# EvilModel 2.0: Bringing Neural Network Models into Malware Attacks

**Authors:** Zhi Wang, Chaoge Liu, Xiang Cui, Jie Yin, Xutong Wang  
**arXiv:** [2109.04344](https://arxiv.org/abs/2109.04344)  
**Date:** 2021-09-09  
**Summary page:** https://www.summarizepaper.com/en/paper/2109.04344v3/

## Key points

- Security concerns in artificial intelligence (AI) are increasing as technology advances
- Previous research explored converting neural network models into stegomalware
- Existing techniques have limitations in real-world attack scenarios, leading to performance degradation and increased workload
- EvilModel is a new stegomalware with three novel embedding methods: MSB reservation, fast substitution, and half substitution
- EvilModel allows seamless integration of malware occupying up to half of the model's volume while maintaining optimal performance
- 550 EvilModels demonstrated an impressive embedding rate of 48.52%
- A quantitative algorithm was developed to evaluate existing embedding methods
- A trigger mechanism was designed for targeted attacks using EvilModel
- Extensive experiments showed the practicality and efficacy of EvilModel in terms of embedding capacity, performance impact, and detection evasion

## Summary

In the realm of artificial intelligence (AI), security concerns have become increasingly prevalent as technology continues to advance. Previous research has explored the potential for converting neural network models into stegomalware, a method of embedding malware within a model without significantly impacting its performance. However, existing techniques have limitations when applied in real-world attack scenarios, often leading to performance degradation and increased workload. To address these challenges, a new and improved stegomalware known as EvilModel has been proposed. EvilModel introduces three novel methods for embedding malware into neural network models: MSB reservation, fast substitution, and half substitution. These techniques allow for the seamless integration of malware that occupies up to half of the model's volume while maintaining optimal performance. Through the creation of 550 EvilModels using various mainstream neural network models and malware samples, it was demonstrated that EvilModel achieved an impressive embedding rate of 48.52%. To evaluate the effectiveness of existing embedding methods, a quantitative algorithm was developed. Additionally, a trigger mechanism was designed to initiate targeted attacks using EvilModel, presenting a potential threat scenario. Through extensive experiments and analyses focusing on embedding capacity, performance impact, and detection evasion, the practicality and efficacy of EvilModel were successfully demonstrated. Authored by Zhi Wang, Chaoge Liu, Xiang Cui Jie Yin,and Xutong Wang,this groundbreaking research sheds light on the evolving landscape of AI security and offers innovative solutions for safeguarding neural network models against malicious attacks. The study has been published in Computers & Security (2022) under the DOI 10.1016/j.cose.2022.102807and represents an extended version of work initially presented at the 26th IEEE Symposium on Computers and Communications (ISCC 2021).