Trigger Value Selection in Clean-Label Malware Backdoors: An Effectiveness-Detectability Analysis

Abstract

Clean-label backdoor poisoning is a threat to machine learning-based malware classifiers because poisoned samples can be inserted into training data without changing their labels. Previous explanation-guided attacks mainly focus on selecting important trigger features, but the values assigned to these features can also affect the attack behavior. In this paper, we study trigger value selection as an independent design factor in clean-label backdoor attacks against feature-based malware classifiers. We evaluate several value-selection strategies on EMBER 2018 and a Win64 PE subset of EMBER 2024 using LightGBM classifiers. We compare rare-value, SHAP-based, frequency-bounded, co-occurrence-aware, and quantile-based selectors under random and distribution-based malware-similar benign sampling. The results show that aggressive selectors such as MinPopulation and CountAbsSHAP can achieve high attack success rate, especially under distribution-based sampling, but they are also easier to detect by sanitization methods such as Isolation Forest. In contrast, selectors such as CorrCountAbsSHAP and Quantile95 can reduce poison recall while keeping useful attack effectiveness. These findings show that trigger value selection is not merely an implementation detail, but an important design choice that shapes the effectiveness and detectability profile of clean-label malware backdoor attacks.