MalModel: Hiding Malicious Payload in Mobile Deep Learning Models with Black-box Backdoor Attack

TL;DR

This paper introduces MalModel, a technique to embed malicious payloads within mobile deep learning models, enabling covert malware execution with minimal impact on model performance and latency.

Contribution

It presents a novel method for hiding malicious payloads in mobile DL models using a black-box backdoor attack strategy, highlighting new attack surfaces in mobile ML frameworks.

Findings

MalModel can embed payloads with as little as 0.4% accuracy drop.

MalModel causes at most 39ms latency overhead.

The method effectively conceals malware in deep learning models.

Abstract

Mobile malware has become one of the most critical security threats in the era of ubiquitous mobile computing. Despite the intensive efforts from security experts to counteract it, recent years have still witnessed a rapid growth of identified malware samples. This could be partly attributed to the newly-emerged technologies that may constantly open up under-studied attack surfaces for the adversaries. One typical example is the recently-developed mobile machine learning (ML) framework that enables storing and running deep learning (DL) models on mobile devices. Despite obvious advantages, this new feature also inadvertently introduces potential vulnerabilities (e.g., on-device models may be modified for malicious purposes). In this work, we propose a method to generate or transform mobile malware by hiding the malicious payloads inside the parameters of deep learning models, based on a strategy that considers four factors (layer type, layer number, layer coverage and the number of bytes to replace). Utilizing the proposed method, we can run malware in DL mobile applications covertly with little impact on the model performance (i.e., as little as 0.4% drop in accuracy and at most 39ms latency overhead).