Trigger Value Selection in Clean-Label Malware Backdoors: An Effectiveness-Detectability Analysis

arXiv:2610.21269 · cs.CR · Submitted 2026-10-15 · Read on arXiv

Listen

Transcript

Introduction to the show: ident: Security Radio. Generated commentary on the latest security and cryptography papers.

Nadia: Today's paper: "Trigger Value Selection in Clean-Label Malware Backdoors".

Elias: The gist: Trigger value selection is an independent design factor that significantly shapes both the effectiveness and detectability profile of clean-label backdoor attacks against feature-based malware classifiers.

Nadia: First, who's behind it and why it matters.

Title and authors: Elias: So we’re looking at the paper "Trigger Value Selection in Clean-Label Malware Backdoors: An Effectiveness-Detectability Analysis". The title tells you immediately that they aren't just focusing on which features to use for the trigger, but how you choose the actual values for those features.

Nadia: Exactly. It’s about this design choice being a major factor in whether the attack works or whether we can spot it later when we try to clean up the model.

Priya: What are these six strategies they are testing? Are they just different ways to pick data points from the training set, or is there a deeper mechanism at play with how they select those values?

Elias: They’re comparing rare-value, SHAP-based, frequency-bounded, co-occurrence-aware, prototype-based, and quantile-based selectors. These are grouped based on what signal they use: frequency or distribution, SHAP contribution or how much influence a value has on the model's decision.

Nadia: And then there’s the co-occurrence and prototype based ones, which look at whether certain feature values naturally appear together in clean samples to help blend the trigger better into the benign data.

Priya: So, if I understand this right, we’re looking at how choosing a value strategy affects two things: how well the backdoor succeeds and how easily a defense can catch it.

Elias: That’s it. The paper isolates trigger value selection as something separate from feature selection or poison sample selection, and they test these selectors against different sampling methods like random sampling and distribution-based distance sampling following Poisoning Malware-Similar Benignware, PMSB eight on EMBER two thousand twenty-four Win64 <ref:2610.21269#pg1>.

Nadia: That’s a lot of interaction to consider for a defender trying to build a robust system. It shows that the choice of trigger value selection isn't just technical detail; it’s strategic in terms of attack and defense.

Priya: It means we need to look at the specific values chosen, not just the features themselves, when thinking about how these clean-label backdoors behave in real systems.

The paper's summary: Elias: Now let’s talk about what they actually found by summarizing their research questions. They set out three main research questions to answer this paper, and those are RQ1, RQ2, and RQ3.

Nadia: RQ1 asks how trigger value selection strategies affect the effectiveness of the backdoor poisoning attack itself. It’s measuring the attack success rate here.

Priya: And RQ2 looks at how these same value-selection strategies impact detectability when we introduce sanitization defenses, like Isolation Forest or other checks they use. It’s really looking at that trade-off between hiding and being caught.

Elias: Then RQ3 examines how malware-similar benign sampling affects that effectiveness and detectability relationship we just discussed. They want to see if changing how those benign samples are sampled changes the whole dynamic between attack success and detection chances.

Nadia: The main point is that they show trigger value selection isn't just an afterthought of feature selection; it’s a decision point that fundamentally changes both how effective and how detectable a clean-label backdoor attack is.

Priya: So, what does this mean for us when we think about understanding these attacks? It means we can’t just focus on the trigger features in isolation; we have to consider which specific values you select for those features because that choice dictates whether the resulting model is more likely to be detected by a defense or successfully evades it.

Elias: That’s right. The summary shows they are systematically testing these selectors against different sampling strategies, and the results show how those choices interact with each other in measurable ways.

The paper's improvements: Nadia: So what are the key improvements suggested by the research? They highlight that some aggressive selectors, like MinPopulation and CountAbsSHAP, achieve very high attack success rates when using distribution-based distance sampling on both datasets.

Priya: That’s interesting because they also achieved high detection rates by Isolation Forest when using those same methods. So they show a conflict there—a strong attack mechanism that is also easily spotted by one of the common defenses.

Elias: But then you look at the other side; combined SHAP and benign prototype generally achieve lower attack success rates, especially when they use random sampling. That suggests that not every value selection strategy leads to a successful backdoor deployment.

Nadia: And for detectability, they found that CorrCountAbsSHAP and Quantile95 can actually reduce poison recall while still keeping a useful attack effectiveness rate. For example, under distribution-based sampling, CorrCountAbsSHAP reduced poison recall from one hundred percent down to about ten point three four percent on EMBER two thousand twenty-four Win64 while still keeping an attack success rate of seventy-nine point three three percent <ref:2610.21269#pg1>.

Priya: So they suggest that we can dynamically select the trigger values based on whether we prioritize high effectiveness or high detectability. If you need a stealthier trigger, you might choose CorrCountAbsSHAP to reduce how easily it gets caught by sanitization methods.

Elias: They also point out that sampling strategy has a strong effect too; distribution-based distance sampling consistently improves attack success compared to random sampling, especially on EMBER two thousand twenty-four Win64 <ref:2610.21269#pg1>. But they stress that value selection and sample selection are complementary; one chooses which benign samples to poison, and the other chooses the trigger pattern learned by the classifier.

Conclusion: Nadia: To wrap up this paper on "Trigger Value Selection in Clean-Label Malware Backdoors: An Effectiveness-Detectability Analysis", it shows that trigger value selection is a core design choice that shapes both how effective and how detectable these backdoors are. The strongest trigger isn't always the most practical if the poisoned samples can be removed by sanitization.

Priya: I think the implication here is that we need more nuanced approaches to defense. Instead of just trying to stop all poisoning, we should focus on designing defenses that account for how different value selection strategies affect detection likelihood.

Elias: They show us that optimizing this relationship requires choosing your selector based on whether you want maximum attack success or better sanitization resilience. This paper is a study in mapping out those trade-offs across different selectors and sampling strategies.

Nadia: It’s a lot to take in, but it gives us concrete ways to think about designing cleaner labels and more robust malware classifiers. We have to keep looking at how these specific choices impact the real world deployment of these models.

Priya: I just want to say that this study really grounds the theory by showing exactly how choosing a specific value selection strategy changes the results, which is super helpful for measurement.

Elias: Yeah, this work is a deep dive into the mechanics of clean-label attacks and how to measure their effectiveness and detectability across different design choices in Trigger Value Selection in Clean-Label Malware Backdoors: An Effectiveness–Detectability Analysis <ref:2610.21269#pg1>.

Nadia: That’s it for this paper on "Trigger Value Selection in Clean-Label Malware Backdoors: An Effectiveness-Detectability Analysis". We'll be back next time with something new from arXiv.

Tri Budi Sabdo Utomo, Kazushi Okamoto, Koki Karube, Kei Harada, Atsushi Shibata

Department of Informatics, Graduate School of Informatics and Engineering, The University of Electro-Communications

cs.CR

Submitted: 2026-10-15

Updated: 2026-10-15

Journal ref: Joint 14th International Conference on Soft Computing and Intelligent Systems and 27th International Symposium on Advanced Intelligent Systems (SCIS-ISIS 2026)

License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/

Importance score: 88/100

The gist: The gist: Trigger value selection is an independent design factor that significantly shapes both the effectiveness and detectability profile of clean-label backdoor attacks against feature-based

Key concepts

Clean-Label Backdoor Poisoning: This is an attack where malicious samples are added to training data without changing their original benign labels. The goal is to embed a hidden trigger pattern that causes the model to misclassify malware as benign later, making the attack hard to spot.
Trigger Value Selection Strategies: These are different methods used by attackers to choose which specific values for the trigger features should be used in the poisoned samples. Strategies include choosing rare values, using SHAP scores to find influential feature contributions, or selecting values based on frequency or distribution in benign data.
Effectiveness vs. Detectability Profile: This refers to the trade-off between how well an attack works (effectiveness) and how easily it can be found by security defenses (detectability). The paper examines how different value selection choices change this balance, showing that some aggressive selectors are highly effective but more detectable.
Distribution-Based Sampling: This is a method of sampling benign data for poisoning attacks where the selection of benign samples is guided by their distribution in the feature space. It helps create a more realistic training set, and the paper compares its impact against simpler random sampling methods.

Summary

The gist: Trigger value selection is an independent design factor that significantly shapes both the effectiveness and detectability profile of clean-label backdoor attacks against feature-based malware classifiers.

Attack Overview

Clean-label backdoor poisoning is a threat because poisoned samples can be inserted into training data without changing their labels, allowing attackers to embed trigger patterns while preserving benign labels The attack may then learn to associate the trigger pattern with the benign class, and at inference time, malware samples containing the same trigger may be predicted as benign. This attack is difficult to notice when the backdoored model still performs normally on clean samples.

Trigger Value Selection Strategies

The paper investigates several value-selection strategies after fixing the trigger features, comparing rare-value, SHAP-based, frequency-bounded, co-occurrence-aware, prototype-based, and quantile-based selectors. These selectors are grouped by their main signal: frequency or distribution, SHAP contribution, and co-occurrence or prototype support.

Frequency- and Quantile-based Selectors choose values according to how common, rare, or distributionally positioned they are in benign data Rare-value selection places the trigger in a sparse region of the feature space, following the intuition of the MinPopulation method.
SHAP-based Selectors use feature attribution scores to estimate how candidate values contribute to the classifier’s decision Signed SHAP selectors use this direction of contribution and select values that are expected to push predictions toward the benign class.
Co-occurrence- and Prototype-based Selectors consider whether selected feature-value pairs naturally appear together in benign samples Co-occurrenceaware selection aims to preserve relationships among selected feature values so that the trigger better blends into the benign distribution.

Effect of Value Selection on Attack Effectiveness (RQ1)

The results indicate that trigger value selection strongly affects attack success even when the trigger feature set is fixed Aggressive selectors such as MinPopulation and CountAbsSHAP achieve very high ASR under distribution-based distance sampling on both datasets. For example, on EMBER 2018, they achieve 97.94% and 98.87% ASR, respectively. Conversely, CombinedSHAP and BenignPrototype generally achieve lower ASR, particularly under random sampling.

Effect of Value Selection on Detectability (RQ2)

Trigger value selection also affects poison recall under sanitization defenses MinPopulation and CountAbsSHAP achieved high ASR, but they were also detected at high rates by Isolation Forest. By contrast, CorrCountAbsSHAP and Quantile95 reduced poison recall while preserving useful attack effectiveness. For instance, under distribution-based sampling, CorrCountAbsSHAP reduced poison recall from 100.00% to 10.34% on EMBER 2024 Win64 while retaining ASR of 79.33%.

Effect of Sampling Strategy (RQ3)

Sampling strategy also has a strong effect on attack effectiveness Distribution-based distance sampling consistently improves ASR compared to random sampling, especially on EMBER 2024 Win64. However, sampling strategy does not remove the role of value selection Sample selection and value selection are therefore complementary: one determines which benign samples are poisoned, while the other determines the trigger pattern learned by the classifier.

Overall, trigger value selection is a core design choice that shapes the effectiveness–detectability profile of clean-label malware backdoors. The strongest trigger is not necessarily the most practical if poisoned samples can be removed by sanitization. This study has several limitations, focusing on featurespace trigger value selection and LightGBM-based classifiers. Future work should study problem-space realizations, broader models and datasets, stronger end-to-end defenses, and value selectors that jointly optimize attack effectiveness and detectability. The references are [1] H. S. Anderson and P. Roth, “EMBER: An Open Dataset for Training Static PE Malware Machine Learning Models,” arXiv preprint arXiv:1804.04637, 2018, doi: 10.48550/arXiv.1804.04637., [2] R. Jordaney, K. Sharad, S. K. Dash, Z. Wang, D. Papini, I. Nouretdinov, and L. Cavallaro, “Transcend: Detecting Concept Drift in Malware Classification Models,” in Proc. 26th USENIX Security Symposium, pp.625–642, 2017., [3] R. J. Joyce, G. Miller, P. Roth, R. Zak, E. Z.-Williams, H. Anderson, E. Raff, and J. Holt, “EMBER2024: A Benchmark Dataset for Holistic Evaluation of Malware Classifiers,” in Proc. 31st ACM SIGKDD Conference on Knowledge Discovery and Data Mining (KDD), pp.5516–5526, 2025., [4] G. Ke, Q. Meng, T. Finley, T. Wang, W. Chen, W. Ma, Q. Ye, and T.-Y. Liu, “LightGBM: A Highly Efficient Gradient Boosting Decision Tree,” in Proc. 31st International Conference on Neural Information Processing Systems (NeurIPS), pp.3149–3157., [5] S. M. Lundberg and S.-I. Lee, “A Unified Approach to Interpreting Model Predictions,” in Proc. 31st International Conference on Neural Information Processing Systems (NeurIPS), pp.4768–4777., [6] G. Severi, J. Meyer, S. Coull, and A. Oprea, “Explanation-Guided Backdoor Poisoning Attacks Against Malware Classifiers,” in Proc. 30th USENIX Security Symposium, pp.1487–1504., [7] T. Gu, B. D.-Gavitt, and S. Garg, “BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chain,” arXiv preprint arXiv:1708.06733, 2017., [8] X. Wang, Y. Feng, B. Bi, Y. Cao, Z. Jin, X. Liu, Y. Liu, and Y. Li, “Not All Benignware Are Alike: Enhancing Clean-Label Attacks on Malware Classifiers,” in Proc. ACM Web Conference 2025 (WWW), pp.2053–2063, 2025., [9] S. Ho, A. Reddy, S. Venkatesan, R. Izmailov, R. Chadha, and A. Oprea, “Data Sanitization Approach to Mitigate Clean-Label Attacks Against Malware Detection Systems,” in Proc. 2022 IEEE Military Communications Conference (MILCOM), pp.993–998, 2022., [10] A. Reddy, S. Venkatesan, R. Izmailov, and A. Oprea, “An Improved Nested Training Approach to Mitigate Clean-label Attacks against Malware Classifiers,” in Proc. 2023 IEEE Military Communications Conference (MILCOM), pp.703–709., [11] S. Venkatesan, H. Sikka, R. Izmailov, R. Chadha, A. Oprea, and M. J. De Lucia, “Poisoning Attacks and Data Sanitization Mitigations for Machine Learning Models in Network Intrusion Detection Systems,” in Proc. 2021 IEEE Military Communications Conference (MILCOM), pp.874–879., [12] G. Severi, S. Boboila, J. Holodnak, K. Kratkiewicz, R. Izmailov, M. J. De Lucia, and A. Oprea, “Model-Agnostic Clean-Label Backdoor Mitigation in Cybersecurity Environments,” arXiv preprint arXiv:2407.08159., [13] A. Paracha, J. Arshad, M. B. Farah, and K. Ismail, “Machine Learning Security and Privacy: A Review of Threats and Countermeasures,” EURASIP Journal on Information Security, vol.2024, no.10, 2024., [14] J. Lee, Y. Cho, R. Lee, S. Yuk, J. Youn, H. Park, and D. Shin, “A Novel Data Sanitization Method Based on Dynamic Dataset Partition and Inspection Against Data Poisoning Attacks,” Electronics, vol.14, no.2, article 374., [15] M. Yudin, A. Reddy, S. Venkatesan, and R. Izmailov, “Backdoor Attacks During Retraining of Machine Learning Models: A Mitigation Approach,” in Proc. 21st International Conference on Security and Cryptography (SECRYPT), pp.140–150, 2024., [16] F. T.

Improvements for AI systems

The improved system can dynamically select trigger values based on whether an attack is targeted for high effectiveness or high detectability by using selectors like CorrCountAbsSHAP and Quantile95, which reduce poison recall while keeping useful attack effectiveness.
The system can optimize the poisoning target selection by employing distribution-based distance sampling following Poisoning Malware-Similar Benignware (PMSB) [8], which has been shown to improve ASR compared with random sampling, especially on EMBER 2024 Win64.
The improved defense mechanism can be enhanced by using multi-faceted sanitization techniques, as the paper suggests that MinPopulation and CountAbsSHAP achieve high ASR, but they were also detected at high rates by Isolation Forest, implying a need to combine detection methods for robust defense.