New to ShortSpan? We distil the AI-security research that matters into practitioner takeaways — edited by Ben Williams (NCC Group).Get the weekly email
// Analysis
Replicant teaches malware to sidestep Android detectors
Published: Mon, 31 Aug 2026 • By James Armitage
Attacks
Replicant, a reinforcement-learning attack, learns how to modify Android malware to evade machine-learning detectors using only label feedback. It reaches a 78.8% mean success rate across seven detectors within 20 queries, transfers across feature spaces, and outperforms prior methods. Its adversarial training variant also builds measurably tougher classifiers.
Machine-learning malware detectors love to brag about high accuracy. In the wild, the attacker only sees your yes or no label. Replicant takes that real constraint, learns how to tweak Android malware in the problem space, and still walks past the guards.
The trick is not per-sample hill-climbing. Replicant trains a reusable policy with deep reinforcement learning (RL). One sub-policy decides when to query the target; the other decides which modification to apply. Modifications are behaviour-preserving gadget transplants: add benign code fragments that only introduce features, keeping the malicious behaviour intact. No feature peeking, no score snooping, just label-only black-box feedback within a 20-query budget.
Across seven Android detectors and three feature spaces (Drebin, APIGraph, RAMDA), Replicant posts a 78.8% mean attack success rate and beats prior Android attacks by 20.9% to 39.2% in the reported comparisons. When the surrogate matches the target, it hits 96.6% success using on average 3.6 queries. Across all settings it averages 7.4 queries. So much for rate limiting as a silver bullet.
Policy beats sample tinkering
The result that should make defenders uneasy: policy transfer trounces sample transfer. A policy trained on a surrogate achieves 78.8% success, versus 43.3% when you just move crafted samples. That is an 82% relative lift for policy over sample transfer in their tests. Translation: learning how to evade generalises; one-off adversarial examples do not.
It also undercuts a comfortable assumption in adversarial training. Training against a greedy per-sample attacker (the common practice) leaves you brittle. In the paper, adversarial training with Replicant’s white-box variant drops residual attack success below 17% for both white-box attackers tested, while training with a greedy baseline leaves the model far more exposed to the stronger attacker. If you train against toys, you get toy robustness.
Before anyone shouts hype: yes, there are limits. The capability set is fixed to gadget transplants that add features, the experiments use the Hypercube Android dataset, and generalisation beyond Android or other transformation sets is unproven. But the core claim holds where it matters: under a strict label-only black-box model that mirrors what most organisations expose, learned evasion is practical, query-efficient, and transferable across detectors and feature spaces.
The uncomfortable takeaway is simple. Attackers can learn strategies offline and spend single-digit queries online to slip past your model. Hiding features, hiding scores, or changing representations does not save you if policies transfer. Treat your adversary as a learning system. If your evaluation assumes static noise, your results are already out of date.
Additional analysis of the original ArXiv paper
📋Original Paper Title and Abstract
REPLICANT: Learning Policies for Evading and Hardening Malware Detectors
Authors: Shae McFadden, Ilias Tsingenopoulos, Mario D'Onghia, Alexander Herzog, Myles Foley, Chris Hicks, Lorenzo Cavallaro, and Fabio Pierazzi
To determine the real-world effectiveness of machine learning based malware detection, it is vital to evaluate its robustness against highly capable adversaries. However, state-of-the-art attacks do not effectively model realistic adversaries, as they often assume access to privileged information such as the training data, feature space, or confidence scores of the target. In this work, we present Replicant, a deep reinforcement learning framework that learns the realistic task of evasion under a strict label-only black-box threat model. Replicant learns a reusable policy on how to modify a malware sample and when to query the target, which transfers across samples, detectors, and feature spaces. Across seven Android malware detectors and three feature spaces, Replicant is the strongest and most query-efficient approach achieving a mean attack success rate of 78.8%, a relative improvement of 20.9%-39.2% over the state-of-the-art. Furthermore, when used for adversarial training, Replicant also outperforms the state-of-the art by producing detectors with more generalizable robustness. With Replicant we demonstrate that learning the task of evasion not only results in stronger attack performance but, crucially, provides a better signal for hardening malware detectors.
🔍ShortSpan Analysis of the Paper
Problem
The paper studies the robustness of machine-learning based Android malware detectors against realistic adversaries who only receive label feedback. Prior attacks often assume privileged access to confidence scores, feature spaces or training data, or they optimise each sample separately, limiting query efficiency and transferability. The authors aim to characterise evasion as a reusable policy-learning task in the problem space, where modifications map to real, behaviour-preserving program changes, and to measure how such learned policies transfer across classifiers, feature representations and time.
Approach
The authors propose Replicant, a hierarchical deep reinforcement learning framework that frames problem-space evasion as a Markov decision process. The agent has two sub-policies: a query policy that decides when to submit a sample for labelling, and a modify policy that selects a capability to apply. Capabilities are instantiated as gadget transplantation operations that add benign code fragments and therefore only add features while preserving malicious behaviour. Replicant is trained on a surrogate classifier under a strict label-only black-box threat model and evaluated against seven target detectors and three feature spaces (Drebin, APIGraph, RAMDA) using the Hypercube Android dataset with time-aware splits. A white-box variant (ReplicantWB) uses confidence scores and is employed for adversarial training (AT-Replicant). The authors compare against per-sample baselines and alternative RL designs, and evaluate transferability, query efficiency, adversarial training, capability drift and temporal drift. Metrics include attack success rate (ASR) within a budget of 20 queries and average queries per sample.
Key Findings
Replicant is the strongest black-box attacker across 1,764 surrogate/target combinations, achieving mean ASR 78.8% within 20 queries and improving over prior Android attacks by 20.9%–39.2% in reported comparisons.
In a matched surrogate/target setting Replicant attains mean ASR 96.6% using on average 3.6 queries per sample; across all settings it averages 7.4 queries, outperforming the best baseline (APG) in both success and query-efficiency.
Policy transfer substantially outperforms sample transfer: deploying a policy trained on a surrogate (policy transfer) yields 78.8% ASR versus 43.3% for transferred samples, and the paper reports an 82.0% relative increase in ASR for policy over sample transfer in their experiments.
Adversarial training with ReplicantWB (AT-Replicant) produces classifiers whose residual ASR drops below 17% against both ReplicantWB and APGWB attackers, while AT using a greedy per-sample attacker (AT-APG) remains far more vulnerable to ReplicantWB.
Robustness decays when attacker capabilities expand: as capability drift increases, AT gains diminish; maintaining both clean performance under temporal drift and adversarial robustness requires combining active learning with adversarial training (the proposed RAL pipeline), which preserves clean performance comparable to active learning while retaining AT-level robustness.
Limitations
The study focuses on strategy given a fixed capability set and does not explore designing stronger capability sets; all experiments use the Hypercube Android dataset and gadget-transplantation capabilities, so reported ASR are relative to that dataset and capability set. The white-box evaluations are used for adversarial training and assume full target access. Generalisation beyond Android, other transformation sets or different datasets is not demonstrated here.
Implications
Offensively, attackers can learn reusable evasion policies on surrogate models that transfer across detectors, feature representations and time while using few queries and only label feedback. Such policies enable high-probability evasion of deployed Android detectors and are more robust than crafting individual evasive samples. Defenders relying on static adversarial training or single-shot countermeasures risk being bypassed as attacker capabilities evolve; sustained hardening requires continuous adaptation to capability and temporal drift. The results show that policy-based attacks are a practical and powerful threat to ML-based malware detection in the wild.
- It tackles why ML-based Android malware detectors get fooled by evasion and proposes a defense that reduces reliance on biased, spurious features.
-...
Very briefly: it shows how large language models can be misused to automate and scale evasion of Android malware detectors by crafting feature-level p...
- It shows how Android malware detectors that rely on ML can be evaded with carefully chosen, real-world APK edits, but only when those edits are prac...
It tackles evasion of ML-based malware detectors by using reinforcement learning to craft adversarial malware directly in the real program space, solv...
- The work offers a DRL-based malware detector that stays effective under long-term concept drift by jointly optimizing classification and when to def...
- Combines two hard problems: malware detectors that drift over time and detectors that can be evaded by adversaries, showing these threats together a...
- It treats attacker and defender as a two-level, evolving game, using bilevel optimization to harden malware detectors against adaptive attacks.
- T...
This work shows how ML-based Android malware detectors can be evaded with tiny, binary-feature changes, exposing real weaknesses in current defenses. ...
- Shows a practical, low-resource adversarial AI that learns to bypass ML-based NIDS using offline training and then deploys on compromised devices, m...
