Explainability-Guided Adversarial Attacks on Transformer-Based Malware Detectors Using Control Flow Graphs
Organizations: Department of Computer Science, Tennessee Tech University, Cookeville, USA · School of Interdisciplinary Informatics, University of Nebraska Omaha, Omaha, USA
Abstract
Transformer-based malware detection systems operating on graph modalities such as control flow graphs (CFGs) achieve strong performance by modeling structural relationships in program behavior. However, their robustness to adversarial evasion attacks remains underexplored. This paper examines the vulnerability of a RoBERTa-based malware detector that linearizes CFGs into sequences of function calls, a design choice that enables transformer modeling but may introduce token-level sensitivities and ordering artifacts exploitable by adversaries. By evaluating evasion strategies within this graph-to-sequence framework, we provide insight into the practical robustness of transformer-based malware detectors beyond aggregate detection accuracy. This paper proposes a white-box adversarial evasion attack that leverages explainability mechanisms to identify and perturb most influential graph components. Using token- and word-level attributions derived from integrated gradients, the attack iteratively replaces positively attributed function calls with synthetic external imports, producing adversarial CFG representations without altering overall program structure. Experimental evaluation on small- and large-scale Windows Portable Executable (PE) datasets demonstrates that the proposed method can reliably induce misclassification, even against models trained to high accuracy. Our results highlight that explainability tools, while valuable for interpretability, can also expose critical attack surfaces in transformer-based malware detectors.
Figures & tables
| Paper | Model Architecture | Modality | Attack Context | Contributions |
|---|---|---|---|---|
| Raff et al. [ 21 ] | Neural Network | Raw Byte Sequences | N/A | Creation of advance malware classifier for large scale classification. |
| Nicosia et al. [ 17 ] | MalGAN | CFG | Black-box | Modification of the MalGAN framework for control flow modalities. |
| Yan et al. [ 27 ] | GNN | CFG | N/A | Implements global and local explainability for CFGs. |
| Shoukouhinejad et al. [ 23 ] | GNN | CFG | N/A | Utilization of advance explainability techniques for control flow modalities. |
| Soi et al. [ 24 ] | DNN | FCG | N/A | Augmentation of FCGs via inclusion of DEX information from APK files. |
| Govea et al. [ 8 ] | GNN + CyberBert | Network Logs + Traffic Flow | N/A | Development of robust detector model using privacy-preserving federated learning. |
| Rounds | ||||||
|---|---|---|---|---|---|---|
| Mean | Median | Mean | Median | Mean | Median | |
| 1 | 87.72% | 87.88% | 2255 | 2249 | 97.24% | 96.61% |
| 2 | 88.52% | 90.40% | 2365 | 2318 | 93.81% | 97.50% |
| 3 | 91.44% | 90.04% | 2300 | 2285 | 99.37% | 99.77% |
| 5 | 90.81% | 90.60% | 2278 | 2271 | 99.65% | 99.74% |
| Rounds | ||||||
|---|---|---|---|---|---|---|
| Mean | Median | Mean | Median | Mean | Median | |
| 1 | 61.51% | 61.20% | 1802 | 1867 | 85.40% | 86.86% |
| 2 | 65.53% | 64.40% | 1720 | 1733 | 95.34% | 95.80% |
| 3 | 69.88% | 69.76% | 1804 | 1798 | 96.95% | 97.00% |
| 5 | 67.36% | 70.96% | 1911 | 2031 | 88.21% | 88.23% |
| Function Call | Function Count |
|---|---|
| entry0 | 5307 |
| sym.imp.KERNEL32.dll_GetStartupInfoA | 3153 |
| sym.imp.KERNEL32.dll_GetModuleHandleA | 2631 |
| sym.imp.MSVCRT.dll__set_app_type | 2282 |
| sym.imp.MSVCRT.dll___p__fmode | 2282 |
| sym.imp.MSVCRT.dll___p__commode | 2282 |
Adversarial Attacks
Adversarial attacks exploit crafted inputs, poisoned data, or system interactions to manipulate AI predictions, behavior, privacy, or reliability.
See all 447 papers