This post summarizes the work we presented at the 2026 IEEE 4th Conference on Information Technology and Data Science (CITDS 2026) in Debrecen, Hungary. My name is József Sándor, and I’m a PhD student in the CrySyS Lab. FAME is joint work with Endre Glocker and Roland Nagy.
Machine learning (ML) has become a popular tool for detecting malware on IoT devices. These devices have very little CPU, memory, and energy to spare, so detectors need to be lightweight. One such detector is SIMBIoTA-ML, which feeds the TLSH similarity hash of a file into a classifier. It is cheap to compute and detects new malware that resembles what the model saw in training.
But like every ML-based detector, SIMBIoTA-ML can be fooled by adversarial examples (AE). In our paper we ask: can we build a systematic, reliable pipeline that produces functional evasive malware against it? The answer is FAME (From Adversarial feature vectors to Malware Evasion).
The hard part: the inverse feature-mapping problem
Most evasion attacks from the ML literature work on continuous feature vectors. You nudge the numbers until the classifier flips its decision. That is fine for images, where any pixel values give a valid image. Malware is different:
- A binary is discrete and has to keep working after modification.
- The detector never sees the binary directly, only features extracted from it.
- Not every point in feature space corresponds to a real executable.
Going from an adversarial feature vector back to a real binary is known as the inverse feature-mapping problem.
An analogy: crossword construction
Think of a crossword puzzle.
- The malware is the crossword grid with all its words and crossings.
- The feature vector is the crossword’s solution, the final answer you get by reading off the marked cells.
Going forward is easy: given a finished crossword, you can read off its solution. Going backward is hard. If someone hands you a solution and asks you to construct a crossword that produces it, you have to find a grid where all the words fit and cross correctly, and that is a puzzle in itself.
It gets worse when you want to change things. Suppose you want to slightly modify the solution. Changing one letter forces changes to the words that cross it, which forces changes to other words, and soon you are rebuilding half the grid. In the same way, changing one entry of a feature vector is easy on paper, but finding out how to modify the malware so that exactly that feature changes, without breaking the rest or breaking the program, is complicated.
FAME is our way of solving this “crossword construction” problem for SIMBIoTA-ML.
Background: TLSH and SIMBIoTA-ML in brief
TLSH is a similarity digest: it maps a file to a 35-byte hash, and files that are similar at the binary level produce similar hashes. It slides a 5-byte window over the file one byte at a time, hashes byte triples from each window into 128 buckets, and computes the quartiles q1, q2, and q3 of the bucket counts. The digest then consists of a checksum, a length indicator (lvalue), two quartile-ratio fields (Q1ratio and Q2ratio), and 128 two-bit codes. Each code is 0 to 3 depending on whether its bucket count is below q1, between q1 and q2, between q2 and q3, or above q3.
SIMBIoTA-ML ignores the checksum and uses the remaining 131 values (lvalue, Q1ratio, Q2ratio, and the 128 codes) as its feature vector. The original SIMBIoTA-ML paper used a Random Forest classifier; here we study four more classifiers: Logistic Regression (LR), SVM, AdaBoost (AB), Gradient Boosting (GB).
How FAME works
We assume an attacker who has full access to the trained classifier. This is realistic for IoT, since an attacker can buy or obtain a device and extract the model from it. FAME is a three-stage pipeline:
- Generate an adversarial feature vector. We take a correctly detected malware sample and apply an established evasion attack in the continuous feature space. We used ten of them: HopSkipJump, ZOO, and the Boundary attack (black-box); FGSM, BIM, PGD, C&W, and DeepFool (gradient-based, for LR and SVM); and two attacks specialized for tree-based models.
-
Discretize it with an SMT solver. The continuous vector is not a valid TLSH hash. Trying every floor/ceiling combination would mean 2^131 candidates, which is hopeless. Instead we ask an SMT solver to find a vertex of the integer hypercube around the adversarial point that is both a valid TLSH hash and still classified as benign.
-
Modify the binary. Using the TLSH anti-whitelisting attack of Fuchs et al., we append crafted bytes to the original malware so that its TLSH hash matches the target hash the solver found.
The following figure shows the discretisation idea in two dimensions:
The attack pushes the original malware (MW) across the decision boundary to a continuous point, AE_ML, in the benign region. But TLSH features are integers, so AE_ML itself is not a real hash. Thus, we look at the integer points around it, obtained by rounding each coordinate down or up. In two dimensions these are the four corners of a unit square, AE_C1 to AE_C4. Only AE_C3 is both a valid TLSH hash and classified as benign (AE_C1 and AE_C2 fall back into the malware region, and AE_C4 breaks TLSH’s structural rules). In the real 131-dimensional feature space there are 2^131 such corners, far too many to check one by one, so we hand the search to an SMT solver.
The SMT encoding
The solver has two kinds of constraints.
TLSH validity. Every feature must be an integer within its valid range. The lvalue must be at least that of the original malware (the attack can only grow the file) and at most 169. Q1ratio and Q2ratio must be between 0 and 15. The 128 bucket codes take values from 0 to 3 and must respect the quartile structure: at least 32 codes equal 0, at least 64 are in {0,1}, and at least 96 are in {0,1,2}.
Classification. We translate each trained model into a formula that is satisfiable only if the model says “benign”:
- LR and SVM: the decision value (a weighted sum, or a sum of polynomial kernel evaluations against support vectors) must be at most zero.
- Tree ensembles: each benign root-to-leaf path is an AND of split conditions, and a tree’s benign vote is the OR over its benign paths. Then we aggregate according to the ensemble: majority voting for RF, a weighted vote for AB, and a summed score of at most zero for GB.
The solver answers Satisfiable (we have a target hash), Unsatisfiable (no valid benign neighbor exists), or Unknown (timeout, 60 seconds in our experiments).
Evaluation
We used ARM and MIPS binaries: 2,000 malware samples from the public CUBE-MALIOT-2021 dataset and 2,000 benign samples from IoT firmware per architecture. We used a 50/50 train/test split, and the models reached 97 to 99% accuracy. We then attacked the correctly detected malware samples (true positives) and tracked how many survive each phase.
Many samples survive the whole pipeline. For LR and SVM, most attacks keep nearly all of the roughly 1,000 attackable samples through all three phases. For example, BIM against LR gives 993 evasive samples on ARM, and BIM against SVM gives 996. Tree-based models lose more samples, often in the last phase. The anti-whitelisting attack can only append bytes, so if the target lvalue is not much larger than the original’s, there is too little room to reach the target hash.
Some attacks struggle. ZOO and DeepFool fail completely or partially against SVM (ZOO produced no evasive samples at all), which suggests the SVM decision boundary resists the perturbation directions they explore.
File size cost. Evasion is not free. The anti-whitelisting attack appends bytes, so the file grows, as it is shown in the following figures:
- MIPS samples generally need larger increases than ARM samples.
- SVM is the most robust in terms of size increase: all attacks force significant growth.
- For LR: BIM, DeepFool, and ZOO give the smallest increases.
- For tree-based models: the black-box Boundary and HopSkipJump attacks consistently need larger increases, while targeted white-box attacks generally need smaller ones.
What’s next
FAME gives us a systematic way to produce adversarial examples at scale, and that is exactly what defenders need. Our next step is using these samples for adversarial training to make SIMBIoTA-ML more robust. We expect that after adversarial training the ML attacks will succeed less often, the SMT solver will fail more frequently, and when evasion still works, the required file size increase will be larger.
For further details, you can check our paper here.
This work was supported by the National Research, Development and Innovation Fund of Hungary (NKKP-ADVANCED 25-153325).