How to Train Your Antivirus: RL to harden malware detectors

AutoRobust uses RL to generate problem-space adversarial malware, real, functional binary/runtime changes and adversarially train detectors on dynamic analysis reports. Instead of abstract feature tweaks, it searches feasible program transformations (API calls, packaging, runtime behaviors) and iteratively retrains a commercial AV model, yielding robustness tied to modeled adversary capabilities. Why it matters: ML detectors are brittle when defenses rely on feature-space perturbations that don’t map to real malware. Defenses should be tested against what an adversary can actually do, not hypothetical feature tweaks. Key takeaways • Problem-space attacks: RL produces executable transformations that preserve functionality. • Adversarial loop: generate attacks to retrain to repeat; ASR drops dramatically under the modeled action set. • Stronger guarantees: constraining actions yields interpretable robustness linked to adversary capabilities. • Real-world relevance: method evaded an ML co