# EvilModel: Hiding Malware Inside of Neural Network Models

**Authors:** Zhi Wang, Chaoge Liu, Xiang Cui  
**arXiv:** [2107.08590](https://arxiv.org/abs/2107.08590)  
**Date:** 2021-07-19  
**Summary page:** https://www.summarizepaper.com/en/paper/2107.08590v4/

## Key points

- The paper introduces the EvilModel approach for hiding malware within neural network models
- Malicious code is embedded within neurons of neural networks to enable covert and evasive delivery of malware
- Utilizes characteristics of neural networks like lack of explainability and strong generalization capabilities to seamlessly integrate malware without impacting performance significantly
- Embedded malware instances can evade detection by traditional antivirus engines during security scans due to unchanged overall architecture of the neural network
- Experimental results demonstrate integration of 36.9MB of malware into a 178MB-AlexNet model with only a marginal 1% loss in accuracy
- Relevance in the context of increasing use of artificial intelligence technologies, emphasizing the importance of understanding and defending against potential attacks leveraging neural networks
- Authors aim for their work to guide development of defenses against cyber threats involving neural networks, stressing proactive measures to safeguard AI systems

## Summary

The paper "EvilModel: Hiding Malware Inside of Neural Network Models" by Zhi Wang, Chaoge Liu, and Xiang Cui presents a groundbreaking approach to delivering malware covertly and evasively through neural network models. This method allows for advanced malware campaigns by embedding malicious code within the neurons of neural networks. By utilizing the inherent characteristics of neural network models such as their lack of explainability and strong generalization capabilities, this technique can seamlessly integrate malware into the model without significantly impacting its performance. The authors demonstrate that these embedded malware instances can evade detection by traditional antivirus engines during security scans due to the unchanged overall architecture of the neural network. Experimental results from the study show that a substantial 36.9MB of malware can be integrated into a 178MB-AlexNet model with only a marginal 1% loss in accuracy. This research is particularly relevant in light of the increasing use of artificial intelligence technologies in various domains. As neural networks are utilized for both benign and malicious purposes, understanding and defending against potential attacks leveraging these models is crucial. The authors hope that their work serves as a reference point for developing defenses against neural network-assisted cyber threats, emphasizing the need for proactive measures to safeguard AI systems from exploitation.