{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,12,22]],"date-time":"2025-12-22T22:27:00Z","timestamp":1766442420211,"version":"3.48.0"},"publisher-location":"New York, NY, USA","reference-count":38,"publisher":"ACM","content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2025,11,19]]},"DOI":"10.1145\/3719027.3765118","type":"proceedings-article","created":{"date-parts":[[2025,11,22]],"date-time":"2025-11-22T23:37:25Z","timestamp":1763854645000},"page":"4394-4408","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":0,"title":["Evaluating the Robustness of a Production Malware Detection System to Transferable Adversarial Attacks"],"prefix":"10.1145","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-1913-6157","authenticated-orcid":false,"given":"Milad","family":"Nasr","sequence":"first","affiliation":[{"name":"Google Deepmind, Mountain view, CA, USA"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0009-0008-3676-9117","authenticated-orcid":false,"given":"Yanick","family":"Fratantonio","sequence":"additional","affiliation":[{"name":"Google, Zurich, Switzerland"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-8420-0760","authenticated-orcid":false,"given":"Luca","family":"Invernizzi","sequence":"additional","affiliation":[{"name":"Google, Zurich, Switzerland"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0009-0008-4066-7893","authenticated-orcid":false,"given":"Ange","family":"Albertini","sequence":"additional","affiliation":[{"name":"Google, Berlin, Switzerland"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0009-0006-7218-5763","authenticated-orcid":false,"given":"Loua","family":"Farah","sequence":"additional","affiliation":[{"name":"Google, Paris, France"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0009-0004-9530-9330","authenticated-orcid":false,"given":"Alex","family":"Petit-Bianco","sequence":"additional","affiliation":[{"name":"Google, Grenoble Area, France"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-5681-3399","authenticated-orcid":false,"given":"Andreas","family":"Terzis","sequence":"additional","affiliation":[{"name":"Google Deepmind, Mountain View, CA, USA"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-3762-5851","authenticated-orcid":false,"given":"Kurt","family":"Thomas","sequence":"additional","affiliation":[{"name":"Google, Mountain View, CA, USA"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-0316-6906","authenticated-orcid":false,"given":"Elie","family":"Bursztein","sequence":"additional","affiliation":[{"name":"Google, Mountain View, CA, USA"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-1463-3461","authenticated-orcid":false,"given":"Nicholas","family":"Carlini","sequence":"additional","affiliation":[{"name":"Google Deepmind, Mountain View, CA, USA"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"320","published-online":{"date-parts":[[2025,11,22]]},"reference":[{"key":"e_1_3_2_1_1_1","volume-title":"Abusing file formats","author":"Albertini Ange","year":"2015","unstructured":"Ange Albertini. Abusing file formats; or, corkami, the novella. The International Journal of Proof of Concept or GTFO (0\u00d7 07):18-41, 2015."},{"key":"e_1_3_2_1_2_1","first-page":"3291","volume-title":"31st USENIX Security Symposium (USENIX Security 22)","author":"Albertini Ange","year":"2022","unstructured":"Ange Albertini, Thai Duong, Shay Gueron, Stefan K\u00f6lbl, Atul Luykx, and Sophie Schmieg. How to abuse and fix authenticated encryption without key commitment. In 31st USENIX Security Symposium (USENIX Security 22), pages 3291-3308, Boston, MA, August 2022. USENIX Association."},{"key":"e_1_3_2_1_3_1","volume-title":"Did you hear that? adversarial examples against automatic speech recognition. arXiv preprint arXiv:1801.00554","author":"Alzantot Moustafa","year":"2018","unstructured":"Moustafa Alzantot, Bharathan Balaji, and Mani Srivastava. Did you hear that? adversarial examples against automatic speech recognition. arXiv preprint arXiv:1801.00554, 2018."},{"key":"e_1_3_2_1_4_1","doi-asserted-by":"publisher","DOI":"10.1109\/SaTML54575.2023.00031"},{"key":"e_1_3_2_1_5_1","volume-title":"Proceedings of the International Conference on Learning Representations (ICLR)","author":"Brendel Wieland","year":"2018","unstructured":"Wieland Brendel, Jonas Rauber, and Matthias Bethge. Decision-based adversarial attacks: Reliable attacks against black-box machine learning models. In Proceedings of the International Conference on Learning Representations (ICLR), 2018."},{"key":"e_1_3_2_1_6_1","volume-title":"Blind spots: Automatically detecting ignored program inputs","author":"Brodin Henrik","year":"2023","unstructured":"Henrik Brodin, Evan Sultanik, and Marek Surovi?. Blind spots: Automatically detecting ignored program inputs, 2023."},{"key":"e_1_3_2_1_7_1","volume-title":"Language models are few-shot learners. arXiv preprint arXiv:2005.14165","author":"Brown Tom B","year":"2020","unstructured":"Tom B Brown. Language models are few-shot learners. arXiv preprint arXiv:2005.14165, 2020."},{"key":"e_1_3_2_1_8_1","volume-title":"February","author":"Bursztein Elie","year":"2024","unstructured":"Elie Bursztein and Yanick Fratantonio. Magika: Ai powered fast and efficient file type identification, February 2024. Google Open Source Blog."},{"key":"e_1_3_2_1_9_1","first-page":"1","volume-title":"Audio adversarial examples: Targeted attacks on speech-to-text. In 2018 IEEE security and privacy workshops (SPW)","author":"Carlini Nicholas","year":"2018","unstructured":"Nicholas Carlini and David Wagner. Audio adversarial examples: Targeted attacks on speech-to-text. In 2018 IEEE security and privacy workshops (SPW), pages 1-7. IEEE, 2018."},{"key":"e_1_3_2_1_10_1","doi-asserted-by":"publisher","DOI":"10.1145\/3128572.3140448"},{"key":"e_1_3_2_1_11_1","volume-title":"Linux Foundation","author":"Ian","year":"2023","unstructured":"Ian Darwin and contributors. The file Command in Linux. Linux Foundation, 2023. Available from: https:\/\/man7.org\/linux\/man-pages\/man1\/file.1.html."},{"key":"e_1_3_2_1_12_1","volume-title":"Bert: Pre-training of deep bidirectional transformers for language understanding. arXiv preprint arXiv:1810.04805","author":"Devlin Jacob","year":"2018","unstructured":"Jacob Devlin. Bert: Pre-training of deep bidirectional transformers for language understanding. arXiv preprint arXiv:1810.04805, 2018."},{"key":"e_1_3_2_1_13_1","volume-title":"James F Dray Jr, et al. Advanced encryption standard (aes)","author":"Dworkin Morris J","year":"2001","unstructured":"Morris J Dworkin, Elaine Barker, James R Nechvatal, James Foti, Lawrence E Bassham, E Roback, James F Dray Jr, et al. Advanced encryption standard (aes). 2001."},{"key":"e_1_3_2_1_14_1","volume-title":"Hotflip: White-box adversarial examples for text classification. arXiv preprint arXiv:1712.06751","author":"Ebrahimi Javid","year":"2017","unstructured":"Javid Ebrahimi, Anyi Rao, Daniel Lowd, and Dejing Dou. Hotflip: White-box adversarial examples for text classification. arXiv preprint arXiv:1712.06751, 2017."},{"key":"e_1_3_2_1_15_1","volume-title":"Elie Bursztein. Magika: AI-Powered Content-Type Detection. Proceedings of the International Conference on Software Engineering (ICSE)","author":"Fratantonio Yanick","year":"2025","unstructured":"Yanick Fratantonio, Luca Invernizzi, Loua Farah, Kurt Thomas, Marina Zhang, Ange Albertini, Francois Galilee, Giancarlo Metitieri, Julien Cretin, Alex Petit-Bianco, David Tao, and Elie Bursztein. Magika: AI-Powered Content-Type Detection. Proceedings of the International Conference on Software Engineering (ICSE), 2025."},{"key":"e_1_3_2_1_16_1","volume-title":"Motivating the rules of the game for adversarial example research. arXiv preprint arXiv:1807.06732","author":"Gilmer Justin","year":"2018","unstructured":"Justin Gilmer, Ryan P Adams, Ian Goodfellow, David Andersen, and George E Dahl. Motivating the rules of the game for adversarial example research. arXiv preprint arXiv:1807.06732, 2018."},{"key":"e_1_3_2_1_17_1","volume-title":"Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572","author":"Goodfellow Ian J","year":"2014","unstructured":"Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572, 2014."},{"key":"e_1_3_2_1_18_1","volume-title":"Benchmarking neural network robustness to common corruptions and perturbations. arXiv preprint arXiv:1903.12261","author":"Hendrycks Dan","year":"2019","unstructured":"Dan Hendrycks and Thomas Dietterich. Benchmarking neural network robustness to common corruptions and perturbations. arXiv preprint arXiv:1903.12261, 2019."},{"key":"e_1_3_2_1_19_1","doi-asserted-by":"publisher","DOI":"10.1109\/SaTML54575.2023.00026"},{"key":"e_1_3_2_1_20_1","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/D17-1215"},{"key":"e_1_3_2_1_21_1","volume-title":"Google workspace: A more secure alternative for today's threat landscape. https:\/\/workspace.google.com\/blog\/identity-and-security\/securealternative","author":"Kim Yulie Kwon","year":"2024","unstructured":"Yulie Kwon Kim. Google workspace: A more secure alternative for today's threat landscape. https:\/\/workspace.google.com\/blog\/identity-and-security\/securealternative, 2024."},{"key":"e_1_3_2_1_22_1","volume-title":"Deep text classification can be fooled. arXiv preprint arXiv:1704.08006","author":"Liang Bin","year":"2017","unstructured":"Bin Liang, Hongcheng Li, Miaoqiang Su, Pan Bian, Xirong Li, and Wenchang Shi. Deep text classification can be fooled. arXiv preprint arXiv:1704.08006, 2017."},{"key":"e_1_3_2_1_23_1","volume-title":"Delving into transferable adversarial examples and black-box attacks. arXiv preprint arXiv:1611.02770","author":"Liu Yanpei","year":"2016","unstructured":"Yanpei Liu, Xinyun Chen, Chang Liu, and Dawn Song. Delving into transferable adversarial examples and black-box attacks. arXiv preprint arXiv:1611.02770, 2016."},{"key":"e_1_3_2_1_24_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.jksuci.2021.12.016"},{"key":"e_1_3_2_1_25_1","volume-title":"Towards deep learning models resistant to adversarial attacks. arXiv preprint arXiv:1706.06083","author":"Madry Aleksander","year":"2017","unstructured":"Aleksander Madry. Towards deep learning models resistant to adversarial attacks. arXiv preprint arXiv:1706.06083, 2017."},{"key":"e_1_3_2_1_26_1","volume-title":"Proceedings of the AAAI Conference on Artificial Intelligence","author":"Morris John X.","year":"2020","unstructured":"John X. Morris, Eli Lifland, Jin Yong Yoo, Jake Grigsby, and Z. YTanjun Qig. Textfooler: A model-agnostic adversarial text generation approach for text classification. Proceedings of the AAAI Conference on Artificial Intelligence, 2020."},{"key":"e_1_3_2_1_27_1","volume-title":"Transferability in machine learning: from phenomena to black-box attacks using adversarial samples. In arXiv preprint arXiv:1605.07277","author":"Papernot Nicolas","year":"2016","unstructured":"Nicolas Papernot, Patrick McDaniel, Ian Goodfellow, Somesh Jha, Z Berkay Celik, and Ananthram Swami. Transferability in machine learning: from phenomena to black-box attacks using adversarial samples. In arXiv preprint arXiv:1605.07277, 2016."},{"key":"e_1_3_2_1_28_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP40000.2020.00073"},{"key":"e_1_3_2_1_29_1","first-page":"5231","volume-title":"International conference on machine learning","author":"Qin Yao","year":"2019","unstructured":"Yao Qin, Nicholas Carlini, Garrison Cottrell, Ian Goodfellow, and Colin Raffel. Imperceptible, robust, and targeted adversarial examples for automatic speech recognition. In International conference on machine learning, pages 5231-5240. PMLR, 2019."},{"issue":"8","key":"e_1_3_2_1_30_1","first-page":"9","article-title":"Language models are unsupervised multitask learners","volume":"1","author":"Radford Alec","year":"2019","unstructured":"Alec Radford, Jeffrey Wu, Rewon Child, David Luan, Dario Amodei, Ilya Sutskever, et al. Language models are unsupervised multitask learners. OpenAI blog, 1(8):9, 2019.","journal-title":"OpenAI blog"},{"key":"e_1_3_2_1_31_1","volume-title":"Eric Wallace, and Sameer Singh. Autoprompt: Eliciting knowledge from language models with automatically generated prompts. arXiv preprint arXiv:2010.15980","author":"Shin Taylor","year":"2020","unstructured":"Taylor Shin, Yasaman Razeghi, Robert L Logan IV, Eric Wallace, and Sameer Singh. Autoprompt: Eliciting knowledge from language models with automatically generated prompts. arXiv preprint arXiv:2010.15980, 2020."},{"key":"e_1_3_2_1_32_1","volume-title":"Sitatapatra: Blocking the transfer of adversarial samples. arXiv preprint arXiv:1901.08121","author":"Shumailov Ilia","year":"2019","unstructured":"Ilia Shumailov, Xitong Gao, Yiren Zhao, Robert Mullins, Ross Anderson, and Cheng-Zhong Xu. Sitatapatra: Blocking the transfer of adversarial samples. arXiv preprint arXiv:1901.08121, 2019."},{"key":"e_1_3_2_1_33_1","volume-title":"Intriguing properties of neural networks. arXiv preprint arXiv:1312.6199","author":"Szegedy C","year":"2013","unstructured":"C Szegedy. Intriguing properties of neural networks. arXiv preprint arXiv:1312.6199, 2013."},{"key":"e_1_3_2_1_34_1","volume-title":"Pax address space layout randomization (aslr)","author":"Team X","year":"2001","unstructured":"PaX Team. Pax address space layout randomization (aslr). 2001. Available: https:\/\/pax.grsecurity.net\/docs\/aslr.txt."},{"key":"e_1_3_2_1_35_1","volume-title":"6th International Conference on Learning Representations, ICLR 2018-Conference Track Proceedings","author":"Tram\u00e8r F","year":"2018","unstructured":"F Tram\u00e8r, D Boneh, A Kurakin, I Goodfellow, N Papernot, and P McDaniel. Ensemble adversarial training: Attacks and defenses. In 6th International Conference on Learning Representations, ICLR 2018-Conference Track Proceedings, 2018."},{"key":"e_1_3_2_1_36_1","unstructured":"VirusTotal. Virustotal. https:\/\/www.virustotal.com\/."},{"key":"e_1_3_2_1_37_1","volume-title":"Generating fluent adversarial examples for natural languages. arXiv preprint arXiv:2007.06174","author":"Zhang Huangzhao","year":"2020","unstructured":"Huangzhao Zhang, Hao Zhou, Ning Miao, and Lei Li. Generating fluent adversarial examples for natural languages. arXiv preprint arXiv:2007.06174, 2020."},{"key":"e_1_3_2_1_38_1","volume-title":"Universal and transferable adversarial attacks on aligned language models. arXiv preprint arXiv:2307.15043","author":"Zou Andy","year":"2023","unstructured":"Andy Zou, Zifan Wang, Nicholas Carlini, Milad Nasr, J Zico Kolter, and Matt Fredrikson. Universal and transferable adversarial attacks on aligned language models. arXiv preprint arXiv:2307.15043, 2023."}],"event":{"name":"CCS '25: ACM SIGSAC Conference on Computer and Communications Security","sponsor":["SIGSAC ACM Special Interest Group on Security, Audit, and Control"],"location":"Taipei Taiwan","acronym":"CCS '25"},"container-title":["Proceedings of the 2025 ACM SIGSAC Conference on Computer and Communications Security"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3719027.3765118","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,12,22]],"date-time":"2025-12-22T22:22:43Z","timestamp":1766442163000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3719027.3765118"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,11,19]]},"references-count":38,"alternative-id":["10.1145\/3719027.3765118","10.1145\/3719027"],"URL":"https:\/\/doi.org\/10.1145\/3719027.3765118","relation":{},"subject":[],"published":{"date-parts":[[2025,11,19]]},"assertion":[{"value":"2025-11-22","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}