Backdoors can silently flip Android malware detectors. We defend with feature selection that shrinks the attack surface in both centralised and federated learning, with little cost to clean accuracy.
Machine learning-based Android malware detectors are increasingly used in security products. However, they are vulnerable to backdoor attacks, where an adversary poisons the training data to embed a hidden trigger that causes misclassification. In this work we propose a defensive feature selection approach that reduces the attack surface available to backdoor adversaries, demonstrating effective defense across classic and federated learning settings.