Evaluating robustness of machine-learning models to adversarial examples is a challenging problem. Many defenses have been shown to provide a false sense of security by causing gradient-based attacks to fail, and they have been broken under more rigorous evaluations. Although guidelines and best practices have been suggested to improve current adversarial robustness evaluations, the lack of automatic testing and debugging tools makes it difficult to apply these recommendations in a systematic manner. In this work, we overcome these limitations by (i) defining a set of quantitative indicators which unveil common failures in the optimization of gradient-based attacks, and (ii) proposing specific mitigation strategies within a systematic evaluation protocol. Our extensive experimental analysis shows that the proposed indicators of failure can be used to visualize, debug and improve current adversarial robustness evaluations, providing a first concrete step towards automatizing and systematizing current adversarial robustness evaluations. Our open-source code is available at: https://github.com/pralab/IndicatorsOfAttackFailure.

Towards Debugging and Improving Adversarial Robustness Evaluations

Windows malware detectors based on machine learning are vulnerable to adversarial examples, even if the attacker is only given black-box query access to the model. The main drawback of these attacks is that: (i) they are query-inefficient, as they rely on iteratively applying random transformations to the input malware; and (ii) they may also require executing the adversarial malware in a sandbox at each iteration of the optimization process, to ensure that its intrusive functionality is preserved. In this paper, we overcome these issues by presenting a novel family of black-box attacks that are both query-efficient and functionality-preserving, as they rely on the injection of benign content - which will never be executed - either at the end of the malicious file, or within some newly-created sections. Our attacks are formalized as a constrained minimization problem which also enables optimizing the trade-off between the probability of evading detection and the size of the injected payload. We empirically investigate this trade-off on two popular static Windows malware detectors, and show that our black-box attacks can bypass them with only few queries and small payloads, even when they only return the predicted labels. We also evaluate whether our attacks transfer to other commercial antivirus solutions, and surprisingly find that they can evade, on average, more than 12 commercial antivirus engines. We conclude by discussing the limitations of our approach, and its possible future extensions to target malware classifiers based on dynamic analysis.

Adversarial EXEmples: Functionality-preserving Optimization of Adversarial Windows Malware

**Workshop website:** https://sites.google.com/view/mldm2021/home 
**Chair: Alessio Micheli** 
**Chair: Manuel Roveri**

MLDM The 10th Italian Workshop on Machine Learning and Data Mining  - Day 1

workshop paper

[![](https://assets.underline.io/uploads/markdown_image/1/image/9a88ae95fbde06e80f4bcf6d4f7d133a.png)](https://certificateaixia.paperform.co/)
The certificate will be provided by December 17. 
In case you need it urgently please contact: francesca.gasparini@unimib.it. 

 

The 20th International Conference of the Italian Association for Artificial Intelligence (**AIxIA 2021**) is organized by AIxIA (Associazione Italiana per l’Intelligenza Artificiale), which is a non-profit scientific society founded in 1988 and devoted to the promotion of Artificial Intelligence. The society aims to increase the public awareness of AI, encourage the teaching of it and promote research in the field.

 
 



**General Chair**

Stefania Bandini, University of Milano-Bicocca, Italyand RCAST - The University of Tokyo, Japan


**Program Chairs**

Viviana Mascardi, University of Genova, Italy; Matteo Palmonari, University of Milano-Bicocca, Italy; Giuseppe Vizzari, University of Milano-Bicocca, Italy

**Organizing Committee**

Francesca Gasparini, University of Milano-Bicocca, Italy (**Chair**); Stefano Ferilli, University of Bari, Italy; Marta Giltri, University of Milano-Bicocca, Italy; Daniela Briola, University of Insubria, Italy


**Publicity and Communication Committee**

Elisabetta Fersini, University of Milano-Bicocca, Italy (**Chair**); Angelo Ferrando, University of Genova, Italy; Francesca Alessandra Lisi, University of Bari, Italy; Giovanni Stilo, University of L'Aquila, Italy; Marco Viviani, University of Milano-Bicocca, Italy


**Workshop Chairs**

Gabriella Cortellessa, ISTC-CNR, Rome, Italy; Silvia Rossi, University of Naples Federico II, Italy; Fabio Stella, University of Milano-Bicocca, Italy


**PC Members**

Fulvio Mastrogiovanni, University of Genova, Italy; Roberto Basili, University of Rome Tor Vergata, Italy; Nicola Gatti, Polytechnic University of Milan, Italy; Stefano Bistarelli, University of Perugia, Italy; Piero Poccianti, Consorzio Operativo Gruppo MPS, Italy; Francesco Scarcello, University of Calabria, Italy; Flavio S. Correa Da Silva, University of São Paulo, Brazil; Elena Cabrio, Université Côte d'Azur, CNRS, Inria, I3S, France; Antonio Lieto, University of Turin, Italy; Diego Calvanese, Free University of Bozen-Bolzano, Italy; Alessio Micheli, University of Pisa, Italy; Francesca A. Lisi University of Bari Aldo Moro, Italy; Mauro Vallati, University of Huddersfield, United Kingdom; Bernardo Magnini, Fondazione Bruno Kessler (FBK), Italy; Luigia C. Aiello, Sapienza University of Rome, Italy; Rafael H. Bordini, Pontifical Catholic University of Rio Grande do Sul, Brazil; Chiara Ghidini, Fondazione Bruno Kessler (FBK), Italy; Federico Bergenti, University of Parma, Italy; Francesco Ricca, University of Calabria, Italy; Andrea Burattin, Technical University of Denmark, Denmark; Angelo Oddi, ISTC-CNR, Italian National Research Council, Italy; Farshad Badie, Aalborg University, Denmark; Emanuel Sallinger, University of Oxford, United Kingdom; Marin Lujak, University Rey Juan Carlos, Spain; Giancarlo Fortino, University of Calabria, Italy; Salvatore Gaglio, University of Palermo, Italy; Johannes K. Fichte, TU Dresden, Germany; Matteo Baldoni, University of Turin, Italy; Fabrizio Riguzzi, Univeristy of Ferrara, Italy; Ivana Dusparic, Trinity College Dublin, Ireland; Serena Villata, CNRS - Laboratoire d'Informatique, Signaux et Systèmes de Sophia-Antipolis, France; Paolo Rosso, Technical University of Valencia, Spain; Ana L. C. Bazzan, Federal University of Rio Grande do Sul, Brazil; Gianluigi Greco, University of Calabria, Italy; Stefano Cagnoni, University of Parma, Italy; Gian Luca Pozzato, University of Turin, Italy; Salvatore Ruggieri, University of Turin, Italy; Claudio Di Ciccio, Sapienza University of Rome, Italy; Eloisa Vargiu, Cetaqua, Water Technology Center, Spain; Marco Maratea, University of Genova, Italy; Andrea Roli, University of Bologna, Italy; Viviana Patti, University of Turin, Italy; Stefania Costantini, University of L'Aquila, Italy; Antonius Weinzierl, Vienna University of Technology, Austria; Silvia Rossi, University of Naples Federico II, Italy; Giovanni Semeraro, University of Bari, Italy; Luciano Serafini, Fondazione Bruno Kessler (FBK), Italy; Laura Giordano, University of Eastern Piedmont, Italy; Ernesto Jimenez-Ruiz, City, University of London, United Kingdom; Marco Gavanelli, University of Ferrara, Italy; Federico Chesani, University of Bologna, Italy

Please register with AIxIA to be able to enter the conference on Underline.io. If you have already registered, please login to Underline.io to be able to see full conference content. In case you do not have an Underline account, please create one. Thank you

Please login to your Underline account

AIxIA 2021

The 20th International Conference of the Italian Association for Artificial Intelligence (AIxIA 2021) is organized by AIxIA (Associazione Italiana per l’Intelligenza Artificiale), which is a non-profit scientific society founded in 1988 and devoted to the promotion of Artificial Intelligence. The society aims to increase the public awareness of AI, encourage the teaching of it and promote research in the field.

Luca Demetrio

2

SHORT BIO

Presentations

Towards Debugging and Improving Adversarial Robustness Evaluations

Adversarial EXEmples: Functionality-preserving Optimization of Adversarial Windows Malware

Stay up to date with the latest Underline news!

PRESENTATIONS

CONFERENCES

COMPANY

RESOURCES