Applying Functionality Preservation Clause Samples

Applying Functionality Preservation. We then validate the perturbations that have been used to generate X′. This is done in order to preserve the original malicious functionality of X within the feature-space as a lower bound, which is essential in this domain. Otherwise, one may have an adversarial example that evades the oracle but has lost its malicious functionality. In this process, any invalid perturbations found in X′ are reverted to their original values from X. Note that the perturbations that are valid or invalid and the way in which functionality preservation works in practice depend on the particular target platform for the malware. We detail valid and invalid perturbations for each of the cases we explore in the evaluation (for Android and Windows) later in Section 4.4.6.