DeepTrust: Multi-Step Classification through Dissimilar Adversarial Representations for Robust Android Malware Detection

TL;DR

DeepTrust addresses the vulnerability of Android malware detectors to adversarial examples by organizing diverse internal detectors into a fixed sequential cascade, where a single internal model ultimately renders the decision. Its core hypothesis is that maximizing representation divergence among internal classifiers makes the attacker's perturbations slow and uncertain, enhancing robustness without sacrificing accuracy on clean data. The approach combines tabular adversarial training and label smoothing to create heterogeneous embeddings, and a carefully crafted three-stage configuration achieved gold at the SaTML'25 competition, outperforming baselines under feature-space and problem-space attacks and showing strong temporal robustness. The work demonstrates that a multi-step, diversity-driven defense can provide practical, scalable security gains for static Android malware detection in realistic benchmark settings.

Abstract

Over the last decade, machine learning has been extensively applied to identify malicious Android applications. However, such approaches remain vulnerable against adversarial examples, i.e., examples that are subtly manipulated to fool a machine learning model into making incorrect predictions. This research presents DeepTrust, a novel metaheuristic that arranges flexible classifiers, like deep neural networks, into an ordered sequence where the final decision is made by a single internal model based on conditions activated in cascade. In the Robust Android Malware Detection competition at the 2025 IEEE Conference SaTML, DeepTrust secured the first place and achieved state-of-the-art results, outperforming the next-best competitor by up to 266% under feature-space evasion attacks. This is accomplished while maintaining the highest detection rate on non-adversarial malware and a false positive rate below 1%. The method's efficacy stems from maximizing the divergence of the learned representations among the internal models. By using classifiers inducing fundamentally dissimilar embeddings of the data, the decision space becomes unpredictable for an attacker. This frustrates the iterative perturbation process inherent to evasion attacks, enhancing system robustness without compromising accuracy on clean examples.

Figures (5)

• Figure 1: Representation of DeepTrust multi-step architecture for a sequence of length $n$ with different internal models. At decision time, a threshold is used to classify using the system's output.
• Figure 2: Hypothetical behavior of different metaheuristics under a feature-space evasion attack in a binary classification task. A) Ensemble. An adversary iteratively crafts the appropriate perturbation so the predicted output is the negative (benign) class. As it has access to probabilities and output class, it can iteratively modify their adversarial example until it is misclassified by reducing the predicted probability. B) Multi-step classification using models with similar learned representations. In a similar fashion, having sequential classification performed by powerful models, but with similar internal representations of the data, makes no impact to robustness, as once it gets to deceive the first internal model, the others will probably misclassify the adversarial example as well. C) Multi-step classification using models with diverse learned representations. In a multi-step classification system that uses powerful models with diverse embedding representations, an adversary will attempt to iteratively cause misclassifications. Lacking information about which model's output is being used for the final prediction, the adversary must prepare a new perturbation for the next model. This new perturbation will likely begin to move away from how a benign class is represented internally by the models that were already bypassed, hardening the iterative search for a successful perturbation.
• Figure 3: Tabular adversarial training in ELSA-RAMD Track 1 (y-axis: recall/specificity, x-axis: $m$).
• Figure 4: Label Smoothing in ELSA-RAMD Track 1 (y-axis: TPR/TNR, x-axis: $\lambda$).
• Figure 5: 2D visualization of embeddings. The top row shows UMAP projections and the bottom row shows t-SNE projections for five different models (columns). The color gradient red-white-blue represents logit prediction values.