Adversarial collapse to robust recovery: assessing the impact of robustness and adversarial retraining on Android malware detection

Machine learning (ML) and deep learning (DL) models are widely used for Android malware detection because they can learn discriminative patterns from static features such as permissions, API calls, and manifest attributes. However, high accuracy on clean benchmark datasets does not guarantee robustness against adversarial attacks that manipulate features while preserving malicious functionality. Existing studies often evaluate robustness only under clean or isolated attack settings, providing an incomplete assessment of real-world security. This paper presents a unified and reproducible benchmarking framework that evaluates both gradient-based and functionality-preserving semantic attacks using the large-scale MalDroid dataset, with cross-dataset validation on Drebin. Four representative models—multi-layer perceptron (MLP), convolutional neural network (CNN), XGBoost, and autoencoder-XGBoost—are evaluated against fast gradient sign method (FGSM), projected gradient descent (PGD), feature insertion (FI), and mixed multi-attack scenarios, followed by mixed adversarial retraining. Experimental results show that clean accuracy can conceal significant robustness weaknesses. Although MLP achieves 97.94% clean accuracy, FI is the most damaging attack, causing accuracy drops of up to 20.55%. XGBoost provides the best robustness-efficiency trade-off under mixed attacks, while adversarial retraining improves robustness across all models. Cross-dataset evaluation reveals dataset-dependent adversarial behavior, highlighting the importance of multi-attack benchmarking, adversarial retraining, and cross-dataset validation for reliable Android malware detection.