Building an Adversarial Malware Dataset by Family and Type: Generation, Evasion, and Poisoning Evaluation

The more unsettling finding isn't the evasion rate itself but the poisoning result: a classifier can be quietly degraded by corrupting less than one in two hundred training samples, which means the attack surface extends backward into data pipelines and labeling workflows, not just inference time.

This connects directly to the deployment-complete benchmarking work covered the same day, which showed benchmark coverage of 94.98% collapsing to 10.07% in real deployment. That paper argued that standard evaluation methods systematically overstate readiness; this malware research is essentially a domain-specific proof of that thesis, demonstrating that EMBER's academic robustness claims do not hold under adversarial conditions that are entirely realistic in production. Together, these two papers reinforce a pattern emerging across recent coverage: the gap between what models demonstrate in controlled evaluation and what they deliver when adversaries, distribution shift, or corrupted data enter the picture is not a niche concern but a structural problem in how the field validates systems before shipping them.

Watch whether VirusTotal or any major EDR vendor publicly responds to the RawMal-TF dataset release with updated detection benchmarks within the next six months. Silence would suggest the industry is absorbing this finding quietly rather than treating it as an actionable signal.