{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,4,7]],"date-time":"2026-04-07T05:49:45Z","timestamp":1775540985456,"version":"3.50.1"},"reference-count":64,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","license":[{"start":{"date-parts":[[2026,1,1]],"date-time":"2026-01-01T00:00:00Z","timestamp":1767225600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2026,1,1]],"date-time":"2026-01-01T00:00:00Z","timestamp":1767225600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2026,1,1]],"date-time":"2026-01-01T00:00:00Z","timestamp":1767225600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"name":"Fellowship Grant from Universit\u00e9 Paris Cit\u00e9, French National Research Agency","award":["ANR-22-PECY-0007 (DefMal)"],"award-info":[{"award-number":["ANR-22-PECY-0007 (DefMal)"]}]},{"name":"Fellowship Grant from Universit\u00e9 Paris Cit\u00e9, French National Research Agency","award":["ANR-23-IAS4-0001 (CKRISP)"],"award-info":[{"award-number":["ANR-23-IAS4-0001 (CKRISP)"]}]},{"name":"Fellowship Grant from Universit\u00e9 Paris Cit\u00e9"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Trans.Inform.Forensic Secur."],"published-print":{"date-parts":[[2026]]},"DOI":"10.1109\/tifs.2026.3671128","type":"journal-article","created":{"date-parts":[[2026,3,5]],"date-time":"2026-03-05T20:42:22Z","timestamp":1772743342000},"page":"3575-3587","source":"Crossref","is-referenced-by-count":0,"title":["Trust Under Siege: Label Spoofing Attacks Against Machine Learning for Android Malware Detection"],"prefix":"10.1109","volume":"21","author":[{"ORCID":"https:\/\/orcid.org\/0009-0009-0890-0760","authenticated-orcid":false,"given":"Tianwei","family":"Lan","sequence":"first","affiliation":[{"name":"Université Paris Cité, Paris, France"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-5104-1476","authenticated-orcid":false,"given":"Luca","family":"Demetrio","sequence":"additional","affiliation":[{"name":"University of Genova, Genova, Italy"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-5042-5387","authenticated-orcid":false,"given":"Farid","family":"Nait-Abdesselam","sequence":"additional","affiliation":[{"name":"Université Paris Cité, Paris, France"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-9035-6718","authenticated-orcid":false,"given":"Yufei","family":"Han","sequence":"additional","affiliation":[{"name":"INRIA, Rennes, France"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-9547-3502","authenticated-orcid":false,"given":"Simone","family":"Aonzo","sequence":"additional","affiliation":[{"name":"EURECOM, Biot, France"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"263","reference":[{"key":"ref1","volume-title":"Malware Statistics","year":"2026"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.1145\/3634737.3637658"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.1145\/3576915.3616589"},{"key":"ref4","volume-title":"Virustotal","year":"2026"},{"key":"ref5","first-page":"2361","article-title":"Measuring and modeling the label dynamics of online anti-malware engines","volume-title":"Proc. 29th USENIX Secur. Symp.","author":"Zhu"},{"key":"ref6","volume-title":"Virustotal Community Contributors","year":"2026"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.1145\/3712308"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2014.23247"},{"key":"ref9","first-page":"1145","article-title":"Humans vs. machines in malware classification","volume-title":"Proc. USENIX","author":"Aonzo"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.1002\/9781119183525"},{"key":"ref11","volume-title":"Antimalware Test Felipe","year":"2026"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.1145\/3243734.3264418"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.1145\/3585385"},{"key":"ref14","volume-title":"Owasp Machine Learning Security Top Ten","year":"2026"},{"key":"ref15","volume-title":"Operating System Market Share Worldwide","year":"2026"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.1145\/3313391"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1109\/ASE.2019.00023"},{"key":"ref18","volume-title":"Av Comparatives","year":"2026"},{"key":"ref19","volume-title":"Clamav","year":"2026"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1002\/spe.2197"},{"key":"ref21","volume-title":"Yara","year":"2026"},{"key":"ref22","doi-asserted-by":"publisher","DOI":"10.1109\/SSCI47803.2020.9308179"},{"key":"ref23","volume-title":"Apktool","year":"2026"},{"key":"ref24","article-title":"Poisoning attacks against support vector machines","author":"Biggio","year":"2012","journal-title":"arXiv:1206.6389"},{"key":"ref25","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-45719-2_11"},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.1145\/3427228.3427261"},{"key":"ref27","doi-asserted-by":"publisher","DOI":"10.1109\/EuroSP51992.2021.00021"},{"key":"ref28","article-title":"EMBER: An open dataset for training static PE malware machine learning models","author":"Anderson","year":"2018","journal-title":"arXiv:1804.04637"},{"key":"ref29","doi-asserted-by":"publisher","DOI":"10.1145\/1150402.1150436"},{"key":"ref30","article-title":"Adam: A method for stochastic optimization","volume-title":"Proc. 3rd Int. Conf. Learn. Represent. (ICLR)","author":"Kingma"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-66415-2_4"},{"key":"ref32","article-title":"Nearest neighbor (NN) norms: NN pattern classification techniques","author":"Dasarathy","year":"1991","journal-title":"IEEE Comput. Soc. Tutorial"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.1016\/j.procs.2016.02.006"},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.1016\/j.softx.2020.100403"},{"key":"ref35","doi-asserted-by":"publisher","DOI":"10.1109\/DSC63325.2024.00027"},{"key":"ref36","doi-asserted-by":"publisher","DOI":"10.1109\/SPW59333.2023.00027"},{"key":"ref37","volume-title":"The Best Antivirus Software for Android","year":"2025"},{"key":"ref38","doi-asserted-by":"publisher","DOI":"10.1109\/TSUSC.2017.2774184"},{"key":"ref39","doi-asserted-by":"publisher","DOI":"10.3390\/app12115394"},{"key":"ref40","volume-title":"Dumpsys","year":"2026"},{"key":"ref41","volume-title":"Tiktok","year":"2026"},{"key":"ref42","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2024.104035"},{"key":"ref43","first-page":"1523","article-title":"Graph backdoor","volume-title":"Proc. 30th USENIX Secur. Symp.","author":"Xi"},{"key":"ref44","first-page":"1487","article-title":"Explanation-guided backdoor poisoning attacks against malware classifiers","volume-title":"Proc. 30th USENIX Secur. Symp.","author":"Severi"},{"key":"ref45","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2021.3117075"},{"key":"ref46","first-page":"3575","article-title":"Poison forensics: Traceback of data poisoning attacks in neural networks","volume-title":"Proc. 31st USENIX Secur. Symp.","author":"Shan"},{"key":"ref47","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2021.3094824"},{"key":"ref48","doi-asserted-by":"publisher","DOI":"10.1109\/SP46215.2023.10179347"},{"key":"ref49","doi-asserted-by":"publisher","DOI":"10.1109\/SP46215.2023.10179308"},{"key":"ref50","first-page":"2689","article-title":"Sparsity brings vulnerabilities: Exploring new metrics in backdoor attacks","volume-title":"Proc. 32nd USENIX Secur. Symp.","author":"Tian"},{"key":"ref51","first-page":"1685","article-title":"Towards A proactive ML approach for detecting backdoor poison samples","volume-title":"Proc. 32nd USENIX Secur. Symp.","author":"Qi"},{"key":"ref52","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2024.104280"},{"key":"ref53","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2017.11.007"},{"key":"ref54","first-page":"321","article-title":"Why do adversarial attacks transfer? Explaining transferability of evasion and poisoning attacks","volume-title":"Proc. USENIX Security Symp.","author":"Demonti"},{"key":"ref55","doi-asserted-by":"publisher","DOI":"10.1109\/BigData55660.2022.10020528"},{"key":"ref56","doi-asserted-by":"publisher","DOI":"10.1109\/ACSACW65225.2024.00016"},{"key":"ref57","doi-asserted-by":"publisher","DOI":"10.1016\/j.ins.2020.05.026"},{"key":"ref58","doi-asserted-by":"publisher","DOI":"10.1145\/1247660.1247690"},{"key":"ref59","article-title":"Deep partition aggregation: Provable defense against general poisoning attacks","author":"Levine","year":"2020","journal-title":"arXiv:2006.14768"},{"key":"ref60","first-page":"22769","article-title":"Improved certified defenses against data poisoning with (deterministic) finite aggregation","volume-title":"Proc. 39th Int. Conf. Mach. Learn.","volume":"162","author":"Wang"},{"key":"ref61","first-page":"3299","article-title":"On collective robustness of bagging against data poisoning","volume-title":"Proc. 39th Int. Conf. Mach. Learn.","volume":"162","author":"Chen"},{"key":"ref62","first-page":"29030","article-title":"Run-off election: Improved provable defense against data poisoning attacks","volume-title":"Proc. Int. Conf. Mach. Learn. (ICML)","volume":"202","author":"Rezaei"},{"key":"ref63","doi-asserted-by":"publisher","DOI":"10.1145\/3576915.3623193"},{"key":"ref64","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v35i9.16971"}],"container-title":["IEEE Transactions on Information Forensics and Security"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/10206\/11313711\/11422270.pdf?arnumber=11422270","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,4,7]],"date-time":"2026-04-07T04:54:45Z","timestamp":1775537685000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/11422270\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026]]},"references-count":64,"URL":"https:\/\/doi.org\/10.1109\/tifs.2026.3671128","relation":{},"ISSN":["1556-6013","1556-6021"],"issn-type":[{"value":"1556-6013","type":"print"},{"value":"1556-6021","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026]]}}}