ML-based malware detection on dynamic analysis reports is vulnerable to both
evasion and spurious correlations. In this work, we investigate a specific ML
architecture employed in the pipeline of a widely-known commercial antivirus
company, with the goal to harden it against adversarial malware. Adversarial
training, the sole defensive technique that can confer empirical robustness, is
not applicable out of the box in this domain, for the principal reason that
gradient-based perturbations rarely map back to feasible problem-space
programs. We introduce a novel Reinforcement Learning approach for constructing
adversarial examples, a constituent part of adversarially training a model
against evasion. Our approach comes with multiple advantages. It performs
modifications that are feasible in the problem-space, and only those; thus it
circumvents the inverse mapping problem. It also makes possible to provide
theoretical guarantees on the robustness of the model against a particular set
of adversarial capabilities. Our empirical exploration validates our
theoretical insights, where we can consistently reach 0\% Attack Success Rate
after a few adversarial retraining iterations.

通过引入一种新颖的强化学习方法来构建对抗样本，针对恶意软件进行对抗训练，我们能够实现该模型对特定一组对抗能力的稳健性，验证了我们的理论洞见。

如何训练您的防病毒软件：基于强化学习的硬化通过问题空间

How to Train your Antivirus: RL-based Hardening through the  Problem-Space

Deep neural networks usually require large labeled datasets for training to
achieve state-of-the-art performance in many tasks, such as image
classification and natural language processing. Although a lot of data is
created each day by active Internet users, most of these data are unlabeled and
are vulnerable to data poisoning attacks. In this paper, we develop an
efficient active learning method that requires fewer labeled instances and
incorporates the technique of adversarial retraining in which additional
labeled artificial data are generated without increasing the budget of the
labeling. The generated adversarial examples also provide a way to measure the
vulnerability of the model. To check the performance of the proposed method
under an adversarial setting, i.e., malicious mislabeling and data poisoning
attacks, we perform an extensive evaluation on the reduced CIFAR-10 dataset,
which contains only two classes: airplane and frog. Our experimental results
demonstrate that the proposed active learning method is efficient for defending
against malicious mislabeling and data poisoning attacks. Specifically, whereas
the baseline active learning method based on the random sampling strategy
performs poorly (about 50%) under a malicious mislabeling attack, the proposed
active learning method can achieve the desired accuracy of 89% using only
one-third of the dataset on average.

本文介绍了一种高效的主动学习方法，它结合了敌对再训练技术，可以生成更多的人工标注数据集而不增加标注预算，产生的敌对样本也提供了一种测量模型易受攻击的方式。作者在减小的 CIFAR-10 数据集上对其性能进行了充分评估，得出该方法有效对抗恶意袭击的结论。

恶意标注和污染攻击下的主动学习

Active Learning Under Malicious Mislabeling and Poisoning Attacks

The ability to deploy neural networks in real-world, safety-critical systems
is severely limited by the presence of adversarial examples: slightly perturbed
inputs that are misclassified by the network. In recent years, several
techniques have been proposed for increasing robustness to adversarial examples
--- and yet most of these have been quickly shown to be vulnerable to future
attacks. For example, over half of the defenses proposed by papers accepted at
ICLR 2018 have already been broken. We propose to address this difficulty
through formal verification techniques. We show how to construct provably
minimally distorted adversarial examples: given an arbitrary neural network and
input sample, we can construct adversarial examples which we prove are of
minimal distortion. Using this approach, we demonstrate that one of the recent
ICLR defense proposals, adversarial retraining, provably succeeds at increasing
the distortion required to construct adversarial examples by a factor of 4.2.

利用形式验证技术构建对抗样本，证明这些样本是最小扭曲的，从而增加了对抗性训练的鲁棒性。