{"id":"https://openalex.org/W7166121726","doi":"https://doi.org/10.48550/arxiv.2606.26707","title":"DroidBreaker: Practical and Functional Problem-Space Attacks on Machine-Learning Android Malware Detectors","display_name":"DroidBreaker: Practical and Functional Problem-Space Attacks on Machine-Learning Android Malware Detectors","publication_year":2026,"publication_date":"2026-06-25","ids":{"openalex":"https://openalex.org/W7166121726","doi":"https://doi.org/10.48550/arxiv.2606.26707"},"language":null,"primary_location":{"id":"doi:10.48550/arxiv.2606.26707","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2606.26707","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"type":"preprint","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.48550/arxiv.2606.26707","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5139448265","display_name":"Christian Scano","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Scano, Christian","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5093633462","display_name":"Diego Soi","orcid":"https://orcid.org/0009-0009-0092-9067"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Soi, Diego","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5051213660","display_name":"Angelo Sotgiu","orcid":"https://orcid.org/0000-0003-2100-9517"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Sotgiu, Angelo","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5069663380","display_name":"Luca Demetrio","orcid":"https://orcid.org/0000-0001-5104-1476"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Demetrio, Luca","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5051452548","display_name":"Davide Maiorca","orcid":"https://orcid.org/0000-0003-2640-4663"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Maiorca, Davide","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5075367917","display_name":"Giorgio Giacinto","orcid":"https://orcid.org/0000-0002-5759-3017"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Giacinto, Giorgio","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5139400171","display_name":"Fabio Roli","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Roli, Fabio","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5139410321","display_name":"Battista Biggio","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Biggio, Battista","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9843000173568726,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9843000173568726,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.007199999876320362,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.002099999925121665,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/malware","display_name":"Malware","score":0.8226000070571899},{"id":"https://openalex.org/keywords/obfuscation","display_name":"Obfuscation","score":0.7279000282287598},{"id":"https://openalex.org/keywords/bytecode","display_name":"Bytecode","score":0.6449000239372253},{"id":"https://openalex.org/keywords/cryptovirology","display_name":"Cryptovirology","score":0.5662000179290771},{"id":"https://openalex.org/keywords/android","display_name":"Android (operating system)","score":0.5569000244140625},{"id":"https://openalex.org/keywords/android-malware","display_name":"Android malware","score":0.5166000127792358},{"id":"https://openalex.org/keywords/evasion","display_name":"Evasion (ethics)","score":0.4869999885559082},{"id":"https://openalex.org/keywords/software","display_name":"Software","score":0.4528000056743622},{"id":"https://openalex.org/keywords/adversarial-system","display_name":"Adversarial system","score":0.42080000042915344}],"concepts":[{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.8226000070571899},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8144999742507935},{"id":"https://openalex.org/C40305131","wikidata":"https://www.wikidata.org/wiki/Q2616305","display_name":"Obfuscation","level":2,"score":0.7279000282287598},{"id":"https://openalex.org/C2779818221","wikidata":"https://www.wikidata.org/wiki/Q837330","display_name":"Bytecode","level":3,"score":0.6449000239372253},{"id":"https://openalex.org/C84525096","wikidata":"https://www.wikidata.org/wiki/Q3506050","display_name":"Cryptovirology","level":3,"score":0.5662000179290771},{"id":"https://openalex.org/C557433098","wikidata":"https://www.wikidata.org/wiki/Q94","display_name":"Android (operating system)","level":2,"score":0.5569000244140625},{"id":"https://openalex.org/C2989133298","wikidata":"https://www.wikidata.org/wiki/Q94","display_name":"Android malware","level":3,"score":0.5166000127792358},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.5156000256538391},{"id":"https://openalex.org/C2781251061","wikidata":"https://www.wikidata.org/wiki/Q5416089","display_name":"Evasion (ethics)","level":3,"score":0.4869999885559082},{"id":"https://openalex.org/C2777904410","wikidata":"https://www.wikidata.org/wiki/Q7397","display_name":"Software","level":2,"score":0.4528000056743622},{"id":"https://openalex.org/C37736160","wikidata":"https://www.wikidata.org/wiki/Q1801315","display_name":"Adversarial system","level":2,"score":0.42080000042915344},{"id":"https://openalex.org/C2781045450","wikidata":"https://www.wikidata.org/wiki/Q254569","display_name":"Backdoor","level":2,"score":0.41769999265670776},{"id":"https://openalex.org/C2781345505","wikidata":"https://www.wikidata.org/wiki/Q2535979","display_name":"Blacklist","level":2,"score":0.41119998693466187},{"id":"https://openalex.org/C153083717","wikidata":"https://www.wikidata.org/wiki/Q6535263","display_name":"Leverage (statistics)","level":2,"score":0.3781999945640564},{"id":"https://openalex.org/C2779395397","wikidata":"https://www.wikidata.org/wiki/Q15731404","display_name":"Malware analysis","level":3,"score":0.3547999858856201},{"id":"https://openalex.org/C2780967490","wikidata":"https://www.wikidata.org/wiki/Q1291200","display_name":"Mobile malware","level":3,"score":0.3483999967575073},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.3100000023841858},{"id":"https://openalex.org/C97686452","wikidata":"https://www.wikidata.org/wiki/Q7604153","display_name":"Static analysis","level":2,"score":0.3034999966621399},{"id":"https://openalex.org/C153180980","wikidata":"https://www.wikidata.org/wiki/Q19776675","display_name":"Commit","level":2,"score":0.29649999737739563},{"id":"https://openalex.org/C141141315","wikidata":"https://www.wikidata.org/wiki/Q2379942","display_name":"Guard (computer science)","level":2,"score":0.29420000314712524},{"id":"https://openalex.org/C186967261","wikidata":"https://www.wikidata.org/wiki/Q5082128","display_name":"Mobile device","level":2,"score":0.28690001368522644},{"id":"https://openalex.org/C3017891749","wikidata":"https://www.wikidata.org/wiki/Q94","display_name":"Android application","level":3,"score":0.2702000141143799},{"id":"https://openalex.org/C41065033","wikidata":"https://www.wikidata.org/wiki/Q2825412","display_name":"Adversary","level":2,"score":0.2612999975681305},{"id":"https://openalex.org/C177264268","wikidata":"https://www.wikidata.org/wiki/Q1514741","display_name":"Set (abstract data type)","level":2,"score":0.25780001282691956},{"id":"https://openalex.org/C9870796","wikidata":"https://www.wikidata.org/wiki/Q490481","display_name":"Turing","level":2,"score":0.2551000118255615}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.48550/arxiv.2606.26707","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2606.26707","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.48550/arxiv.2606.26707","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2606.26707","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Adversarial":[0],"APKs":[1,74],"are":[2,76],"Android":[3,200],"applications":[4],"modified":[5,104,192],"in":[6,214],"the":[7,103,138,144,188,191],"problem":[8],"space":[9],"to":[10,35,143],"evade":[11],"machine-learning":[12],"malware":[13,226],"detectors.":[14],"In":[15],"this":[16],"work,":[17],"we":[18,115],"first":[19],"show":[20],"that,":[21],"despite":[22],"claims,":[23],"existing":[24],"problem-space":[25,124],"attacks":[26,134],"remain":[27],"largely":[28],"impractical.":[29],"Most":[30],"techniques":[31],"leverage":[32],"software":[33],"transplantation":[34],"inject":[36,52],"entire":[37],"benign":[38],"modules,":[39,162],"introducing":[40],"many":[41],"side-effect":[42],"features":[43],"and":[44,97,121,132,156,164,170,184,190,210,217,220],"often":[45],"causing":[46],"build-time":[47],"failures.":[48],"Fine-grained":[49],"methods":[50],"that":[51,64,75,93,127,176],"only":[53,94,137],"a":[54,118,148,172,196],"narrow":[55],"subset":[56],"of":[57,150,158,199],"components":[58,140],"exhibit":[59],"limited":[60],"effectiveness,":[61],"while":[62],"those":[63],"also":[65],"use":[66],"obfuscation":[67,157],"rely":[68],"on":[69,195,229],"brittle":[70],"bytecode":[71],"rewriting,":[72],"producing":[73],"syntactically":[77],"valid":[78],"but":[79],"semantically":[80],"unusable.":[81],"Prior":[82],"work":[83],"further":[84],"overestimates":[85],"attack":[86,125],"success":[87],"rates":[88,206],"by":[89,135,180,224],"running":[90],"smoke":[91],"tests":[92],"validate":[95],"installation":[96],"basic":[98],"execution,":[99],"without":[100],"assessing":[101],"whether":[102],"APK":[105,139],"still":[106],"preserves":[107],"its":[108],"intended":[109],"behavior.":[110],"To":[111],"overcome":[112],"these":[113],"limitations,":[114],"present":[116],"DROIDBREAKER,":[117],"practical":[119],"(build-safe)":[120],"functional":[122],"(semantics-preserving)":[123],"framework":[126],"provides:":[128],"(i)":[129],"query-efficient":[130],"white-":[131],"black-box":[133,218],"manipulating":[136],"most":[141],"influential":[142],"target":[145],"model;":[146],"(ii)":[147],"set":[149],"fine-grained,":[151],"build-safe":[152],"manipulations":[153],"(including":[154],"injection":[155],"API":[159],"calls,":[160],"app":[161],"permissions,":[163],"URLs)":[165],"with":[166,207],"minimal":[167,211],"side":[168,212],"effects;":[169],"(iii)":[171],"semantics-preserving":[173],"functionality":[174],"test":[175],"enforces":[177],"runtime":[178],"equivalence":[179],"comparing":[181],"execution":[182],"logs":[183],"API-level":[185],"traces":[186],"between":[187],"initial":[189],"APK.":[193],"Evaluated":[194],"recent":[197],"corpus":[198],"applications,":[201],"DROIDBREAKER":[202],"achieves":[203],"high":[204],"evasion":[205],"few":[208],"queries":[209],"effects":[213],"both":[215],"white-box":[216],"settings,":[219],"drastically":[221],"reduces":[222],"detections":[223],"commercial":[225],"scanners":[227],"hosted":[228],"VirusTotal.":[230]},"counts_by_year":[],"updated_date":"2026-07-01T06:00:48.157686","created_date":"2026-06-27T00:00:00"}