LAMDA: A Longitudinal Android Malware Benchmark for Concept Drift Analysis
Authors: Md Ahsanul Haque
Ismail Hossain
Md Mahmuduzzaman Kamol
Md Jahangir Alam
Suresh kumar Amalapuram
Sajedul Talukder
Mohammad Saidur Rahman
Venue: ICLR 2026 Poster (2026)
Keywords: Machine Learning
Android Malware
Concept Drift Analysis
Explainability
Dataset Benchmark
Primary area: datasets and benchmarks
TL;DR: This paper presents the largest and most diverse Android malware benchmark dataset for studying concept drift with a comprehensive temporal analysis, feature stability, and explainability.

Abstract: Machine learning (ML)-based malware detection systems often fail to account for the dynamic nature of real-world training and test data distributions. In practice, these distributions evolve due to frequent changes in the Android ecosystem, adversarial development of new malware families, and the continuous emergence of both benign and malicious applications. Prior studies have shown that such concept drift—distributional shifts in benign and malicious samples, leads to significant degradation in detection performance over time. Despite the practical importance of this issue, existing datasets are often outdated and limited in temporal scope, diversity of malware families, and sample scale, making them insufficient for the systematic evaluation of concept drift in malware detection.

To address this gap, we present LAMDA, the largest and most temporally diverse Android malware benchmark to date, designed specifically for concept drift analysis. LAMDA spans 12 years (2013–2025, excluding 2015), includes over 1 million samples (approximately 37\% labeled as malware), and covers 1,380 malware families and 150,000 singleton samples, reflecting the natural distribution and evolution of real-world Android applications. We empirically demonstrate LAMDA's utility by quantifying the performance degradation of standard ML models over time and analyzing feature stability across years. As the most comprehensive Android malware dataset to date, LAMDA enables in-depth research into temporal drift, generalization, explainability, and evolving detection challenges.

Published as a conference paper at ICLR 2026
LAMDA: A LONGITUDINAL ANDROID MALWARE BENCHMARK FOR CONCEPT DRIFT ANALYSIS
Md Ahsanul Haque', Ismail Hossain' Md Mahmuduzzaman Kamol', .d Jahangir Alam', Suresh kumar Amalapuram", Sajedull Talukder', Mohammad Saidur Rahman Department of Computer Science, University of Texas El Paso
Indian Institute of Technology Hyderabad, {mhaque whossssinnn mkamol, ma am1 @miners. utup.edu edu rerkkmarkrr@@maaa.... com, (stalukder) msrahman3 Setteeppaaneeeeeeeeeeeeeeee edu
ABSTRACT
Machine learning (ML)-based malware detection systems often fail to account for the dynamic nature of real-world training and test data distributions. practice, these distributions evolve due to frequent changes in the Android ecosystem, ad- versarial development of new malware families, and the continuous emergence of both benign and malicious applications. Prior studies have shown that such concept drift distributional shifts in benign and malicious samples, leads to sig- nificant degradation in detection performance over time. Despite the practical im- portance of this issue, existing datasets are often outdated and limited in temporal scope, diversity of malware families, and sample scale, making them insufficient for the systematic evaluation of concept drift in malware detection.
To address this gap, we present LAMDA, the largest and most temporally diverse Android malware benchmark to date, designed specifically for concept drift anal- ysis. LAMDA spans 12 years (2013-2025, excluding 2015), includes over 1 mil- lion samples (approximately 37% labeled as malware), and covers 1,380 malware families and 150,000 singleton samples, reflecting the natural distribution and evo- lution of real-world Android applications. We empirically demonstrate LAMDA's utility by quantifying performance degradation of standard ML models over time and analyzing feature stability across years. As the most comprehensive Android malware dataset date, LAMDA enables in-depth research into temporal drift, generalization, explainability, and evolving detection challenges. The dataset and code are available at: http://igscc-lbaaggiubbbooooo..
INTRODUCTION
Android malware poses a growing threat to user privacy and security, with over 33 million attacks blocked in 2024 alone (Kaspersky) 2024 AV-TEST 2025). Static feature based MI. methods, which analyze features extracted from Android application packages (APKs), have emerged as a promising defense mechanism (Arp et al. 2014 Mariconti al. 2017). However, these detectors often suffer performance degradation over time due to concept drift gradual shifts in the feature distribution caused by the evolving nature of both malicious and benign software (Yang al., 2021b).
Concept drift can result from several factors, including changes in developer practices, updates Android APIs, and, most significantly, the evolving and adaptive strategies of malware au- thors (Greenberg. 2020). To evade detection, adversaries frequently obfuscate or modify their code by injecting alternative API calls, altering manifest components, or exploiting newly introduced ser- vices (News, 2024). For example, the Android trojan SoumniBot obfuscates its manifest file to evade analysis and detection (News) 2024). These tactics lead to observable shifts static features over time, undermining the robustness of ML-based detection systems (Yang al. (022bb. Prior studies have shown that malware families (i.e., clusters samples exhibiting similar behavioral traits) play central role in driving such drifts (Chow et al. 2023 Barbero al. 2022).
Although concept drift plays a central role in Android malware evolution, most existing datasets not designed support drift analysis. Datasets such as Drebin (Arp et al. 2014). TESSER-

---

Published as a conference paper at ICLR 2026
ACT (Pendlebury et al., 2019). and APIGraph (Zhang al. 2020) are limited in temporal coverage, family diversity, or structural organization for studying drift. Similarly, Windows-basee datasets like
EMBER (Anderson & Roth 2018), SOREL-20M (Harang & Rudd 2020), and BODMAS (Yang
et all. 2021a) are constrained by short collection periods or target different ecosystems. While FM-
BERSim (Corlatescu al. 2023). MalNet (Freitas et al.) 2022), and AnoShift (Dragoi et al. 2022)
offer task-specific contributions, they do not support longitudinal drift analysis in Android malware classification. To address these gaps, we introduce LAMDA, a novel Android malware benchmark dataset curated for temporal drift analysis with family evolution. LAMDA spans over 12 years (i.e., 2013-2025, excluding 2015 due the unavailability of hashes in the AndroZoo repository (AI- lix et al. 2016)), covering 1,008,381 APK samples across 1,380 unique malware families and over 150,000 Singleton samples (i..e, samples without av class labels) from AndroZoo repository (Alecci et al. 2024). Each sample is labeled using VirusTotall's ' vt_detect on count (Virus Total (025) reported in AndroZoo database (Alecci et al. 2024). The samples are decompiled to extract fine- grained static features following the Drebin (Arp et al. 2014) feature definitions.
We validate LAMDA through a series of comprchensive evaluations, including longitudinal degra- dation analysis of the supervised binary classification under concept drift (AnoShift-style (Dragoi jet al. 2022)), temporally disjoint training (testing), and family-wise feature stability assessments. LAMDA enables opplanation-uuider analysis of concept drift and combines long-ferm structural modeling with SHAP-basee attributions (Lundherg & Leel (017). allowing researchers to trace how feature relevance shifts over time and better understand the underlying causes of model degradation.
In summary, the contributions of this paper are as follows:
We present LAMDA, a large-scale Android malware benchmark comprising over million APKs across 1,380 unique families spanning for 12 years (2013 to 2025, excluding 2015),
built on static features based on Drebin (Arp et al. 2014) features.
We perform a detail concept drift detection using structured temporal splits (Dragoi et al.) 2022 to show that LAMDA exhibits pronounced distributional shift than prior benchmark. We conduct comprehensive drift analysis, including per-feature distribution shifts, fea- ture stability analysis across malware families (Zhang et al. 2020), temporal label flipping analysis, and SHAP-based explanation (Lundberg & Lee 2017) drift that reveal temporal changes in feature importance.
We show that existing drift adaptation methods, though effective on prior bench- mark (Zhang et al.] (2020), fail to generalize on LAMDA due to its more realistic and pronounced concept drift.
RELATED WORK
In this section, we discuss prior work and their limitations that motivate the creation of LAMDA.
Evolution of Malware Datasets and Benchmarks. Early malware datasets such as Drebin (Arp) ct al. 2014) (Android) and EMBER (Anderson & Roth 20188) (Windows) have played a pivotal role study concept drift in malware analysis. More recent inforts-incluuing SOREL-20M (Harang & Rudd 2020) and BODMAS (Yang et al. 2021a) for Windows, and TESSERACT (Pendlebury ct al.] | 2019). APIGraph (Zhang et al.) 2020). and Chen al. (2023) for Android attempt address limitations in scale and recency. Nonetheless, these datasets suffer from one or more major limita- tions -they are often outdated, contain either relatively few malware samples or families, or lack long-term temporal coverage necessary for studying the evolution of malware. For example, Drebin spans only 2010-2012 with 5,560 samples from 179 families; TESSERACT covers 2014-2016 with 12,735 samples; API Graph spans 2012-201 18 with 32,089 samples from 1,120 families; and [Ceen jtt al. (202)) includes 10,200 samples across 254 families from 2019-2021. Despite their temporal spread, these datasets not explicitly structured to support longitudinal drift analysis capture evolutionary patterns in malware behavior.
Explainability and Semantic Features. Explainability is critical for understanding how feature importance shifts under concept drift. While Drebin (Arp et al., 2014 and BODMAS (Yang et al.) 202 introduced interpretable features and temporal structure, few studies have systematically used them to analyze drift. TRANSCENDENT (Barbero et al. 2022) incorporates semantic reason- ing for selective prediction, but longitudinal robustness of explanations remains underexplored due
2

---

Published as a conference paper at ICLR 2026
to limited dataset support. LAMDA fills this gap by providing temporally structured benchmark with interpretable features and SHapley Additive exPlanations (SHAP)- based explanations (Lund-) berg & Lee 2017). enabling fine ane-grained, longitudinal analysis of model behavior and drift.
LAMDA CREATION
In this section, describe the construction process of the LAMDA. We have downloaded APKs from AndrooZoo repository (Allix et al., (2016) and decompiled APKs to extract static Drebin (Arp) al. 2014) features and then transformed the features into binary vectors for downstream analysis.
Label Assignment and Collection Strategy. To construct large-scale, temporally diverse dataset, we use metadata from AndroZoo (Allix et al.) (016). including APK hashes, VirusTotal (VT) results, and submission dates. For each year from 2013 to 2025 (excluding 2015, which lacks valid entries), we collect APKs and assign binary labels using the vt vt_detect ion field. Following prior heuristics (Arp et al. 2014 Pendlebury et al. 2019), we define: (i) Benign for vt_detectt... i = 0, (ii) Malware for vt www.ecetiiion 2 4, and (in)) discard Uncertain samples with scores in 1, The 2 threshold mitigates label noise by requiring stronger AV consensus (Chen et al., 2016).
To reduce sampling bias in learning systems, we collected 50,000 malware and 50,000 benign sam- ples per year, while preserving month-wise temporal distributions across both categories. Although prior work such as TESSERACT (Pendlebury et al., 2019; Chen et al. 2023) adopts a 90: 10 benign- to-malware ratio, we attempt to maintain balanced 50:50 ratio (Anderson & Roth, 2018). This choice is motivated by the need to mitigate the risk of skewed learned representations (such over- fitting (Shwartz-ZD Ziv et al. 2023), disparity in learning (Zhou et al. 2023)) that can arise from class imbalance. A balanced dataset helps ensure that the model learns meaningful distinctions between classes, captures a wider range of malware families, and is exposed to a broader spectrum of behav- iors and evasive techniques. Such diversity not only enables longitudinal generalization studies but also increases the difficulty of the detection task, particularly for learning systems that must contend with rare, novel, or semantically similar malware families (Anderson & Roth 2018). Nonetheless, due to limited availability of malware samples in certain years such as 2017, 2023, 2024, and 2025, LAMDA still exhibits class imbalance, with each of these years showing different imbalance ratios.
Another practical challenge during data collection involved download and decompilation failures, requiring us to over-fetch APKs to meet target counts. To mitigate this, we included 20% overhead in the number of APK hashes per year. All APKs are retrieved via authenticated academic access to the AndroZoo repository [ [year] / / to facilitate temporal slicing and cross-year analysis. Corrupted or undecom- pilable samples are excluded and logged for transparency. The final dataset comprises over one million APKs. A detailed wesr breakdown is provided in Appendix A
and stored
consistent directory structure [[year] ] / /ma I wa re/,
Label Assignment. We utilized the original labels provided by AndroZoo (Allix et al., 2016) and their VorusTotal scan dates range from 2009 to 2025, depending on the APKs. Due the original label scan date variation, we re-scanned all malware samples in our dataset using VirusTotal at the time of data collection. We reported the label drift observed between the original AndroZoo labels and our re-scan labels in Section 5.4
Family Label Acquisition. To enable finer-grained analysis of how malware behavior evolves over time, we assign family-level labels to all malware samples using AVClass2 (Sebastián al., & Caballero, (020), which standardizes noisy antivirus vendor labels into consistent malware family names. This is critical for developing detection systems that generalize emerging threats. The labeling process involves retrieving VirusTotal (2025) reports, converting them to the required format, running AVClass2, and post- post-processing the output to retain SHA256 mappings. Figures [[) and [bb) show the yearly distribution of recurring versus newly observed families and the count of singleton families-ther that appear only once resperespcyy.lly. Family labels enable research into more complex tasks such as multi-class classification and the study of temporal trends across malware families.
https://andrrzzoo.uu uni auaccess
3

---

Published as a conference paper at ICLR 2026
Table APIGraph and LAMDA Dataset Statisties.
APIGraph
LAMDA
Year
Benign
Malware
Family
Singleton
Benign
Malware
Family
Singleton
2012
27613
3066
36
2013
43873
4871
172
68
42048
44383
213
1550
2014
52843
5871
175
55427
45756
2482
2015
52173
5797
193
53
2016
50859
5651
199
64059
45134
375
5861
2017
24930
26200
147
77785
21359
207
9063
2018
38214
4213
128
45
64942
39350
373
20579
2019
49465
41385
2020
55718
46355
588
30644
2021
45528
35627
30020
2022
44768
41648
651
24927
2023
46462
7892
5922
2024
47633
794
64
626
2025
44640
23
14
290,505
32,089
638,4475
369,906
Cxarnia Teuihar
SEDCEER
2000
Figure: Temporal trends in
(a) LAMDA.
(b) APIGraph.
malware family evolution.
Figure 2: Fl-score over time across different temporal splits.
Decompilation and Static Feature Extraction. Each APK is statically decompiled using apktool (Brut 2025), producing a disassembled smali representation and the original androidManffest xml. We parse these artifacts to extract a diverse set of static fea- tures commonly used in Android malware detection (Arp et al. 2014). Specifically, the AndroidManifest. xml file analyzed to obtain the list of requested permissions (e.g., ACCESS.PINE.LOCK
declared activities and services, broadcast receivers, required hard- ware components, and intent filters (Arp et al.) (2014). Meanwhile, the disassembled smali code scanned to identify invocations of restricted APIs (e.g., Not cat onmanage i fy), suspicious API usages (e.g.. set.yystemeeee
ce), and embedded hardcoded IPs/URLs (e.g.. crrsshlyiics com). The extracted Drebin feature sets comprises several static categories de- rived from Android APKs (Arp et al. 2014). A detailed list of features is provided in Appendix B
Vectorization and Temporal Feature Alignment. After decompiling each APK, we extract static features into data file. Each year's data is split into 80% training and 20% testing sets using stratified sampling to preserve class balance. From the training set, we construct global vocabu- lary by taking the union of unique tokens across all samples, yielding 9,690,482 (=s 9.69 million) raw features (Yang et al., 20216). Each APK is then represented as a high-dimensional binary vec- using a bag-of-tokens model, where each token corresponds to a binary feature indicating its presence or absence in the sample (Arp et al. 2014). To reduce dimensionality and ensure com- putational feasibility, we apply Variance wwwanceTheehhor
from seikit-leaze variance features. For all experiments, we use the Baseline variant, which applies threshold of 0.001 (Rahman al.) 2025), resulting 4, 561 final features. This compact and consistent repre- sentation supports range of downstream tasks, including supervised learning, drift analysis, and continual learning. More details are in Appendix The dataset initially created in a sparse matrix format, storing binary feature vectors and metadata compressed .np z files to optimize for storage and computational efficiency. These npp files are organized by year and stratified into training and test splits. A detailed breakdown of feature dimensions under varying Vari MarianceThh. Threehhhhhhhe ld set- tings is provided in Appendix(B B For scalability of LAMDA, we have also published global features, variance threshold objects and selected features after applying Va
eliminate low-
4

---

Published as a conference paper at ICLR 2026
Tabular Comparison of LAMDA and APIGraph. Table provides the statistics of API- Graph Zhang et al. (2020) and LAMDA in terms of number of benign, malware, families and sin- gleton samples for each year.
CONCEPT DRIFT DETECTION
In this section, examine performance degradation of supervised models across temporally distant splits (Dragoi et al. 2022) (Section[4.]) to detect concept drift, followed by distributional shifts using Jeffreys divergence and I-SNE visualizations (Sections and 4.2)
4.1 CONCEPT DRIFT DETECTION WITH SUPERVISED LEARNING
Experimental Setting, To evaluate the robustness of malware detectors under temporal distribu- tion shifts, we perform supervised learning experiments using four widely adapted detector models from the malware research - Linear SVM, LightGBM, MLP. XGBoost, detectBERT, and ViT (Arp ct al.
2014 Anderson & Roth 2018). Detailed model configurations are provided in Appendix D
Following the AnoShift benchmark (Dragoi et al., 2022), we divide LAMDD into three temporally separated regions: TRAIN (i.e., initial training set), IID, NEAR, and FAR. TRAIN+IID includes samples from 2013-2014, with the last month of each year held out for IID evaluation. Models are trained on all other months, and the held-out portion serves as an in-distribution test set to measure baseline performance
temporally adjacent, unseen data. To assess generalization under drift, we define two evaluation regions: NEAR (2016-2017) and FAR (2018-2025), allowing systematic analysis of performance degradation as the temporal gap from training increases. For comparison, we evaluate the same models on the APIGraph dataset (Zhang et al. 2020) using a similar split: All experiments
training on 2012, IID on 2013, NEAR repeated five times with different random seeds. For each split, we report results in Table 2 as mean averaged across all runs and years within each split. Figure 2 shows yearly results averaged over runs. This experiment uses the MAMDA-baseling with TwrrannceTeeeeee 0.001. To study the impact of feature space on drift, we also test thresholds of 0.01 and 0.0001, with results provided in Appendix D
2014, and FAR
of
Results. Table 2 summarizes the performance of malware detectors on both LAMDA and API- Graph under the TID, NEAR, and FAR evaluation splits. All detectors perform strongly under IID) conditions, but their effectiveness declines sharply as the temporal gap from training increases. For instance, LightGBM's Fl-score on LAMDA drops from 97.49% (IID) to 59.48% (NEAR) and 47. 47.24% (FAR), alongside a significant rise in the false negative rate, from 1.47% to 50.51% and 64.10%, respectively, resperively-ddddoonttainnnn increased difficulty. In contrast, the false positive rate (FPR) remains low and stable, likely due the more consistent behavior of benign apps over time. Fig- ure further visualizes this trend, showing how F1-scores decline over time. Notably, we observe sharp drop in performance between 2016 and 2017, indicating significant distributional shift. A similar decline is evident from 2023 to 2024. In contrast, Fl-scores increase from 2018 to the 2019- 2022 period, suggesting that these intermediate years exhibit less drift relative to 2017 and 2018.
In APIGraph, LightGBM's Fi-score drops from 85.95% (IID) to 66.77% (NEAR), but stabilizes at 68.20 68.20% on FAR. The Fl-scores over the years in Figure ( indicate a smaller degree of temporal drift, with only modest changes between years. Compared to the APIGraph, LAMDA shows a higher standard deviation in both NEAR and FAR. suggesting more pronounced and variable distributional shifts. Complex transformer-basee
models like DeR and ViT also degrade with increasing drift severity. This supports our claim that LAMDA introduces stronger concept drift, making it more challenging and realistic benchmark for evaluating long-term malware detection.
Significant Performance Drop in 2017 and 2018. Figure a shows a significant performance drop in 2017 and 2018 for LAMDA. This drop also aligns with multiple independent indicators of strong drift present in these two years. Figure 3 shows a sharp increase in Jeffrey's 's divergence between 2016 to 2017 and from 2017 2018, indicating substantial shifts in static features such as API usage and permissions. Feature stability results in Figure (aa highlight that features are most unstable in 2017-2018, with larger fluctuations across malware families, suggesting significant
5

---

Published as a conference paper at ICLR 2026
Table 2: Comparison of performances on LAMDA and API Graph across three temporal splits.
Split
LAMDA
Gruph PR-AUC
ROC-AUC
AUC
UNR
FNR
Li
97.49 g0.17
.9.55.0.o co
a0.5
1.74
40.4
s0u00
-0.20_..m
22.39.n.0
a.33
11D
MLP
SVM
94.99 u..7
98. 89.89.m io
99. ms
98.75
4.82
2. 2.50aniss
4.09
2:58
a2.00
96.37
97.33
a..94..mm mm
83. $3.49 mm
26. 26.74an.co
20.3 2mc0
0.00ap.co
XCiRond
07.05 14
09. 15
97
2 2:70
2
80 aauee
96 g0
80 mm
28. 28.35
0
0.75 gn-e0
DeteciDERR
a5.27
98. 22.922.n
98.61
3.96
4.48
83.08 studo
98 98.82.3.00
94.19.mm
25.50
3.48
VIT
94.97
98. 91
98.01
4 4.63..4
4.17
98, 38.65
98. 23.73
17.82,1100
0.5t
Li
59.48
74.05
70.18
50,51
1.85
77
95.94_3.00
83.01
47. 21.8
NEAR
MLP
56.57
N2.71
62.5 $3
67
55.65 55.62.
68.7245.02
63.06ane
86.77
68.31
XGBonsi
12.35
24:22055
53.84
2.14
a1.4
86.90
.9.0..
20.41
10.00
DetooRERT
75386-29-7
49.92
08 s0:03
23.4
12.54.1.2
VIT
58.77 45
71.47
12.33
63 p:9.0n
48.65 u20
4.63
72.15
ao.c0
93.08 a0.00
78, a..
31.23
2.4 abuco
LightGBM
47.3 47.24
78.04_10.43 20.43
78.04
G3 g3.330
64.10,s2
1.30
68.20 L1C3
95.68 a..31
$1.60 L..0
45.34
0,61 ao.e7
FAR
SVM
MLP
47.59
41.86122.55
84.M
79407
-15.5
62.27
66 16.16:31:1
69 09.9321685
64.40
1.27
1.44
63.9 13.92
93. 93.44:3.32 18.181
87 10 is
64.2 64.22
25.46
46.45.0100
44.26.8.35
1 1.23
140
XCIRonst
42.75 42.75x55
7685-16.11
60. a3
68. 18.11
1.6
54 58.16-
83 13.4
65 65.03
16.68.5.0
1414033
DeteciBERT
45.0)
26.47
60.56
3.15
73:23
96.74
35.57 83.15
0.99.6a
47.083gm
78.53-1017
58.77gmr
60.25
4.77
73.69
27.71gu61
2013
2014
2014
2017
AP Graph
(a) LAMDA
(b) APIGraph
Matware
Figure 3: Jeffreys divergence heatmaps across Figure 4: t-SNE projections showing feature years for LAMDA and APIGraph.
space evolution for LAMDA and APIGraph.
behavioral changes. SHAP-based explanation drift (Figure 7ap also shows a strong drop in 2017 and 2018, confirming abrupt changes in the model's decision logic during this period.
4.2 VISUAL ANALYSIS OF CONCEPT DRIFT
Setting. To track how malware and benign class distributions evolve over time, we use two com- plementary visualization techniques: Jeffreys divergence heatmaps and t-SNE projections. Jef- freys divergence (Jeffreys) 1946). a symmetric information theorreicc measure, quantifies distribu- tional shifts in individual static features across years. We compute pairwise divergences for all yearly combinations in LAMDA (013-2025) and APIGraph (2012-2018)
parallel, we apply t-SNE (Van der Maaten & Hinton| 2008) to project high-dimensional feature vectors into 2D space. For direct comparison, we focus on four years shared by both datasets (2013, 2014, 2016, 2017), following common practice in prior malware drift studies (Pendlebury et al. 2019). Full year- wise t-SNE visualizations are provided in Appendix
Analysis. Figure 3 shows Jeffreys divergence heatmaps for both datasets. In both LAMDA and APIGraph, divergence increases as the temporal gap widens, confirming non-trivial concept drift. LAMDA cxhibits a broader divergence range, particularly from 2022-2025, reflecting substantial feature distribution changes likely driven by evolving APIs, shifting development practices, and emerging malware behaviors. In contrast, APIGraph remains relatively stable, with limited diver- gence in its later years. Figure f provides t-SNE projections for the selected years. LAMDA, samples become more dispersed by 2016-2017. suggesting increasing structural sparsity in feature space. Since t-SNE distorts global distances, we corroborate these patterns with Jeffreys diver- gence, which confirms genuine distributional shifts. APIGraph, by comparison, maintains tight and relatively static clusters, indicating limited structural evolution. Together, these trends underscore LAMDA's value temporally rich benchmark for studying real-world concept drift.

---

Published as a conference paper at ICLR 2026
1.0
Staiiity score
0.6
0.4
0.0 086
35. ditecs water 1iNe 30, Roptiacc 40, bridk vaprce. mubiest 44, Me, Paid di, stocal, 47 viicad, 46, Pook wwwoerrtontc Lilliick pariil minano
SanA FOLLL RETCINCOO, 2A, kngurt, SYINNL styriis Joke. ah clii druddvarkg ba basung' genien, accoofing bonggg
DeER, 30. 53. 93,
hoverr
Figure 5: The distribution of feature stability scores for top 100 malware families. 58 families are common in both LAMDA (green) and APIGraph (blue) datasets, and families marked as red labels along x-axis available in LAMDA with minimum family size criteria.
COMPREHENSIVE DRIFT ANALYSIS
In this section, we present more in-depth analysis of different types of drift, including feature stability (Section 5.1). temporal drift (Section 5.2). SHAP-based explainability (Section (.3) and label drift (Section
5.1 FEATURE SPACE STABILITY ANALYSIS ON TOP MALWARE FAMILIES
Analysis Setting. We evaluate the temporal consistency of malware families using two comple- mentary metries: stability scores and Optimal Transport Dataset Distance (OTDD) (Alvarez- & Fusi 2020), following prior work (Zhang et al. 2020 Dragoi et al., 2022). The analysis con- ducted in the original feature space and focuses on the 100 malware families with the largest sample sizes. Within each family, samples are temporally ordered from 2013 to 2025, though not all fami- lies contain data for every year. Following (Zhang al. 2020), we partition each family's 's samples into ten equal subsets, each representing 10% of the family's 's total. For APIGraph, we identify 58 families with at least 10 samples between 2013 and 2018, meeting this subdivision requirement. Stability scores are then computed using Jaccard similarity across the ten subsets for both LAMDA and APIGraph.
Stability Scores Analysis. Figure Figure5]shows shows the distribution of consecutive pairwise stability scores across ten groups for each of the top 100 malware families. The number of samples per family varies considerably, ranging from 186 to 32,475, with mean of 1,984 and median of 535. The green box plots correspond to LAMDA, while the blue box plots represent APIGraph. Both datasets capture the temporal evolution of malware families, reflected in the spread and median of stability scores. Broader spreads and lower medians in both datasets indicate greater behavioral variability over time. Notably, LAMDA includes more families and reflects broader evolutionary patterns than APIGraph. These differences suggest that detection models trained on LAMDA may offer improved insight into concept drift, benefiting from greater sample diversity and family coverage.
5.2 TEMPORAL DRIFT ANALYSIS ON COMMON MALWARE FAMILIES
Analysis Setting. We assess the drifting behavior over the years for the common families present from 2013 to 2025. We observe that only 10 families appear consistently each year, except for 2025. Subsequently, we compute the year-wise stability score for the original feature set within each of these 10 common families. Additionally, we measure the distribution distances based on the CADE (Yang al. 202Tb) latent features in the test set. This experiment uses 2013 dataset for training and 2014 to 2024 samples serve as test sets.
Feature-Based Stability Evaluation. Figure 6a shows Jaccard similarity- based stability scores across consecutive yearly sample sets for 10 common malware families. Flatter curves indicate stronger temporal consistency, while sharp variations reflect feature drift. Most families such as a rpush, di anjí n, and sms reg exhibit relatively stable trends, suggesting consistent feature
7

---

Published as a conference paper at ICLR 2026
Table 3: This table shows label drift for Android malware samples, highlighting shifts in detection over time. TS: Total # of Malware Samples, Bc: Currently Labeled as Benign, BBc Percentage of Total Malware Samples Currently Labeled as Benign. D Immproved Improved Detection, Dw eakened Weakened Detection, DUnchenged: Unchanged Detection, DS Significant Drop of Detection Count, DS mmpproee:: Detection Count Significantly Increased.
Year
TS
Be
%Bc
Dimproucd
Deeakened
Dunchenged
DSprop
DSIncrease
2013
44383
24
0.05
40436
439
3484
85
34481
2014
45756
345
0.75
37108
1554
6749
863
27239
2016
45134
177
0.39
26963
7485
10509
1160
13581
21359
1108
5.19
7765
10289
2018
39350
1242
3.16
I7561
15346
5201
7304
7600
2019
41585
22
0.05
22905
9294
9364
467
7518
2020
46355
25
0.05
20755
3931
21644
294
8001
2021
35627
23
0.06
10385
4482
20737
176
2531
2022
41648
4
0.01
10445
3629
27570
121
2719
2023
7892
15
0.19
1763
1979
4135
592
416
20244
794
0
0.00
74
319
79
19
0
0.00
2
(a) Stability scores.
(b) lances.
Distribution
(a)
LAMDA.
(b) APIGraph.
Figure 7: SHAP-based explanation drift
Figure 6: Stability and distribution analysis on malware families.
LAMDA and APIGraph datasets.
distributions over time. contrast, families like umpay, fakeapp, and dnot ua display pro- nounced fluctuations, with notable spike around 2017-2018. The especially large peak for umpay signals substantial temporal drift, likely tied to evolving malware behaviors during that period. Over- all, these results show that while many families retain stable characteristics, others undergo signifi- cant shifts, underscoring the importance of dynamic adaptation in detection models.
Latent Space Drift Detection via Distance Metrics. Figure 6b shows the distribution of dis- tances from test samples (2014-2024) to their nearest class centroids across 10 common families, computed the contrastive latent space (Yang et al. (021b). Each test sample encoded using the trained contrastive autoencoder, and Euclidean distances to class centroids are computed and normalized within each class using the Median Absolute Deviation (MAD). A sample is classified as drifted if normalized MAD score (k) exceeds the empirical threshold TMAD = 3.5; other- wise, it is considered non-drifted. This criterion identifies samples that deviate significantly from learned class distributions as drift instances. The resulting boxplots reveal a clear separation between non-drifted (green) and drifted (red) samples across families. Drifted samples consistently exhibit higher distances, with more separation for families such as plankton, umpay, and d an in. In contrast, non-drifted samples cluster tightly around their centroids, indicating intra-family stability. Additional analysis are provided in Appendix C
5.3
TEMPORAL ANALYSIS OF SHAP-BASED EXPLANATION DRIFT
Analysis Setting. Explanation drift happens when the features a malware detector relies on for decisions change over time. To study this in the LAMDA and APIGraph datasets, measure two types of change using SHAP (Lundberg Lee 2017) feature attributions: Jaccard distance, which measures overlap in important features across time, and Kendall distance, which measures ranking consistency. Small distances consistent reasoning, while large Jaccard or low Kendall values indicate shifts in reasoning. We compute SHAP values using Kerne 1 Expl a ner (Lundberg &
8

---

Published as a conference paper at ICLR 2026
Table Comparison of concept drift adaptation methods on LAMDA and APIGraph under different
labeling budgets. Results are reported as mean ssdd.
APIGraph
LAMDA
Budget
Method
FI (96
FNR (%)
FPR (%)
Fl (%)
FNR (%)
FPR (96)
Chen et al.
2023
89,26 1o.31 1..31
15.13
0.51
37.43
93.7912.71
50
Yong
2021b
83.92
19. 19.79
1.0700115
34 34.2021.80
44.00g2.50
$6,80
TRANSCENDEN
Barbero et
38.42+1.82
69.47++1.85
1.65+0.27
32.00+1..00
37.50+2.30
63.70+1.50
Chen
2023
90,701o.15
13.18
0.45
38.50
3,30
93.50 12.00
100
Yang
2021b
87.08 20.64
14.39 1
1.10 10
37.30
37.20
2:200
TRANSCENDEN
Bankkro et
2022
40.17 40.17+1.40
68 16.0344..
1.4200.25
35 35.80+1.55
2X 1.000
70.10+1.66
Chen 43 al. 2023
91.70=0.a8
11,43+0.0 01
0.4400.01
41.00+1.50
2.85-0.22
91.20+=2.90
200
CADE Yang 87 ar
2021b
88.87 2:0
14 14.05
0.74
38.50
31 g0
38.50
TRANSC
42.38 1.300
66.48+1.84
1.1540.21
39.00+1.20
11.3041300
76. 76.30=11.40
Chen 2023
92.39
10.18
0.45+0.02
13,00+1.60
2,50-0.22
89,80=2.110
Tang
89.16+0.53
13.23
0.80
45,40+1.10
59.20+1.50
10:0
TRANS FNDEN Rumsrr et al. 2022
43,97 11:91
65.41
1.
40.011.10
15 15.60
82.80 11
2017) with 100 background and 100 test samples per month. We calculate distances over the top- 1000 features. To make figures easier read, the r-axis in Figure 7a is labeled every three months, covering June 2013-January 2025 (shown from September 20 2013-December 2024). For APIGraph, the period is January 2013-December 2018 with the same labeling scheme (Figure 7b
Lee
Jaccard and Kendall Distance Analysis. Figure 7a shows that LAMDA exhibits consistently high Jaccard distances (around 0.9), indicating substantial variability in relied-upon features over time. sharp dip around September 2017 marks rare period of stability. 'he Kendall distances show a moderate but steady pattern, reinforcing that both the set and ranking of important features fluctuate significantly across time. In contrast, APIGraph (Figure 7b) shows gradual downward trend in both measures, suggesting relatively stable feature importance. Overall, SHAP-based anal- ysis highlights LAMDA's volatility compared to APIGraph, underscoring it's value for studying concept drift, continual learning, and model robustness in dynamic malware detection scenarios.
5.4 LABEL DRIFT ANALYSIS ACROSS YEARS
Analysis Setting. We study how malware sample labels change over time, focusing on where a sample initially classified as malicious based on VirusTotal (VT) consensus is later reclassified as benign in subsequent year, and vice versa. To analyze label drift, we use metadata from both AndroZoo (AZ) and VirusTotal (VT). AndroZoo provides metadata indicating how many VT en- gines flagged an application as malware at given point. We first collected this metadata for year. Then, for the same set of samples, we retrieved updated reports directly from VT in later year. By comparing the two reports, we track how many samples changed their labels over time.
Table summarizes how labels change over time according to VT and AZ. The table reports yearly statistics from 2013 to 2025, including the total number of malware samples (TS) contained in LAMDA for each year. Among these, we report: the number of samples whose labels have changed to benign (Bc); the samples where more VT engines now flag them as malware (Dmmprovst;; the samples where fewer VT engines now flag them as malware (Dweakened): and the samples where the total number of VT detections remains unchanged (Dunchangee). For example, in 2013, among 44,383 malware samples that were initially detected as malicious, 24 are no longer flagged by any VT engine. Of the remaining 40,436 samples, 439 are now flagged by fewer engines, 3, 4,48 show no change, and the rest are flagged by more engines. In addition, some samples show significant drop Dropped) increase (DStucrease) in detection count, with these columns specifically highlighting drastic change (greater than 50%) in detection count.
Results.
6 CONCEPT DRIFT ADAPTATION
In this section, evaluate concept drift adaptation (CDA) using three state-of-the-ar (SOTA) tech- niques: Chen et al. (2023), CADE (Yang et al.) 20216). and TRANSCENDENT (Barbero et al.] 2022), on the LAMDA dataset to highlight the unique adaptation challenges compared to APIGraph

---

Published as a conference paper at ICLR 2026
We adopt the Chen et al. (2023) active learning framework, which operates on monthly cycle with labeling budgets of 50, 100, 200, and 400 samples. In each cycle, a subset of test samples is selected for labeling, after which the model is retrained to mitigate performance degradation.
Results. Table + summarizes the performance of the evaluated methods. Across most labeling
budgets, Chen-AL delivers the strongest results, except at the budget of 400 on LAMDA. Compared to APIGraph, LAMDA introduces substantially more challenging adaptation scenarios. While[Chen et al. 2 consistently outperforms CADE and TRANSCENDENT. all methods fail to generalize effectively LAMDA. For instance, with a labeling budget of 400, Chen et al. (2023) achieves an Fl-score of about 92% on APIGraph, but drops sharply to 43% on LAMDA. Similarly, CADE and TRANSCENDENT achieve only 45% and 40% F1-score, respectively. These findings empirically demonstrate that existing SOTA CDA techniques are insufficient when faced with longitudinal and complex distributional shifts such as those captured by LAMDA, highlighting the need for more advanced CDA approaches capable of adapting to long-term drift.
7 DISCUSSION AND LIMITATION
LAMDA's temporal structure facilitates evaluation of generalization under distributional shift, while its family diversity allows for studying malware evolution and model adaptation with limited data, including transfer and few-shot learning. Beyond these uses, LAMDA is also designed to facilitate continual learning research for both Domain and Class incremental learning (Rahman et al. 2022 Park et al. 2025), with detailed experimental results provided in Appendix
Limitations. While LAMDA provides solid foundation for studying concept drift in malware analysis, we acknowledge a few limitations. First, it relies exclusively on DREBIN (Arp al. 2014) features. Other static features such as control flow graphs and clustered API calls are out of scope of this work. Furthermore, which are observable only at runtime. Second, while previous work suggests a 10:90 malware-to- benign ratio. LAMDA attempts to maintain a 50:50 ratio, which may be viewed as downplaying the role of benign software distributions. However, this design emphasizes family diversity and balanced classes to create a challenging benchmark.
do not perform feature extraction on dynamic behaviors of the APKs
Future Research Direction. We envision the following future to tackle the challenges of concept drift adaptation depicted in this work. Firstly, a dynamic learning approach is needed, where the system can recognize the drifted patterns and adjust itself over time. Along with semi-supervised learning, concept adjustment techniques He et al. (2024) and continual learning Park et al. (2025) can enable the system to detect malware more effectively under continuous and evolving drifts. Sec- ondly, multi-modal representation learning may help models handle drifts more effectively. Finally, techniques that can handle singleton samples and both intra-class and inter-class distribution shifts would be helpful. In addition, methods that can handle both concept drift and label drifts simultane- ously can further improve robustness under the distribution changes observed in LAMDA.
LAMDA Extension. We plan to continue the support for LAMDA and extend this dataset with a focus on multi-modal feature integration. Specifically, we will incorporate not only DREBIN- based static features. but also dynamic sandbox behaviors, control-flow execution characteristics, and enriched intelleeneel feeds.
8 CONCLUSION
In this paper, we present LAMDA, a large-scale, temporally structured Android malware dataset spanning over decade. It enables analysis of how detection performance evolves with shifts in malware behavior and feature distributions. Our evaluations on supervised learning, feature stabil- ity, and explanation analysis demonstrate the impact of these temporal shifts. With broad coverage, diverse families, and static features, LAMDA offers a reproducible benchmark for advancing re- silient and adaptive malware detection systems.
10

---

Published as a conference paper at ICLR 2026
ETHICS STATEMENT
This work does not involve human subjects or personally identifiable information. All Android ap- plications were collected from the publicly available AndroZoo repository and contain no user data. To avoid misuse, we provide only extracted feature representations and associated metadata. As we didn't share live malware, the dataset can be made openly available the research community. We believe the release of LAMDA fully complies with the ICLR Code of Ethics.
REPRODUCIBILITY STATEMENT
We provide comprehensive documentation and scripts to facilitate reproducibility. The dataset is publicly available on Zenodo in both Parquet and NPZ formats, accompanied by detailed metadata, allowing researchers select the format pipelines used in this work are released through an anonymous GitHub repository. which includes clear execution scripts and step-by-step guidelines reproduce the reported results. Importantly, our source code is designed to be flexible, enabling researchers to incorporate new samples into the dataset with minimal effort.
suitable for their needs. All code and experimental
In addition, we include detailed documentation of the dataset construction process, metadata, pre- processing steps, and experimental configurations. Together, these resources ensure that the findings of this paper can be independently verified, reproduced, and extended by the research community.
REFERENCES
Marco Alecci, Pedro Jesús Ruiz Jiménez, Kevin Allix, Tegawendé Bissyandé, and Jacques Klein. AndroZoo: A Retrospective with Glimpse into the Future. In Infernational Conference Mining Software Repositories (MSR), 2024.
Kevin Allix, Tegawendé F Bissyandé, Jacques Klein, and Yves Le Traon. AndroZoo: Collecting Millions of Android Apps for the Research Community. In International Conference Mining Software Repositories (MSR), 2016.
David Alvarez-Melis and Nicolo Fusi. Geometric dataset distances via optimal transport. Advances in Neural Information Processing Systems (NeurIPS), 2020.
Hyrum S Anderson and Phil Roth. EMBER: An open dataset for training static PE malware machine learning models. arXiv:1804.04637. 2018.
Daniel Arp, Michael Spreitzenbarth, Malte Hubner, Hugo Gascon, Konrad Rieck, and CERT Siemens. Drebin: Effective and explainable detection of android malware in your pocket. In Network and Distributed System Security Symposium (NDSS), 2014.
AV-TEST. Malware statistics and trends report.
wttp:::/wwwaavttt....o
stat istics/maaaaaa. wawmmaawware//emm 2025.
Federico Barbero, Feargus Pendlebury, Fabio Pierazzi, and Lorenzo Cavallaro. Transcending Tran- scend: Revisiting malware classification the presence of concept drift. IEEE Symposium on Security and Privacy (S&P), 2022.
Brut. Apktool. https: https://apktool.cog org/ 2025. Accessed: 2025-04-26.
Sen Chen, Minhui Xue, Zhushou Tang, Lihua Xu, and Haojin Zhu. Stormdroid: streaminglized machine learning- -based system for detecting android malware. In ACM ASIA Conference Computer and Communications Security (AsiaCCS), 2016.
Tianqi Chen and Carlos Guestrin. XGBoost: A scalable tree boosting system. ACM SIGKDD International Conference on Knowledge Discovery and Data Mining (KDD), pp. 785-794 2016.
Yizheng Chen, Zhoujie Ding, and David Wagner. Continuous learning for android malware detec- tion. In USENIX Security Symposium, 2023.
11

---

Published as a conference paper at ICLR 2026
Theo Chow, Zeliang Kan, Lorenz Linhardt, Lorenzo Cavallaro. Daniel Arp, and Fabio Pierazzi. Drift forensics of malware classifiers. In ACM Workshop on Artificial Intelligence and Security (AISec), 2023.
Dragos Georgian Corlatescu, Alexandru Dinu, Mihaela Gaman, and Paul Sumedrea. Embersim: A large-scale databank for boosting similarity search in malware analysis. In Advances in Neural Information Processing Systems (NeurIPS) Datasets and Benchmarks Track, 2023.
Matthias De Lange, Rahaf Aljundi, Mare Masana, Sarah Parisot, Xu Jia, Aleš Leonardis, Gregory Slabaugh, and Tinne Tuytelaars. A continual learning survey: Defying forgetting in classification tasks. IEEE transactions on pattern analysis and machine intelligence, 44(7):3366 3385, 2021.
Marius Dragoi, Elena Burceanu, Emanuela Haller, Andrei Manolache, and Florin Brad. Anoshift: A distribution shift benchmark for unsupervised anomaly detection. Advances in Neural Information Processing Systems (NeurIPS), 2022.
Scott Freitas, Rahul Duggal, and Duen Horng Chau. Malnet: large-scale image database of malicious software. In Proceedings of the 31st ACM International Conference Information & Knowledge Management, 2022.
Daniele Ghiani, Daniele Angioni, Angelo Sotgiu, Maura Pintor, Battista Biggio, et al. Understand- ing regression in continual learning for malware detection. In CEUR WORKSHOP PROCEED- INGS, volume 3962. CEUR-WS, 2025.
Andy Greenberg. Android ransomware's evolution is worrying researchers, 2020. URL https: 7/www. w red. cow.///torr//mmrroo-rraaaasssase cessed: 2025-05-06.
worrywwo-r-n-ooooo evoluti on Ac-
Richard Harang and Ethan M. Rudd. Sorel-20m: A large scale benchmark dataset for malicious pe detection, 2020.
Yiling He, Junchi Lei, Zhan Qin, Kui Ren, and Chun Chen. Combating concept drift with explanatory detection and adaptation for android malware classification. arXiv preprint arXiv:2405.04094 2024.
Harold Jeffreys. An invariant form for the prior probability in estimation problems. Proceedings of the Royal Society of London. Series A. Mathematical and Physical Sciences, 186(1007)4433-41,, 1946.
Kaspersky.
Mobile threat report 2024.
htttps:/sseurellis com/
mobile threetttthrtttee report- wepprtt2024//1000 2024/115499 2024. Accessed: 2025-04-18.
Guolin Ke, Qi Meng. Thomas Finley, Taifeng Wang. Wei Chen, Weidong Ma, Qiwei Ye, and Tie- Yan Liu. Lightgbm: A highly efficient gradient boosting decision tree. Advances in neural information processing systems, 30, 2017.
Scout M Lundberg and Su-In Lee. A unified approach interpreting model predictions. In Advances in Neural Information Processing Systems (NeurIPS), 2017.
Enrico Mariconti, Lucky Onwuzurike, Panagiotis Andriotis, Emiliano De Cristofaro, Gordon Ross, and Gianluca Stringhini. MAMADROID: Detecting android malware by building markov chains of behavioral models. In Nenwork and Distributed System Security Symposium (NDSS), 2017.
The Hacker News. New android trojan 'soumnibot' evades detection by obfuscat-
ing manifest file, 2024. URL htttps://thehaceerreww com/2024/04/
new-android-trojarr soumnibet evades html
Accessed: 2025-05-06.
Diane Oyen, Michal Kucer, Nicolas Hengartner, and Har Simrat Singh. Robustness to label noise de- pends on the shape of the noise distribution. Advances in Neural Information Processing Systems, 35:35645-33 -56666666666.... 2022.
Jimin Park, AHyun Ji, Minji Park, Mohammad Saidur Rahman, and Se Eun Oh. MalCL: Leveraging basebased generative replay to combat catastrophic forgetting in malware classification. In AAA/ Conference Artificial Intelligence (AAAT), 2025.
12

---

Published as a conference paper at ICLR 2026
Fabian Pedregosa, Gaël Varoquaux. Alexandre Gramfort, Vincent Michel, Bertrand Thirion, Olivier Grisel, Mathieu Blondel, Peter Prettenhofer, Ron Weiss, Vincent Dubourg, Jake Vanderplas, Alexandre Passos, David Cournapeau, Matthieu Brucher, Matthieu Perrot, and Édouard Duch- esnay. Scikit-lcarn: Machine learning in python. Journal of Machine Learning Research, 12: 2825-2836 2011.
Feargus Pendlebury, Fabio Pierazzi, Roberto Jordaney, Johannes Kinder, and Lorenzo Cavallaro. TESSERACT: Eliminating experimental bias in malware classification across space and time, In USENIX Security Symposium, 2019.
Mohammad Saidur Rahman, Scott E. Coull, and Matthew Wright, On the limitations of continual learning for malware classification. In First Conference on Lifelong Learning Agents (CoLLAs), 2022.
Mohammad Saidur Rahman, Scott Coull, Qi Yu, and Matthew Wright. MADAR: Efficient continual learning for malware analysis with distribution- replay. Conference on Applied Machine Learning in Information Security (CAMLIS), 2025.
David Rolnick, Arun Ahuja, Jonathan Schwarz, Timothy Lillicrap, and Gregory Wayne. Experience replay for continual learning. In Advances in Neural Information Processing Systems (NeurIPS), 2019.
Marcos Sebastián, Richard Rivera, Platon Kotzias, and Juan Caballero. Avelass: A tool for massive malware labeling. In International symposium research in attacks, intrusions, and defenses, pp. 230-253. Springer, 2016.
Silvia Sebastián and Juan Caballero. Avclass2:
Massive malware tag extraction from av labels. In Proceedings of the 36th Annual Computer Security Applications Conference, pp. 42-53, 2020.
Ravid Shwartz-Ziv, Micah Goldblum, Yucen Li, C Bayan Bruss, and Andrew Wilson. Simplify- ing neural network training under class imbalance. Advances in Neural Information Processing Systems (NeurIPS), 2023.
Gido M van de Ven, Tinne Tuytelaars, and Andreas S Tolias. Three types of incremental learning. Nature Machine Intelligence, 2022.
Laurens Van der Maaten and Geoffrey Hinton. Visualizing data using t-SNE. Journal of Machine Learning Research (JMLR), 2008.
VirusTotal. VirusTotal - Stats.
http://wwwwiiruuttttl.lc.oo
2025.
Yunyang Xiong, Zhanpeng Zeng, Rudrasis Chakraborty, Mingxing Tan, Glenn Fung, Yin Li, Vikas Singh, Richard Socher, and Caiming Xiong. Nyströmformer: A nyström- algorithm for approximating self-attention. In Proceedings of the AAAI Conference on Artificial Intelligence (AAAI), volume 35, pp. 14138-14148, 2021.
Ke Xu, Yingjiu Li, Robert Deng, Kai Chen, and Jiayun Xu. Droidevolver: Self-evolving android malware detection system. In JEEE European Symposium on Security and Privacy (EuroS&P), 2019.
Limin Yang, Arridhana Ciptadi, Ihar Laziuk, Ali Ahmadzadeh, and Gang Wang. BODMAS: An open dataset for learning based temporal analysis of PE malware. In IEEE Security and Privacy Workshops (SPW), 2021a.
Limin Yang, Wenbo Guo, Qingying Hao, Arridhana Ciptadi, Ali Ahmadzadeh, Xinyu Xing, and Gang Wang. CADE: Detecting and explaining concept drift samples for security applications. In USENIX Security Symposium, 2021b.
Xiaohan Zhang, Yuan Zhang, Ming Zhong, Daizong Ding, Yinzhi Cao, Yukun Zhang, Mi Zhang, and Min Yang. Enhancing state-of-the-art classifiers with api semantics to detect evolved android malware. In ACM Conference on Computer and Communications Security (CCS), 2020.
Zhihan Zhou, Jiangchao Yao, Feng Hong, Ya Zhang, Bo Han, and Yanfeng Wang. Combating representation learning disparity with geometric harmonization. Advances in Neural Information Processing Systems (NeurIPS), 2023.
13

---

Published as a conference paper at ICLR 2026
OVERVIEW OF APPENDIX
The following appendices provide further information:
1.
A
Dataset Statistics: Year-wise malware/benign counts and family distributions.
2.
B
Feature Description: Overview of all static features extracted from APKs.
3.
C
Additional Analysis of Concept Drift: Visual analysis of concept drift and feature
space stability analysis using OTDD
4.
D Model Architectures and Detail Results: Architectures and extended evaluation on
LAMDA variants.
5.
E Behind the Scenes: Practical Challenges: Technical and operational challenges during
dataset construction.
6.
F Effect of Label Noise Training Data: Impact of different VirusTotal thresholds on labeling.
7.
More analysis Label Drift Across Years: Year-wise analysis of evolving VorusTotal labels.
G
8.
Scalability of LAMDA: Instructions for extending LAMDA with new samples using our codebase.
9.
Continual Learning on LAMDA: Class- and domain Gomain-incremennal learning benchmarks.
10.
Computational Resources: Hardware and runtime configuration for dataset generation.
K Dataset Documentation: Details about dataset documentation, accessibility, and repro-
ducibility.
A DATASET STATISTICS
LAMDA benchmark is constructed from total of 1,008,381 Android APKs, comprising 369,906 malware samples and 638,475 benign samples. Table summarizes the yearly distribution of both malware and benign APKs. To mitigate class imbalance during training, our initial goal to collect approximately 50,000 malware and 50,000 benign samples per year; this target could not be met certain years. Specifically, we were unable to collect sufficient samples for the years 2017, 2021, 2023, 2024, and 2025 due to our labeling criterion-requirig or more for malware- and the limited availability of up-to-date samples in the AndroZoo repos- itory (Allix et a 2016: Aleecii et al.) 2024). Additional constraints, such as corrupted downloads and decompilation failures, further reduced the effective sample count in those years. Despite these limitations, LA LDMDA remains the largest Android malware dataset to date in terms of both total sample count and temporal coverage.
VirusTotal detection count of
Beyond binary labels, LAMDA also includes family-level annotations for malware samples. As shown in Table 6 the dataset spans 1,380 distinct malware families, offering rich diversity for fu- ture analysis. Additionally, 150,604 samples singletons, belonging to families that appear only once in the dataset, representing rare or unique variants. Moreover, 2,985 samples are marked as "unknown". where AVClass2 unable confidently assign family label. Table 7 reports the VotusTotal VirusTootl 2025) detection counts for these unknown-labeled samples, offering insight into their potential threat level even in the absence of a family tag.
This comprehensive summary, encompassing both class labels and family-level information, sup- ports wide range of research directions, including supervised detection, rare variant modeling. family classification, and concept drift analysis across diverse malware behaviors.
B FEATURE DESCRIPTION
Built upon static analysis of Android APKs, LAMDA incorporates broad spectrum of execution- free features based on the features of Drebin (Arp et al. 2014). Table g summarizes the key cat- egories of static features used in LAMDA (Arp al. 2014). These include declared components
14

---

Published as a conference paper at ICLR 2026
Table Year-wise distribution of total, malware, and benign samples.
Year
Total Samples
Malware Samples
Benign Samples
2013
86,431
44,383
42,048
2014
101,183
45,756
55,427
2016
109,193
45,134
64,059
2017
99,144
21,359
77,785
2018
104,292
39,350
64,942
2019
91,050
41,585
49,465
2020
102,073
46,355
55,718
2021
81,155
35,627
45,528
2022
86,416
41,648
44,768
2023
54,354
7,892
46,462
2024
48,427
794
47,633
2025
44,663
23
44,640
Total
1,008,381
369,906
638,475
Table 6: Year-wise breakdown of malware family distributions in LAMDA.
Year
New
Existing
Valid Family
#of Singleton
#of Unknown
2013
213
213
1550
24
2014
91
140
231
2482
345
2016
179
196
375
5861
177
2017
88
119
207
9063
1108
2018
153
220
373
20579
1242
2019
259
376
635
18916
22
2020
141
447
588
30644
2021
43
252
295
30020
23
2022
161
490
651
24927
2023
37
187
224
5922
15
2024
64
626
2025
8
14
Total
1,380
150,604
2,985
Table 7: Distribution of unknown malware samples by VirusTotal detection count.
VT Detection
10
12
Total
Unknown Sample
15 3
2,985
(e.g., services, activities), permissions (requested and used), intent filters, restricted or suspicious API calls, and embedded network indicators such as hardcoded IPs and URLs.
Each APK is converted into binary feature vector using bag-of-tokem representation. Tokens are derived from the presence absence of the static properties listed in Table & Since each applica- tion typically uses only small fraction of the global feature space, the resulting vectors are sparse and high-ddmensioonl.. To address this, we apply different SerianceThreshon
feature selec- tion (Pedregosa et al. (2011) resulting in three dataset variants with different dimensionalities and sizes. Table summarizes these variants. The Baseline variant uses a threshold of 0.001 (Rah- man al. 2025) and yields 4,561 binary features. Increasing the threshold to 0.01 results in smaller, more compressed feature space with 925 features, while lowering it to 0.0001 expands the feature space over 25,000 features.
15

---

Published as a conference paper at ICLR 2026
Table 8: Static Features and Their Descriptions.
Feature
Description
Requested permissions
Permissions declared the manifest (e.g., CAMERA, BLUETOOTH)
indicating intended access to sensitive resources.
Declared activities and services
Registered components of the application, providing insight into its structural and behavioral composition.
Broadcast receivers
Components that handle specific system or custom intents (e.g.. (OOT_COMPLETED), often linked persistence or event-driven behavior.
Hardware components
Device capabilities required by the app (c.g., camera, Bluctooth), implying functional intent.
Intent filters
Define the types of intents components can respond to; critical for modeling potential entry points.
Used permissions
Permissions referenced in the smali code, reflecting actual permis-
sion usage.
Restricted calls
APIS that protected by system permissions grant access sensitive resources.
Suspicious API calls
APIs heuristically associated with malicious or abnormal behavior. Hardcoded network endpoints that may indicate command-ande control (C&C) servers or tracking mechanisms.
Embedded IP addresses
and URL domains
B.1 LAMDA VARIANTS
For the LAMDA dataset variants, we apply different thresholds using the Varriance
(varTh) feature selector. In the baseline configuration (varTh = 0 001), we retain 4,561 features with a total in-memory size 222 MB. For a more relaxed threshold (varTh 0 0.0001), we preserve 25,460 features, resulting in memory size of 554 MB. Conversely, applying stricter threshold (varTh = 01) yields 915 features with a reduced storage size of 138 MB. These information summarized in Table
Table 9: Summary of Dataset Variants by Variance Threshold.
Variant
Threshold
# Metadata
# Binary Features
Size
Baseline
0.001
4561
222MB
var thresh 0.0001
0.0001
25460
554MB
var.thresh.000
0.01
925
138MB
C ADDITIONAL ANALYSIS OF CONCEPT DRIFT
In this section, we provide in detail analysis of LAMDA visualization using t-SNE and feature space stability analysis using Optimal Transport Dataset Distance (OTDD) (Alvarez-Melis & Fusi 2020).
C.I VISUAL ANALYSIS OF CONCEPT DRIFT
To visualize the structural differences these features capture, we present t-SNE projections compar- ing LAMDA and API Graph (Dragoi et al. 2022) in Figure g LAMDA shows more scattered and diverse malware clusters over time, suggesting richer feature representations and stronger concept drift compared to the relatively compact structure API Graph. This diversity, driven by the dy- namic of static tokens such as APIs and permissions, highlights the importance of broad and representative feature sets for modeling evolving malware behavior. Figure [ further validates this hypothesis with varying number of virus total engine detection count.
16

---

Published as a conference paper at ICLR 2026
(a) LAMDA.
(b) API Graph.
Figure 8: I-SNE projection of LAMDA and API Graph dataset, (a) I-SNE project of LAMDA from 2013 to 2025 (excluding 2015) and (b) t-SNE projection of API Graph from 2012 2018
plcblten
eatinne
Gatepn
Gooptell
danch
campay
bocket
Sypaay
OTDD on LAMDA Dataset
Figure 9: Optimal Transport Distance of 60 common families. Each the plots shows the area of nine OTDD scores of 10 groups of 10 families in LAMDA.
C.2 FEATURE SPACE STABILITY ANALYSIS
Optimal Transport Dataset Distance (OTDD) Analysis. Figure 9 and 10 illustrates temporal distributional shifts using Optimal Transport Dataset Distance (OTDD) Allarre-MMlis Fusi, 2020), geometric method for quantifying differences between probability distributions. To as- sess intra-family drift, we partition each malware family in the LAMDA and APIGraph datasets into ten chronological subsets and compute OTDD between consecutive pairs. The results visualized via radar plots, where each axis represents a subset transition. Compact, regular shapes indicate temporal stability, while larger irregular shapes signal drift. Comparing the two datasets, the LAMDA radar plots show both regular and irregular patterns indicating temporal shifts of malware families that causes concept drift. Similar behavior is also observed in the APIGraph dataset for the same families.
D ADDITIONAL EXPERIMENTAL DETAILS
In this section, we summarize the details of the model architectures and the training setup for each method used in our experiments, In addition, we present supplementary results.
D.I DETAILS OF THE BASELINE METHODS
Multi- Perceptron (MLP). The MLP model used for the experiments is adapted from prior work (Rahman et al. 2022 2025) and is composed of four fully connected layers with the following sizes: 1024, 512, 256, and 128. Each hidden layer is followed by batch normalization, ReLU activation, and a dropout layer with dropout rate of 0.5. The final output layer uses a sigmoid activation function for binary classification. The model is trained using Adam optimizer with
17

---

Published as a conference paper at ICLR 2026
aparter
Setar
badea
Faver
OTDD APIGraph Dataset
Figure 10: Optimal Transport Distance of 60 common families. Each of the plots shows the area of nine OTDD scores of 10 groups of 10 families in APIGraph.
learning rate of 0.001, and batch size 512, it stabilizes by this point, avoiding unnecessary GPU time.
LightGBM. In addition to MLP, we also use LightGBM (Ke et al. 2017), gradient-boosted de- cision tree ensemble, for binary classification. LightGBM is trained with up to 5000 estimators and a learning rate of 0.02, with early stopping based on Area Under the Curve (AUC) metric if no improvement observed for 100 rounds. Each tree allowed up to 256 leaves to provide high capacity for learning complex patterns. We apply 80% subsampling of both rows and features to mitigate overfitting. We also include L1 and Le regularization to further penalize methods com- plexity to prevent overfitting. These hyperparameters are selected based practices in malware detection benchmarks such as EMBER (Anderson & Roth 2018) and TESSERACT (Pendlebury et al. 2019).
XGBoost. The adapted XGBoost is configured with tree depth of 12 and a learning rate of 0.05. We use log loss objective for binary classification (Chen & Guestrin 2016 Anderson & Roth 2018). The method trained for up to 3000 boosting rounds and uses the qpu_hist tree construction method to accelerate training. The input data is loaded in XGBoost's s DMatrix format, which is optimized for memory efficiency and fast training. We train the method on the full training data without applying early stopping and evaluate using log loss.
Support Vector Machine (SVM). A linear SVM model is implemented using LinearSVC and calibrated using downstream evaluation where probabilistic thresholds ranking-based metrics are used. Following prior work, the method is trained on the full dataset with a maximum of 10,000 iterations (Chen) 2023). Post-training, model memory usage reported using psutil il to assess resource footprint.
watassiieryy to enable probability outputs. This is essential for
detectBERT. DetectBERT is lightweight transformer-based model designed for malware classi- fication that leverages DexBERT embeddings to learn full app-level representations. projects the input vector into a hidden space using fully connected layer, then prepends a learnable [CLS] token. The resulting sequence is processed by two stacked transformer layers utilizing Nyström- based self-attention (Xiong et al. (021). followed by LayerNorm and classification head applied to the [CLS] J output. The model also supports alternative aggregation strategies such as averaging summation over token embeddings.
VIT. We utilize ViT-based model adapts the Vision Transformer (ViT) framework to malware classification using static feature vectors. Each input sample, represented as flat feature vector, is projected into a hidden-dimense is optionally prepended to the sequence, and positional embeddings are added to all tokens. The resulting token sequence is passed through a stack of seven Transformer encoder blocks, each con- sisting of LayerNorm, multi-head self-attention, and two-layer feed-forward network with GELU activation and residual connections. After encoding, the final hidden state of the [CLS] token (or the feature token if [CLS] is not used) is extracted and passed through classifier composed of LayerNorm and a linear output layer. The model outputs logits over malware families and supports fine-grained malware classification detection.
token via linear embedding layer. A learnable [CLS] token
18

---

Published as a conference paper at ICLR 2026
Table 10: Performance of models across IID, NEAR, and FAR splits for LAMDA on Baseline (VarianceThreshold = 0. 001).
Split
Midel
Accuracy
Precisioa
Recall
F1
ROC AUC
ARA
IPR
ENR
LightIBM
11.34
96.74
98.26
99.55
0.48
MLP
0044
9691
97.50 0.16
0.12
99
2.58
2.50
NGBoout
97.3620.15
0.14
0.36
29620.01
deteceBUKK
05.83.00155
1.12 94.1442242
6.4910000
VIT
05,57=0.00
9583-+00.3
94.97=1..99
08.91
98.61 00.6
4.63-60811
4.17:0773
LightGUM
3.96
90.36 5.21
29.09 30,82
59.48 28.20
14.05 + 25.76
70.18 27.10
188 0.95
50.51 + 30.82
NEAR
SVM
MLP
32.08
3..5
76.12 13.95
72.56 15.35
64.38 28,88
45,155 50.42
$2.91 28.40
$6.57
28.41
82.71 11.19
75.38 17.98
67.94 = 24.59
62.53 29.82
2.79
3.98 a 1.19
55,62 a 28.58
$1.95 30.42
XCHooodd
n..5 3:75
86 18 9.02
16 + 50.94
55 1 29.73
77.75 16.85
68, 14.14-m 26.622655
$3.54 10 10.94
deteceULIIT
84,21-4881
78.61 19.05
50.08.137.55
59.11
73.86.129.77
56,95 1.3,60
4.05 10.84
49.92.57..5
VIT
83.66
73,73 22.28
51.32 39.01
58.77 35.48
1. 32.31
63.97 40.01
48.68 39,01 1,28
LightIBM
a
47.24 27.33
78.04
63.45
0.95
22:97
EAR
MLP
43
$0.99
76.12
73.89
35.09 20:81
41
47.39
$4.94 11.23
79.07 15.06
66.16 34.34
1.14
1:37 0:77
64.40 20,33
XGilonet
$2.60 11:07
70.00 37.26
31,89 20:43
42.75 2:
76.35 16.49
60:35 35.88
1.69 0.55
68.11 20.45
81.79::11.09
66. 06.4490:88.11
35.494420.54
45.01
76.37=223.07
60.56--36..0
3.15:=1.19
64.57=20.54
VIT
81.98.9..4 9.44
63,56 2: 36.55
18.77 4: 22.66
47.03 1: 29.55
78.53 2 20.17
58.77 2: 37.82
4.77 1.20
60.23 4: 22.66
All models are trained on three different LAMDA variants with VarianceThreshoold (VarTh) f0.01, 0.001, 0.0001} where VarTh 0.001 is the baseline. No task-specific tuning or dataset- specific hyperparameter adjustments are performed to ensure fair comparisons across splits and datasets.
D.2 BASELINE PERFORMANCE
We compare LAMDA baseline with API Graph (Zhang al. 2020) dataset and provide a compre- hensive results on four methods discussed above using AnoShift-style (Dragoi et al. 2022) splits. A subset of Table I0 and Table [1] are explained in the main body of the paper. We present the results with more performance metrics.
Across both NEAR and FAR splits, LAMDA consistently exhibits lower scores across all perfor- mance metrics compared to API Graph, and notably higher false negative rates (FNR). These trends clearly indicate that LAMDA captures a significantly higher degree of concept drift. Furthermore, the standard deviation across metrics is substantially higher in LAMDA, especially for drifted years, underscoring the dataset's 's temporal instability detection performance--alle validating the presence of concept drift.
Table 11: Performance of models across IID, NEAR, and FAR splits for API Graph.
Split
Accuracy
Precision
ROC
LightCBM
7:000
95.78 a 0.00
73:44 a 0.00
83.14 0.00
98.93 0.00
94,92 a
0,36 0.00
26.56 ::
IID
SVM
MLP
97.35 00.20
96.04
94.84 2 1.49
94.12 0.00
70.35 0.00
77.79 4 2.35
50.86 0.00
85.43 1.35
97.21 0.00
94,02 0.92
90.90 0.00
59.33 1.75
0.09 0.00
0.47
29.15
22.21 2.85
XCIRoost
00.0
=1.57=0.00
0.00
78.94
95.93 0.00
0.00
0.00
deteciBERT
97.01 1100
98.59 0.00
0.00
9632
11.00
97.40:20.00
91:85=0000
18100.000
86 06.64:20.00
08.65:00000
03.73:1:0.00
0.81:20.00
17.87:0000
LightCIRM
94.54 x
94,07 8.00
51.33 + 0.00
66.42 0.00
96.28 0.00
83.45 0.00
0,36 a 0.00
48.67 01.00
NEAR
MLP
SVM
66.55
1,26
0.37
XGBaodi
92.76 2..06+0..0
77. 0.00
51.12 0.00
92.13 0.00
1:21 0.00
detecBERT
95.24 1. 0.29
90.54 1.04
56.87 1. 0.71
69.05 :: 0.00
91.33 0.45
$2.54 1: 1.20
0.59 1: 0.15
43.13 1. 0.71
VIT
91.73.10.00
76.15_00:00
68, 18.77..00000
72.15.10.00
93.08. 93.08.100000
78,26.10.00
2.1.00.00
$1.23110.00
LightCBM
87.48
FAR
SVM
MLP
94.50
94.33:00.00
T1.38 0.33
50.31 6.28
$6.34 7.27
51.14
63.56 2 5.08
80 6
90.02 2.91
92.73 0.92
71.38
2.446:22.3
1.60 0.20
+.12
45.66 7.27
XGBooM
0.35
75,99 2.62
16.01 1.92
$1.29 1.45
87.78 1.90
66.19 4.30
1.49 0.28
$3.96 :: 1.92
95.35 : I1.53
26,50 1.52
64.33 5.55
73.23 =: 3.6M
96.74 0.17
83.15 4: 1.44
11399 4: 0.15
35.67 3.55
94001:10.71
65.50=1151
71.2916.881
68.47:3994
18.21110.19
73.69:33.33
3.81:10.14
27.2116.811
D.3 LAMDA VARIANTS AND DRIFT SENSITIVITY
LAMDA offers flexibility to researchers for Android malware analysis by supporting different fea- ture selection variants. In this section, evaluate two additional variants of LAMDA. As shown in Table 12 and Table [ we report detailed performance results for the four methods and config- urations used in the primary analysis of concept drift with Vari ance d of 0.001. The
19

---

Published as a conference paper at ICLR 2026
USMOEN
SYM
DYH Defecti051
0.8
Detect IRENT
0.8
6.7
0.7
0.-
01A
Text Year
Text Year
(a) Var ance www.sholerrehhhooooooooooooooo 0.01
(h) Vari wawaaaaneeeheseao 0.0001
Figure 11: Fl-scores on different models on based on AnoShifi-style split on LAMDA. (a) for ParianceThresholo 0.01 and (b) for VarianceTh 0.0001.
Table 12: Performance of models across IID, NEAR, and FAR splits for LAMDA variant of Var TarrianceThreho...e (0.01).
Split
Model
Accurncy
Precisim
Recall
F1
ROC AUC
PR AUC
FPR
FNR
LightGIM
97.08
96.40 0.22
96,55
96.07 0.6
99.22
0.13
2.8::003
385
MLP
99.29
3.18
0.87
05.50 244
24.10
97.86.0.54
17.34
5.90
96.74
9901
0.36
0.45
3.26
LighGGBM
84.17
75:03 = 15.03
54,00 x 27:34
61.38 24.22
73.38 22.25
66.97 27.37
5.56 0.94
#6.00
NEAR
MLP
SVM
33.59
6.:47
54.52
73.64 2 16.21
$3.78 33:07
52.23 26.78
$9.77 24.33
$4.13 24.86
79.17
54.88
14.79
14:32
65,60
S8.73 25.70
06.60::22.33 24.33
17.09 2.87
6,09 1.22
26-23 23.00
43.77 26.7M
XGRiaal
3,56
68.78 20
47 x 27:52
$4.98 26.43
77.52
14:71
62.60 26.30
6.57
$3 27.52
desectSEKC
$2.25 1. 5.19
67.95 = 24.85
54.6 $1.89
59.95 1: 31.61
71.17 1: 10.38
55.08 64.96
63.83
8.79 0.97
45.34 1. $4,89
VIT
$3.91 3: 5.34
75.41 22.66
$1.05 37.34
34.67 59.35
72.45 :: 31.57
39.94
4,87 0.34
48.95 4: 37.34
LighaGBM
24.58
35.65
39.50 23.30
50.13 27.27
60.50 23.10
FAR
77.50
33.97
33.45
23.50
25.83
12.22
21.41
82.84
38.23
24.71
61.53
variant using a threshold of 0.01 exhibits a relatively higher average F1-score across NEAR and FAR splits compared that of the Baseline (0 001) and var.thresh.0 0001 variants. Figure shows this trend as well, highlighting the comparative performance of the LAMDA variants.
To further understand how these feature selection variants influence drift sensitivity, we focus on the NEAR split with the SVM. For false positive rate (FPR), both the baseline and varTh-0. 0001 maintain relatively low values (~4.07 07 + 0.18), whereas varTh-0. 01 shows sharp increase to 17.09 + 2.87. This suggests that reducing the feature set too aggressively may misclassify benign as malware. Conversely, the false negative rate (FNR) slightly improves under varTh=0. 01, decreasing from ~55.62 + 28.88 and 57.772 + 28.87, baseline and varTh=0. 0001, respectively, to 46.22 23.97. This indicates that even with fewer features, the model may still capture certain generalizable malware traits, improving detection of some malicious samples.
However, for the LightGBM model, this change is accompanied by a drop in precision. While in NEAR region both the baseline and varTh-0 0001 variants maintain high precision scores (around 90.36 + 5.21), the varTh-O. 011 variant yields lower precision of 75.03 + 15.03. This reflects shift in the methods decision behavior under more aggressive feature selection, emphasiz- ing the importance of balancing dimensionality reduction with predictive consistency.
In summary, while varTh=0. 01 may occasionally help with generalization under drift, it also amplifies misclassification of benign apps and reduces predictive stability. The baseline and varTh=0. 0001 offer more shift in data distribution.
20

---

Published as a conference paper at ICLR 2026
Table 13: Performance of models across IID, NEAR, and FAR splits for LAMDA variant of Var MarranceThresoooo (0.0001).
Split
Model
Accuracy
Precisio
Recall
F1
ALC
PRAUC
FPR
FNR
LIgHGUM
96,30 0.35
98.11 0
6.23
99.53 0,00
99.54 0.09
MLP
00.2
0.23
2.20 0.25
SVM
=0,2
0.06
0.72
9
XGBoost
00.29
0.53
97.44
99.35 0.10
0.53
95.33
96.74
0.77
1.41
LighIGIM
35955=3911
=0.34 5.75
4 10.74
58,06 28.06
74.58 23,25
70.47 = 26.85
1,70 0.880
51.06 30.74
NEAR
SYM
MLP
60:22:3::8
31.79=3..6
71.61 21.55
00:23 13:36
22.25
89.35
27.83
56.79
51.19 29.64
$1.65
76.15 16.45
13.25
63.54=200 20.13
09
3:1 0:09
4.07 2.118
57.72 28.87
50662
XGBoost
3.45
86.32 6.81
66.56 30.72
20.00228.5 28,54
77.29 19.06
69.61 = 25.51
2.52
53.14 30.72
$4.30=2400 4.09
77:92 # 19.62
56.08
57.46
90.73
54.36
74.34
25.90 60.96
67.51
36.87
4.33 013--:000
40.02 + 57.46
VIT
$1.40 0. 6.49
53:97 + 26 76
S8.13 36.00
60.56 + 52.07
10.96-2231 31.45
$9.47 = 40.55
11:55 0.86
41.87 + 36,00
LighGUIM
$3.96
75.34
15.61
47.02 27,47
77.98
64.21 35.89
1,18
64.38 23,11
FAR
MUP
$1,23 11.94
11.82
13.48 34.34
11.33 16
29.64 17:51
44.05 21.95
60.99 à 23.11
82.52
76944
65.55 35
63.06 32.51
70.36 17.51
16.44
XGBBost
$3.47
35.43
25.75
77.49
63.56
1
20.83
$2.54
38.73
17.34 +:
27.85
57.23
62.66
37.08
30,10
54.58 23.33
E BEHIND THE SCENES: PRACTICAL CHALLENGES IN LAMDA CREATION
E.1 ADMINISTRATIVE CHALLENGES
Downloading large volumes of real-world malware presents significant cybersecurity risks within any institutional environment. During our data collection process, the downloading and unpack- ing of live malware samples triggered internal threat detection systems, automated security tools flagged these activities as potential breaches. To mitigate these risks, we implemented strict con- tainment policies, such as disabling execution permissions. Additionally, we worked closely with the university's ss cybersecurity team to obtain the necessary approvals and ensure compliance with all relevant security policies. We maintained continuous communication with them throughout the process to ensure proper coordination and promptly address any emerging issues.
E.2 TECHNICAL. CHALLENGES
We faced several technical constraints during the sample collection and processing pipeline. The AndroZoo platform imposes strict download rate limits, allowing only 40 concurrent downloads per user. As a result, we had Unfortunately, accidental oversights on our part led to temporary request blocks which disrupted the collection process. Similarly, the Virus API has strict rate limits, which can significantly slow down the retrieval of metadata. Additionally, a considerable number of APKs failed to decompile successfully using Apktool. These failures were often due to obfuscation, corrupted files, or non- standard packaging formats. So, we had to perform multiple rounds of sampling to reach our target number usable samples.
extremely cautious to avoid violating their terms and conditions.
F EFFECT OF LABEL NOISE IN TRAINING DATA
Label noise in Android malware family classification, particularly when using the Drebin (Arp al. 2014) feature set can significantly impact model performance due to ambiguous and overlapping feature representations.
demonstrated recent work (Oyen et al.) 2022), the robustness of clas- sification models depends not only on the amount of label noise but also on its distribution within the feature space. Specifically, feature-dependent label noise, where the prohability of a label flip is contingent the position of sample in feature space, can cause a substantial drop in accuracy, even at low noise levels.
This is especially relevant for Drebin features, where different malware families may share static features like permissions (I1 = INTERNET, .2 = SEND_SMS), API calls (æ3 = getDevica Ic) and hardware access (z4 DEAD_PHONE.STATEE
Samples with minimal or ambiguous patterns (e.g., 25 = ACCESS NETWORK STATE and Ig = RECEIVE BOOT COMPLETED) are likely to fall near decision boundaries, increasing the risk of mislabeling. Such feature-dependent noise is more
21

---

Published as a conference paper at ICLR 2026
Table 14: Effect of thresholding on sample counts and relative percentage change (w.r.t. threshold
4).
Threshold
Benign Samples
Malware Samples
% Change (Benign)
Change (Malware)
638,475
369,906
0.0%
0.0%
638,475
369,906
0.0%
0.0%
638,475
369,906
0.0%
0.0%
638,475
369,906
0.0%
0.0%
638,475
324,927
0.0%
12.16%
638,475
281,824
0.0%
23.81 %
7
638,475
241,690
0.0%
34.666%
638,475
206,644
0.0%
144.144 14%
638,475
177,707
0.0%
4. 51.96%
10
638,475
155,376
0.0%
L 58.00%
11
638,475
138,041
0.0%
62.68%
638,475
123,783
0.0%
66.53%
638,475
111,350
0.0%
69.89%
2000
Year: 2013
Year: 2018
1600
Year: 2012
Year: 2014
Year: 2019
Year: 2013
-B- Year: 2016
Year: 2010
1400
Year: 2024
7000
Year: 2017
Year: 2033
Sample Count
1200
Vear: 2035
2000
Sample
3000
2009
000
3000
200
1000
12
100
12
Figure 12: Sample Count wise for Each VT Detection Threshold.
agg
180
Figure 13: t-SNE visualization of benign and malware samples at varying Virus Total (VT) detection threshold.
detrimental than uniform class-dependent noise and warrants careful consideration in malware classification tasks.
Table 14 shows the effect of increasing the VorusTotal (VT) detection (Virus'Total 2025) threshold on malware labeling in the LAMDA dataset. According to previous studies (Pendlebury et al., 2019 Rahman al. 2022 Yang et al.) 202 sample is considered benign if vt_detection O. and labeled as malware if vt irt_detection 2 4. As seen from the Benign sample column in the Table [4] the number of benign samples remains unchanged across all thresholds, since the benign definition fixed and independent the malware thresholding rule. However, the number of malware samples decreases significantly the threshold increases from 4 to 13. For instance, at
22

---

Published as a conference paper at ICLR 2026
threshold of 10, the number of malware samples drops by 58% compared to the baseline at threshold 4. This trend continues, reaching a 69.89% reduction at threshold 13. These results demonstrate that requiring stronger agreement among antivirus engines (i.e., higher threshold) leads to more conservative malware labeling, effectively excluding a substantial portion of potentially malicious samples. While this may improve the confidence in the labeled malware, it also drastically reduces dataset coverage. Therefore, the choice of VT threshold directly impacts the balance between label precision and data availability, and threshold 4 provides practical trade-off commonly adopted in existing literature (Xu et al. [019 [Pendlebury et al. 2019 Park et al. 2025
Figure 12 illustrates the distribution of malware sample counts across different VirusTotal (VT) threshold VirusTotal 2025) values for each year from 2013 to 2025 (except 2015). The VT count, plotted on the z-axis, represents the number of antivirus (AV) engines that flagged sample as ma- licious, serving as a metric for detection consensus or confidence. A consistent trend is observed across all years- - as the VT threshold increases, the number of flagged samples decreases. This sug- gests that only small fraction of malware samples achieve strong consensus among AV engines, while the majority are detected by relatively few engines. The sample count is highest between VT counts of 5 to 7, especially in earlier years such as 2013-2017, indicating a moderate level of agreement in those periods. In contrast, from 2022 onward, the overall volume of detected samples largely concentrated in the lower VT ranges, which may reflect advancements in malware evasion techniques or shifts in detection criteria. These observa- tions justify the use of a VT threshold. Using higher threshold (c.g., 100) may lead to overly conservative labeling with potential false negatives, while lower thresholds increase coverage but may introduce noise. Thus, this temporal analysis provides critical insight into threshold selection and highlights the evolving nature of malware detection over time.
decreases sharply, and the detections
Figure [3 shows the t-SNE projections across varying VirusTotal (VT) detection VirusTTotal 2025) thresholds. At lower thresholds (e.g., VT 2 4 to 6), there is significant overlap between the mal- ware and benign clusters, indicating that many samples labeled as malware may exhibit similar characteristics to benign samples. This suggests that lower thresholds capture a broader range of potentially ambiguous or borderline malicious behaviors. As the VT detection count increases (c.g., VT > 10), the overlap diminishes, and malware samples become more distinct and spatially sep- arated from benign samples in the embedded space. This indicates that higher-threshe samples possess more distinguishable feature representations, likely reflecting stronger and more consistent malicious behaviors detected by a greater number of antivirus engines. Furthermore, the density of malware samples decreases as the threshold rises, aligning with the observed reduction in malware counts from the dataset.
malware
Table 15: Fl scores of the baseline malware detectors with varying VT thresholds.
Split
Model
VT=4
VT=5
VT=6
VT=7
VT=8
VT=9
VT=10
VT=11
VT=12
VT=13
LightGBM
0.8515
0.8566
0.8148
0.8397
0.8172
0.8511
0.8574
0.8364
0.6889
0.8385
MLP
0.8364
0.8173
0.8166
0.8319
0.8393
0.8102
0.8628
0.7536
0.8623
HID
SVM
0.7898
0.7954
0.7605
0,7543
0.8155
0.7492
0.7598
0,7353
0.6559
0,7462
XGBoost
0,8456
0.8028
0.8298
0.8255
0.8119
0.8370
0.8273
0.7844
0.7324
0.7538
LightGBM
0.2423
0.2008
0.2308
0.1994
0.2470
0.1962
0.1956
0,2178
0.1639
0.2133
NEAR
MI.P
0.1971
0.1894
0.2191
0.2201
0.2123
0.2275
0.2249
0.1771
0,1867
0,2098
SVM
0.1330
0.1512
0.1569
0,1763
0.1971
0.2712
D.1386
0.1381
0,1261
0,1865
XGBoost
0.2221
0.2064
0.2703
0.2788
0.2761
0.1937
0.2788
0.2361
0,2563
0.2241
LightGBM
0.1284
0.1477
0.1559
0.1039
0.0852
0.1562
D.1551
0.0935
0.0511
0.2306
Mİ.P
0.1284
0.2716
0.0918
0.0721
0.1362
0.1873
0.1954
0.0841
0.0912
0.0947
FAR
SVM
0.2393
0.2272
0.1503
0.0655
0.0938
0.1100
0.1222
0.0540
0.0508
0.0706
XGBoost
0.1560
0.3513
0.2926
0.2613
0.1971
0.1787
0.2133
0.1067
0.1385
0.1452
To assess the impact of label noise on malware detection, we conduct set of experiment varying the VirusTotal (VT) labeling Threshold. We first create a set of LAMDA datasets, where in each dataset contain all benign samples and only malware samples with a specific VT labeling count. For example, for the first dataset, we keep all benign samples and those malware samples that were flagged exactly by 4 antivirus engines (VT=4), In the next dataset, we include malware samples with VT=5, and so on, up to VT=13. This resulted in creating ten separate LAMDA dataset variants, each reflecting different level of confidence in the AV engines.
23

---

Published as a conference paper at ICLR 2026
Mode (VTr))
Strre (713))
Poek (rP-ct)
1 2 5
Sears by Medel (07
E1 Scare Moddd (TT33
Stere by Mede Noall
Figure 14: Combined F1 score plots for VT thresholds 4 to 13.
(a)
(c)
Figure 15: Comparison of model performance across VorusTotal detection thresholds for (a) F1-
score, (b) PR-AUC, and (c) ROC-AUC.
Next, We evaluate standard malware detectors (LightGBM, MIP, SVM, and XGBoost) on these datasets using the AnoShift-style splits, which simulate temporal concept drift by training IID split and tested on NEAR and FAR splits. Each malware detector's performance evaluated using F1-score metric.
Table 15 presents performance details of the baseline malware detectors using F1-scores metric with varying VT count. We made the following observations. LightGBM with VT=4, observe F1- score 0,8515 under the IID split, however drops significantly to 0.2423 on NEAR and to 0. 0.1284 on FAR splits. This decline highlights the degradation of malware detector over time.
24

---

Published as a conference paper at ICLR 2026
Androcoo Count
2020
2021
2022
2023
2024
2025
20
40
30
Virustotal Current AV Detection Count
Figure 16: Malware AV detection drift over the years Virustotal vs AndroZoo Metadata. Be: Currently Labeled as Benign, D Improved: Improved Detection, DWeakened: Weakened Detection, DUnchenged Unchanged Detection.
Figure 15 illustrates the average F1, PR-AUC, and ROC-AUC scores of the baseline malware de- tectors with varying VT labeling threshold. While Figure [5a is the summarization Figure [4] subplots (a), (b) and (c) illustrate how performance metrics vary when the VT threshold is set to different values. Across all these three evaluation metries, we observe only minor differences in baseline malware detectors performance. This suggests that, varying the VT labeling threshold has minimal impact on baseline accuracy. This result suggests that the primary causes of performance degradation in main experiments may not be the labeling noise from VT, but rather factors such as temporal concept drift and class imbalance. The observed performance degradation is more likely attributed the distributional shifts time, reinforeing the relevance of concept drift in real-world malware detection scenarios.
G ADDITIONAL VISUALIZATION ON LABEL. DRIFT ACROSS YEARS
Figure 16 illustrates the analysis through visual quantification of label drift across years, using Androozoo metadata and the updated VorusTotal (VT) (Virus Total 2025) report.
H SCALABILITY OF LAMDA
To support long-term use and extensibility, we have designed LAMDA with scalability mind. In the context of LAMDA, scalability refers the extensibility of the dataset-speciffiallly, its ability to be easily expanded with new samples. We have published three variants of LAMDA on the HuggingF ace repository, each supporting different Vari SearianceThreshe The dataset creation process begins by splitting the static feature files (i.e.. dat files extracted from each APK) into stratified train and test splits. From the training split, we collect the global set of all unique tokens (i.e., features), encode both train and test samples into binary vectors in this raw feature space, and apply Var Bancehhe Threehhrehheee reshol 1 d to select nigh-variance features from the training data. The same selected features are then applied to the test data using the saved threshold ob object.
configuration.
We publish the following artifacts to facilitate scalability: raw feature matrices (before thresholding). reduced feature matrices (after thresholding), and the serialized TarianceThreehool object (in joblib format). Using these resources and the accompanying codebase, researchers can seam- lessly extend LAMDA by collecting newer APKs, extracting static features, encoding them, and applying the same thresholding object to map them into LAMDA's 's feature space. While it is not feasible add samples the training set because doing would alter the global vocabulary
25

---

Published as a conference paper at ICLR 2026
and invalidate the original thresholding, researchers add test-time samples for evaluation. This supports drift detection on newer and future malware variants without requiring retraining. Thus, LAMDA enables reproducible research and practical testing of detection models against evolving threats.
CONTINUAL LEARNING ON LAMDA
In real-world settings, large number of new benign and malicious Android applications are intro- duced each year. As result, both benign (e.g., due to changes in user demands, Android APIs, security practices) and malicious (c.g., the emergence of novel malware variants) behaviors evolve over time, leading to concept drift. This makes challenging for static machine learning models to maintain reliable performance over time without retraining regularly. However, complete retraining of past data becomes impractical due the massive volume of Android applications released daily
and the high computational cost associated with retraining. On the other hand, training solely
cent data often leads to catastrophic forgetting (De Lange et al. 2021 Rahman et al. 2022), where previously acquired knowledge is overwritten offers a compelling solution by enabling the detection models to adapt incrementally to new benign and malware applications without the need to retrain with all past data (Park al. 2025 Rahman
lost. In such a situation, continual learning (CL)
et a 2022 Ghiann et al. 20255. However, some CL. techniques may require access to a small subset of past data.
I.1 LAMDA FOR CONTINUAL LEARNING
LAMDA can be natural choice for benchmarking CL due to several key properties of its design and structure:
1. Temporal granularity: It spans over a decade (2013-2025, excluding 2015) with available both monthly and yearly splits, allowing custom CL as per need.
II. Concept drift: As shown in Section 4, LAMDA exhibits significant distributional changes over time, both feature and label space.
III. Flexible task construction:
Domain-IL:: Using yearly data splits while maintaining a consistent malware or be- nign labeling.
Class-IL: Leveraging AVClass2-labeled malware families to incrementally expand the label space.
IV. Real world relevance: LAMDA is derived from real-world Android APKs and VirusTotal reports, introducing authentic drift and noise.
We evaluate CL the LAMDA benchmark using established baselines, Naive (i.e., None) and Joint, inspired by the prior work (Rahman et al. 2022, Ghiani et al., (022).. Additionally, we include Replay (i.e., Experience Replay) (Rolnick based CL method, configured with a buffer size of 200 samples per experience. The Naive baseline trains the model sequentially on each experience or task without any access to past data, while the Joint baseline retrains the model from scratch using the cumulative data observed up to the current experience or task.
2019), ofte-offtheearr memory replay
These baselines are tested under two settings: Domain Incremental Learning (Domain-IL.), which involves binary malware vs benign classification across yearly tasks, and Class Incremental Learning malware families to classify (van de Ven et al.) 2022
(Class-IL), where each task introduces Rahman et al. 2022). Due to the lack of available prior work that can assign a single behavioral label, we didn't consider Task Incremental Learning (Task-IL) in experimental setups.
We define each experience or task in the Domain-IL experiment as all samples (both benign and malicious) collected within specific calendar year (e.g., 2013, 2014, .... 2025). However, for the Class-IL experiments, each experience or task consists of only the malware samples collected during the corresponding year.
26

---

Published as a conference paper at ICLR 2026
1.2 CONTINUAL LEARNING EXPERIMENTAL SETUP
Domain-IL. In this setting, each experience or task corresponds to samples collected during a specific year (i.e., 2013, 2014, ... and so on). The model designed to continuously learn to distinguish between malware and benign samples as the data distribution evolves over time. We use the Basel nn variant of our published dataset, treating each year as a separate task in the learning sequence. The objective is for the model to adapt and maintain accurate binary classification performance despite the temporal distribution shifts.
Class-IL. In this setting, we utilize different dataset derived from the Baseline variant of our published dataset. We selected only those malware families that contained more than 10 samples in the test set, resulting the year 2025 from our experiments, as no family in that split met the minimum sample threshold. Additionally, we omit standard class incremental learning (Park et al. 2025 Rahman et al. 2022). where entirely new classes are introduced in each experience. This approach does not reflect how malware appears in real-world scenarios, malicious samples often come from a mix of previously seen and new families. This claim is supported by the analysis presented in Table 6 The model is expected to learn incrementally to classify samples across all malware families encountered.
total of 154 families for our experiment. Consequently, we excluded
Model Architecture. We use shared base architecture, a multi-layer perceptron (MLP) for both Class-IL and Domain-IL settings, consisting of four hidden layers - 512, 384, 256, 128, with ReLU activation. However, Tasc-specific heads are added to support each learning scenario. For Class-IL, add single linear layer outputting logits for all classes and train with categorical cross-entropy loss. For Dll we use a two-layer MI.P head (100 units each, with dropout p=0.2) and a final sigmoid output, trained with binary cross-entropy. All networks optimized with SGD (learning- rate 0.01, momentum 0.9, weight-decay 0.000001).
Evaluation Metrics. We evaluate classification performance using Fl score, which is the har- monic mean of precision and recall. It provides balanced measure of model's predictions, par- ticularly important in imbalanced datasets. Following the prior work (Ghiani et al. 2025), and compute the F1 score after training the k-th experience using two complementary evaluation modes:
Backward Transfer Performance: We measures the model's ability to retain knowledge from previous tasks. After training on experience k, we compute the F1 scores on all previously seen experiences (S k). This helps quantify the extent of catastrophic forgettng (CF).
Forward Transfer Performance:
We measures the model's ability to generalize to future, unseen tasks. After training on experience n, we compute the Fl score all future experi- ences (> k). This indicates how well the model's current knowledge transfers to upcoming distributions.
I.3 CONTINUAL LEARNING EXPERIMENTAL RESULTS
Figures 18 19 and 20 demonstrate the effectiveness of the CL methods in evaluating in realistic scenarios using LAMDA benchmark. In the Class-IL setting, we observe strong signs of catastrophic forgetting, especially in the Naive and Replay (Experience Replay) strategies. Backward Fl scores drop sharply after certain years, showing that learning new classes without retaining the previous knowledge leads to forgetting. Joint retains high performance as expected due its exposure to all the previous data. In the Domain-IL setting, we observe that forgetting is relatively limited due to the fixed set of classes (malware or benign). Although the data distribution evolves over time, which leads to all strategies experiencing gradual decline in forward F1 scores as they fail to adapt to new distributions. Additionally, we report the average Fl scores of LAMDA across all tasks under the Class-IL and Domain-IL scenarios in Tables 17 and [6] In the Class-IL setting (Table 17). the Joint strategy consistently achieves the highest performance, as expected, due to its access to the full dataset during training. However, this advantage also implies the need for significantly higher computational resources which makes it less practical for weal-world settings. The Naive and Replay strategies perform considerably worse, which was also expected as the continual introduction of
27

---

Published as a conference paper at ICLR 2026
Ststey balry
Bratney
1000
Figure 17: Fl Score in Domain-IL (Forward)
Figure 18: F1 Score Domain-ll. (Backward)
Figure 19: Fl Score in Class-IL (Forward)
Figure 20: Score Class-IL (Backward)
new classes. In contrast, the Domain-IL. results (Table 16) show generally higher and stable F1 scores across all strategies. Since the label space remains fixed over time, both Replay and even the Naive strategy perform reasonably well. This observation suggests that the primary challenge in Domain-IL is not always forgetting, but rather adapting to distributional shifts in the data.
These results highlight LAMDA's ability to capture both key challenges in continual learning: class expansion and distributional shift. As such, LAMDA serves as a realistic and challenging benchmark that supports future research in continual learning.
Table 16: Average Fl scores of Domain IL across all experiences or tasks for LAMDA.
Year
Strategy
Average F1 Score
Year
Strategy
Average F1 Score
Naive
48.86 + 1.15
2020
Naive
80,26 0.27
2013
Joint
46.89 0.33
Joint
83.08 0.13
Replay
46.56 0.00
Replay
79.93
Naive
2021
Joint
57.38 + 1.67
Joint
84 0.
Replay
57.13 1.71
Replay
79,46 0.55
2016
Naive
68.07 + 0.82
2022
Naive
75.86
Joint
69.21 0.78
Joint
85.02 0.03
Replay
68.75 1.20
Replay
7..02.00.52
2017
Naive
0.31
2023
Naive
78.10 1.28
Joint
77.05 1.13
Joint
85.59 0.23
Replay
1.27
Replay
0.77
2018
Naive
76.64
2024
Naive
0.854
Joint
+.015
Joint
87.86 0.
Replay
75.94 1.46
Replay
84.77 4: 0.11
2019
Naive
0.16
2025
Naive
72.71 0.883
Joint
0.47
Joint
88.52.40..0
Replay
79.72 0.09
Replay
4
COMPUTATIONAL RESOURCES FOR LAMDA GENERATION
All dataset processing and experiments for LAMDA were conducted on a high-performance com- pute server with the following configuration:
Dual-socket Intel Xeon Gold 6430 with a total of 128 logical cores (64 phys- ical cores, threads per core).
CPU:
Memory: TB RAM, with approximately 810 GB available during runtime.
28

---

Published as a conference paper at ICLR 2026
Table 17: Average Fl scores of Class-IL across all experiences or tasks for LAMDA.
Year
Strategy
Average Fl Score
Year
Strategy
Average Fl Score
Naive
12.60 0.65
2020
Naive
13.50
2013
Joint
12.89 a 0.37
Joint
68.63 0.67
Replay
12.75 0.48
Replay
52.67 1.34
2021
Joint
28.64 0.49
Joint
72.23 + 0.46
Replay
24.07
Replay
50.21
2016
Naive
32.64
2022
Naive
53.91 0.42
Joint
4.214
Joint
76,98
Replay
$2.60 0.36
Replay
54.74
2017
Naive
19.68 1.12
2023
Naive
38.39 + 1.84
Joint
$1.14
Joint
80.88 0.25
Replay
16,92
Replay
37.65 2.46
Naive
2024
Joint
59.66 0.311
Joint
81.79 0.29
Replay
23.86
Replay
12.49 1.76
2019
Naive
47.98 + 1.71
Joint
65.86 1.20
Replay
44.43 a 0.26
GPU: 4x NVIDIA H100 NVL. GPUs with 95.8 GB memory per GPU. Experiments conducted under CUDA 12. and driver version 570.124.06,
This infrastructure enabled us to efficiently process over 1 million APKs, large-scale temporal benchmarking over 12 years of Android malware data.
K
DATASET DOCUMENTATION
K.1
HOSTED URLs
DOL
http:s//poo..orr//133777///////3
Hugging Face.
Croissant. isaissant
GitHub Code Access.
httpss//gthaaa.cmm//06c/1/////
Project Page.
K.2
DATASET CURATION AND PREPROCESSING METHODOLOGY
Dataset Construction: corpus of over one million Android Package Kits (APKs), span- ning the years 2013 to 2025 with the exclusion of 2015, is compiled from the AndroZoo repository Allix al. (2016) Alecci al. (2024). A 20% overhead hases included the downloading process to account for download and decompilation failures. The collected APKs are systematically organized into year-specific directories, with subdirectories desig- nated for malware [[year] /ma wawre/) / and benign applications ([year] /beni gn/).
Label Assignment: Binary classification labels is assigned based on the output of Virus-
Total (VT) analysis reported in the AndroZoo repository Allix et al. (2016): Alecci et al.
(2024)
Benign: vt_detection =
Malware: vt.detection 2 4
Uncertain: detection [1,3] (discarded)
29

---

Published as a conference paper at ICLR 2026
Malware Family Labeling: AVClass2 Sebastián et al. (2016) is used to standardize mal-
ware family labels using VirusTotal reports. Labels are linked to APKs using SHA256 hashes to support multi-class and temporal malware analysis.
Static Feature Extraction based on Drebin: Each APK is decompiled using
apktool Brut (2025) extract static features:
xml: permissions, components (activities, services, re- ceivers), hardware features, intent filters
From AndroidManiieneo
From small i code: restricted/suspicious API calls, hardcoded URLs/IPs
Vectorization & Preprocessing: Extracted features are vectorized into high-dimensional
binary vectors using a bag-of-tokens approach. global vocabulary (~9.69M tokens) was constructed. Dimensionality was reduced using Variance (threshold 0.001), resulting in 4,561 final features.
Data Splitting: Each year's data is split using stratified sampling:
Training: 80%
Testing: 20%
Class balance maintained within each split.
Storage & Format: Final dataset is saved in both npz (sparse matrix) and parquet (tabular) formats. Each year's 's folder includes:
Dazain.parquer
- X.ttet. parquet
Metadata columns include: hash, label, family, vt count, year month, followed by binary features.
Scalability Support: We have released global vocabulary, selected features, and prepro- cessing objects (e.g., VarianceThreeholdd enable integration with ML pipelines, including Hugging Face.
K.3 ACCESSIBILITY AND REPRODUCIBILITY
The dataset has been made publicly available on Hugging Face at attttps:/ htw.//gggggggge.././// co/ datasets/IQSee Lttp//ISeecC-aa Lab/ LAMDA, and has been assigned a permanent Digital Object Identifier
stttps://doi.org/110 wrt.ooggg//.... 57967 57567 Furthermore, dedicated GitHub project page has been created https: : /eisssccllala lab github.thh....o 1o/ LAMDA/] which includes de- tailed instructions and code to reproduce the reported results.
We committed the long-term preservation of our dataset through regular checks aimed identifying and rectifying any data anomalies. Moreover, we are dedicated to the continuous main- tenance this resource by promptly addressing user inquiries and issues, and by releasing updates and enhancements informed by user feedback.
30


Reviews:
[{"review_id": "Rl00hXFOxB", "reviewer": "Reviewer_x7WH", "summary": "The authors introduce LAMDA, a temporally diverse dataset meticulously crafted to tackle the challenges of concept drift in Android malware detection. This benchmark spans 12 years and includes over 1 million samples. Additionally, the authors assess state-of-the-art concept drift adaptation methods, revealing their limitations when applied to LAMDA. This highlights the urgent need for more robust approaches in the field.", "questions": "1. It is suggested  to conduct a tabular comparison of the existing data to display information such as the number of malware samples, family types, and distribution over the years. This will clarify the innovative aspects of this study.\n\n2. Has the data been deduplicated? Given that many malware samples exhibit identical features at the characteristic level (even if their hash codes differ), it is crucial to know if any deduplication efforts have been made to ensure diversity in software feature.\n\n3. Please provide feasible research directions for future concept drift adaptation work based on the results of your dataset collection. For instance, does the dataset exhibit characteristics that differ from other datasets, making concept drift adaptation more challenging? While it is still recommended to continuously expand the dataset, simply increasing the amount of data is not sufficient for innovation. It is also necessary to introduce fresh perspectives and methodologies.\n\n4. I am particularly curious about the decision to submit this work to ICLR instead of a conference or journal focused on software engineering or security.", "limitations": "", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "The paper is well-organized.\nThe research topic is significant.\nThe experiments are sufficient.", "weaknesses": "It lacks a clear comparison with relevant datasets.\nIt lacks specific guidance for future work.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "Fjq9eZVT0U", "reviewer": "Reviewer_GAMZ", "summary": "The authors present LAMDA, a malware dataset that spans 12 years and therefore is aimed at capturing classifier drop in performance due to representational drift.", "questions": "In Figure (2) for LAMDA, could the authors explain why there is a large performance drop in 2017 and 2018?\n\nDrebin-style features are rather old (from 2014), could the authors support the choice for this feature set? \n\nIn Table 4 in the appendix, it seems like there are extremely low malware samples from 2023-2025 compared to the train set. This seems to coincide in Figure (2) LAMDA with a very big performance drop. I wonder if the authors have any comments on this? It seems strange to keep especially the years of 2024 and 2025 given the huge class imbalance.", "limitations": "", "rating": 6, "confidence": 2, "soundness": 2, "presentation": 2, "contribution": 2, "strengths": "This work is in an area that is now not near my current area of research, thus my lower confidence score.\n\nThe dataset is large and to the best of my knowledge the longest longitudinal malware dataset collected to date. The analysis is very thorough.", "weaknesses": "See questions", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "o4PARaru0S", "reviewer": "Reviewer_dzpd", "summary": "This paper introduces LAMDA, a large-scale Android malware dataset spanning 12 years (2013–2025, excluding 2015) with over 1 million APK samples, designed specifically to study concept drift in malware detection. The dataset comprises approximately 37% malware samples across 1,380 families and includes static Drebin features. The authors empirically demonstrate performance degradation of standard ML models over time and analyze feature stability, providing a temporal benchmark substantially larger and more diverse than existing datasets. The paper includes comprehensive drift analysis using multiple techniques including Jeffreys divergence, t-SNE visualization, SHAP-based explanations, and label drift analysis.", "questions": "Collection Procedure and Label Stability: During dataset construction, were APKs scanned once or multiple times on VirusTotal? If repeated scans occurred, how were temporal discrepancies in detection counts handled—by selecting the earliest, latest, or majority label? Clarifying this would help assess label stability across the 12-year span. \n \nIntra-Sample Temporal Drift: Has the team examined how features or VirusTotal labels for the same APK hash change across years? This could quantify intra-sample drift and distinguish it from population-level concept drift. \n \nDynamic and Hybrid Features: Given the exclusive use of static Drebin features, do the authors plan to include dynamic runtime features (e.g., API invocation traces, network behaviors) or hybrid representations in future LAMDA versions? This would enrich longitudinal analysis and reflect real-world adaptive threats. \n \nTemporal Label Validation: Considering that VirusTotal engines evolve over time, did the authors fix specific engine versions or cross-engine consensus thresholds to mitigate version-induced label drift?", "limitations": "", "rating": 8, "confidence": 5, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "\tScale and Temporal Scope: Over 1 million samples across 12 years with 1,380 families and 150K singleton samples provide unprecedented temporal coverage and diversity for Android malware research. This addresses a genuine gap in existing datasets. \n\tComprehensive Drift Analysis: The multi-faceted approach (supervised learning degradation, feature distribution shifts via Jeffreys divergence, feature stability scores, SHAP-based explanation drift, label drift) provides rich evidence for concept drift. The integration of multiple complementary methods strengthens the analysis. \n\tReproducibility and Scalability: Publication of feature matrices, variance threshold objects, and code supports reproducibility. The design enables extensibility to new samples, which is valuable for long-term use. \n\tRigorous Experimental Validation: The comparison between LAMDA and APIGraph on identical evaluation protocols effectively demonstrates that LAMDA exhibits stronger, more realistic drift. High standard deviations in LAMDA results versus APIGraph's stability support the claim of pronounced drift.", "weaknesses": "Unclear Scan Consistency： The paper does not specify whether VirusTotal labels were obtained from single-pass or repeated scans. Since detection outcomes can vary across rescans, this ambiguity may introduce label inconsistency. \n \nLack of Intra-Sample Drift Analysis： The study analyzes global and family-level drift but does not consider intra-sample temporal variation—how the same APK’s features might change across time. Such analysis could better capture longitudinal behavior shifts. \n \nStatic Feature Limitation： LAMDA focuses exclusively on Drebin-style static features. While this ensures comparability, it may overlook runtime or dynamic behaviors that evolve differently, slightly limiting ecological completeness.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Poster)