cs.LGAug 28, 2026

REPLICANT: Learning Policies for Evading and Hardening Malware Detectors

Authors: Shae McFadden, Ilias Tsingenopoulos, Mario D'Onghia, Alexander Herzog, Myles Foley, Chris Hicks, Lorenzo Cavallaro, Fabio Pierazzi

Organizations: King’s College London · The Alan Turing Institute · University College London · KU Leuven · 

Read PDF
Ask AI
Cite

Copy citation

DOINot available for this paper

Abstract

To determine the real-world effectiveness of machine learning based malware detection, it is vital to evaluate its robustness against highly capable adversaries. However, state-of-the-art attacks do not effectively model realistic adversaries, as they often assume access to privileged information such as the training data, feature space, or confidence scores of the target. In this work, we present Replicant, a deep reinforcement learning framework that learns the realistic task of evasion under a strict label-only black-box threat model. Replicant learns a reusable policy on how to modify a malware sample and when to query the target, which transfers across samples, detectors, and feature spaces. Across seven Android malware detectors and three feature spaces, Replicant is the strongest and most query-efficient approach achieving a mean attack success rate of 78.8%, a relative improvement of 20.9%-39.2% over the state-of-the-art. Furthermore, when used for adversarial training, Replicant also outperforms the state-of-the art by producing detectors with more generalizable robustness. With Replicant we demonstrate that learning the task of evasion not only results in stronger attack performance but, crucially, provides a better signal for hardening malware detectors.

Figures & tables

Figure 1: Evasion Curves , attack efficiency across all 1,7641{,}764 surrogate/target combinations and ten seeds. Replicant outperforms every baseline with the highest evasion rate per query.
 PTE 
Transfer AxesASRAvgQSTE
Matched96.6±0.7∗∗∗\mathbf{96.6}^{***}_{\pm 0.7}3.6±0.33.6_{\pm 0.3}59.4±4.3\textit{59.4}_{\pm 4.3}
Temporal96.6±0.6∗∗∗\mathbf{96.6}^{***}_{\pm 0.6}3.6±0.33.6_{\pm 0.3}59.4±4.4\textit{59.4}_{\pm 4.4}
Architecture87.4±1.1∗∗∗\mathbf{87.4}^{***}_{\pm 1.1}5.8±0.35.8_{\pm 0.3}44.7±1.8\textit{44.7}_{\pm 1.8}
Representation78.8±1.3∗∗∗\mathbf{78.8}^{***}_{\pm 1.3}7.6±0.27.6_{\pm 0.2}42.5±2.8\textit{42.5}_{\pm 2.8}
Combined73.0±1.5∗∗∗\mathbf{73.0}^{***}_{\pm 1.5}8.5±0.28.5_{\pm 0.2}41.3±1.9\textit{41.3}_{\pm 1.9}
Table 2: Transferability Results , PTE ( PTE ) versus STE ( STE ) for Replicant across the matched setting and four axes of transferability within all settings.
Figure 2: Transferability Curves , PTE ( PTE ) versus STE ( STE ) for Replicant . Solid curves plot PTE over queries and the dashed lines display the ASR of STE .
Figure 3: AT Curves , ASR across both attackers and AT pipelines for each of the 15 AT rounds. The colors denote the AT pipeline and line style denotes the attacker.
Figure 4: Capability Drift Curves , ASR for the attackers as the capability set grows from reduced set ( 50%50\% of original) to the full capability set.
  A-AUT(ASR)
SettingA-AUT( F1\mathbf{F_{1}} )WBBB
Base26.7±0.526.7_{\pm 0.5}99.9±0.099.9_{\pm 0.0}93.9±0.993.9_{\pm 0.9}
AL49.8±0.1∗∗∗\mathbf{49.8}^{***}_{\pm 0.1}98.2±0.298.2_{\pm 0.2}88.5±0.788.5_{\pm 0.7}
AT29.5±0.429.5_{\pm 0.4}00.1±0.1∗∗∗\phantom{0}\mathbf{0.1}^{***}_{\pm 0.1}00.4±0.1∗∗∗\phantom{0}\mathbf{0.4}^{***}_{\pm 0.1}
AT & AL47.9±0.2\textit{47.9}_{\pm 0.2}19.4±2.119.4_{\pm 2.1}20.6±1.2\textit{20.6}_{\pm 1.2}
RAL49.0±0.5∗∗∗\mathbf{49.0}^{***}_{\pm 0.5}00.6±0.3\phantom{0}\textit{0.6}_{\pm 0.3}00.8±0.4∗∗∗\phantom{0}\mathbf{0.8}^{***}_{\pm 0.4}
Table 5: Temporal Drift Results , clean performance and robustness over time reported as A-AUT( F1F_{1} ) and A-AUT(ASR), respectively. The WB ( Replicant WB ) and BB ( Replicant ) attacks are fixed policies from their training period.
Appendix figures & tables5 assets

Supplementary material from the paper’s appendix.

Appendix

Figure 5: Temporal gap , per training-period pair: Solid curves plot the ASR of PTE over target queries and the dashed horizontals lines demonstrate the ASR of STE . Aggregated as the temporal gap row of Table 2 and the purple curve of Figure 2 . The cross-period curves follow the matched-period curves with the same target training period, showing both the effect of temporal luck and that the temporal gap is negligible.
Figure 6: Architecture gap , per target classifier: Solid curves plot the ASR of PTE over target queries and the dashed horizontals lines demonstrate the ASR of STE . Aggregated as the architecture gap row of Table 2 and the green curve of Figure 2 .
Figure 7: Representation gap , per feature-space pair: Solid curves plot the ASR of PTE over target queries and the dashed horizontals lines demonstrate the ASR of STE . Aggregated as the representation gap row of Table 2 and the orange curve of Figure 2 .
Figure 8: Combined gap , per target classifier: Solid curves plot the ASR of PTE over target queries and the dashed horizontals lines demonstrate the ASR of STE . Aggregated as the combined gap row of Table 2 and the red curve of Figure 2 .
Figure 9: RL Design Curves. Attack efficiency across all 1,7641{,}764 surrogate/target combinations and ten seeds. Replicant outperforms every other RL agent design with the highest evasion rate per query.
More in this topic

Adversarial Attacks

Adversarial attacks exploit crafted inputs, poisoned data, or system interactions to manipulate AI predictions, behavior, privacy, or reliability.

See all 432 papers

Explore similar work

CardsList

  1. Adversarial Co-Evolution of Malware and Detection Models: A Bilevel Optimization Perspective

    Apr 24, 2026Olha Jurečková, Martin Jureček, Matouš Kozák +1Adversarial AttacksAdversarial Robustness

    Faculty of Information Technology, Czech Technical University in Prague, Th´akurova 9, Prague, 16000, Czech Republic

  2. Towards Certified Malware Detection: Provable Guarantees Against Evasion Attacks

    Apr 22, 2026Nandakrishna Giri, Asmitha K. A., Serena Nicolazzo +2Randomized SmoothingAdversarial Attacks

    Department of Computer Applications, Cochin University of Science and Technology, India · Department of Electrical, Computer and Biomedical Engineering, University of Pavia, Via Adolfo Ferrata 5, 27100, Pavia, Italy

  3. Learning to Look Benign: Targeted Evasion of Malware Detectors via API Import Injection

    May 18, 2026Juozas Dautartas, Olga Kurasova, Juozapas Rokas Čypas +1Adversarial AttacksMalware Classification

    Institute of Data Science and Digital Technologies, Faculty of Mathematics and Informatics, Vilnius University, LT-08412 Vilnius, Lithuania