Pith. sign in

REVIEW 5 major objections 5 minor 1 cited by

TIF: Learning Temporal Invariance in Android Malware Detectors

T0 review · 5 major / 5 minor · reviewed 2026-08-08 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read TIF makes Android malware detectors learn time-stable features by partitioning training data into monthly environments and aligning invariant gradients, slowing performance decay after deployment.

desk verdict TIF is a solid empirical package for drift-robust malware detection, but the temporal-ordering claim needs a random-environment control; still worth serious review. read the letter →

arxiv 2502.05098 v3 pith:6ESUAHBC submitted 2025-02-07 cs.CR cs.AI

Xinran Zheng , Shuo Yang , Edith C.H. Ngai , Suman Jana , Lorenzo Cavallaro This is my paper · ORCID
classification cs.CRcs.AI
keywords Androidmalwaredetectionconceptdrifttemporalinvariantlearningmulti-proxycontrastivegradientalignmentdistributionshiftrepresentation
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Learning-based Android malware detectors lose accuracy as malware evolves, because standard empirical risk minimization locks onto features that are discriminative today but unstable tomorrow. This paper argues that invariant learning can fix this if the training data is sliced by time into environments that expose the drift, and if the encoder is forced to both represent the diversity within each class and align its gradients across environments. The proposed TIF framework does exactly that: it partitions training apps by observation date, uses multi-proxy contrastive learning to capture varied malware sub-structures, and applies invariant gradient alignment to suppress time-specific features. On a decade-long Android dataset, TIF attached to existing detectors improves first-year F1 by up to about 8 percent and reduces the number of retraining updates needed under continual learning by roughly 41 percent. The paper's claim is that TIF is a plug-in training paradigm for any learning-based malware detector, not a new detector or feature space.

What carries the argument

The load-bearing objects are the temporal environment partition and the two loss modules. The partition assigns each training app to environment $e$ via $E(x_i) = \lfloor (t_i - T_{\min})/\Delta \rfloor$, with $\Delta$ chosen as one month in the main experiments; this is what reveals drift without requiring environment labels. Multi-proxy contrastive learning keeps $K$ learnable proxy vectors per class, softly assigns samples to proxies through a temperature-scaled softmax, and adds intra-class diversity and inter-class separation terms; this gives the encoder high-quality, varied representations of malware families despite severe class imbalance. Invariant gradient alignment replaces the shared dummy classifier of invariant risk minimization with per-environment scalar classifiers $s_e$ and penalizes $\sum_e \|\nabla_{s_e} R^e(s_e \circ \phi)\|^2$, aligning gradients so the same classifier works across all months. The two-stage schedule, amplify discriminative information first and then suppress unstable information, is what makes the invariant penalty effective rather than collapsing to a trivial representation.

What would settle it

On the paper's dataset, compute the number of malicious apps in each 2014 monthly environment; if any month has fewer than, say, 20 malicious samples, train TIF on that split and compare its AUT(F1, 12m) on 2015 against plain ERM. If the gain disappears or turns negative under such imbalance, the temporal-environment assumption is the weak link. A complementary test: shuffle the 2014 samples randomly into pseudo-environments and re-run TIF; the claimed gain should vanish if time itself, rather than environment size, is what exposes drift.

Watch

Extended reading notes

Core claim

The central claim is that the brittleness of learning-based Android malware detectors under natural drift is not fixed by better features or more frequent retraining alone; it is fixed by training the encoder to be invariant across temporal environments. TIF segments the labeled training set (2014 samples in the evaluation) into monthly environments via observation dates, then runs a two-stage procedure: first, a multi-proxy contrastive loss amplifies discriminative representations by softly assigning samples to several learnable proxies per class; second, an invariant gradient alignment penalty, a modification of the standard invariant-risk-minimization penalty that uses per-environment dummy classifiers, forces the encoder to produce representations whose gradients are similar across environments. The result, the paper reports, is a detector that keeps stable, discriminative features in focus and therefore degrades more slowly, with the largest gains in the first years after deployment. This is presented as an orthogonal enhancement: TIF changes the training objective, not the model architecture or the feature space.

Load-bearing premise

The approach assumes that calendar-month slices of the training data expose the unstable features that invariant learning should suppress, and that every monthly slice has enough malicious samples for the contrastive and gradient-alignment losses to be statistically meaningful; if a month has very few malware samples, the invariance penalty may amplify sampling noise instead of suppressing drift.

Editorial extensions

If this is right

  • Detectors trained with TIF should degrade more slowly in the first years after deployment, which is exactly the period when retraining budgets are tightest.
  • Because the framework changes only the training objective, it can be layered onto any future feature space or model architecture without redesign.
  • In a continual-learning setting, TIF lowers labeling cost: the paper's comparison shows the TIF-equipped pipeline needed 38 updates over 84 months versus 65 for the state-of-the-art continual baseline.
  • In both closed-world and open-world drift scenarios, the invariant representations achieve higher feature-contribution scores, indicating the model relies on stable, discriminative features rather than time-specific cues.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If time is only one of several drift axes, the same recipe could be applied with environments defined by other recorded metadata (such as app store, country, or Android version) to expose non-temporal spurious correlations, though the paper does not test this.
  • The core assumption that temporal drift is the dominant form of natural drift may break for datasets collected over short periods or with irregular sampling, so a natural extension would be to measure TIF's gains as a function of training-span length.
  • Because TIF only needs timestamps at training time, it could be lifted to other security classifiers that log detection dates, such as network intrusion detection, where gains would likely be largest in domains with family-like evolution.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

5 major / 5 minor

Summary. The paper proposes TIF, a training framework intended to make learning-based Android malware detectors robust to natural distribution drift over time. TIF partitions the training data into temporal environments based on application observation dates (Eq. 10), then applies a two-stage procedure: a discriminative-information amplification stage using multi-proxy contrastive learning (MPC), and an unstable-information suppression stage combining MPC with invariant gradient alignment (IGA, Eq. 18). The authors claim that TIF is model- and feature-agnostic, and they evaluate it on a decade-long AndroZoo-derived dataset across Drebin/DeepDrebin, Malscan, and BERTroid feature representations, reporting AUT(F1,12m) gains over ERM and several baselines, especially in the first deployment years. The paper also includes closed-world/open-world drift scenarios, an ablation study, a study of environment granularity, a comparison to continual learning with HCC, and a comparison to standard regularization methods.

Significance. If the empirical claims hold, TIF addresses a practically important problem: detectors deployed on a fixed training snapshot degrade sharply as malware evolves, and TIF's reported gains in the early deployment years (e.g., 8.16% AUT improvement over DeepDrebin in 2015) are material. The paper is well positioned within the malware-drift literature and makes a principled connection to invariant learning. The authors are careful to follow the TESSERACT temporal-bias methodology, evaluate multiple feature spaces, include a two-stage ablation, and study environment granularity. They also state an intention to release code and dataset metadata. However, the central temporal-invariance claim is not yet fully supported: the paper lacks a control that removes temporal ordering while keeping environment sizes fixed, reports no variance or significance testing despite averaging over three seeds, and selects environment granularity after inspecting test-period results. These issues are addressable and do not invalidate the core idea, but they need to be resolved before the claims can be accepted.

major comments (5)
  1. [Section IV-C and Table V] The paper varies environment granularity (monthly, quarterly, equal-sized n=4,8,12) but never varies the ordering of samples into environments. A control where the same number and sizes of environments are formed by random assignment, or by permuting timestamps, is necessary to attribute the observed gains to temporal ordering rather than to the multi-proxy/alignment regularization alone. This is especially important because the ablation in Table IV shows MPC1 alone raises AUT from 0.859 to 0.902 for 2015, so a random-environment control could reveal that the temporal mechanism contributes little beyond the regularizer. Please add such a control and report the comparison.
  2. [Section V (intro) and Tables I, IV, VI] The evaluation section states that all experiments were run with random seeds 1, 42, and 2024 and results averaged, but no standard deviations, confidence intervals, or significance tests are reported anywhere. Many comparisons involve small differences (e.g., Table I, DeepDrebin 2018: TIF 0.794 vs APIGraph-style baseline around 0.79; Table V, monthly vs quarterly in 2019: 0.769 vs 0.775). Without measure of variance, the reader cannot judge whether the reported gains, especially the smaller ones in later years and in the ablation additions, are stable across seeds. Please report per-seed results or variance and run pairwise significance tests.
  3. [Section V-F and Table V] Environment granularity is selected after inspecting the test-period results. Table V shows monthly splitting is not uniformly best: quarterly achieves higher AUT in 2020 (0.764 vs 0.732), 2021 (0.750 vs 0.717), 2022 (0.717 vs 0.688), and 2023 (0.690 vs 0.665). The justification that monthly is preferable for short-term stability is post hoc and risks overfitting the evaluation horizon. Please either select the granularity on a validation split that is not part of the test period, or report results for both granularities as primary analyses and clearly label the selection rule.
  4. [Section V-A3] The claim that TIF can be 'seamlessly integrated into any learning-based detector' is not supported by the experimental setup, because all experiments use a two-layer linear classifier applied to each feature representation rather than the original detectors' architectures. For example, DeepDrebin's original network is a three-layer DNN, and BERTroid involves a pretrained transformer. The current setup tests TIF as a representation-level training method on fixed feature spaces, not as a drop-in replacement for the original training loop. Please either evaluate TIF with at least the original architecture for one or two detectors, or temper the integration claim to 'any feature representation coupled with a linear classifier'.
  5. [Section IV-C and Section V-A1] The paper does not report the number of samples, or the number of malicious samples, in each temporal environment. With only 23,302 malicious apps out of 217,280 total, monthly environments in early 2014 may be very small and severely label-imbalanced, which would make the proxy alignment loss in Eq. 13 and the invariant gradient penalty in Eq. 18 noisy and possibly dominated by sampling artifacts. Please report the per-environment sample and label counts for the chosen granularity, and include an analysis of whether the results are stable when small or highly imbalanced environments are removed or merged.
minor comments (5)
  1. [Table IV] The table header reads 'AUR(F1, 12m)' but the metric is AUT (Area Under Time); please correct the abbreviation.
  2. [Section V-E] The ablation text says the experiments use 'the Drebin detector,' but Table IV and the surrounding text refer to DeepDrebin; please unify the terminology so the base architecture is unambiguous.
  3. [Section V-A3] The label 'DeepDrebin [41]' is used both as a detector name and as a feature-space/architecture configuration; consider distinguishing the Drebin feature space from the DeepDrebin architecture in the tables and text.
  4. [Section VI-A2] The update-trigger rule based on F1 < 0.90 is explicitly described as explanatory, but no sensitivity analysis is provided for this threshold; a brief discussion of how the comparison depends on the chosen threshold would clarify the continual-learning results.
  5. [Section V-A1] The malware ground-truth threshold (vt=4) is described as 'low' and intended to be challenging, but the paper does not report how many samples are near the threshold or how label noise might affect the temporal-invariance evaluation; a short analysis of label robustness would strengthen the results.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity found: TIF's temporal-invariance claims are empirical and the reported gains are not equivalent to the training objective or fitted parameters.

full rationale

The central claim of the paper is empirical: TIF defines a training objective (Eqs. 17, 20, 21) and evaluates whether detectors trained with it generalize to future-year samples. The reported quantities—AUT(F1,12m), monthly F1, update counts, and FCS—are computed on held-out temporal splits and are not identical by construction to any fitted parameter or component of the loss. The environment partition in Eq. 10 uses observation dates, but the test results are obtained on samples outside the 2014 training interval, so the improvement is not a refit of the input. The ablation in Table IV compares configurations on the same train/test split, and the fact that MPC1 alone provides part of the gain does not make the full-model result circular. Self-citations (TESSERACT, Euphony, Transcend) are used for evaluation methodology, family labeling, and related-work framing rather than as the sole justification of the invariance claim; these are external or standardized tools with independent content. The absence of a shuffled-environment control is a limitation for causal attribution of the gains to temporal ordering, but that is an experimental-design issue, not a circular reduction.

Assumptions & free parameters 6 free parameters · 4 assumptions · 0 invented entities

TIF introduces no new physical entities; the 'proxies' are learned parameters, and 'environments' are constructed from timestamps. The main unstated inputs are hyperparameters and the assumption that temporal segmentation matches the true drift structure.

free parameters (6)
  • Environment granularity Delta = monthly (evaluated quarterly, n=4,8,12)
    Section V-F selects monthly partitioning after comparing on test data; this choice affects all reported results.
  • Number of proxies K = not reported
    Multi-proxy contrastive module in Section IV-D relies on K learnable proxies per class; value is not stated.
  • Temperature tau = not reported
    Similarity scaling in Eq. 11 requires a temperature, not specified.
  • Margin m = not reported
    Inter-class separation loss in Eq. 16 uses a margin.
  • Loss weights alpha, beta = not reported
    Weights in Eqs. 20 and 21; no values or tuning procedure given.
  • Proxy update hyperparameters = not reported
    Proxy update mechanism in Figure 4 and Algorithm 1 is described qualitatively; momentum or learning rates unspecified.
assumptions (4)
  • standard math Invariant risk minimization theory applies when environments expose spurious correlations (Arjovsky et al., 2019).
    The framework relies on the IRM principle that a classifier optimal across environments will use invariant features; cited in Section II-C.
  • domain assumption Observation dates from Androzoo reflect the time of malware discovery and thus the temporal drift signal.
    Section V-A1 uses VirusTotal submission dates as the timestamp; if these do not track real-world evolution, environments are misaligned.
  • domain assumption The training and test label spaces are the same binary categories (benign/malware) and samples have unknown semantic similarities.
    Stated in Section IV-A2; the method does not handle new classes beyond the binary labels.
  • ad hoc to paper The two-layer linear classifier applied to each feature representation is a valid stand-in for the original detectors' architectures when claiming model-agnostic integration.
    Section V-B3 describes using the same classifier head for all feature spaces, which limits the generality of the 'any detector' claim.

how reviews work

0 comments
Cite this review

Pith. "Pith review of TIF: Learning Temporal Invariance in Android Malware Detectors." pith.science (2026). https://pith.science/paper/6ESUAHBC

@misc{pith2026250205098,
  author       = {Pith},
  title        = {Pith review of: TIF: Learning Temporal Invariance in Android Malware Detectors},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/6ESUAHBC}},
  note         = {Machine review of arXiv:2502.05098}
}
read the original abstract

Learning-based Android malware detectors degrade over time due to natural distribution drift caused by malware variants and new families. This paper systematically investigates the challenges classifiers trained with empirical risk minimization (ERM) face against such distribution shifts and attributes their shortcomings to their inability to learn \emph{stable} discriminative features. Invariant learning theory offers a promising solution by encouraging models to generate stable representations across environments that expose the instability of the training set. However, the lack of prior environment labels, the diversity of drift factors, and low-quality representations caused by diverse families make this task challenging. To address these issues, we propose TIF, the first temporal invariant training framework for malware detection, which aims to enhance the ability of detectors to learn stable representations across time. TIF organizes environments based on application observation dates to reveal temporal drift, integrating specialized multi-proxy contrastive learning and invariant gradient alignment to generate and align environments with high-quality, stable representations. TIF can be seamlessly integrated into any learning-based detector. Experiments on a decade-long dataset show that TIF excels, particularly in early deployment stages, addressing real-world needs and outperforming state-of-the-art methods.

Figures

Figures reproduced from arXiv: 2502.05098 by the authors.

Figure 1
Figure 1. The top-10 families’ proportions vary over time; zero [PITH_FULL_IMAGE:figures/full_fig_p003_1.png] view at source ↗
Figure 2
Figure 2. (a), (b), and (c) show real code snippets from an early Airpush version, a later Airpush version, and the Hiddad adware [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 3
Figure 3. (a) and (b) illustrate changes in the discriminability of the top 10 discriminative training features and the top 10 [PITH_FULL_IMAGE:figures/full_fig_p006_3.png] view at source ↗
Figures from the paper (6 more)
Figure 4
Figure 4. Figure 4: The proposed invariant training framework and its core components [PITH_FULL_IMAGE:figures/full_fig_p007_4.png]
Figure 5
Figure 5. Figure 5: Monthly performance of DeepDrebin (a), Malscan (b), [PITH_FULL_IMAGE:figures/full_fig_p011_5.png]
Figure 6
Figure 6. Figure 6: The variance in malware feature representation simi [PITH_FULL_IMAGE:figures/full_fig_p012_6.png]
Figure 7
Figure 7. Figure 7: Discriminability for the Top-10 important features after [PITH_FULL_IMAGE:figures/full_fig_p013_7.png]
Figure 8
Figure 8. Figure 8: F1 scores for TIF and HCC [8] in the no continual learning scenario. A subscript of -1 indicates the result of the model on the initial validation set. 0 20 40 60 80 Date (as Month Index) 0.0 0.2 0.4 0.6 0.8 1.0 F1 Score HCC F1 TIF F1 [PITH_FULL_IMAGE:figures/full_fig…
Figure 9
Figure 9. Figure 9: Detection performance of HCC [8] and the proposed [PITH_FULL_IMAGE:figures/full_fig_p014_9.png]

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. Malaika: Understanding Malware through Tri-Grounded Agentic Reasoning

    cs.CR 2026-07 conditional novelty 6.0 of 10

    A tri-grounded multi-agent harness improves precision and auditability of Android malware behavior reports over fixed LLM pipelines and frontier coding agents.

Reference graph

Works this paper leans on

53 extracted references · 40 canonical work pages · cited by 1 Pith paper

  1. [1]

    Transcending transcend: Revisiting malware classification in the presence of concept drift,

    F. Barbero, F. Pendlebury, F. Pierazzi, and L. Cavallaro, “Transcending transcend: Revisiting malware classification in the presence of concept drift,” in2022 IEEE Symposium on Security and Privacy (SP). IEEE, 2022, pp. 805–823

    2022

  2. [2]

    {CADE}: Detecting and explaining concept drift samples for security applications,

    L. Yang, W. Guo, Q. Hao, A. Ciptadi, A. Ahmadzadeh, X. Xing, and G. Wang, “{CADE}: Detecting and explaining concept drift samples for security applications,” in30th USENIX Security Symposium (USENIX Security 21), 2021, pp. 2327–2344

    work page 2021

  3. [3]

    Exploiting code symmetries for learning program semantics,

    K. Pei, W. Li, Q. Jin, S. Liu, S. Geng, L. Cavallaro, J. Yang, and S. Jana, “Exploiting code symmetries for learning program semantics,” inForty-first International Conference on Machine Learning (Spotlight),

    work page

  4. [4]

    {TESSERACT}: Eliminating experimental bias in malware classifi- cation across space and time,

    F. Pendlebury, F. Pierazzi, R. Jordaney, J. Kinder, and L. Cavallaro, “{TESSERACT}: Eliminating experimental bias in malware classifi- cation across space and time,” in28th USENIX security symposium (USENIX Security 19), 2019, pp. 729–746

    2019

  5. [5]

    Is it overkill? analyzing feature- space concept drift in malware detectors,

    Z. Chen, Z. Zhang, Z. Kan, L. Yang, J. Cortellazzi, F. Pendlebury, F. Pierazzi, L. Cavallaro, and G. Wang, “Is it overkill? analyzing feature- space concept drift in malware detectors,” in2023 IEEE Security and Privacy Workshops (SPW). IEEE, 2023, pp. 21–28

    work page 2023

  6. [6]

    Drift forensics of malware classifiers,

    T. Chow, Z. Kan, L. Linhardt, L. Cavallaro, D. Arp, and F. Pierazzi, “Drift forensics of malware classifiers,” inProceedings of the 16th ACM Workshop on Artificial Intelligence and Security, 2023, pp. 197–207

    work page 2023

  7. [7]

    Recent advances in concept drift adaptation methods for deep learning,

    V . Y . F. Tan, P. L.A., and K. Jagannathan, “Recent advances in concept drift adaptation methods for deep learning,” inProceedings of the Thirty-First International Joint Conference on Artificial Intelligence, Jun 2022. [Online]. Available: http://dx.doi.org/10.24963/ijcai.2022/784

    work page doi:10.24963/ijcai.2022/784 2022

  8. [8]

    Continuous learning for android malware detection,

    Y . Chen, Z. Ding, and D. Wagner, “Continuous learning for android malware detection,” in32nd USENIX Security Symposium (USENIX Security 23), 2023, pp. 1127–1144

    2023

Show all 53 references
  1. [9]

    Droidevolver: Self-evolving android malware detection system,

    K. Xu, Y . Li, R. Deng, K. Chen, and J. Xu, “Droidevolver: Self-evolving android malware detection system,” in2019 IEEE European Symposium on Security and Privacy (EuroS&P). IEEE, 2019, pp. 47–62. JOURNAL OF LATEX CLASS FILES, VOL. 14, NO. 8, AUGUST 2021 15

    2019

  2. [10]

    Fast & furious: On the modelling of malware detection as an evolving data stream,

    F. Ceschin, M. Botacin, H. M. Gomes, F. Pinag ´e, L. S. Oliveira, and A. Gr ´egio, “Fast & furious: On the modelling of malware detection as an evolving data stream,”Expert Systems with Applications, vol. 212, p. 118590, 2023

    2023

  3. [11]

    Investigating labelless drift adaptation for malware detection,

    Z. Kan, F. Pendlebury, F. Pierazzi, and L. Cavallaro, “Investigating labelless drift adaptation for malware detection,” inProceedings of the 14th ACM Workshop on Artificial Intelligence and Security, 2021, pp. 123–134

    2021

  4. [12]

    Recda: Concept drift adaptation with representation enhancement for network intrusion detection,

    S. Yang, X. Zheng, J. Li, J. Xu, X. Wang, and E. C. Ngai, “Recda: Concept drift adaptation with representation enhancement for network intrusion detection,” inProceedings of the 30th ACM SIGKDD Confer- ence on Knowledge Discovery and Data Mining, 2024, pp. 3818–3828

    2024

  5. [13]

    Scrr: Stable malware detection under unknown deployment environment shift by decoupled spurious correlations filtering,

    Y . Yang, B. Yuan, J. Lou, and Z. Qin, “Scrr: Stable malware detection under unknown deployment environment shift by decoupled spurious correlations filtering,”IEEE Transactions on Dependable and Secure Computing, 2024

    2024

  6. [14]

    Enhancing state-of-the-art classifiers with api semantics to detect evolved android malware,

    X. Zhang, Y . Zhang, M. Zhong, D. Ding, Y . Cao, Y . Zhang, M. Zhang, and M. Yang, “Enhancing state-of-the-art classifiers with api semantics to detect evolved android malware,” inProceedings of the 2020 ACM SIGSAC Conference on Computer and Communications Security, Oct

    2020

  7. [15]

    When does group invariant learning survive spurious correlations?

    Y . Chen, R. Xiong, Z.-M. Ma, and Y . Lan, “When does group invariant learning survive spurious correlations?”Advances in Neural Information Processing Systems, vol. 35, pp. 7038–7051, 2022

    2022

  8. [16]

    Robustness to spurious cor- relations via human annotations,

    M. Srivastava, T. Hashimoto, and P. Liang, “Robustness to spurious cor- relations via human annotations,”International Conference on Machine Learning,International Conference on Machine Learning, Jul 2020

    2020

  9. [17]

    The implicit fairness criterion of unconstrained learning,

    L. Liu, M. Simchowitz, and M. Hardt, “The implicit fairness criterion of unconstrained learning,”arXiv: Learning,arXiv: Learning, Aug 2018

    2018

  10. [18]

    Invariant learning via probability of sufficient and necessary causes,

    M. Yang, Y . Zhang, Z. Fang, Y . Du, F. Liu, J.-F. Ton, J. Wang, and J. Wang, “Invariant learning via probability of sufficient and necessary causes,”Advances in Neural Information Processing Systems, vol. 36, 2024

    2024

  11. [19]

    Pcl: Proxy-based contrastive learning for domain generalization,

    X. Yao, Y . Bai, X. Zhang, Y . Zhang, Q. Sun, R. Chen, R. Li, and B. Yu, “Pcl: Proxy-based contrastive learning for domain generalization,” inProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2022, pp. 7097–7107

    2022

  12. [20]

    Learning with mixture of prototypes for out-of-distribution detection,

    H. Lu, D. Gong, S. Wang, J. Xue, L. Yao, and K. Moore, “Learning with mixture of prototypes for out-of-distribution detection,”arXiv preprint arXiv:2402.02653, 2024

    2024 arXiv

  13. [21]

    Aomdroid: detecting obfuscation variants of android malware using transfer learning,

    Y . Jiang, R. Li, J. Tang, A. Davanian, and H. Yin, “Aomdroid: detecting obfuscation variants of android malware using transfer learning,” inSe- curity and Privacy in Communication Networks: 16th EAI International Conference, SecureComm 2020, Washington, DC, USA, October 21-23...

    2020

  14. [22]

    When malware changed its mind: An empirical study of variable program behaviors in the real world

    E. Avllazagaj, Z. Zhu, L. Bilge, D. Balzarotti, and T. Dumitras, “When malware changed its mind: An empirical study of variable program behaviors in the real world.”USENIX Security Symposium,USENIX Security Symposium, Dec 2020

    2020

  15. [23]

    Episode-based prototype generating network for zero-shot learning,

    Y . Yu, Z. Ji, J. Han, and Z. Zhang, “Episode-based prototype generating network for zero-shot learning,” inProceedings of the IEEE/CVF con- ference on computer vision and pattern recognition, 2020, pp. 14 035– 14 044

    2020

  16. [24]

    Optimization as a model for few-shot learning,

    S. Ravi and H. Larochelle, “Optimization as a model for few-shot learning,” inInternational conference on learning representations, 2016

    2016

  17. [25]

    Domr: Towards deep open-world malware recogni- tion,

    T. Lu and J. Wang, “Domr: Towards deep open-world malware recogni- tion,”IEEE Transactions on Information Forensics and Security, 2023

    2023

  18. [26]

    Robust ma- chine learning for malware detection over time,

    D. Angioni, L. Demetrio, M. Pintor, and B. Biggio, “Robust ma- chine learning for malware detection over time,”arXiv preprint arXiv:2208.04838, 2022

    2022 arXiv

  19. [27]

    Temporal-incremental learning for android malware detec- tion,

    T. Sun, N. Daoudi, W. Pian, K. Kim, K. Allix, T. F. Bissyande, and J. Klein, “Temporal-incremental learning for android malware detec- tion,”ACM Transactions on Software Engineering and Methodology, vol. 34, no. 4, pp. 1–30, 2025

    2025

  20. [28]

    Revisiting concept drift in windows malware detection: Adaptation to real drifted malware with minimal samples,

    A. S. Li, A. Iyengar, A. Kundu, and E. Bertino, “Revisiting concept drift in windows malware detection: Adaptation to real drifted malware with minimal samples,”arXiv preprint arXiv:2407.13918, 2024

    2024 arXiv

  21. [30]

    Out-of-distribution generalization via risk extrapolation (rex),

    D. Krueger, E. Caballero, J.-H. Jacobsen, A. Zhang, J. Binas, D. Zhang, R. Le Priol, and A. Courville, “Out-of-distribution generalization via risk extrapolation (rex),” inInternational conference on machine learning. PMLR, 2021, pp. 5815–5826

    2021

  22. [31]

    On calibration and out- of-domain generalization,

    Y . Wald, A. Feder, D. Greenfeld, and U. Shalit, “On calibration and out- of-domain generalization,”Advances in neural information processing systems, vol. 34, pp. 2215–2227, 2021

    2021

  23. [32]

    Invariant risk minimization,

    M. Arjovsky, L. Bottou, I. Gulrajani, and D. Lopez-Paz, “Invariant risk minimization,”arXiv preprint arXiv:1907.02893, 2019

    1907 arXiv

  24. [33]

    The risks of invariant risk minimization,

    E. Rosenfeld, P. Ravikumar, and A. Risteski, “The risks of invariant risk minimization,”arXiv preprint arXiv:2010.05761, 2020

    2010 arXiv

  25. [34]

    Towards understanding variants of invariant risk minimization through the lens of calibration,

    K. Yoshida and H. Naganuma, “Towards understanding variants of invariant risk minimization through the lens of calibration,”arXiv preprint arXiv:2401.17541, 2024

    2024 arXiv

  26. [35]

    Invariance principle meets information bottleneck for out-of-distribution generalization,

    K. Ahuja, E. Caballero, D. Zhang, J.-C. Gagnon-Audet, Y . Bengio, I. Mitliagkas, and I. Rish, “Invariance principle meets information bottleneck for out-of-distribution generalization,”Advances in Neural Information Processing Systems, vol. 34, pp. 3438–3450, 2021

    2021

  27. [36]

    Environment inference for invariant learning,

    E. Creager, J.-H. Jacobsen, and R. Zemel, “Environment inference for invariant learning,” inInternational Conference on Machine Learning. PMLR, 2021, pp. 2189–2200

    2021

  28. [37]

    Heterogeneous risk minimization

    J. Liu, Z. Hu, P. Cui, B. Li, and Z.-J. Shen, “Heterogeneous risk minimization.”arXiv: Learning,arXiv: Learning, May 2021

    2021

  29. [38]

    Unshuffling data for improved generalization in visual question answering,

    D. Teney, E. Abbasnejad, and A. van den Hengel, “Unshuffling data for improved generalization in visual question answering,” inProceedings of the IEEE/CVF international conference on computer vision, 2021, pp. 1417–1427

    2021

  30. [39]

    Intriguing properties of adversarial ml attacks in the problem space,

    F. Pierazzi, F. Pendlebury, J. Cortellazzi, and L. Cavallaro, “Intriguing properties of adversarial ml attacks in the problem space,” in 2020 IEEE Symposium on Security and Privacy (SP). IEEE Computer Society, 2020, pp. 1308–1325. [Online]. Available: https: //doi.ieeecomputer...

    2020

  31. [40]

    Drebin: Effective and explainable detection of android malware in your pocket

    D. Arp, M. Spreitzenbarth, M. Hubner, H. Gascon, K. Rieck, and C. Siemens, “Drebin: Effective and explainable detection of android malware in your pocket.” inNdss, vol. 14, 2014, pp. 23–26

    2014

  32. [41]

    Adversarial examples for malware detection,

    K. Grosse, N. Papernot, P. Manoharan, M. Backes, and P. McDaniel, “Adversarial examples for malware detection,” inComputer Security– ESORICS 2017: 22nd European Symposium on Research in Computer Security, Oslo, Norway, September 11-15, 2017, Proceedings, Part II

    2017

  33. [42]

    Evaluating explanation methods for deep learning in security,

    A. Warnecke, D. Arp, C. Wressnegger, and K. Rieck, “Evaluating explanation methods for deep learning in security,” in2020 IEEE european symposium on security and privacy (EuroS&P). IEEE, 2020, pp. 158–174

    2020

  34. [43]

    Understanding and improving feature learning for out-of-distribution generalization,

    Y . Chen, W. Huang, K. Zhou, Y . Bian, B. Han, and J. Cheng, “Understanding and improving feature learning for out-of-distribution generalization,”Advances in Neural Information Processing Systems, vol. 36, 2024

    2024

  35. [44]

    Springer, 2017, pp. 62–79

    2017

  36. [45]

    Malscan: Fast market-wide mobile malware scanning by social-network centrality anal- ysis,

    Y . Wu, X. Li, D. Zou, W. Yang, X. Zhang, and H. Jin, “Malscan: Fast market-wide mobile malware scanning by social-network centrality anal- ysis,” in2019 34th IEEE/ACM International Conference on Automated Software Engineering (ASE). IEEE, 2019, pp. 139–150

    2019

  37. [46]

    Detecting android malware: From neural embeddings to hands-on validation with bertroid,

    M. Chaieb, M. A. Ghorab, and M. A. Saied, “Detecting android malware: From neural embeddings to hands-on validation with bertroid,” arXiv preprint arXiv:2405.03620, 2024

    2024 arXiv

  38. [47]

    Rich feature construction for the optimization-generalization dilemma,

    J. Zhang, D. Lopez-Paz, and L. Bottou, “Rich feature construction for the optimization-generalization dilemma,” inInternational Conference on Machine Learning. PMLR, 2022, pp. 26 397–26 411

    2022

  39. [48]

    Euphony: harmonious unification of ca- cophonous anti-virus vendor labels for android malware,

    M. Hurier, G. Suarez-Tangil, S. K. Dash, T. F. Bissyand ´e, Y . L. Traon, J. Klein, and L. Cavallaro, “Euphony: harmonious unification of ca- cophonous anti-virus vendor labels for android malware,” inProceedings of the 14th International Conference on Mining Software Reposito...

    2017

  40. [49]

    Transcend: Detecting concept drift in malware classification models,

    R. Jordaney, K. Sharad, S. Dash, Z. Wang, D. Papini, I. Nouretdinov, and L. Cavallaro, “Transcend: Detecting concept drift in malware classification models,”USENIX Security Symposium,USENIX Security Symposium, Dec 2016

    2016

  41. [50]

    Guided retraining to enhance the detection of difficult android malware,

    N. Daoudi, K. Allix, T. F. Bissyand ´e, and J. Klein, “Guided retraining to enhance the detection of difficult android malware,” inProceedings of the 32nd ACM SIGSOFT International Symposium on Software Testing and Analysis, 2023, pp. 1131–1143

    2023

  42. [51]

    Un- derstanding deep learning (still) requires rethinking generalization,

    C. Zhang, S. Bengio, M. Hardt, B. Recht, and O. Vinyals, “Un- derstanding deep learning (still) requires rethinking generalization,” Communications of the ACM, vol. 64, no. 3, pp. 107–115, 2021

    2021

  43. [53]

    Regularization for deep learning: A taxonomy,

    J. Kuka ˇcka, V . Golkov, and D. Cremers, “Regularization for deep learning: A taxonomy,”arXiv preprint arXiv:1710.10686, 2017

    2017 arXiv

  44. [2020]

    Available: http://dx.doi.org/10.1145/3372297.3417291

    [Online]. Available: http://dx.doi.org/10.1145/3372297.3417291

  45. [2024]

    Available: https://openreview.net/forum?id=OLvgrLtv6J

    [Online]. Available: https://openreview.net/forum?id=OLvgrLtv6J

Pith tools

Reviewed August 8, 2026 · model on record in the stance chip above.