safety security
The Malware Detector Can Fail Without Moving Its Metrics
Across 453,174 injected faults, 72.3 percent of evaluated tree-model faults barely changed aggregate recall or false-positive rate, even when individual predictions moved.
Summary
Across 453,174 injected faults, 72.3 percent of evaluated tree-model faults barely changed aggregate recall or false-positive rate, even when individual predictions moved.
Hardware malware detectors classify performance-counter patterns, but faults inside their own decision logic can quietly change which executions pass. Researchers injected 453,174 stuck-at and selected parameter-bit faults across 18 classifiers, counter budgets and ensemble designs. Tree models showed a lower mean critical-fault fraction than function-based models, 5.3 versus 14.3 percent. Yet 72.3 percent of evaluated tree faults were metric-silent by the study's aggregate threshold, despite possible changes to individual predictions. In a representative J48 design, an idealized selection method identified 16 of 115 structural units whose protection reduced predicted worst-case recall loss from 60.1 to 3.3 points. RTL correspondence and physical hardening cost remain unvalidated.
Why it matters
Across 453,174 injected faults, 72.3 percent of evaluated tree-model faults barely changed aggregate recall or false-positive rate, even when individual predictions moved.
Limits and context
- RTL correspondence and physical hardening cost remain unvalidated.
Key claims
Across 453,174 injected faults, 72.3 percent of evaluated tree-model faults barely changed aggregate recall or false-positive rate, even when individual predictions moved.
Qualification: RTL correspondence and physical hardening cost remain unvalidated.
Evidence: source-2026-10-28-009
Sources
- arXiv preprint 2610.36612, original v1arXiv · primary research
Corrections
No corrections have been recorded for this story.