Data-Free Backdoor Attack on Malware Image Classification Models

Machine learning-based image malware classifiers are increasingly vital for safeguarding enterprises and infrastructure. However, these models are vulnerable to backdoor attacks, where adversaries inject subtle triggers causing intentional misclassifications. Existing backdoor techniques typically require access to the original training data, a significant limitation in regulated domains where malware datasets are proprietary and confidential. In this work, we propose a novel data-free backdoor attack methodology that circumvents this constraint by utilizing surrogate datasets constructed from publicly available malware repositories. Our approach incorporates a logit-based dictionary filtering mechanism to select surrogate samples closely resembling the original training distribution, subsequently embedding stealthy visual triggers—such as checkerboard patterns and noise patches—into these samples. By fine-tuning a blackbox convolutional neural network (CNN) malware classifier with this poisoned surrogate data and employing a logit similarity-based loss function, we successfully implant robust backdoors. Experimental results demonstrate an attack success rate (ASR) of up to 99%, where we utilize the DIKE dataset to construct the surrogate dataset and target an existing CNN-based malware classifier architecture [2], with minimal degradation in clean sample classification accuracy. Our findings highlight a critical vulnerability in contemporary malware detection systems, emphasizing the necessity for enhanced defense mechanisms against data-free adversarial threats. The code and dataset are available at our GitHub repository<sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">1</sup>.