Paper deep dive
Latent Stability Analysis of Malware Representations Under Feature-Space Perturbations
Bamidele Ajayi, Ken McGarry
Intelligence
Status: succeeded | Model: Gemma-4-26B-A4B | Prompt: intel-v1 | Confidence: 92%
Last extracted: 8/1/2026, 10:45:11 AM
Summary
This paper introduces a latent-stability analysis pipeline to evaluate how malware representations behave under feature-space perturbations, addressing the limitations of standard clean-sample metrics. Using the EMBER dataset, the authors compare full features, PCA, VAE, and novel VAE+Mandelbrot+PINNFlow representations. They define Latent Escape Divergence (LED) and use PINNFlow to measure residual, velocity, risk, and gradient-shift metrics. While full EMBER features achieve the highest clean classification performance (ROC AUC 0.9962), the proposed VAE+Mandelbrot+PINNFlow representation provides superior diagnostic value for stability under perturbation, with PINNFlow improving robustness across all probe types.
Entities (7)
Relation Signals (5)
Full EMBER features → achieves → ROC AUC 0.9962
confidence 98% · Full EMBER features achieve the strongest clean classification performance with ROC AUC of 0.9962
PCA-64 → achieves → ROC AUC 0.9846
confidence 95% · PCA-64 is the strongest compressed baseline with ROC AUC of 0.9846
EMBER → usedwith → LightGBM
confidence 95% · LightGBM is used as a fixed downstream classifier across representations... on EMBER-style features
PINNFlow → improves → Robustness
confidence 92% · PINNFlow improves robustness relative to VAE+Mandelbrot across all evaluated perturbation types
VAE → produces → Latent Escape Divergence
confidence 90% · We define Latent Escape Divergence (LED) to measure changes in escape-time profiles under perturbation... VAE+Mandelbrot+PINNFlow representation
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:Static malware detectors are commonly evaluated using clean-sample metrics such as accuracy, F1, ROC AUC, and PR AUC. However, these metrics provide limited insight into how learned malware representations behave when feature vectors are perturbed, how close samples move toward uncertain decision regions, or whether compressed representations preserve security-relevant structure. This paper presents a latent-stability analysis pipeline for malware perturbation assessment in EMBER feature space. The pipeline compares full EMBER features, PCA-based compression, beta/denoising variational autoencoder representations, Mandelbrot-inspired escape-time descriptors, and a PINN-style latent-flow module. We define Latent Escape Divergence (LED) to measure changes in escape-time profiles under perturbation, and use PINNFlow-derived residual, velocity, risk, and gradient-shift metrics to characterize latent movement. Experiments are conducted on EMBER static PE feature vectors using 180,000 training samples, 180,000 test samples, and 240,000 holdout samples. Full EMBER features achieve the strongest clean classification performance with ROC AUC of 0.9962 and F1 of 0.9713, while PCA-64 is the strongest compressed baseline with ROC AUC of 0.9846 and F1 of 0.9347. The proposed VAE+Mandelbrot+PINNFlow representation does not outperform these baselines for clean classification, but it provides additional diagnostic value under controlled feature-space perturbation probes.
Tags
Links
- Source: https://arxiv.org/abs/2607.24896v1
- Canonical: https://arxiv.org/abs/2607.24896v1
Trouble viewing inline? Open PDF directly →
Full Text
42,633 characters extracted from source content.
Expand or collapse full text
Latent Stability Analysis of Malware Representations Under Feature-Space Perturbations Bamidele Ajayi , Ken McGarry School of Computer Science and Engineering, University of Sunderland, Sunderland, UK Abstract Static malware detectors are commonly evaluated using clean-sample metrics such as accuracy, F1, ROC AUC, and PR AUC. However, these metrics provide limited insight into how learned malware representations behave when feature vectors are perturbed, how close samples move toward uncertain decision regions, or whether compressed representations preserve security-relevant structure. This paper presents a latent-stability analysis pipeline for malware perturbation assessment in EMBER feature space. The pipeline compares full EMBER features, PCA-based compression, beta/denoising variational autoencoder representations, Mandelbrot-inspired escape-time descriptors, and a PINN-style latent-flow module. We define Latent Escape Divergence (LED) to measure changes in escape-time profiles under perturbation, and use PINNFlow-derived residual, velocity, risk, and gradient-shift metrics to characterize latent movement. Experiments are conducted on EMBER static PE feature vectors using 180,000 training samples, 180,000 test samples, and 240,000 holdout samples. Full EMBER features achieve the strongest clean classification performance with ROC AUC of 0.9962 and F1 of 0.9713, while PCA-64 is the strongest compressed baseline with ROC AUC of 0.9846 and F1 of 0.9347. The proposed VAE+Mandelbrot+PINNFlow representation does not outperform these baselines for clean classification, but it provides additional diagnostic value under controlled feature-space perturbation probes. These probes are intended for representation-stability analysis and should not be interpreted as functionality-preserving PE-level malware transformations. In particular, PINNFlow improves robustness relative to VAE+Mandelbrot across all evaluated perturbation types and yields interpretable latent-shift measurements. The results show that latent-stability diagnostics can complement conventional malware classification metrics by exposing perturbation-induced representation changes that are not captured by clean-sample performance alone. I Introduction Machine-learning-based malware detection research has primarily focused on engineered static features and learned representations that can classify malicious executables outside brittle signatures. Data-mining approaches were shown to detect malicious executables based on metadata, byte-derived features, and supervised machine learning early on [1, 2]. A large public dataset and feature representation for static Windows PE malware detection was formalized by the EMBER benchmark [3]. Temporal PE malware analysis was later supported by BODMAS [4], and multi-file-format evaluation with challenge samples designed to confuse malware classifiers was introduced by EMBER2024 [5]. Gradient-boosted decision trees like LightGBM [6] remain competitive against more complex classifiers when trained on EMBER-style features. Robustness to adversarial examples is critical for security-focused malware analysis, however. Adversarial machine learning studies demonstrate that even small adversarial perturbations can confuse many classifiers [8, 9, 10]. In malware detection, these perturbations are semantically/security-critical: since instructions can often be modified in ways that preserve overall executable functionality and malicious intent, detector-facing features may change under attack, causing misclassification. Prior research has explored malware evasion with reinforcement-learning attacks [11], byte insertion [12], black-box attacks against Windows malware detectors [13], detection-resistant PE binaries [14, 15], and PE packing strategies [16]. An unanswered question, however, is how malware representations change when the input is perturbed. Clean Area Under Curve (AUC) does not capture this. PCA, kernel methods, manifold learning, and autoencoders/VAEs are common tools for compressing malware feature spaces into 2D or 3D, which can then be visualized to analyze high-dimensional behavior. Principal Component Analysis [18] provides a linear dimensionality reduction baseline, kernel and manifold methods mine for nonlinear spatial structure [19, 20], and autoencoders and variational autoencoders (VAEs) learn nonlinear latent spaces with neural networks [21, 22, 23]. Still, most reduced malware representations are carefully evaluated as static inputs to classifiers. There is little work on characterizing their latent behavior as objects under perturbation. This paper aims to bridge that gap by building a neural-geometric framework to study latent space movement induced by input perturbations. First, it projects VAE latent coordinates into complex-coordinate pairs. Then, it computes Mandelbrot-inspired escape-time fingerprints from each pair; formally defines Latent Escape Divergence (LED); and learns a physics-informed neural network (PINN)-style latent flow field across concatenated constant-and-perturbed PE trajectories. This paper does not claim that malware “is fractal” or behaves according to physical law. Complex dynamics and PINNs are used as principled mathematical lenses through which to measure aspects of nonlinear stability, decision boundary complexity, and adversarial trajectory consistency. I-A Contributions To address this gap, the proposed framework studies latent-space movement induced by malware feature perturbations. The contributions are summarized as follows. 1. It formulates malware perturbation analysis as latent trajectory analysis: transformations Tt(x)T_t(x) induce paths zt=fϕ(Tt(x))z_t=f_φ(T_t(x)) whose stability can be measured independently of clean classification accuracy. 2. It implements a beta/denoising VAE with KL warm-up and free-bits regularization to mitigate posterior collapse, and reports active-unit and KL diagnostics. 3. It introduces Mandelbrot-inspired escape-time fingerprints from VAE latent coordinates and defines LED as a mathematical measure of perturbation-induced complex-dynamical instability. 4. It develops a PINN-style latent-flow module that enforces an advection-like residual over pseudo-time perturbation trajectories and adds unique residual, velocity, risk, and gradient-shift diagnostics. 5. It uses box-counting dimension to quantify the complexity of uncertain classifier boundary regions in reduced malware representation spaces. 6. It provides a complete ablation on EMBER comparing Full features, PCA-64, VAE-64, VAE+Mandelbrot-64, VAE+Mandelbrot+PINNFlow-64, and PINNFlowOnly-64 under clean classification and controlled perturbation probes. I-B Positioning and Scope of the Contribution The results support a conservative but principled claim. Full EMBER features and PCA-64 remain stronger for clean classification. The novelty lies in a diagnostic framework for latent stability, perturbation dynamics, and boundary complexity. I Related Work and Gaps I-A Static Malware Benchmarks EMBER provides labeled static PE feature vectors and tooling for reproducible malware learning [3]. BODMAS introduces temporal analysis of PE malware [4], while EMBER2024 broadens benchmark evaluation to multiple file types and challenge settings [5]. These datasets support standardized evaluation but are often used primarily for clean classification metrics. This paper uses EMBER as a controlled setting and introduces additional diagnostics for latent dynamics and perturbation stability. I-B Malware Classifiers Traditional malware learning uses engineered executable features and conventional classifiers [1, 2]. Neural malware models such as MalConv process raw bytes end-to-end [7], but strong tree-based classifiers remain difficult to beat on tabular EMBER features. LightGBM is used as a fixed downstream classifier across representations, thereby isolating the effect of representation design rather than classifier choice. I-C Adversarial Malware and Functionality Preservation General adversarial example research established that learned classifiers can be manipulated at test time [8, 9, 10, 11]. Malware evasion differs from image perturbation because practical transformations should preserve executability and malicious intent. Anderson et al. studied reinforcement-learning evasion against static PE detectors [12]; Kolosnjaji et al. studied adversarial malware binaries against deep learning detectors [13]; Demetrio et al. surveyed and implemented practical Windows malware attacks and secml-malware [14, 15]; and MAB-Malware studied black-box reinforcement-learning attacks [16].The default perturbations are feature-space probes, not functionality-preserving binary transformations. The framework is designed to accept external clean/perturbed feature pairs generated by raw-PE workflows, but such external PE-level evaluation is left for future work. I-D Latent Representation Learning PCA remains a strong baseline for dimensionality reduction [18]; kernel PCA and UMAP capture nonlinear structure [19, 20]. VAEs provide probabilistic latent representations [21], denoising autoencoders encourage robustness to corrupted inputs [22], and beta-VAE regularizes latent factors [23]. The gap addressed here is that malware latent representations are often evaluated by downstream AUC/F1 without measuring the dynamics or stability of the latent space itself. I-E Complex Dynamics, Fractal Geometry, and PINNs The Mandelbrot set is a canonical object in complex dynamics, where escape-time iteration reveals nonlinear stability and boundary complexity [24, 26]. Box-counting dimension estimates geometric complexity of sets and boundaries [25]. PINNs impose residual constraints during neural learning [27], but can suffer from optimization and conditioning challenges [28]. This paper adapts these tools cautiously: Mandelbrot-style escape-time is used as a nonlinear sensitivity descriptor of latent coordinates, and PINNFlow is used as a dynamics-informed regularizer rather than a claim of physical law. TABLE I: Prior work, open gap, and contribution of this paper. Prior work Open gap Contribution in this paper EMBER, BODMAS, and EMBER2024 provide malware benchmarks [3, 4, 5]. Evaluation is often dominated by clean detection metrics such as F1 and AUC. Adds latent-stability, escape-divergence, PINN-flow, and boundary-complexity diagnostics. LightGBM and raw-byte neural models provide strong malware classifiers [6, 7]. Strong classifiers do not directly explain how compressed representations move under perturbation. Holds the downstream classifier fixed while comparing Full, PCA, VAE, complex-dynamical, and PINNFlow representations. Adversarial malware work studies functionality-preserving evasion [12, 13, 14, 15, 16]. Attack success is often measured without characterizing latent dynamical signatures. Defines LED and PINNFlow residual/velocity/risk-shift metrics for perturbation-induced instability. PCA, kernel PCA, UMAP, autoencoders, and VAEs reduce dimensionality [18, 19, 20, 21]. Reduced representations are usually evaluated by classifier performance, not geometry or dynamics. Introduces Mandelbrot-inspired escape-time fingerprints and box-counting boundary diagnostics. PINNs enforce residual constraints for physical systems [27, 28]. Malware has no physical governing equation, so literal PINN claims are inappropriate. Uses a PINN-style residual only as a dynamics-informed prior over pseudo-time perturbation trajectories. I Principled Framework I-A Why Latent Dynamics Matter Let x∈ℝdx ^d be an EMBER feature vector and let TtT_t be a perturbation operator indexed by pseudo-time or intensity t∈[0,1]t∈[0,1], with T0(x)=xT_0(x)=x and T1(x)=x′T_1(x)=x . A representation map fϕ:ℝd→ℝmf_φ:R^d ^m induces a latent trajectory zt=fϕ(Tt(x)).z_t=f_φ(T_t(x)). (1) For a security model, the key object is not only the point z0z_0 but the path ztt=01\z_t\_t=0^1: evasion occurs when perturbation moves a sample toward or across an unstable decision region while preserving security semantics. Clean AUC measures separability at t=0t=0; latent dynamics measure the response of the representation and decision function along a perturbation path. This view motivates three diagnostics. First, displacement and neighborhood overlap quantify geometric stability. Second, LED measures how nonlinear complex-dynamical stability changes under perturbation. Third, PINNFlow residuals measure whether perturbation movement is consistent with a learned latent transport structure. Together, these diagnostics allow the study of representation stability even when clean classification does not improve. I-B VAE with Anti-Collapse Regularization Let a beta/denoising VAE encode x to qϕ(z|x)=(μϕ(x),diag(σϕ2(x)))q_φ(z|x)=N( _φ(x),diag( _φ^2(x))). The reparameterized latent is z=μϕ(x)+σϕ(x)⊙ϵ,ϵ∼(0,I).z= _φ(x)+ _φ(x) ε, ε (0,I). (2) The basic objective is ℒVAE=ℒrec+βtD~KL(qϕ(z|x)∥p(z)).L_VAE=L_rec+ _t\, D_KL(q_φ(z|x)\|p(z)). (3) To address KL collapse, βt _t is warmed up linearly from 0 to β=0.5β=0.5 over 15 epochs, and a free-bits floor of 0.01 is applied to per-dimension KL terms. Denoising is used by corrupting the input while reconstructing the clean target [22]. Unlike the previous beta=2.0 configuration, the run uses a 64-dimensional latent space, KL warm-up, and free bits. I-C Mandelbrot-Inspired Escape-Time Descriptor The VAE latent vector z∈ℝmz ^m is robustly standardized using training-set medians and interquartile ranges. Adjacent coordinates are mapped into complex values cj=ρtanh(z~2j−1)+iρtanh(z~2j),c_j=ρ ( z_2j-1)+iρ ( z_2j), (4) where ρ bounds the coordinate scale. For each cjc_j, the escape-time iteration is wn+1(j)=(wn(j))2+cj,w0(j)=0.w_n+1^(j)=(w_n^(j))^2+c_j, w_0^(j)=0. (5) The normalized escape time is τj(z)=1Nminn:|wn(j)|>r, _j(z)= 1N \n:|w_n^(j)|>r\, (6) with N=64N=64 and r=2.0r=2.0; coordinates that do not escape are assigned τj=1 _j=1. The vector τ(z)τ(z) and its summary statistics form a complex-dynamical stability fingerprint. The interpretation is precise but limited: escape time captures nonlinear sensitivity of the latent coordinate under an iterative stability test, not malware semantics by itself. I-D Latent Escape Divergence For a clean sample x and perturbed sample x′=T1(x)x =T_1(x), LED is defined as LED(x,x′)=1K‖τ(fϕ(x′))−τ(fϕ(x))‖1.LED(x,x )= 1K \|τ(f_φ(x ))-τ(f_φ(x)) \|_1. (7) LED is therefore the mean absolute change in normalized escape-time profile. It measures perturbation-induced change in complex-dynamical latent stability. A high LED means the perturbation changed the sample’s escape-time fingerprint even if the classifier score or Euclidean distance does not fully reflect that change. I-E PINNFlow as Structured Latent Transport PINNFlow learns a latent velocity field vθ(z,t)v_θ(z,t) and scalar risk potential uθ(z,t)u_θ(z,t) over pseudo-time perturbation trajectories. Given latent states z0=fϕ(x)z_0=f_φ(x) and z1=fϕ(x′)z_1=f_φ(x ), a pseudo-trajectory is zt=(1−t)z0+tz1.z_t=(1-t)z_0+tz_1. (8) Inspired by PINN residual learning [27], PINNFlow uses an advection-style residual Rθ(zt,t)=∂uθ∂t+vθ(zt,t)⊤∇zuθ(zt,t).R_θ(z_t,t)= ∂ u_θ∂ t+v_θ(z_t,t) _zu_θ(z_t,t). (9) The training objective is ℒflow=λTℒtransition+λyℒsup+λR‖Rθ‖22+λE‖vθ‖22.L_flow= _TL_transition+ _yL_sup+ _R\|R_θ\|_2^2+ _E\|v_θ\|_2^2. (10) This enforces structure by discouraging arbitrary risk-potential changes along a learned flow field. In the run, λT=1.0 _T=1.0, λy=1.0 _y=1.0, λR=0.5 _R=0.5, and λE=10−4 _E=10^-4. PINNFlow contributes unique diagnostics: residual shift, velocity-norm shift, risk-probability shift, gradient-norm shift, and predicted-displacement shift. I-F Boundary Complexity via Box Counting Let s(z)s(z) be a classifier score. The uncertain boundary set is approximated by ℬα=z:|s(z)−0.5|≤qα,B_α=\z:|s(z)-0.5|≤ q_α\, (11) where qαq_α keeps the most uncertain fraction of samples. The box-counting dimension is estimated from DB≈ΔlogN(ϵ)Δlog(1/ϵ),D_B≈ N(ε) (1/ε), (12) where N(ϵ)N(ε) is the number of occupied boxes of side length ϵε. Fractal descriptors are relevant because evasion often exploits irregular or high-curvature decision regions: more intricate uncertain boundaries can imply greater sensitivity to small representation movements. The paper uses this as a descriptive statistic, not as proof of fractal malware semantics. IV Experimental Design IV-A Dataset and Split The experiment uses EMBER-style static PE feature vectors with d=2381d=2381. The dataset split contains 180,000 training samples, 180,000 test samples, and 240,000 holdout samples. Fig. 1 shows balanced train labels. The configuration uses latent dimension 64, beta=0.5, KL warm-up over 15 epochs, free bits 0.01, denoising noise standard deviation 0.03, 40 VAE epochs, 25 PINNFlow epochs, and LightGBM downstream classification. 1 Require: Feature dataset =(xi,yi)i=1nD=\(x_i,y_i)\_i=1^n, latent dimension k, perturbation set T, classifier family C. Ensure: Clean-test metrics, perturbation-stability metrics, robustness summaries, and saved experimental artifacts. 2 3// Phase 1: Data Preparation 4 Load EMBER/BODMAS-style feature vectors and labels 5 Remove invalid or unlabeled samples where applicable 6 Split data into training, test, and holdout sets: tr,te,hoD_tr,D_te,D_ho 7 Fit scaler on trD_tr and transform all splits 8 9// Phase 2: Representation Learning 10 Set RFull←XR_Full← X 11 Compute RPCA←PCAk(X)R_PCA _k(X) 12 Train beta/denoising VAE with KL warm-up and free-bits regularization 13 Encode samples using the VAE latent mean: Z←μϕ(X)Z← _φ(X) 14 Compute escape-time profile τ(Z)τ(Z) from bounded complex latent pairs 15 Construct REsc←[Z,τ(Z),s(τ(Z))]R_Esc←[Z,τ(Z),s(τ(Z))] 16 17// Phase 3: PINNFlow Feature Construction 18 Generate controlled perturbation pairs (x,T(x))(x,T(x)) for T∈T 19 Encode pairs as latent transitions (z,z′)(z,z ) 20 Train PINNFlow using transition, supervised, residual, and energy losses 21 Extract flow metrics: velocity, risk probability, residual, gradient, and displacement 22 Construct RPINN←[REsc,FlowMetrics(Z)]R_PINN←[R_Esc,FlowMetrics(Z)] 23 24// Phase 4: Clean Classification Ablation 25 Set representation list ℛ←RFull,RPCA,Z,REsc,RPINNR←\R_Full,R_PCA,Z,R_Esc,R_PINN\ 26 27foreach R∈ℛR do 28 Train classifier hR∈h_R on RtrR_tr and ytry_tr 29 Predict labels and scores on RteR_te 30 Compute Accuracy, Precision, Recall, F1, ROC AUC, and PR AUC 31 Estimate confidence intervals using bootstrap resampling 32 33Apply paired McNemar tests between selected classifiers 34 35// Phase 5: Perturbation-Stability Evaluation 36 foreach T∈T do 37 Generate perturbed holdout features Xho′←T(Xho)X _ho← T(X_ho) 38 Encode XhoX_ho and Xho′X _ho into each learned representation 39 Compute L2 displacement, cosine similarity, and kNN overlap 40 Compute LED(x,x′)=1K‖τ(z′)−τ(z)‖1LED(x,x )= 1K\|τ(z )-τ(z)\|_1 41 Compute PINNFlow residual, velocity, risk, and gradient shifts 42 Evaluate classifier robustness on perturbed representations 43 44 45// Phase 6: External PE-Pair Evaluation 46 if external clean/perturbed feature pairs are provided then 47 Load (Xclean,Xperturbed,y)(X_clean,X_perturbed,y) from NPZ file 48 Apply the fitted scaler and representation pipeline 49 Compute LED, PINNFlow shifts, and perturbed-classification metrics 50 51 52// Phase 7: Artifact Generation 53 Save configuration, trained models, VAE diagnostics, classification tables, stability summaries, robustness results, and figures 54 55return experimental metrics and saved artifacts 56 Algorithm 1 Latent-Stability Malware Representation and Evaluation Pipeline TABLE I: Key Experimental Hyperparameters Parameter Value Latent dimension 64 VAE beta 0.5 KL warm-up 15 epochs Free bits 0.01 Denoising noise std. 0.03 VAE epochs 40 PINNFlow epochs 25 PINN λT,λy,λR,λE _T, _y, _R, _E 1.0, 1.0, 0.5, 10−410^-4 Classifier LightGBM Figure 1: EMBER training class balance. IV-B Representations Six representations are evaluated: 1. Full: all 2381 EMBER features. 2. PCA-64: 64-dimensional PCA representation. 3. VAE-64: deterministic VAE latent mean. 4. VAE+Mandelbrot-64: VAE latent vector plus escape-time profile and summary statistics. 5. VAE+Mandelbrot+PINNFlow-64: VAE+Mandelbrot features plus PINNFlow diagnostics. 6. PINNFlowOnly-64: only the six PINNFlow diagnostic features. IV-C Perturbation Probes Five controlled feature-space probes are evaluated on holdout samples: Gaussian noise, sparse dropout, sparse injection, benign-centroid movement, and an EMBER byte-histogram/entropy-histogram smoothing proxy. These are diagnostic probes only. They should not be described as functionality-preserving PE attacks. A ready future path is to generate raw PE clean/perturbed pairs externally, re-extract EMBER features, and feed them into the same evaluation interface. Input Feature Data EMBER / BODMAS Static PE Vectors Train / Test / Holdout Split Feature Cleaning and Scaling Full Feature Representation PCA d→kd→ k Beta/Denoising VAE z=μϕ(x)z= _φ(x) Escape-Time Profile τ(z)τ(z) PINNFlow Metrics Residual, Velocity, Risk, Gradient Representation Set Full, PCA, VAE, VAE+Escape, VAE+Escape+PINNFlow Downstream Classifier LightGBM / HGB / RF / LR Clean-Test Evaluation Accuracy, Precision, Recall, F1, ROC AUC, PR AUC Statistical Analysis Bootstrap CIs McNemar Tests Saved Outputs CSV, JSON, Figures, Model Artifacts Latent Representation Construction Figure 2: Overall architecture of the malware latent-stability analysis pipeline. Static PE feature vectors are cleaned and scaled, then passed through full-feature, PCA, VAE, escape-time, and PINNFlow representation branches. Each representation is evaluated with a fixed downstream classifier and compared using clean-test metrics, confidence intervals, and paired significance tests. Perturbation Input Layer Stability and Robustness Evaluation Holdout Samples Xhold,yholdX_hold,y_hold Perturbation Suite Gaussian, Dropout, Injection, Benign-Centroid, Histogram Proxy Optional External PE Pairs Xclean,Xperturbed,yX_clean,X_perturbed,y Encode Clean Representations Z Encode Perturbed Representations Z′Z Geometric Stability L2 displacement Cosine similarity kNN overlap Latent Escape Divergence LED(x,x′)=1K‖τ(z′)−τ(z)‖1LED(x,x )= 1K\|τ(z )-τ(z)\|_1 PINNFlow Shifts Residual shift Velocity shift Risk-probability shift Gradient shift Classifier Robustness Predictions on Z′Z F1, ROC AUC, PR AUC Robustness and Stability Tables / Figures Figure 3: Perturbation-stability and external PE-pair evaluation workflow. Holdout samples are perturbed using controlled feature-space probes, while externally generated PE-level clean/perturbed feature pairs may also be supplied. Clean and perturbed representations are compared using geometric stability metrics, Latent Escape Divergence, PINNFlow shift metrics, and downstream classifier robustness. V Results V-A VAE and PINNFlow Training Diagnostics The VAE configuration directly addresses the earlier KL-collapse weakness. The final latent diagnostics report mean total KL per sample of 14.83, mean KL per dimension of 0.232, 64 active units using variance >10−3>10^-3, 55 active units using variance >10−2>10^-2, and no KL-collapse flag. Fig. 4 shows the VAE training curve and PINNFlow diagnostics. PINNFlow total loss decreases from 0.341 to 0.076, supervised BCE decreases from 0.333 to 0.066, and transition MSE decreases from 0.00427 to 0.00105. This does not prove superior classification, but it shows that PINNFlow learned measurable latent-trajectory structure. (a) VAE training curve. (b) PINNFlow training diagnostics. Figure 4: Training diagnostics. The VAE avoids the earlier near-zero-KL collapse, and PINNFlow learns transition, supervised, residual, and energy terms. TABLE I: VAE latent diagnostics Diagnostic Value Latent dimension 64 Mean total KL per sample 14.830 Mean KL per dimension 0.232 Median KL per dimension 0.0076 Active units, var >10−3>10^-3 64 Active units, var >10−2>10^-2 55 Mean latent mean variance 0.2015 KL collapse flag False V-B Clean Classification Ablation Table IV reports clean EMBER classification. Full features remain strongest. PCA-64 is the strongest compressed representation. The VAE, Mandelbrot, and PINNFlow variants improve the diagnostic expressiveness of the latent space but do not surpass PCA-64 for clean classification. Fig. 5 shows the ROC and precision-recall ablations. TABLE IV: Clean EMBER classification ablation. Method Features Accuracy Precision Recall F1 ROC AUC PR AUC Train s Full 2381 0.9714 0.9741 0.9685 0.9713 0.9962 0.9965 372.60 PCA-64 64 0.9350 0.9397 0.9297 0.9347 0.9846 0.9858 19.54 VAE+Mandelbrot+PINNFlow-64 113 0.9262 0.9313 0.9202 0.9257 0.9804 0.9820 22.77 VAE-64 64 0.9237 0.9270 0.9199 0.9234 0.9797 0.9814 15.95 VAE+Mandelbrot-64 107 0.9227 0.9258 0.9189 0.9224 0.9794 0.9811 26.10 PINNFlowOnly-64 6 0.9137 0.9179 0.9086 0.9133 0.9719 0.9741 3.72 (a) ROC ablation. (b) Precision-recall ablation. Figure 5: Clean classification ablation. Full features and PCA-64 remain strongest, while VAE+Mandelbrot+PINNFlow-64 is best among the VAE-derived variants. V-C Latent Geometry and Escape-Time Behavior Figs. 6 and 7 show two-dimensional projections of the learned representations. PCA preserves stronger class structure than the VAE latent. The VAE+Mandelbrot and VAE+Mandelbrot+PINNFlow projections reshape the geometry and expose additional structure, but class overlap remains substantial. Fig. 8 shows the distribution of mean normalized escape time by class; the overlap confirms that escape time is not a standalone classifier, but a stability descriptor. (a) PCA-64 projection. (b) VAE-64 projection. Figure 6: Latent visualizations for PCA and VAE representations. (a) VAE+Mandelbrot-64 projection. (b) VAE+Mandelbrot+PINNFlow-64 projection. Figure 7: Complex-dynamical and PINNFlow latent visualizations. PINNFlow changes the geometry but does not eliminate class overlap. Figure 8: Distribution of mean normalized Mandelbrot-inspired escape time by class. Escape profiles overlap, supporting their use as stability descriptors rather than direct labels. V-D Boundary Complexity Table V reports box-counting complexity for uncertain decision regions. PINNFlowOnly has the largest estimated boundary dimension, followed by PCA-64 and VAE+Mandelbrot+PINNFlow-64. The VAE+Mandelbrot representation has higher boundary complexity than VAE-64, supporting the claim that complex-dynamical features expose additional nonlinear structure in uncertain regions. The high R2R^2 values indicate stable log-log scaling fits for most representations. TABLE V: Boundary box-counting complexity on uncertain decision regions. Method Dimension R2R^2 Full 1.6280 0.9947 PCA-64 1.7164 0.9952 VAE+Mandelbrot+PINNFlow-64 1.7084 0.9958 VAE-64 1.4413 0.9934 VAE+Mandelbrot-64 1.5517 0.9949 PINNFlowOnly-64 1.7902 0.9960 V-E Perturbation Robustness Table VI reports F1 under perturbation probes. PCA-64 remains strongest overall. However, VAE+Mandelbrot+PINNFlow-64 improves over VAE+Mandelbrot-64 for all five probes and over VAE-64 for several structured probes. The gain is largest for movement toward the benign centroid (0.9057 to 0.9145) and EMBER histogram proxy perturbation (0.9105 to 0.9159). This is the strongest empirical support for PINNFlow: it does not improve clean classification over PCA, but it partially recovers robustness relative to the complex-dynamical VAE under structured perturbations. TABLE VI: Perturbation robustness measured by F1. Perturbation PCA-64 VAE-64 VAE+Mandelbrot-64 VAE+Mandelbrot+PINNFlow-64 PINNFlowOnly-64 Gaussian small 0.9318 0.9225 0.9228 0.9245 0.9104 Sparse dropout 0.9275 0.9163 0.9170 0.9205 0.9085 Sparse injection 0.9331 0.9230 0.9243 0.9281 0.9114 Toward benign centroid 0.9229 0.9072 0.9057 0.9145 0.9053 EMBER histogram proxy 0.9223 0.9091 0.9105 0.9159 0.9021 V-F LED and PINN-Specific Perturbation Diagnostics Fig. 9 and Table VII report LED. The structured perturbations that most change the escape profile are benign-centroid movement and the EMBER histogram proxy, followed by sparse dropout. Sparse injection and small Gaussian noise produce smaller escape-time shifts. Because LED is computed from the Mandelbrot escape profile, it is identical for VAE+Mandelbrot and VAE+Mandelbrot+PINNFlow; this is expected and motivates separate PINNFlow-specific diagnostics. Figure 9: Mean Latent Escape Divergence under perturbation probes. LED captures perturbation-induced change in Mandelbrot escape-time fingerprints. TABLE VII: Mean LED by perturbation. Perturbation Mean LED Gaussian small 0.0157 Sparse dropout 0.0412 Sparse injection 0.0105 Toward benign centroid 0.0635 EMBER histogram proxy 0.0564 The code adds PINN-specific metrics. Fig. 10 shows residual, risk-probability, and velocity-norm shifts. These plots make the PINNFlow contribution measurable beyond LED. The benign-centroid and EMBER histogram perturbations produce the largest PINN residual and risk shifts, aligning with the perturbation probes that resemble evasion-like movement toward benign-looking regions. (a) PINN residual shift. (b) PINN risk-probability shift. (c) PINN velocity-norm shift. Figure 10: PINNFlow-specific perturbation diagnostics. These features isolate the PINN contribution, unlike LED which is driven by the Mandelbrot escape profile. TABLE VIII: Selected PINNFlow perturbation shifts for VAE+Mandelbrot+PINNFlow-64. Perturbation Residual Risk Velocity Gaussian small 0.0084 0.0048 0.0014 Sparse dropout 0.0264 0.0184 0.0052 Sparse injection 0.0039 0.0022 0.0007 Toward benign centroid 0.0362 0.0272 0.0075 EMBER histogram proxy 0.0354 0.0273 0.0072 V-G Paired Significance Tests McNemar tests compare VAE-64 with other methods. Table IX shows significant differences for all comparisons. The direction matters: Full and PCA-64 are significantly stronger than VAE-64, while VAE+Mandelbrot+PINNFlow-64 is significantly different and improves over VAE-64 in clean metrics but does not surpass PCA-64 or Full features. TABLE IX: McNemar paired tests using VAE-64 as baseline. Comparison b c p VAE-64 vs Full 1630 10209 <10−6<10^-6 VAE-64 vs PCA-64 3247 5283 <10−6<10^-6 VAE-64 vs VAE+Mandelbrot-64 1774 1587 0.0013 VAE-64 vs VAE+Mandelbrot+PINNFlow-64 4748 5193 <10−5<10^-5 VAE-64 vs PINNFlowOnly-64 7179 5381 <10−6<10^-6 VI Discussion VI-A Interpreting the Latent-Dynamics Contribution The results support four claims. First, latent dynamics matter because perturbations induce paths in representation space, and those paths expose stability properties invisible to clean metrics. Second, LED provides a mathematically defined stability metric: the average absolute change in normalized complex-dynamical escape profile. Third, PINNFlow enforces structure through a transport-style residual and yields measurable residual/velocity/risk-shift diagnostics. Fourth, fractal descriptors capture boundary complexity by estimating how uncertain decision regions scale across box sizes. VI-B Boundaries of the Claims The method should not be presented as a superior clean classifier. Full features remain strongest; PCA-64 remains the best compressed baseline. It should also not be claimed that malware is governed by Mandelbrot dynamics or physical laws. The correct framing is that complex dynamics and PINN-style residuals are mathematical descriptors and inductive biases for representation stability analysis. VI-C Methodological Safeguards and Threats to Validity The pipeline directly addresses four expected concerns. VAE undertraining was addressed through KL warm-up, free bits, lower beta, larger latent dimension, and active-unit diagnostics. PINNFlow’s unique contribution was made measurable through PINNFlowOnly, residual shift, velocity shift, risk shift, and gradient-shift diagnostics. Functionality preservation is explicitly treated as a limitation, with an external perturbation-pair interface for future PE-level workflows. The Mandelbrot component is mathematically grounded as escape-time sensitivity analysis and boundary-complexity characterization, not as metaphor. VII Generalization Beyond Malware Detection Although this study focuses on static malware detection, the proposed latent-stability perspective may be relevant to other security-critical machine learning tasks where structured input changes can alter model confidence or representation geometry. Examples include intrusion detection, phishing classification, fraud analytics, and anomaly-based network monitoring. However, this transfer should be treated as a hypothesis rather than an empirical conclusion of this paper. The most portable components of the framework are the diagnostic ideas: measuring representation displacement, neighborhood stability, Latent Escape Divergence (LED), and latent-flow residual shifts under controlled perturbations. These diagnostics could be adapted to other domains if domain-appropriate perturbation operators are defined and validated. For example, a perturbation in phishing detection would need to preserve the semantic intent of a message, while a perturbation in intrusion detection would need to preserve the operational meaning of a network event. Therefore, the contribution of this paper is not a general proof that LED or PINNFlow will improve robustness across all security domains. Rather, it provides a methodology that can be re-tested in other domains using task-specific perturbation models, datasets, and validation criteria. VIII Limitations The most important limitation is that the default perturbations are feature-space probes. They are useful for controlled analysis but do not prove functionality-preserving PE manipulation. Second, the evaluation uses EMBER 2018-style static PE features; additional evaluation on BODMAS temporal data and EMBER2024 challenge samples is needed. Third, while the VAE does not collapse according to KL diagnostics, it still underperforms PCA-64 for clean classification. Fourth, PINNFlow improves robustness relative to VAE+Mandelbrot under several probes but still does not beat PCA-64. Fifth, box-counting dimensions are descriptive estimates and should be interpreted as boundary-complexity diagnostics rather than definitive fractal proofs. IX Future Work Future work should connect the pipeline to raw PE perturbation tools and feature re-extraction workflows, such as secml-malware and LIEF-style binary rewriting [15]. The strongest next experiment is to evaluate clean/perturbed pairs generated by functionality-preserving transformations and test whether LED and PINNFlow residual divergence detect evasion better than classifier confidence, PCA distance, or ordinary VAE latent distance. Additional work should include EMBER2024 challenge-set detection at fixed false-positive rates, BODMAS temporal transfer, contrastive latent learning, and calibration analysis for LED/PINN residual thresholds. X Conclusion This paper presents a VAE+Mandelbrot+PINNFlow malware representation pipeline as a principled latent-dynamics framework. The EMBER run uses anti-collapse VAE training, formal LED, PINNFlow transport residuals, PINN-specific diagnostics, and box-counting boundary analysis. Clean classification results show that Full features and PCA-64 remain superior. Nevertheless, the framework contributes a novel way to analyze malware perturbation behavior: it measures how representations move, how escape-time stability changes, how latent-flow residuals respond, and how uncertain decision boundaries scale. The contribution is therefore best understood as neural-geometric, complex-dynamical, and dynamics-informed perturbation-stability analysis for malware representation learning. XI Code Availability The source code used for the experiments in this study is available at:https://github.com/abamidele/Latent-Stability-Analysis-of-Malware-Representations-Under-Feature-Space-Perturbations. References [1] M. G. Schultz, E. Eskin, E. Zadok, and S. J. Stolfo, “Data mining methods for detection of new malicious executables,” in Proc. IEEE Symposium on Security and Privacy Workshops, 2001. [2] J. Z. Kolter and M. A. Maloof, “Learning to detect and classify malicious executables in the wild,” Journal of Machine Learning Research, vol. 7, p. 2721–2744, 2006. [3] H. S. Anderson and P. Roth, “EMBER: An open dataset for training static PE malware machine learning models,” arXiv preprint arXiv:1804.04637, 2018. [4] L. Yang, A. Ciptadi, I. Laziuk, A. Ahmadzadeh, and G. Wang, “BODMAS: An open dataset for learning based temporal analysis of PE malware,” in Proc. IEEE Security and Privacy Workshops, 2021. [5] R. J. Joyce, G. Miller, P. Roth, R. Zak, E. Zaresky-Williams, H. Anderson, E. Raff, and J. Holt, “EMBER2024: A benchmark dataset for holistic evaluation of malware classifiers,” arXiv preprint arXiv:2506.05074, 2025. [6] G. Ke, Q. Meng, T. Finley, T. Wang, W. Chen, W. Ma, Q. Ye, and T.-Y. Liu, “LightGBM: A highly efficient gradient boosting decision tree,” in Advances in Neural Information Processing Systems, vol. 30, 2017. [7] E. Raff, J. Barker, J. Sylvester, R. Brandon, B. Catanzaro, and C. Nicholas, “Malware detection by eating a whole EXE,” arXiv preprint arXiv:1710.09435, 2017. [8] C. Szegedy, W. Zaremba, I. Sutskever, J. Bruna, D. Erhan, I. Goodfellow, and R. Fergus, “Intriguing properties of neural networks,” in International Conference on Learning Representations, 2014. [9] I. J. Goodfellow, J. Shlens, and C. Szegedy, “Explaining and harnessing adversarial examples,” in International Conference on Learning Representations, 2015. [10] N. Papernot, P. McDaniel, I. Goodfellow, S. Jha, Z. B. Celik, and A. Swami, “Practical black-box attacks against machine learning,” in Proc. ACM Asia Conference on Computer and Communications Security, p. 506–519, 2017. [11] B. Biggio, I. Corona, D. Maiorca, B. Nelson, N. Srndic, P. Laskov, G. Giacinto, and F. Roli, “Evasion attacks against machine learning at test time,” in Joint European Conference on Machine Learning and Knowledge Discovery in Databases, p. 387–402, Springer, 2013. [12] H. S. Anderson, A. Kharkar, B. Filar, D. Evans, and P. Roth, “Learning to evade static PE machine learning malware models via reinforcement learning,” arXiv preprint arXiv:1801.08917, 2018. [13] B. Kolosnjaji, A. Demontis, B. Biggio, D. Maiorca, G. Giacinto, C. Eckert, and F. Roli, “Adversarial malware binaries: Evading deep learning for malware detection in executables,” in Proc. European Signal Processing Conference, p. 533–537, 2018. [14] L. Demetrio, S. E. Coull, B. Biggio, G. Lagorio, A. Armando, and F. Roli, “Adversarial EXEmples: A survey and experimental evaluation of practical attacks on machine learning for Windows malware detection,” arXiv preprint arXiv:2008.07125, 2020. [15] L. Demetrio and B. Biggio, “secml-malware: Pentesting Windows malware classifiers with adversarial EXEmples in Python,” arXiv preprint arXiv:2104.12848, 2021. [16] W. Song, X. Li, S. Afroz, D. Garg, D. Kuznetsov, and H. Yin, “MAB-Malware: A reinforcement learning framework for attacking static malware classifiers,” arXiv preprint arXiv:2003.03100, 2020. [17] D. Park and B. Yener, “A survey on practical adversarial examples for malware classifiers,” arXiv preprint arXiv:2011.05973, 2020. [18] I. T. Jolliffe, Principal Component Analysis, 2nd ed. Springer, 2002. [19] B. Schölkopf, A. Smola, and K.-R. Müller, “Nonlinear component analysis as a kernel eigenvalue problem,” Neural Computation, vol. 10, no. 5, p. 1299–1319, 1998. [20] L. McInnes, J. Healy, and J. Melville, “UMAP: Uniform manifold approximation and projection for dimension reduction,” arXiv preprint arXiv:1802.03426, 2018. [21] D. P. Kingma and M. Welling, “Auto-encoding variational Bayes,” in International Conference on Learning Representations, 2014. [22] P. Vincent, H. Larochelle, Y. Bengio, and P.-A. Manzagol, “Extracting and composing robust features with denoising autoencoders,” in Proc. International Conference on Machine Learning, p. 1096–1103, 2008. [23] I. Higgins, L. Matthey, A. Pal, C. Burgess, X. Glorot, M. Botvinick, S. Mohamed, and A. Lerchner, “beta-VAE: Learning basic visual concepts with a constrained variational framework,” in International Conference on Learning Representations, 2017. [24] B. B. Mandelbrot, The Fractal Geometry of Nature. W. H. Freeman, 1982. [25] K. Falconer, Fractal Geometry: Mathematical Foundations and Applications. John Wiley & Sons, 1990. [26] R. L. Devaney, An Introduction to Chaotic Dynamical Systems, 2nd ed. Addison-Wesley, 1989. [27] M. Raissi, P. Perdikaris, and G. E. Karniadakis, “Physics-informed neural networks: A deep learning framework for solving forward and inverse problems involving nonlinear partial differential equations,” Journal of Computational Physics, vol. 378, p. 686–707, 2019. [28] A. S. Krishnapriyan, A. Gholami, S. Zhe, R. M. Kirby, and M. W. Mahoney, “Characterizing possible failure modes in physics-informed neural networks,” in Advances in Neural Information Processing Systems, vol. 34, 2021.