Certifiably robust malware detectors by design

Mario Fritz; Pierre-Francois Gimenez; Sarath Sivaprasad

REVIEW 3 major objections 3 minor 18 references

Certifiably robust malware detectors by design

T0 review · 3 major / 3 minor · reviewed 2026-08-05 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Malware detectors can be made certifiably robust by design

desk verdict The ERDALT architecture and experiments are honest and possibly useful, but Proposition 2 is not established and, as stated, is vacuous; the paper's core 'by design' claim collapses. read the letter →

arxiv 2508.10038 v1 pith:RCWUXWXD submitted 2025-08-10 cs.CR cs.AI

Pierre-Francois Gimenez , Sarath Sivaprasad , Mario Fritz This is my paper

classification cs.CRcs.AI

keywords adversarialexamplesmalwaredetectioncertifiablerobustnessmonotonicclassifiersstaticanalysisthreatmodelpreorderfeaturepost-processingERDALT

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper asks how to build static malware detectors that an attacker cannot evade by applying semantics-preserving transformations to a Windows executable. The central claim is that robustness to such threats is equivalent, in a precise sense, to monotonicity: any detector that survives all transformations in a threat model can be rewritten as a monotone classifier applied to a transformed feature vector. The authors prove this decomposition and build ERDALT, a network that learns the feature post-processing from adversarial examples so the resulting detector is robust by design. On a corpus of 67,000 malware samples, the manual monotone-feature route reaches 100 percent robustness against eight black-box attacks, and ERDALT reaches 96 to 100 percent robustness with ROC AUC in the low-to-mid 90s, at some cost in detection performance. The payoff is a defense that treats malware attacks as constrained functionality-preserving edits rather than small perturbations.

What carries the argument

The load-bearing object is the threat-model preorder $\preceq_M$: $P \preceq_M P'$ means an attacker can turn program $P$ into $P'$ using transformations in $M$. Robustness is defined relative to this preorder, so an attack is only a move upward in the preorder. The decomposition of Proposition 2, $f \circ \phi = (f \circ h) \circ (g \circ \phi)$, is the machinery that connects robustness to monotonicity: $h$ picks a canonical preimage under $g$, and $f \circ h$ is shown monotone. ERDALT implements the same idea by learning $g$ as a linear layer with no bias and no activation, constrained via an $\ell^2$ loss to map every observed perturbation vector to a nonnegative vector, while the upper

What would settle it

Find a semantics-preserving transformation allowed by the threat model that decreases one of the 40 manual features (for example, removing an import or merging sections), so that $\phi(P') \not\geq \phi(P)$ while $P \preceq_M P'$; a monotone classifier built on those features would then flip from malicious to benign, refuting the certified-robustness claim.

Watch

Extended reading notes

Core claim

The paper's central formal result is Proposition 2: given a threat model $M$, a feature map $\phi$, and a classifier $f$ that is robust (malicious decisions cannot be turned benign by transformations in $M$), there exist functions $g$ and $h$ such that $f \circ \phi = (f \circ h) \circ (g \circ \phi)$, where $f \circ h$ is monotonically increasing. In words, every robust detector is a monotone classifier acting on a suitably post-processed version of the raw features; conversely, a monotone feature map paired with a monotone classifier is certified robust (Proposition 1). At the feature level, the authors propose 40 hand-selected features designed so that the attacker can only increase them,

Load-bearing premise

The entire robustness guarantee rests on the assumption that the feature map after post-processing is monotone with respect to the attacker's transformation preorder — for the hand-crafted features this is asserted only when the attacker has no special capabilities, and for ERDALT it is guaranteed only for perturbation vectors present in the training data.

Editorial extensions

If this is right

Robust malware detection can be designed rather than patched: if the feature map is monotone with respect to the attacker's transformations, any monotone classifier is certified robust for that threat model.
Proposition 2 implies that robustness is not a property of the classifier alone; the same robustness can be achieved by a monotone model after a learned feature post-processing, so fragile features like byte histograms can be salvaged via linear combinations.
ERDALT's training requires only adversarial examples, not expert knowledge of the threat model, and its linear layer automatically selects non-fragile features and drops irrelevant ones.
Combining ERDALT with adversarial training yielded 100 percent robustness in the authors' experiments, while ERDALT alone reached 96 percent, suggesting the two defenses are complementary.
The characterization explains why monotone classifiers for malware work: monotonicity is the algebraic shadow of the attacker's asymmetric ability to add features more easily than subtract them.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

Proposition 2 is existential and does not construct $g$; if finding the right post-processing is as hard as finding a robust classifier, the practical gain of the decomposition depends on how well ERDALT's linear-layer search approximates the ideal $g$ — a question the experiments only partially answer.
The same decomposition should transfer to other domains with irreversible feature extraction, such as network-packet or dynamic-analysis detectors, where one could collect perturbation vectors for those threat models and test ERDALT-style training.
Because $g$ is generally non-injective, the monotone latent space discards distinctions among feature vectors in the same equivalence class; this may be a structural source of the ROC AUC drop observed for monotone models.
A natural stress test is to generate a new semantics-preserving transformation not in the training perturbation set and check whether ERDALT's robustness drops; the certificate in Proposition 3 is explicitly conditioned on the perturbation set being known during training.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Thanks for the paper. My take: the empirical part is a real attempt, but the theory doesn't hold up. The proof of Proposition 2 has a false step, and even if you patch it, the statement is trivial.

What's new and good: ERDALT is a new architecture—a linear layer constrained to map observed perturbation vectors to nonnegative vectors, followed by a monotonic network. The ablation study is clean, the code is public, and the authors are explicit that ERDALT is empirically robust only and limited by the training attack distribution. The manual feature experiment is a nice demonstration that domain-specific features buy robustness.

Soft spots: the proof step in Section 3 derives a total preorder on feature space from one-sided robustness. That inference is false. Definition 1 only preserves scores at or above threshold; two evaded samples can have scores cross order under transformations without violating robustness. More fundamentally, Proposition 2 holds for any classifier, robust or not: take g that maps features to the score and h that maps a score back to some features with that score—the composition is the score function. So it is not a characterization of robust detectors. The subsequent claim that you can learn a monotone detector on g∘ϕ and keep certified robustness needs g∘ϕ to be monotone w.r.t. the threat preorder, which is exactly what the failed step was supposed to give. Thus the certified-robustness motivation for ERDALT is unsupported. ERDALT's actual guarantee (Prop 3) only applies if the full set of perturbation vectors Δ_M is known; in practice it's a finite sample from one attack package, so the measured robustness is partly in-distribution to the same attacks. The paper admits this.

None of this makes the paper worthless. As an empirical defense, ERDALT is plausible and comparable to adversarial training in Table 2, though not better in AUC. The theoretical overreach is the problem. Who it's for: people working on adversarial malware defenses may want to read the empirical sections and possibly reproduce. The theory should be cited with care. It deserves a serious referee—the flaw is catchable and the authors could reframe the contribution. But as is, the central claim should not stand.

Referee Report

3 major / 3 minor

Summary. The paper proposes a threat-model-aware approach to robust malware detection: instead of bounding perturbation magnitude, it models the set of functionality-preserving transformations an attacker can apply, and designs detectors that are robust by construction. Section 3 introduces Definition 1 (one-sided robustness), proves Proposition 1 (monotone features plus monotone classifier imply robustness), and states Proposition 2, claiming that every robust detector can be decomposed as a monotone classifier on a transformed feature space. Section 4 derives ERDALT, an architecture that learns a linear feature post-processing and a monotone upper network from adversarial examples, with Proposition 3 giving a formal robustness guarantee when the set of perturbation vectors is finite and exactly known. Experiments compare manual 40 features with EMBER features, several defenses (PV feature selection, adversarial training, ERDALT, and their combination), and report ROC AUC and robustness against secml-malware attacks.

Significance. If the theoretical characterization were valid, the paper would be significant: it would replace unrealistic epsilon-ball assumptions with a threat-model preorder suited to malware, and it would offer a practical, code-released architecture. The empirical results are also informative: manually selected features substantially increase robustness of otherwise fragile classifiers, and the ablation study suggests the linear layer is the main contributor to ERDALT's robustness. However, the central proposition is flawed and, as stated, vacuous, and the claimed certification for the manual features is not supported by a formal threat model. These issues undermine the main theoretical contribution and the title claim.

major comments (3)

[Section 3, Definition 1 and Proposition 2] The proof step 'Since f◦ϕ is robust by assumption, this preorder satisfies P ⪯M P′ ⇒ ϕ(P) ⪯ϕ ϕ(P′)' is false. Definition 1 is one-sided: it only requires f(ϕ(P)) ≥ τ ⇒ f(ϕ(P′)) ≥ τ. If f(ϕ(P)) = 0.4 and f(ϕ(P′)) = 0.3 with τ = 0.5, robustness holds vacuously yet f(ϕ(P)) > f(ϕ(P′)), so the preorder property fails. The rest of the proof and the claim that one can learn a monotone detector on g◦ϕ 'while keeping the certifiable robustness' depend on this implication. Moreover, Proposition 2 itself is vacuous: for any f, take g = f and let h be a preimage selector on the image of f; then f◦h is the identity on that image and the decomposition holds with no robustness assumption. The proposition therefore does not characterize robust detectors and cannot justify the claimed monotone post-processing.
[Section 3, hand-crafted features, p. 5-6; Table 1] The paper asserts that the 40 manual features are 'monotonic when the attacker has no particular capability' and that Proposition 1 then guarantees robustness, but it never defines a formal threat model M nor proves that each of the 40 features is non-decreasing under every allowed transformation. 'No particular capability' is not a precise threat model, so the certified robustness claim for the manual-feature baseline is not established. Table 1 reports empirical robustness against the specific secml-malware attack suite, which is not a certification. This gap is load-bearing because the manual-features/monotone-classifier combination is presented as a certifiably robust-by-design detector.
[Section 5.2 and 5.4] ERDALT's linear layer is fitted on adversarial examples generated with secml-malware, and its robustness is then evaluated against attacks from the same package and attack-generation procedure. The paper acknowledges that ERDALT is only 'empirically robust' and limited by its training dataset, but the reported 96% robustness in Table 2 and Section 5.4 is partly a re-fit of the observed attack distribution. The experiments do not demonstrate generalization to unseen transformations outside the training distribution, and Proposition 3's exact guarantee requires the full finite set ΔM to be known during training, which the experiments do not satisfy. The comparison with adversarial training should be interpreted in this light.

minor comments (3)

[Proposition 2 proof] There is a domain error in the monotonicity argument: 'Let v1, v2 ∈ Dϕ such that v1 ≤ v2' but f◦h is defined on Df, not Dϕ. The intended statement is v1, v2 ∈ Df. Also, the equation 'f(v1)=f(g(h(ϕ(P))))' is garbled; it should be f(ϕ(P)) = f(h(g(ϕ(P)))).
[Section 5.1] The test set is highly imbalanced (4611 goodware vs 55,000 malware), and ROC AUC is used without discussing how this imbalance affects the comparison. This is acceptable for AUC but should be stated explicitly.
[Throughout] There are minor typos, e.g., 'These models models' in Section 5.1, and the typesetting of the circular composition notation in Proposition 3 is hard to read. The notation '⃝1 k=n' should be defined in the text.

Circularity Check

0 steps flagged · score 2.0 of 10

No significant circularity: the formal claims are conditional constructions and the empirical limitations are explicitly disclosed.

full rationale

The paper's central theoretical result, Proposition 2, is a representation theorem: it defines a preorder from the classifier's own outputs and then constructs g and h. This makes the conclusion 'f ∘ h is monotonically increasing' follow largely from the definition of that preorder, which could be seen as vacuous or over-general, but it is not a circular derivation in the sense of fitting a parameter and then calling it a prediction. The proof's questionable step is the assertion that robustness implies P ⩭_M P' ⇒ ϕ(P) ⩭_ϕ ϕ(P'); the skeptic's counterexample shows this inference may be invalid. That is a correctness/soundness concern, not a circularity concern. Proposition 3 is explicitly conditional: 'If Δ_M is known during training, then ERDALT is robust.' Its proof uses linearity and monotonicity to sum perturbation vectors; no input is reused as its own output. The empirical robustness of ERDALT is admittedly limited by its training data: 'it requires adversarial examples to learn the set of transformations the attackers can use and, therefore, is limited by its training dataset.' The evaluation uses attacks from the same secml-malware package that likely supplied the adversarial examples used to fit the linear layer, so the robustness numbers are partly a re-fit of the observed attack distribution. However, the paper labels this 'empirically robust' rather than certifiably robust, so it is a disclosed limitation, not a concealed circular prediction. The only self-citation ([15], monotonic neural network) is used for a baseline architecture and is not load-bearing. Overall, no derivation step reduces by construction to its own input; score 2 reflects the minor self-citation and the admittedly fitted nature of the empirical robustness evaluation.

Assumptions & free parameters 3 free parameters · 4 assumptions · 0 invented entities

The ledger records the unproven premises: monotonicity of the manual features, finiteness of the perturbation set, and representativeness of the training adversarial examples. The trivial decomposition theorem does not add an independent grounding because it holds for any classifier. No invented entities are introduced.

free parameters (3)

ERDALT loss coefficients (l2 and l3 weights) = not reported
The positivity constraint on L(δ) is enforced by a weighted l2 loss; without the weights and training schedule, the robustness claim cannot be reproduced.
ERDALT linear layer and monotonic network hyperparameters = not reported
Number of layers, widths, optimizer, and epochs are omitted; the empirical AUC/robustness results depend on them.
Number of manually selected features = 40
The certified baseline uses exactly 40 expert-chosen features; the set is asserted monotone without proof.

assumptions (4)

ad hoc to paper The feature mapping ϕ is monotonically increasing with respect to the threat-model preorder ⪯_M.
Required for Proposition 1 and for the manual-feature certification; asserted after a short informal discussion, not proven.
domain assumption The set of perturbation vectors Δ_M is finite and independent of the program P.
Proposition 3 relies on decomposing a transformation into a finite sum of perturbation vectors; the paper states this as an assumption in Section 4.
domain assumption The 1033 training adversarial examples represent the attacker's full capability.
ERDALT is only empirically robust; its robustness guarantee is limited by the training set, as the authors acknowledge.
ad hoc to paper The monotone decomposition conclusion requires g∘ϕ to be monotone with respect to ⪯_M.
Proposition 2 proves f∘h is monotone as a function on R^k but does not establish that the composed detector is robust under Definition 1; this missing monotonicity is load-bearing.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Certifiably robust malware detectors by design." pith.science (2026). https://pith.science/paper/RCWUXWXD

@misc{pith2026250810038,
  author       = {Pith},
  title        = {Pith review of: Certifiably robust malware detectors by design},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/RCWUXWXD}},
  note         = {Machine review of arXiv:2508.10038}
}

read the original abstract

Malware analysis involves analyzing suspicious software to detect malicious payloads. Static malware analysis, which does not require software execution, relies increasingly on machine learning techniques to achieve scalability. Although such techniques obtain very high detection accuracy, they can be easily evaded with adversarial examples where a few modifications of the sample can dupe the detector without modifying the behavior of the software. Unlike other domains, such as computer vision, creating an adversarial example of malware without altering its functionality requires specific transformations. We propose a new model architecture for certifiably robust malware detection by design. In addition, we show that every robust detector can be decomposed into a specific structure, which can be applied to learn empirically robust malware detectors, even on fragile features. Our framework ERDALT is based on this structure. We compare and validate these approaches with machine-learning-based malware detection methods, allowing for robust detection with limited reduction of detection performance.

Figures

Figures reproduced from arXiv: 2508.10038 by the authors.

**Figure 1.** (a) Adversarial perturbation in the image problem space. (b) Adversarial perturbation in the problem and the feature spaces. The crosshatched part of the space cannot be reached by perturbation. However, attackers still require the modified malware to function properly (i.e., stealing credentials, encrypting disks, etc.). So, adversarial attacks against malware analysis are generally performed in the problem space… view at source ↗

**Figure 2.** ERDALT framework. l1 minimize the detection error, l2 ensures the perturbations positivity and l3 encourages the linear layer to be a diagonal matrix. We propose the deep learning architecture presented in [PITH_FULL_IMAGE:figures/full_fig_p008_2.png] view at source ↗

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

18 extracted references · 12 canonical work pages

[1]

IEEE Access 9, 155161–155196 (2021)

Akhtar, N., Mian, A., Kardan, N., Shah, M.: Advances in adversarial attacks and defenses in computer vision: A survey. IEEE Access 9, 155161–155196 (2021)

work page 2021
[2]

arXiv preprint arXiv:1804.04637 (2018) 14 Pierre-Fran¸ cois Gimenez, Sarath Sivaprasad, Mario Fritz

Anderson, H.S., Roth, P.: Ember: an open dataset for training static pe malware machine learning models. arXiv preprint arXiv:1804.04637 (2018) 14 Pierre-Fran¸ cois Gimenez, Sarath Sivaprasad, Mario Fritz

arXiv 2018
[3]

SN Computer Science 5(6), 710 (2024)

Bena, N., Anisetti, M., Gianini, G., Ardagna, C.A.: Certifying accuracy, privacy, and robustness of ml-based malware detection. SN Computer Science 5(6), 710 (2024)

work page 2024
[4]

In: international conference on machine learning

Cohen, J., Rosenfeld, E., Kolter, Z.: Certified adversarial robustness via random- ized smoothing. In: international conference on machine learning. pp. 1310–1320. PMLR (2019)

2019
[5]

In: Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security

Dambra, S., Han, Y., Aonzo, S., Kotzias, P., Vitale, A., Caballero, J., Balzarotti, D., Bilge, L.: Decoding the secrets of machine learning in malware classification: A deep dive into datasets, feature extraction, and model performance. In: Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security. pp. 60–74 (2023)

work page 2023
[6]

IEEE Trans- actions on Information Forensics and Security 16, 3469–3478 (2021)

Demetrio, L., Biggio, B., Lagorio, G., Roli, F., Armando, A.: Functionality- preserving black-box optimization of adversarial windows malware. IEEE Trans- actions on Information Forensics and Security 16, 3469–3478 (2021)

2021
[7]

IEEE Transactions on Dependable and Secure Com- puting 16(4), 711–724 (2017)

Demontis, A., Melis, M., Biggio, B., Maiorca, D., Arp, D., Rieck, K., Corona, I., Giacinto, G., Roli, F.: Yes, machine learning can be more secure! a case study on android malware detection. IEEE Transactions on Dependable and Secure Com- puting 16(4), 711–724 (2017)

work page 2017
[8]

In: Bengio, Y., LeCun, Y

Goodfellow, I.J., Shlens, J., Szegedy, C.: Explaining and harnessing adversarial ex- amples. In: Bengio, Y., LeCun, Y. (eds.) 3rd International Conference on Learning Representations, ICLR 2015 (2015)

work page 2015

Show all 18 references

[9]

arXiv preprint arXiv:2302.01757 (2023)

Huang, Z., Marchant, N.G., Lucas, K., Bauer, L., Ohrimenko, O., Rubinstein, B.I.: Certified robustness of learning-based static malware detectors. arXiv preprint arXiv:2302.01757 (2023)

2023 arXiv
[10]

In: Proceedings of the Fourth ACM International Workshop on Security and Privacy Analytics

´Incer Romeo, ´I., Theodorides, M., Afroz, S., Wagner, D.: Adversarially robust malware detection using monotonic classification. In: Proceedings of the Fourth ACM International Workshop on Security and Privacy Analytics. pp. 54–63 (2018)

2018
[11]

arXiv preprint arXiv:2112.12310 (2021)

Ling, X., Wu, L., Zhang, J., Qu, Z., Deng, W., Chen, X., Wu, C., Ji, S., Luo, T., Wu, J., et al.: Adversarial attacks against windows pe malware detection: A survey of the state-of-the-art. arXiv preprint arXiv:2112.12310 (2021)

2021 arXiv
[12]

In: 2020 IEEE symposium on security and privacy (SP)

Pierazzi, F., Pendlebury, F., Cortellazzi, J., Cavallaro, L.: Intriguing properties of adversarial ml attacks in the problem space. In: 2020 IEEE symposium on security and privacy (SP). pp. 1332–1349. IEEE (2020)

2020
[13]

In: Workshops at the Thirty-Second AAAI Conference on Artificial Intelligence (2018)

Raff, E., Barker, J., Sylvester, J., Brandon, R., Catanzaro, B., Nicholas, C.K.: Malware detection by eating a whole exe. In: Workshops at the Thirty-Second AAAI Conference on Artificial Intelligence (2018)

2018
[14]

arXiv preprint arXiv:2007.00753 (2020)

Silva, S.H., Najafirad, P.: Opportunities and challenges in deep learning adversarial robustness: A survey. arXiv preprint arXiv:2007.00753 (2020)

2007 arXiv
[15]

In: Machine Learning and Knowledge Discovery in Databases

Sivaprasad, S., Singh, A., Manwani, N., Gandhi, V.: The curious case of convex neural networks. In: Machine Learning and Knowledge Discovery in Databases. Re- search Track: European Conference, ECML PKDD 2021, Bilbao, Spain, September 13–17, 2021, Proceedings, Part I 21. pp. 7...

2021
[16]

In: 2019 IEEE Security and Privacy Workshops (SPW)

Suciu, O., Coull, S.E., Johns, J.: Exploring adversarial examples in malware de- tection. In: 2019 IEEE Security and Privacy Workshops (SPW). pp. 8–14. IEEE (2019)

2019
[17]

arXiv preprint arXiv:1312.6199 (2013)

Szegedy, C., Zaremba, W., Sutskever, I., Bruna, J., Erhan, D., Goodfellow, I., Fer- gus, R.: Intriguing properties of neural networks. arXiv preprint arXiv:1312.6199 (2013)

2013 arXiv
[18]

IEEE access 7, 46717– 46738 (2019)

Vinayakumar, R., Alazab, M., Soman, K., Poornachandran, P., Venkatraman, S.: Robust intelligent malware detection using deep learning. IEEE access 7, 46717– 46738 (2019)

2019

Pith tools

Reviewed August 5, 2026 · model on record in the stance chip above.

[1] [1]

IEEE Access 9, 155161–155196 (2021)

Akhtar, N., Mian, A., Kardan, N., Shah, M.: Advances in adversarial attacks and defenses in computer vision: A survey. IEEE Access 9, 155161–155196 (2021)

work page 2021

[2] [2]

arXiv preprint arXiv:1804.04637 (2018) 14 Pierre-Fran¸ cois Gimenez, Sarath Sivaprasad, Mario Fritz

Anderson, H.S., Roth, P.: Ember: an open dataset for training static pe malware machine learning models. arXiv preprint arXiv:1804.04637 (2018) 14 Pierre-Fran¸ cois Gimenez, Sarath Sivaprasad, Mario Fritz

arXiv 2018

[3] [3]

SN Computer Science 5(6), 710 (2024)

Bena, N., Anisetti, M., Gianini, G., Ardagna, C.A.: Certifying accuracy, privacy, and robustness of ml-based malware detection. SN Computer Science 5(6), 710 (2024)

work page 2024

[4] [4]

In: international conference on machine learning

Cohen, J., Rosenfeld, E., Kolter, Z.: Certified adversarial robustness via random- ized smoothing. In: international conference on machine learning. pp. 1310–1320. PMLR (2019)

2019

[5] [5]

In: Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security

Dambra, S., Han, Y., Aonzo, S., Kotzias, P., Vitale, A., Caballero, J., Balzarotti, D., Bilge, L.: Decoding the secrets of machine learning in malware classification: A deep dive into datasets, feature extraction, and model performance. In: Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security. pp. 60–74 (2023)

work page 2023

[6] [6]

IEEE Trans- actions on Information Forensics and Security 16, 3469–3478 (2021)

Demetrio, L., Biggio, B., Lagorio, G., Roli, F., Armando, A.: Functionality- preserving black-box optimization of adversarial windows malware. IEEE Trans- actions on Information Forensics and Security 16, 3469–3478 (2021)

2021

[7] [7]

IEEE Transactions on Dependable and Secure Com- puting 16(4), 711–724 (2017)

Demontis, A., Melis, M., Biggio, B., Maiorca, D., Arp, D., Rieck, K., Corona, I., Giacinto, G., Roli, F.: Yes, machine learning can be more secure! a case study on android malware detection. IEEE Transactions on Dependable and Secure Com- puting 16(4), 711–724 (2017)

work page 2017

[8] [8]

In: Bengio, Y., LeCun, Y

Goodfellow, I.J., Shlens, J., Szegedy, C.: Explaining and harnessing adversarial ex- amples. In: Bengio, Y., LeCun, Y. (eds.) 3rd International Conference on Learning Representations, ICLR 2015 (2015)

work page 2015