Lion Cipher Lab
Harden a malware feature classifier against benign-feature padding with monotonic constraints
- AI Security
- Advanced
- ~90 min
- Free · no account required
Why it matters
Most production malware detectors have a static, feature-based model somewhere in the pipeline: a program that looks at a file WITHOUT running it, turns it into numbers (how many suspicious imports, how random the code sections look, how many ordinary strings it carries), and scores it. The EMBER dataset made this design the standard teaching example. Its weakness is well documented: a model that has learned 'lots of ordinary content means benign' can be fooled by an author who simply ADDS ordinary content. Adding imports, strings or sections does not remove any malicious functionality, so it…
What you'll learn
- explaining append-only (benign-feature padding) evasion of a static, feature-based malware detector
- building a reproducible robustness test that searches a padding grid for the lowest score per sample
- reading and applying the exact semantics of scikit-learn's monotonic_cst (+1 / 0 / -1, over the positive-class probability)
- choosing constraint signs from the attacker's capabilities rather than from domain intuition
- verifying a monotonicity guarantee empirically (count of samples whose score padding could lower)
- measuring the clean-accuracy and false-positive cost of a defence at a matched false-positive budget
- measuring, and reporting, the attack a monotonic model does NOT cover (feature removal)
Steps in this lab
- What you are defending, and the hole in it
- Open a terminal, make a scratch folder, install scikit-learn
- Write the synthetic data and the two robustness tests
- Baseline: train the unconstrained detector, then pad it
- Read the exact semantics of monotonic_cst before you choose signs
- Retrain with monotonic constraints and re-run the same attack
- Measure the cost fairly: the same false-positive budget
- The honest negative: the attack monotonicity does not cover
- When to use this, when not to, and how a pro does it better