Battista Biggio

Backdoor attacks poison the training data, causing the model to behave normally on clean inputs but predict attacker-chosen labels when trigger patterns are embedded into the input samples. Defending against such attacks is highly challenging, especially when the defender has limited access to clean data. Existing defense methods often rely on restrictive assumptions—such as high poisoning ratios or poisoning strategies—limiting their practicality and generalization. To overcome these limitations, we propose Prototype-Guided Robust Learning (PGRL), a defense that only requires a small set of verified benign samples, and integrates two complementary components during fine-tuning: Label Consistency Verification (LCV), which detects and removes suspicious samples from the potentially poisoned dataset; and Feature Distance Estimation (FDE), which enforces the unlearning of backdoor-related representations. Extensive experiments against eight existing defenses show that PGRL achieves superior robustness across diverse architectures, datasets, and advanced attack scenarios, establishing a new standard for practical and generalizable backdoor defense.

Adversarial machine learning is an important area of research in computer science, focusing on understanding and mitigating attacks that make use of the vulnerabilities of machine learning models. In such attacks, adversaries aim to exploit these vulnerabilities in order to harm model's utility or violate its privacy or availability. These attacks include evasion, poisoning, exploratory, and explainability. Evasion, poisoning, and explainability attacks aim to harm the models' utility, while exploratory attacks violate the privacy of the models. To reduce the negative impacts of these attacks, a plethora of defense mechanisms have been proposed. In this survey, we review a substantial body of works and propose a comprehensive and novel taxonomy of defense strategies. We divide defense systems into eight main categories including: training-based, architecture-based, uncertainty-based, detection-based, optimization-based, transformation-based, information-theoretic, and hybrid approaches. For each category, we analyze and summarize key techniques and algorithms. Moreover, we investigate the limitations associated with these defenses, such as model generalization, robustness-accuracy trade-off, and adaptability challenges. By highlighting the strengths and weaknesses of existing defenses, this survey aims to enlighten future research towards more robust and efficient adversarial defense mechanisms.

End-to-end machine learning malware detectors are vulnerable to adversarial EXEmples, carefully-crafted malicious programs that evade detection through minimal perturbations. Such attacks typically operate by either replacing unused content (patch attacks), or injecting new patterns (content-injection attacks). To counter these attacks, recent research has focused on certification methods for end-to-end models that aim to prove robustness guarantees within bounded perturbation sizes. However, existing approaches (i) are not robust against content-injection manipulations and (ii) provide only probabilistic guarantees for perturbations that are negligible relative to the overall program size. Hence, in this paper we address these limitations through a novel deterministic certification schema based on (de)randomized smoothing. Our defense splits each executable into non-overlapping chunks and classifies them independently. The final decision is obtained via majority voting across all chunks, ensuring that localized modifications, such as injected or patched code, influence only a limited subset of chunks and have minimal impact in the overall classification. This design guarantees that each chunk either contains or does not contain an adversarial perturbation, enabling us to (i) handle manipulations occurring at arbitrary locations within the program, and (ii) compute deterministic estimates of the perturbation magnitude required to evade detection. We demonstrate the effectiveness of our certification schema through extensive experimental analysis, comparing our defense against a range of state-of-the-art attacks and defenses. The results show that our approach achieves unmatched robustness across all tested attack scenarios, substantially outperforming competing defenses.

Living-off-the-land (LOTL) techniques, which exploit legitimate system utilities to execute malicious commands, pose significant challenges to cyber-threat detection by blending with benign behavior. Current state-of-the-art machine learning (ML) detection methods suffer from two critical limitations: (1) a need for large-scale datasets that capture LOTL behaviors, essential for detection at low false-positive rates (FPR) and high true-positive rates (TPR), and (2) a lack of adversarial manipulation evaluations, despite the inherent presence of adaptive attackers in cybersecurity contexts. To address these challenges, we introduce a novel, cyber-security focused data synthesis (DS) framework that augments malicious LOTL samples by combining threat intelligence with legitimate baselines from enterprise networks. We evaluate our framework in a large-scale production environment, focusing on the detection of Linux LOTL reverse shells. The resulting dataset and models—collectively referred to as QuasarNix —enable ML detectors that detect roughly 60% of malicious reverse shells at an industry-grade FPR = 10 ^-6 , whereas non-augmented baselines remain effectively blind at this operating point. We demonstrate that unprotected ML models remain vulnerable to black-box evasion attacks. To counteract these risks, we incorporate adversarial training into our DS framework, enhancing the robustness of our LOTL detection models. Through an explainability analysis, we confirm that QuasarNix provide detection engineers with evidence-based attribution, aligning with cybersecurity domain expertise. To foster reproducibility, we publicly release our framework implementation, ¹ synthesized dataset, ² and pre-trained models. ³

To address the extremely concerning problem of software vulnerability, system security is often entrusted to Machine Learning (ML) algorithms. Despite their now established detection capabilities, such models are limited by design to flagging the entire input source code function as vulnerable, rather than precisely localizing the concerned code lines. However, the detection granularity is crucial to support human operators during software development, ensuring that such predictions reflect the true code semantics to help debug, evaluate, and fix the detected vulnerabilities. To address this issue, recent work made progress toward improving the detector’s localization ability, thus narrowing down the vulnerability detection “window” and providing more fine-grained predictions. Such approaches, however, implicitly disregard the presence of spurious correlations and biases in the data, which often predominantly influence the performance of ML algorithms. In this work, we investigate how detectors comply with this requirement by proposing an explainability-based evaluation procedure. Our approach, defined as Detection Alignment (DA), quantifies the agreement between the input source code lines that most influence the prediction and the actual localization of the vulnerability as per the ground truth. Through DA, which is model-agnostic and adaptable to different detection tasks, not limited to our use case, we analyze multiple learning-based vulnerability detectors and datasets. As a result, we show how the predictions of such models are consistently biased by non-vulnerable lines, ultimately highlighting the high impact of biases and spurious correlations.

Cross-domain transfer attacks are inherently ill-posed due to profound structural and semantic discrepancies between surrogate and target models. Conventional methods often fail due to gradient stagnation and label misalignment. We propose Cross-Domain Adversarial Optimization (CDAO), a training-free paradigm establishing high-fidelity adversarial guidance across heterogeneous domains without task-specific retraining. Differentiable Spatial-Spectral Mapping (DSSM) reconciles physical dimension mismatches, restoring analytical gradient flow through non-isomorphic input spaces. To resolve semantic disjointness, Target Proxy Distillation (TPD) reformulates proxy target selection as a Best Arm Identification problem. Using multi-fidelity Successive Halving, TPD adaptively distills informative proxy classes with minimal query overhead, eliminating shared label assumptions. By unifying structural and semantic alignment into a plug-and-play pipeline, CDAO enables effective cross-domain guidance at inference time. Extensive evaluations demonstrate CDAO achieves state-of-the-art transferability and superior query efficiency, consistently surpassing complex parametric adaptation methods in diverse and evolving open-world environments.