Pith. sign in

REVIEW 5 major objections 8 minor 28 references

Clean malware scores miss how representations move under feature perturbation; latent-stability diagnostics catch that movement.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · grok-4.5

2026-07-31 11:06 UTC pith:5YCCLPPC

load-bearing objection Honest diagnostic pipeline for malware latent stability under feature probes; useful tooling, no clean-accuracy win, and no PE-level attacks yet. the 5 major comments →

arxiv 2607.24896 v1 pith:5YCCLPPC submitted 2026-07-27 cs.CR cs.AI

Latent Stability Analysis of Malware Representations Under Feature-Space Perturbations

Bamidele Ajayi , Ken McGarry This is my paper
classification cs.CR cs.AI
keywords malware classificationEMBERlatent stabilityvariational autoencoderMandelbrot escape timephysics-informed neural networkperturbation analysisadversarial malware
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

Standard malware detector scores only look at clean samples. They do not show how a learned representation shifts when features are nudged, how close samples drift toward uncertain decision regions, or whether a compressed encoding still holds security-relevant structure. This paper builds a pipeline on EMBER static PE features that compares full features, PCA, a beta/denoising VAE, Mandelbrot-inspired escape-time fingerprints, and a PINN-style latent-flow module. It defines Latent Escape Divergence to measure change in escape-time profiles and uses flow residual, velocity, risk, and gradient shifts to track latent movement. Full features and PCA-64 still win on clean classification, but the combined VAE+Mandelbrot+PINNFlow representation adds diagnostic value and improves robustness over VAE+Mandelbrot on every controlled probe the authors run.

Core claim

The authors claim that latent-stability analysis complements clean malware metrics: by treating perturbations as paths in representation space and measuring Latent Escape Divergence plus PINNFlow residual, velocity, risk, and gradient shifts, one can expose perturbation-induced representation changes that accuracy, F1, and AUC alone do not capture. On EMBER, full features and PCA-64 remain stronger clean classifiers, but PINNFlow improves robustness relative to VAE+Mandelbrot across all five feature-space probes and yields interpretable latent-shift measurements.

What carries the argument

Latent Escape Divergence (LED): the mean absolute change in Mandelbrot-style normalized escape-time fingerprints between clean and perturbed VAE latents, paired with a PINN-style latent-flow module that learns velocity and risk along pseudo-time trajectories and reports residual, velocity, risk, and gradient shifts.

Load-bearing premise

The controlled feature-space probes used here are enough to stand in for security-relevant evasion, even though they are not functionality-preserving changes to real PE binaries.

What would settle it

Generate clean/perturbed EMBER pairs from real functionality-preserving PE transformations, then check whether LED and PINNFlow residual divergence detect evasion better than classifier confidence, PCA distance, or plain VAE latent distance on those pairs.

Watch this falsifier — get emailed when new claim-graph text bears on it.

If this is right

  • Clean AUC/F1 alone is insufficient to certify a malware representation; latent path diagnostics should be reported alongside them.
  • PINN-style transport residuals can recover some robustness lost when adding complex-dynamical escape features to a VAE, without beating PCA on clean accuracy.
  • Escape-time and box-counting boundary measures can flag which compressed spaces have more intricate uncertain regions under the same fixed classifier.
  • The same evaluation interface can ingest external clean/perturbed PE feature pairs once raw-binary attack tools re-extract EMBER features.
  • If LED and flow-shift thresholds calibrate well, they become candidate early-warning signals for representation drift toward benign-looking regions.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • Security teams could treat LED or residual-shift spikes as monitorable signals in CI pipelines that re-score models after feature-schema or packing-tool changes, not only at training time.
  • The method’s portable core—displacement, neighborhood overlap, escape divergence, and flow residuals—could be re-tested on phishing or intrusion features if domain-valid, semantics-preserving probes are defined first.
  • A direct bake-off of LED against ordinary VAE latent L2 and classifier-score drop on the same PE-level attack set would clarify whether the complex-dynamics layer adds detection power beyond geometry.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

5 major / 8 minor

Summary. The manuscript proposes a latent-stability analysis pipeline for malware representations on EMBER static PE features. A beta/denoising VAE (64-dim, KL warm-up, free bits) is trained; adjacent latent coordinates are mapped to complex pairs on which Mandelbrot-style escape-time fingerprints τ(z) are computed; Latent Escape Divergence (LED) is defined as the L1 change in τ under perturbation; and a PINN-style module ("PINNFlow") imposes an advection residual on linearly interpolated clean→perturbed latent paths, yielding residual/velocity/risk/gradient-shift diagnostics. Six representations are compared under a fixed LightGBM classifier on clean data and five feature-space perturbation probes. The headline results are honestly scoped: Full features (ROC AUC 0.9962) and PCA-64 (0.9846) beat all VAE variants on clean data (Table IV); PINNFlow improves perturbed F1 only relative to VAE+Mandelbrot, not relative to PCA (Table VI). The authors repeatedly disclaim functionality preservation and physical/fractal semantics.

Significance. If the results hold, the contribution is a reproducible, openly-coded (§XI) diagnostic methodology rather than a better classifier, and the paper is commendably disciplined about this: clean-metric inferiority to PCA is stated in the abstract, the Mandelbrot component is framed as a sensitivity descriptor rather than a claim about malware semantics (§III.C, §VI.B), and the feature-space-probe limitation is flagged three times (§II.C, §IV.C, §VIII). The anti-collapse VAE diagnostics (Table III: 64/55 active units, KL per-dimension breakdown) and the inclusion of McNemar tests on clean metrics are good practice. However, the security value of the diagnostics is currently asserted rather than demonstrated: nothing in the paper shows that LED or PINNFlow shifts track actual evasion success, and the headline robustness gains are sub-1% F1 without uncertainty estimates. The work is a solid methodology paper whose empirical validation lags its framing.

major comments (5)
  1. [§V.E, Table VI] Table VI (§V.E): the central robustness claim — that VAE+Mandelbrot+PINNFlow improves over VAE+Mandelbrot on all five probes — rests on F1 differences ranging from 0.0017 (Gaussian small: 0.9228→0.9245) to 0.0088 (benign centroid). No confidence intervals or paired tests are reported for perturbed metrics, even though the pipeline (Algorithm 1, lines 25–26) computes bootstrap CIs and McNemar tests and §V.G applies McNemar to clean results. The same machinery must be applied to Table VI; with 240k holdout samples the larger gains are likely significant, but the smaller ones (Gaussian, sparse injection) may not be, and the claim 'improves across all evaluated perturbation types' (Abstract) should then be qualified accordingly.
  2. [§V.F, Tables VII–VIII] The diagnostic value of LED and PINNFlow shifts is never validated against any evasion-relevant ground truth. Table VII and Table VIII show that benign-centroid movement produces the largest LED (0.0635) and residual shift (0.0362), but the paper does not test whether these shifts correlate with, or predict, classifier misclassification under perturbation — which is the property that would make them 'complement clean metrics' in a security sense. A cheap, in-scope validation exists: per-sample analysis on the existing holdout probes (e.g., point-biserial correlation or AUC of LED/risk-shift as a predictor of the clean→perturbed correctness flip), or one gradient-based feature-space attack on the EMBER features. Without this, Tables VII–VIII establish only that the metrics move, not that they are informative.
  3. [§III.E, Eq. (10), Table IV] Table IV, feature counts, and §III.E: the PINNFlow diagnostic features include a risk probability u_θ trained with a supervised BCE term (L_sup in Eq. (10), λ_y = 1.0) using sample labels. These label-informed features are then appended to the representation (113 features vs. 107 for VAE+Mandelbrot) and fed to the downstream classifier, and 'risk-probability shift' is reported as a stability diagnostic. This is not leakage in the train/test sense, but it breaks the like-for-like comparison with PCA-64 and VAE-64, whose features are label-free, and it means the risk-shift diagnostic partly measures a supervised head rather than intrinsic latent geometry. The paper should state this explicitly and, ideally, report an ablation with λ_y = 0 to separate the supervised and dynamics contributions.
  4. [§V.D, Table V] Table V (§V.D): box-counting dimensions are compared across six representations that live in spaces of different dimension (6 to 2381) and different scaling. Box-counting estimates are scale- and embedding-dependent; the ranking 'PINNFlowOnly (1.79) > PCA-64 (1.72) > VAE+Mandelbrot+PINNFlow (1.71) > ...' is used to support the claim that complex-dynamical features 'expose additional nonlinear structure,' but no normalization of the uncertain-boundary set (e.g., per-representation standardization of B_α coordinates before box counting) or controls (e.g., dimension of a label-shuffled or Gaussian-matched boundary) are described. Either justify comparability or downgrade Table V to a within-representation descriptive statistic.
  5. [§IV.A, Algorithm 1] §IV.A: the 180k/180k/240k split is non-standard and its provenance is not given. EMBER 2018 has 800k labeled samples with a time-based train/test boundary; the paper does not state whether the 600k used are a random subsample, whether the split respects the temporal boundary, or whether holdout is disjoint from the scaler/VAE/PINNFlow training data (Algorithm 1 line 5 fits the scaler on D_tr only, but PINNFlow training pairs (line 14) — which split do they come from?). This matters for comparability of the full-feature AUC (0.9962) with published EMBER LightGBM numbers and for ruling out probe-pair contamination of the holdout evaluation.
minor comments (8)
  1. [Table IV] Table IV: the feature counts (107 for VAE+Mandelbrot, 113 for +PINNFlow) imply 32 escape-time coordinates plus 11 summary statistics and 6 PINNFlow metrics, but this arithmetic is never itemized; a short table of feature composition would help.
  2. [§V, Algorithm 1] Bootstrap confidence intervals are computed per Algorithm 1 (line 25) but never actually reported in any results table; either report them (at least for Table IV) or remove the claim.
  3. [§V.C, Figs. 6–7] Figs. 6 and 7: the 2D projection method is not stated (PCA of the latent? UMAP? t-SNE?), making the class-overlap discussion in §V.C hard to interpret.
  4. [§III.A, §III.D] Notation inconsistency: T_t(x) with T_1(x) = x' in §III.A vs. T(x) in Algorithm 1 (line 14); also K in Eq. (7) is used without being tied to the number of complex pairs (m/2 = 32).
  5. [References] Reference [17] (Park & Yener survey) appears in the bibliography but does not seem to be cited in the text.
  6. [§IV.A, Fig. 1] Fig. 1 (training class balance) carries no information beyond what one sentence could state; EMBER 2018 is balanced by construction.
  7. [§VII] §VII (generalization to phishing, fraud, IDS) is explicitly framed as hypothesis but still reads as padding; it could be shortened to a paragraph without loss.
  8. [§III.B, §V.A] The VAE reconstruction loss L_rec is never reported; given the denoising objective (§III.B), a reconstruction-quality number or sample check would support the claim that the latent space preserves 'security-relevant structure.'

Circularity Check

1 steps flagged

No significant circularity: diagnostics are defined metrics and empirical ablations on external EMBER labels, not self-fulfilling predictions.

specific steps
  1. self definitional [§III.E Eqs. 8–10; §V.F Fig. 10 / Table VIII (PINNFlow shifts)]
    "PINNFlow uses an advection-style residual R_θ(z_t, t)=∂u_θ/∂t + v_θ(z_t,t)^⊤ ∇_z u_θ(z_t,t). The training objective is L_flow = λ_T L_transition + λ_y L_sup + λ_R ∥R_θ∥²_2 + λ_E ∥v_θ∥²_2. ... PINNFlow contributes unique diagnostics: residual shift, velocity-norm shift, risk-probability shift, gradient-norm shift..."

    Residual (and related flow) quantities are penalized during training on pseudo-trajectories z_t=(1-t)z_0+t z_1, then residual/velocity/risk shifts on similar perturbation paths are reported as diagnostics. Those particular shift numbers partly reflect the trained inductive bias rather than an independent external observable. This is mild and non-load-bearing: the paper’s comparative robustness claim is F1 under probes (Table VI), not that residual magnitude itself predicts a held-out physical law.

full rationale

This is a representation-diagnostics and ablation paper, not a first-principles derivation. Clean and perturbed classification use fixed LightGBM against external EMBER labels; Full and PCA-64 baselines are independent of the proposed modules. LED is explicitly defined as mean L1 change of Mandelbrot-inspired escape-time profiles (Eq. 7) and then measured—definitional measurement, not a fitted quantity re-presented as a prediction. PINNFlow is trained with transition/supervised/residual/energy losses on linear latent interpolations and later reports residual/velocity/risk shifts; those shift diagnostics partly echo the inductive bias, but the load-bearing empirical claim (F1 robustness of VAE+Mandelbrot+PINNFlow vs VAE+Mandelbrot on holdout probes, Table VI) is an independent classifier evaluation, not forced by construction. No self-citation uniqueness theorem, no ansatz smuggled as external fact, and the paper repeatedly disclaims that malware is fractal or physical. Score 1 only for the mild train-residual / report-residual diagnostic coupling, which is not central or self-fulfilling.

Axiom & Free-Parameter Ledger

6 free parameters · 5 axioms · 3 invented entities

The central diagnostic claim rests on treating synthetic feature-space operators as meaningful stability probes; on using Mandelbrot escape-time and PINN advection residuals as mathematical lenses without physical/fractal malware ontology; and on several hand-chosen architecture and loss hyperparameters. Classification labels and EMBER features are standard external inputs. No new physical entity is postulated, but LED, escape-time fingerprints, and PINNFlow diagnostics are paper-invented measurement constructs whose security relevance depends on the probe assumption.

free parameters (6)
  • VAE beta and KL schedule = beta=0.5, warmup=15 epochs, free_bits=0.01
    beta=0.5 with linear warm-up over 15 epochs and free-bits floor 0.01 are chosen to avoid posterior collapse; they shape the latent geometry that all LED/PINN diagnostics depend on.
  • Latent dimension k = 64
    Fixed at 64 for PCA/VAE comparability; controls capacity and all compressed metrics.
  • Escape-time iteration parameters (N, r, rho) = N=64, r=2.0, rho bounds tanh-mapped coords
    N=64 iterations, escape radius r=2.0, and scale rho in the tanh complex map define τ(z) and thus LED; chosen by convention/hand, not derived.
  • PINNFlow loss weights λ_T, λ_y, λ_R, λ_E = 1.0, 1.0, 0.5, 1e-4
    Balance transition, supervised, residual, and energy terms; directly affect learned velocity/risk fields and reported shifts.
  • Denoising noise std and training epochs = noise_std=0.03; 40 / 25 epochs
    Input corruption level 0.03, 40 VAE epochs, 25 PINNFlow epochs are experimental knobs affecting representation quality.
  • Boundary uncertainty quantile q_α = unspecified numeric q_α (fraction of most uncertain samples)
    Defines the uncertain set B_α for box-counting dimension; hand-chosen fraction of scores near 0.5.
axioms (5)
  • domain assumption Feature-space perturbation operators T_t on EMBER vectors are valid instruments for studying security-relevant latent stability even when they do not preserve PE functionality or malicious semantics.
    Stated throughout §II.C, §IV.C, and Limitations; load-bearing for interpreting LED and PINN shifts as malware-relevant.
  • ad hoc to paper Mandelbrot escape-time on paired VAE coordinates is a meaningful nonlinear sensitivity descriptor of latent stability (not of malware semantics per se).
    §III.C–D introduces τ_j and LED; justified as mathematical lens, not derived from PE structure.
  • ad hoc to paper Linear interpolation z_t=(1-t)z_0+t z_1 is an adequate pseudo-trajectory for imposing an advection-style PINN residual on perturbation paths.
    §III.E Eq. (8)–(9); standard PINN-style construction without malware-specific dynamics.
  • domain assumption Holding LightGBM fixed isolates representation quality across Full/PCA/VAE/PINN variants.
    §II.B and experimental design; common practice but ties all rankings to one classifier family.
  • standard math Standard VAE ELBO, PCA, box-counting dimension, and McNemar/bootstrap testing apply as used.
    Background methods cited from Kingma & Welling, Jolliffe, Falconer, etc.
invented entities (3)
  • Latent Escape Divergence (LED) no independent evidence
    purpose: Scalar measure of mean absolute change in Mandelbrot-inspired escape-time profiles between clean and perturbed latents.
    Defined in §III.D Eq. (7); primary novel diagnostic. No external validation that high LED predicts real PE evasion better than latent L2 or confidence.
  • PINNFlow latent-flow module (malware setting) no independent evidence
    purpose: Learn velocity and risk potential over pseudo-time perturbation trajectories and emit residual/velocity/risk/gradient/displacement shift features.
    §III.E; PINNs exist, but this transport residual over EMBER latent pairs and the six diagnostic features are paper-specific constructs.
  • VAE latent Mandelbrot escape-time fingerprint τ(z) no independent evidence
    purpose: Map standardized latent pairs to complex c_j and produce normalized escape-time vectors as stability descriptors.
    §III.C; escape-time is classical, but its use as a malware latent fingerprint concatenated into classifier features is introduced here.

pith-pipeline@v1.2.0-grok45-kimik3 · 16849 in / 4244 out tokens · 78806 ms · 2026-07-31T11:06:15.824312+00:00 · methodology

0 comments
read the original abstract

Static malware detectors are commonly evaluated using clean-sample metrics such as accuracy, F1, ROC AUC, and PR AUC. However, these metrics provide limited insight into how learned malware representations behave when feature vectors are perturbed, how close samples move toward uncertain decision regions, or whether compressed representations preserve security-relevant structure. This paper presents a latent-stability analysis pipeline for malware perturbation assessment in EMBER feature space. The pipeline compares full EMBER features, PCA-based compression, beta/denoising variational autoencoder representations, Mandelbrot-inspired escape-time descriptors, and a PINN-style latent-flow module. We define Latent Escape Divergence (LED) to measure changes in escape-time profiles under perturbation, and use PINNFlow-derived residual, velocity, risk, and gradient-shift metrics to characterize latent movement. Experiments are conducted on EMBER static PE feature vectors using 180,000 training samples, 180,000 test samples, and 240,000 holdout samples. Full EMBER features achieve the strongest clean classification performance with ROC AUC of 0.9962 and F1 of 0.9713, while PCA-64 is the strongest compressed baseline with ROC AUC of 0.9846 and F1 of 0.9347. The proposed VAE+Mandelbrot+PINNFlow representation does not outperform these baselines for clean classification, but it provides additional diagnostic value under controlled feature-space perturbation probes.

Figures

Figures reproduced from arXiv: 2607.24896 by Bamidele Ajayi, Ken McGarry.

Figure 1
Figure 1. Figure 1: EMBER training class balance. where N(ϵ) is the number of occupied boxes of side length ϵ. Fractal descriptors are relevant because evasion often exploits irregular or high-curvature decision regions: more intricate uncertain boundaries can imply greater sensitivity to small representation movements. The paper uses this as a descriptive statistic, not as proof of fractal malware semantics. IV. EXPERIMENTAL… view at source ↗
Figure 2
Figure 2. Figure 2: Overall architecture of the malware latent-stability analysis pipeline. Static PE feature vectors are cleaned and scaled, then passed through full-feature, [PITH_FULL_IMAGE:figures/full_fig_p005_2.png] view at source ↗
Figure 3
Figure 3. Figure 3: Perturbation-stability and external PE-pair evaluation workflow. Holdout samples are perturbed using controlled feature-space probes, while externally [PITH_FULL_IMAGE:figures/full_fig_p005_3.png] view at source ↗
Figure 4
Figure 4. Figure 4: Training diagnostics. The VAE avoids the earlier near-zero-KL collapse, and PINNFlow learns transition, supervised, residual, and energy terms. [PITH_FULL_IMAGE:figures/full_fig_p006_4.png] view at source ↗
Figure 5
Figure 5. Figure 5: Clean classification ablation. Full features and PCA-64 remain strongest, while VAE+Mandelbrot+PINNFlow-64 is best among the VAE-derived [PITH_FULL_IMAGE:figures/full_fig_p007_5.png] view at source ↗
Figure 6
Figure 6. Figure 6: Latent visualizations for PCA and VAE representations. [PITH_FULL_IMAGE:figures/full_fig_p008_6.png] view at source ↗
Figure 7
Figure 7. Figure 7: Complex-dynamical and PINNFlow latent visualizations. PINNFlow changes the geometry but does not eliminate class overlap. [PITH_FULL_IMAGE:figures/full_fig_p008_7.png] view at source ↗
Figure 8
Figure 8. Figure 8: Distribution of mean normalized Mandelbrot-inspired escape time [PITH_FULL_IMAGE:figures/full_fig_p009_8.png] view at source ↗
Figure 9
Figure 9. Figure 9: Mean Latent Escape Divergence under perturbation probes. LED [PITH_FULL_IMAGE:figures/full_fig_p009_9.png] view at source ↗
Figure 10
Figure 10. Figure 10: PINNFlow-specific perturbation diagnostics. These features isolate the PINN contribution, unlike LED which is driven by the Mandelbrot escape [PITH_FULL_IMAGE:figures/full_fig_p010_10.png] view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

28 extracted references · 9 linked inside Pith

  1. [1]

    Data mining methods for detection of new malicious executables,

    M. G. Schultz, E. Eskin, E. Zadok, and S. J. Stolfo, “Data mining methods for detection of new malicious executables,” inProc. IEEE Symposium on Security and Privacy Workshops, 2001

    2001

  2. [2]

    Learning to detect and classify malicious executables in the wild,

    J. Z. Kolter and M. A. Maloof, “Learning to detect and classify malicious executables in the wild,”Journal of Machine Learning Research, vol. 7, pp. 2721–2744, 2006

    2006

  3. [3]

    EMBER: An open dataset for training static PE malware machine learning models,

    H. S. Anderson and P. Roth, “EMBER: An open dataset for training static PE malware machine learning models,” arXiv preprint arXiv:1804.04637, 2018

    Pith/arXiv arXiv 2018

  4. [4]

    BOD- MAS: An open dataset for learning based temporal analysis of PE malware,

    L. Yang, A. Ciptadi, I. Laziuk, A. Ahmadzadeh, and G. Wang, “BOD- MAS: An open dataset for learning based temporal analysis of PE malware,” inProc. IEEE Security and Privacy Workshops, 2021

    2021

  5. [5]

    EMBER2024: A benchmark dataset for holistic evaluation of malware classifiers,

    R. J. Joyce, G. Miller, P. Roth, R. Zak, E. Zaresky-Williams, H. Anderson, E. Raff, and J. Holt, “EMBER2024: A benchmark dataset for holistic evaluation of malware classifiers,” arXiv preprint arXiv:2506.05074, 2025

    Pith/arXiv arXiv 2025

  6. [6]

    LightGBM: A highly efficient gradient boosting decision tree,

    G. Ke, Q. Meng, T. Finley, T. Wang, W. Chen, W. Ma, Q. Ye, and T.-Y . Liu, “LightGBM: A highly efficient gradient boosting decision tree,” in Advances in Neural Information Processing Systems, vol. 30, 2017

    2017

  7. [7]

    Malware detection by eating a whole EXE,

    E. Raff, J. Barker, J. Sylvester, R. Brandon, B. Catanzaro, and C. Nicholas, “Malware detection by eating a whole EXE,” arXiv preprint arXiv:1710.09435, 2017

    Pith/arXiv arXiv 2017

  8. [8]

    Intriguing properties of neural networks,

    C. Szegedy, W. Zaremba, I. Sutskever, J. Bruna, D. Erhan, I. Goodfellow, and R. Fergus, “Intriguing properties of neural networks,” inInternational Conference on Learning Representations, 2014

    2014

  9. [9]

    Explaining and harnessing adversarial examples,

    I. J. Goodfellow, J. Shlens, and C. Szegedy, “Explaining and harnessing adversarial examples,” inInternational Conference on Learning Repre- sentations, 2015

    2015

  10. [10]

    Practical black-box attacks against machine learning,

    N. Papernot, P. McDaniel, I. Goodfellow, S. Jha, Z. B. Celik, and A. Swami, “Practical black-box attacks against machine learning,” inProc. ACM Asia Conference on Computer and Communications Security, pp. 506–519, 2017

    2017

  11. [11]

    Evasion attacks against machine learning at test time,

    B. Biggio, I. Corona, D. Maiorca, B. Nelson, N. Srndic, P. Laskov, G. Giacinto, and F. Roli, “Evasion attacks against machine learning at test time,” inJoint European Conference on Machine Learning and Knowledge Discovery in Databases, pp. 387–402, Springer, 2013

    2013

  12. [12]

    Learning to evade static PE machine learning malware models via reinforcement learning,

    H. S. Anderson, A. Kharkar, B. Filar, D. Evans, and P. Roth, “Learning to evade static PE machine learning malware models via reinforcement learning,” arXiv preprint arXiv:1801.08917, 2018

    Pith/arXiv arXiv 2018

  13. [13]

    Adversarial malware binaries: Evading deep learning for malware detection in executables,

    B. Kolosnjaji, A. Demontis, B. Biggio, D. Maiorca, G. Giacinto, C. Eckert, and F. Roli, “Adversarial malware binaries: Evading deep learning for malware detection in executables,” inProc. European Signal Processing Conference, pp. 533–537, 2018

    2018

  14. [14]

    Adversarial EXEmples: A survey and experimental evaluation of practical attacks on machine learning for Windows malware detection,

    L. Demetrio, S. E. Coull, B. Biggio, G. Lagorio, A. Armando, and F. Roli, “Adversarial EXEmples: A survey and experimental evaluation of practical attacks on machine learning for Windows malware detection,” arXiv preprint arXiv:2008.07125, 2020

    Pith/arXiv arXiv 2008

  15. [15]

    secml-malware: Pentesting Windows mal- ware classifiers with adversarial EXEmples in Python,

    L. Demetrio and B. Biggio, “secml-malware: Pentesting Windows mal- ware classifiers with adversarial EXEmples in Python,” arXiv preprint arXiv:2104.12848, 2021

    Pith/arXiv arXiv 2021

  16. [16]

    MAB-Malware: A reinforcement learning framework for attacking static malware classifiers,

    W. Song, X. Li, S. Afroz, D. Garg, D. Kuznetsov, and H. Yin, “MAB-Malware: A reinforcement learning framework for attacking static malware classifiers,” arXiv preprint arXiv:2003.03100, 2020

    Pith/arXiv arXiv 2003

  17. [17]

    A survey on practical adversarial examples for malware classifiers,

    D. Park and B. Yener, “A survey on practical adversarial examples for malware classifiers,” arXiv preprint arXiv:2011.05973, 2020

    Pith/arXiv arXiv 2011

  18. [18]

    I. T. Jolliffe,Principal Component Analysis, 2nd ed. Springer, 2002

    2002

  19. [19]

    Nonlinear component analysis as a kernel eigenvalue problem,

    B. Sch ¨olkopf, A. Smola, and K.-R. M ¨uller, “Nonlinear component analysis as a kernel eigenvalue problem,”Neural Computation, vol. 10, no. 5, pp. 1299–1319, 1998

    1998

  20. [20]

    UMAP: Uniform manifold approximation and projection for dimension reduction,

    L. McInnes, J. Healy, and J. Melville, “UMAP: Uniform manifold approximation and projection for dimension reduction,” arXiv preprint arXiv:1802.03426, 2018

    Pith/arXiv arXiv 2018

  21. [21]

    Auto-encoding variational Bayes,

    D. P. Kingma and M. Welling, “Auto-encoding variational Bayes,” in International Conference on Learning Representations, 2014

    2014

  22. [22]

    Extracting and composing robust features with denoising autoencoders,

    P. Vincent, H. Larochelle, Y . Bengio, and P.-A. Manzagol, “Extracting and composing robust features with denoising autoencoders,” inProc. International Conference on Machine Learning, pp. 1096–1103, 2008

    2008

  23. [23]

    beta-V AE: Learning basic visual concepts with a constrained variational framework,

    I. Higgins, L. Matthey, A. Pal, C. Burgess, X. Glorot, M. Botvinick, S. Mohamed, and A. Lerchner, “beta-V AE: Learning basic visual concepts with a constrained variational framework,” inInternational Conference on Learning Representations, 2017

    2017

  24. [24]

    B. B. Mandelbrot,The Fractal Geometry of Nature. W. H. Freeman, 1982

    1982

  25. [25]

    Falconer,Fractal Geometry: Mathematical Foundations and Appli- cations

    K. Falconer,Fractal Geometry: Mathematical Foundations and Appli- cations. John Wiley & Sons, 1990

    1990

  26. [26]

    R. L. Devaney,An Introduction to Chaotic Dynamical Systems, 2nd ed. Addison-Wesley, 1989

    1989

  27. [27]

    Physics-informed neu- ral networks: A deep learning framework for solving forward and inverse problems involving nonlinear partial differential equations,

    M. Raissi, P. Perdikaris, and G. E. Karniadakis, “Physics-informed neu- ral networks: A deep learning framework for solving forward and inverse problems involving nonlinear partial differential equations,”Journal of Computational Physics, vol. 378, pp. 686–707, 2019

    2019

  28. [28]

    Characterizing possible failure modes in physics-informed neural networks,

    A. S. Krishnapriyan, A. Gholami, S. Zhe, R. M. Kirby, and M. W. Mahoney, “Characterizing possible failure modes in physics-informed neural networks,” inAdvances in Neural Information Processing Systems, vol. 34, 2021

    2021