Track papers across labs, topics, and trends.
Search papers, labs, and topics across Lattice.
To bridge the gap between opaque industrial antivirus pipelines and siloed academic benchmarks, this work formalizes an evaluation methodology for Compound AI Systems that integrate rule-based heuristics with static and dynamic machine learning detectors. The authors construct system-level threat models under varying degrees of attacker knowledge to analyze end-to-end evasion and computational overhead rather than isolated classifier vulnerabilities. Across real-world malware corpora, they show that multi-component pipelines can substantially reduce inference latency and training costs with negligible detection loss, but exposing component routing introduces severe trade-offs where knowledgeable adversaries intentionally induce costly dynamic fallbacks to degrade system responsiveness.
Adversaries targeting multi-stage compound AI systems do not just bypass detection—they weaponize pipeline routing to induce severe latency bottlenecks, proving that operational efficiency and adversarial robustness are fundamentally at odds.
Industrial Windows malware detectors are commonly described as Compound AI Systems composed of multiple heterogeneous components, including rule-based mechanisms as well as machine-learning-based static and dynamic analyses. However, due to industrial secrecy and limited public disclosure, the internal architectures of these systems can only be inferred, rendering systematic evaluations of detection accuracy, computational costs, and adversarial robustness largely infeasible. In contrast, academic research provides reproducible and transparent evaluation methodologies, but typically investigates individual detection components in isolation. To bridge the gap between academic research and industrial practice, and inspired by state-of-the-art industrial architectures for Windows malware detection, we propose a novel methodology that (i) explicitly balances the trade-off among detection performance, computational requirements, and robustness, and introduces (ii) system-level threat models that capture how attackers exploit different degrees of knowledge to evade the entire Compound AI System rather than isolated detectors. Experiments conducted on real-world data demonstrate that the Compound AI System training time can be reduced and responsiveness improved while incurring only a marginal loss in detection performance. Leveraging our threat modeling, we show that increasingly knowledgeable attackers craft more effective adversarial examples, revealing the system's strengths and weaknesses, degrading its responsiveness, and exposing a direct trade-off between efficiency and robustness. Finally, we translate these trade-offs into take-home messages and deployment guidelines, helping practitioners to select the system that best matches their operational constraints.