LLM-Driven Feature-Level Adversarial Attacks on Android Malware Detectors

2025/12/24 by Tianwei Lan, Lan, Tianwei, Farid Naït-Abdesselam +1
Computer Science · #Advanced Malware Detection Techniques #Adversarial Robustness in Machine Learning #Artificial Intelligence (cs.AI) #Cryptography and Security (cs.CR) #FOS: Computer and information sciences #Network Security and Intrusion Detection

paper · doi:10.48550/arxiv.2512.21404

openalex publication_date 2025/12/24 · openalex created_date 2025/12/30 · openalex updated_date 2026/07/28

Abstract

The rapid growth in both the scale and complexity of Android malware has driven the widespread adoption of machine learning (ML) techniques for scalable and accurate malware detection. Despite their effectiveness, these models remain vulnerable to adversarial attacks that introduce carefully crafted feature-level perturbations to evade detection while preserving malicious functionality. In this paper, we present LAMLAD, a novel adversarial attack framework that exploits the generative and reasoning capabilities of large language models (LLMs) to bypass ML-based Android malware classifiers. LAMLAD employs a dual-agent architecture composed of an LLM manipulator, which generates realistic and functionality-preserving feature perturbations, and an LLM analyzer, which guides the perturbation process toward successful evasion. To improve efficiency and contextual awareness, LAMLAD integrates retrieval-augmented generation (RAG) into the LLM pipeline. Focusing on Drebin-style feature representations, LAMLAD enables stealthy and high-confidence attacks against widely deployed Android malware detection systems. We evaluate LAMLAD against three representative ML-based Android malware detectors and compare its performance with two state-of-the-art adversarial attack methods. Experimental results demonstrate that LAMLAD achieves an attack success rate (ASR) of up to 97%, requiring on average only three attempts per adversarial sample, highlighting its effectiveness, efficiency, and adaptability in practical adversarial settings. Furthermore, we propose an adversarial training-based defense strategy that reduces the ASR by more than 30% on average, significantly enhancing model robustness against LAMLAD-style attacks.

Citations

• Trust Under Siege: Label Spoofing Attacks against Machine Learning for Android Malware Detection
• LAMD: Context-driven Android Malware Detection and Classification with LLMs
• AppPoet: Large Language Model based Android malware detection via multi-view prompt engineering
• Decoding the Secrets of Machine Learning in Malware Classification: A Deep Dive into Datasets, Feature Extraction, and Model Performance
• A Survey of Large Language Models
• Jigsaw Puzzle: Selective Backdoor Attack to Subvert Malware Classifiers
• Retrieval-Augmented Generation for Knowledge-Intensive NLP Tasks
• Attention Is All You Need
• R2-D2: ColoR-inspired Convolutional NeuRal Network (CNN)-based AndroiD Malware Detections
• Adam: A Method for Stochastic Optimization
• Explaining and Harnessing Adversarial Examples
• Intriguing properties of neural networks

Related

• Defending against Adversarial Malware Attacks on ML-based Android Malware Detection Systems
• Adversarial Patterns: Building Robust Android Malware Classifiers
• LAMD: Context-driven Android Malware Detection and Classification with LLMs
• MalPurifier: Enhancing Android Malware Detection with Adversarial Purification against Evasion Attacks
• Level Up with ML Vulnerability Identification: Leveraging Domain Constraints in Feature Space for Robust Android Malware Detection