuses on the exciting bits." This paper dives into that idea, but with a twist: instead of looking at photos of cats or cars, they are looking at malware. Malware is the digital equivalent of a virus; it's a malicious computer program. Scientists have found a way to turn the invisible code of these viruses into grayscale images, looking a bit like static on an old TV. The goal is to see if the "smart hiding" trick works on these virus images the same way it works on photos of the natural world.

The Experiment: Hiding the Right (or Wrong) Things

The researchers set up a massive digital playground to test this. They used a standard robot brain (a neural network called ResNet18) and gave it two very different sets of homework. The first set was RawMal-TF, a collection of 17,000 grayscale images of computer viruses, with 1,000 examples for each of the 17 virus families. The second set was CIFAR-100, a famous collection of 100,000 photos of everyday things like apples, trucks, and frogs, used as a control group to see how the trick behaves on normal pictures.

They tested four different ways of training the robot:

No Cutout: The robot sees the images exactly as they are.
Random Cutout: The robot sees the original image plus copies where a random square is blacked out.
Low-Saliency Cutout: The robot sees copies where the black square is placed over the "boring," unimportant parts of the image (according to a smart teacher model).
High-Saliency Cutout: The robot sees copies where the black square is placed over the "exciting," most important parts of the image.

They tested different sizes for these black squares (covering 5%, 10%, 20%, or 30% of the image) and different numbers of extra copies (4 or 8 per original image).

The Results: A Tale of Two Worlds

The findings were a fascinating mix of "it works!" and "wait, no it doesn't."

On the Natural Images (CIFAR-100):
The "smart hiding" strategy actually worked! When the researchers used Low-Saliency Cutout (hiding the boring parts), the robot got better at its job. Specifically, when they hid 10% of the image in the least important spots, the robot's accuracy jumped to 63.51%, beating the standard "no hiding" score of 62.65%. It seems that for photos of real-world objects, telling the robot to ignore the background and focus on the main subject is a great way to learn. However, if they tried to hide the most important parts (High-Saliency), the robot got confused and performed much worse.

On the Malware Images (RawMal-TF):
Here, the story took a sharp turn. The "smart hiding" strategy failed. In fact, it made things worse. The best result for the virus images came from the No Cutout group, where the robot saw the images perfectly, achieving a score of 72.83%. Every single version of the "hiding" trick—whether random, low-saliency, or high-saliency—dropped the score.

The best "hiding" attempt (Random Cutout with a 30% square) only reached 71.55%.
The "Low-Saliency" strategy (hiding the boring parts) was sometimes slightly better than random, but often slightly worse, and never beat the "No Cutout" score.
The "High-Saliency" strategy (hiding the important parts) was consistently the worst, dropping scores significantly.

What This Means: Viruses Aren't Just Pictures

The authors suggest that this difference happens because malware images and natural images are fundamentally different. When you look at a photo of a dog, the "important" parts are the dog's face and ears. Hiding the grass in the background (low-saliency) helps the robot focus on the dog.

But a malware image is just a translation of computer code into a picture. The "important" parts that the computer sees might be specific patterns of bytes, file headers, or padding that look like random static to us. When the researchers used the "smart" method to hide the "boring" parts, they might have accidentally covered up crucial structural clues that the virus family needs to be identified. It's like trying to learn a language by covering up the vowels; you might think you're focusing on the consonants, but you've actually destroyed the sentence structure.

The paper concludes that while saliency-guided cutout is a powerful tool for natural images, it doesn't automatically work for malware. The "smart" way to hide parts of a virus image isn't just about looking at the picture; it requires understanding the hidden structure of the code itself. For now, the simplest approach—showing the robot the full, unmasked image—remains the champion for identifying these digital threats.

Technical Summary: CAM-Guided Saliency Cutout and Image-Based Malware Classification

Problem Statement

Image-based malware classification converts binary executable files into grayscale images to leverage Convolutional Neural Networks (CNNs) for analysis. While CNNs achieve state-of-the-art results in this domain, overfitting remains a concern. Dropout and Cutout regularization are standard techniques to mitigate overfitting; Cutout specifically masks random spatial regions of training images to force the model to learn from diverse visual patterns rather than relying on single local features.

The central research question of this paper is whether Cutout regularization can be improved by guiding the placement of the masked region using High-Resolution Class Activation Mapping (HiResCAM). Specifically, the authors investigate if removing regions identified as "low-saliency" (less important to the model's prediction) or "high-saliency" (most important) yields better classification performance compared to standard random Cutout. A secondary objective is to determine if behaviors observed in natural image datasets (like CIFAR-100) translate to the malware domain, or if malware images require distinct treatment due to their structural differences from natural images.

Methodology

The study employs a controlled experimental design using ResNet18 as the baseline architecture. The experiments are conducted on two datasets:

RawMal-TF: A malware dataset containing 17 families with 1,000 samples each, converted into standard grayscale images.
CIFAR-100: A natural image dataset used as a comparative benchmark.

Experimental Conditions

Four training scenarios are compared:

No Cutout: The baseline using original training images.
Random Cutout: Standard Cutout where square regions are selected randomly.
Low-Saliency Cutout: The cutout region is selected from areas with low activation in a HiResCAM map generated by a "teacher" model (a no-cutout ResNet18 trained on the same data).
High-Saliency Cutout: The cutout region is selected from areas with high activation in the HiResCAM map.

Implementation Details

Teacher Model: A ResNet18 trained without cutout generates HiResCAM saliency maps for the training images.
Augmentation: For each original image, $M$ augmented copies are created ( $M \in \{4, 8\}$ ). Each copy has a square region masked (filled with black).
Cutout Areas: Experiments test mask sizes covering 5%, 10%, 20%, and 30% of the image area.
Selection Logic: For CAM-guided cutout, candidate windows are scored by average saliency. The method selects a window from the bottom 10% (low-saliency) or top 10% (high-saliency) of candidates to ensure diversity among the $M$ copies, rather than always picking the absolute minimum or maximum.
Training Configuration: 100 epochs, SGD optimizer, batch size 128, learning rate 0.1 with cosine scheduling. Three random seeds (42, 43, 44) are used to assess robustness. Validation data is never masked.

Key Results

RawMal-TF (Malware) Results

The results for the malware dataset are negative regarding the utility of saliency-guided cutout:

Baseline Superiority: The No Cutout baseline achieved the highest mean best validation accuracy (72.83% ± 0.16%).
Cutout Degradation: All cutout conditions (Random, Low-Saliency, and High-Saliency) resulted in lower mean validation accuracy than the baseline.
- Best Random Cutout ( $M=4$ , 30% area): 71.55%.
- Best Low-Saliency Cutout ( $M=4$ , 30% area): 71.43%.
- Best High-Saliency Cutout: ~70.66%.
Saliency vs. Random: Low-saliency cutout showed inconsistent results compared to random cutout, with differences ranging from -0.56 to +0.46 percentage points across different configurations. High-saliency cutout was consistently worse than random cutout, with deficits up to -2.00 percentage points.
Conclusion: Saliency-guided placement did not improve malware classification; in fact, the standard random approach performed better than the guided approaches, though both were inferior to no augmentation.

CIFAR-100 (Natural Image) Results

In contrast, the natural image dataset showed positive results for specific saliency-guided strategies:

Baseline: No Cutout accuracy was 62.65% ± 0.57%.
Low-Saliency Improvement: Low-saliency cutout with $M=4$ and 10% area achieved 63.51% ± 0.36%, outperforming the baseline by 0.86 percentage points and the corresponding random cutout by 1.25 percentage points.
High-Saliency Degradation: High-saliency cutout was consistently harmful, performing significantly worse than both the baseline and random cutout across all configurations.
Robustness: Low-saliency cutout remained robust even as mask area increased (20% and 30%), whereas random and high-saliency cutout performance deteriorated rapidly.

Key Contributions and Significance

The paper's primary contribution is the empirical demonstration that saliency-guided Cutout is domain-dependent.

Domain Disparity: The study establishes that techniques effective for natural images (specifically low-saliency cutout) do not automatically transfer to malware images. In the malware domain, the "low-saliency" regions identified by HiResCAM do not necessarily correspond to non-critical background information as they might in natural images.
Nature of Malware Images: The authors argue that malware images are derived from byte sequences and binary structures (e.g., PE headers, section boundaries). A local square mask in a malware image may remove contiguous byte regions that encode critical structural information for family classification, regardless of the pixel intensity or saliency score. Consequently, masking these regions (even if deemed "low-saliency" by a teacher model) may damage the representation rather than regularize it.
High-Saliency Risk: The results confirm that masking high-saliency regions is generally detrimental in both domains, as it removes the most discriminative features the model relies on.
Future Direction: The paper suggests that for malware, masking strategies should be structure-aware (aligning with binary offsets, PE sections, or entropy transitions) rather than relying solely on image-based saliency maps derived from natural image assumptions.

Limitations and Scope

The authors explicitly note several limitations:

Architecture Specificity: Results are based solely on ResNet18; performance may differ with other architectures (e.g., ViT, EfficientNet).
Image Representation: The study is limited to grayscale images; other binary-to-image transformations were not tested.
Statistical Power: While three seeds were used, the sample size is small, and confidence intervals should be viewed as exploratory.
Compute Budget: The augmented training sets ( $M=4$ or $8$) involve more training examples than the baseline, meaning the comparison is not strictly compute-matched in terms of optimizer steps.

In summary, the paper concludes that while saliency-guided Cutout can improve natural image classification, it currently offers no benefit—and may be harmful—for grayscale malware classification, highlighting the need for domain-specific augmentation strategies in malware analysis.