Ramp improves stealth malware backdoor attacks using reversed perturbations
RAMP: Reversing Adversarial Perturbations to Strengthen Clean-Label Backdoor Attacks against Malware Detectors
Cryptography and Security
Summary
Malware detectors often update by learning from new programs, which can let attackers hide harmful code during training. This paper shows a way to make these hidden backdoor attacks stronger without changing the visible behavior or labels of programs. The authors created a method called RAMP that cleverly changes programs so they look like malware internally before adding hidden triggers, making the attack more effective. Their experiments show RAMP works well even with very few poisoned programs and keeps normal detection performance high.
What this means in practice
- •For cybersecurity engineers: Test malware detection updates against stronger, harder-to-detect backdoor attacks using RAMP's perturbation techniques.
- •For software security auditors: Evaluate the resilience of antivirus update pipelines to clean-label backdoor attacks enhanced by reversed feature manipulation.
Authors
Jinwen Xin, Dongni Zhang, Chenyang Wang, Jianming Fu, Ming Tang, Guojun Peng
Abstract
Deep learning-based malware detectors are commonly updated by fine-tuning on newly collected samples, but this practical update pipeline also creates an attack surface for training-time backdoor attacks. In realistic crowdsourced data collection, however, strict label vetting typically restricts attackers to the clean-label setting, in which poisoned samples must retain benign labels and functionality, making effective backdoor injection substantially harder. We present a new attack perspective based on feature-space manipulation: instead of relying solely on stronger trigger designs or selecting benign samples that are naturally similar to malware, we deliberately construct benign programs whose representations shift toward the malware region before trigger injection, thereby creating stronger feature-label conflicts during training. Based on this insight, we propose RAMP, an attack enhancement method that uses a genetic algorithm to optimize reversed adversarial perturbations under black-box access and then injects them through functionality-preserving binary manipulations. Extensive experiments show that RAMP substantially improves attack effectiveness over trigger-only baselines, with especially pronounced gains at low poisoning ratios, while maintaining accuracy on clean data. Moreover, RAMP can be combined with advanced trigger designs.