Papers › Lemna: Explaining deep learning based security applications

Lemna: Explaining deep learning based security applications

15 Jan 2018Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security 2018 1archive 2025-07-28

Wenbo Guo, Dongliang Mu5, Jun Xu4, Purui Su6, Gang Wang3, Xinyu Xing

While deep learning has shown a great potential in various domains,the lack of transparency has limited its application in security orsafety-critical areas. Existing research has attempted to developexplanation techniques to provide interpretable explanations foreach classication decision. Unfortunately, current methods areoptimized for non-security tasks (e.g., image analysis). Their keyassumptions are often violated in security applications, leading toa poor explanation delity.In this paper, we proposeLEMNA, a high-delity explanationmethod dedicated for security applications. Given an input datasample,LEMNAgenerates a small set of interpretable features to ex-plain how the input sample is classied. The core idea is to approx-imate a local area of the complex deep learning decision boundaryusing a simple interpretable model. The local interpretable modelis specially designed to (1) handle feature dependency to betterwork with security applications (e.g., binary code analysis); and(2) handle nonlinear local boundaries to boost explanation delity.We evaluate our system using two popular deep learning applica-tions in security (a malware classier, and a function start detectorfor binary reverse-engineering). Extensive evaluations show thatLEMNA’s explanation has a much higher delity level compared toexisting methods. In addition, we demonstrate practical use casesofLEMNAto help machine learning developers to validate model be-havior, troubleshoot classication errors, and automatically patchthe errors of the target models.

Code

Repository list and official/mentioned flags are the archive's, frozen 2025-07-28. Reachability, where shown, is from one Syntology probe window (2026-09-16 to 2026-09-18); repositories not probed show nothing. GitHub stars are not tracked.

Code Syntology ran Syntology

Not run by Syntology. Nothing on this page verifies that the listed code works.

Tasks

Results from the paper archive 2025-07-28

No leaderboard rows for this paper in the archive.

Report a problem or propose a change · a person checks every report against the paper or source before anything changes; decisions are listed on /corrections