Trigger value choice shapes malware backdoor attack success and detection
Trigger Value Selection in Clean-Label Malware Backdoors: An Effectiveness-Detectability Analysis
Cryptography and Security
Summary
Malware classifiers can be tricked by adding hidden triggers to training data, known as backdoor attacks. This paper finds that not just where these triggers appear, but the exact values used for these triggers, affect how well attacks work and how easily they are detected. Different strategies for setting trigger values lead to trade-offs between attack success and detectability. The authors tested multiple value selection methods and found some create strong attacks but easier detection, while others keep attacks effective but harder to find. This shows choosing trigger values is a key design step, not just a small detail.
What this means in practice
- •For cybersecurity engineers: Design better defenses against backdoor poisoning by understanding how trigger value choice affects attack detectability.
- •For machine learning security teams: Develop more robust malware classifiers by tracking how different trigger value strategies influence attack success and detection rates.
Authors
Tri Budi Sabdo Utomo, Kazushi Okamoto, Koki Karube, Kei Harada, Atsushi Shibata
Abstract
Clean-label backdoor poisoning is a threat to machine learning-based malware classifiers because poisoned samples can be inserted into training data without changing their labels. Previous explanation-guided attacks mainly focus on selecting important trigger features, but the values assigned to these features can also affect the attack behavior. In this paper, we study trigger value selection as an independent design factor in clean-label backdoor attacks against feature-based malware classifiers. We evaluate several value-selection strategies on EMBER 2018 and a Win64 PE subset of EMBER 2024 using LightGBM classifiers. We compare rare-value, SHAP-based, frequency-bounded, co-occurrence-aware, and quantile-based selectors under random and distribution-based malware-similar benign sampling. The results show that aggressive selectors such as MinPopulation and CountAbsSHAP can achieve high attack success rate, especially under distribution-based sampling, but they are also easier to detect by sanitization methods such as Isolation Forest. In contrast, selectors such as CorrCountAbsSHAP and Quantile95 can reduce poison recall while keeping useful attack effectiveness. These findings show that trigger value selection is not merely an implementation detail, but an important design choice that shapes the effectiveness and detectability profile of clean-label malware backdoor attacks.