Use case sources
Source reports and analysis supporting this case are listed below. AITBM interpretation and any indicative scoring are derived from this public evidence.
Researchers at Skylight were able to create a universal bypass string that evades detection by Cylance's AI Malware detector when appended to a malicious file.
ASSESSED SYSTEM
The AI malware-detection component of CylancePROTECT and Cylance Smart Antivirus in the state Skylight Cyber tested in 2019: a locally installed detector whose decision is composed from a core ML model and a secondary reputation-scoring model whose positive assessments override the core model's verdict, with a verbose logging mode, enabled by the researchers on their own installation, that exposes reputation scoring and model ensembling internals.
OUT OF SCOPE
Skylight Cyber's analysis tooling and the adversarial malware it produced (attacker tooling); Cylance's non-ML detection layers, cloud services and management console, none of which the record describes; any later Cylance or BlackBerry product release or remediation, which the record does not document; and any named victim, since no in-the-wild use of the bypass is recorded.
Architecture: Traditional ML / Classifier (decision tree Q6) — The decision tree resolves at Q6 by elimination. Q1 = NO (no coordinating agents). Q2 = NO (no planner, goal or task state; the model returns a verdict for each input). Q3 = NO (the model invokes no function, API, plugin or MCP tool). Q4 = NO (no inference-time retrieval layer). Q5 = NO (no generative interface; the output is a classification score or verdict). What is described is a file-scoring malware classifier ensemble (core model plus reputation override model) embedded in an endpoint product, so classifier intra-axis weights apply. Cn-5, Cn-6 and Cn-7 are left applicable and UNKNOWN rather than NOT APPLICABLE because the product acts autonomously on its verdicts and the record does not describe that action space. Tier 2: Tier 2 Consumer: Cylance Smart Antivirus is a consumer product and CylancePROTECT an endpoint product; the detector decides whether files on individual users' machines are treated as malicious, so a bypass exposes individuals to malware execution. It is not Tier 1 because the record establishes no immediate physical, financial or societal harm at scale, and not Tier 3 because the input population is not controlled internal users.
Documented attack or failure path
- Researchers studied public material about Cylance's AI malware detector, including public talks and Cylance patent submissions.
- They obtained the AI-enabled detection software and operated it locally, giving unlimited offline access to the detector.
- They enabled verbose logging, which exposed the model's reputation scoring and model ensembling internals.
- From the logged reputation scores they reverse-engineered which file attributes carried positive or negative reputation, and discovered a secondary model whose positive assessments override the core ML model's decision.
- They fused attributes of known-good files into malware, producing a universal bypass that, appended to a malicious file, drove the override model to a positive assessment.
- The secondary model overrode the core model and the adversarial malware evaded the AI detector.
Observed controls and bounded outcomes
Positive credit is given only where the record directly demonstrates a control operating. Recommended or merely presumed controls receive no positive scoring credit.
- The record does not show the core ML model itself being defeated: the bypass depended on the secondary reputation model overriding the core model's verdict, so the core model's decision on the unmodified malware was not the failure point.
Layer 1 — Intrinsic Vulnerability Profile
Each sub-metric is placed on its five-level rubric by the evidence quoted beside it. Missing applicable evidence remains unknown. The displayed midpoint and interval are scenario values, not inferred control performance.
| Sub-metric | Score | Rubric basis | Evidence |
|---|---|---|---|
| Robustness (Ro) — scenario interval 0.08–0.76 (midpoint 0.42), Tier 2 MVT 0.50 indeterminate | |||
| Ro-1Adversarial Input Resistance | 0.25w 0.32 | Ro-1 = 0.25: detection resisted the unmodified (naive) malware, since the bypass needed a crafted perturbation, but it failed under a moderate, reusable perturbation. 'Universal' places the attack success rate well above the 50% bound, so the 0.50 anchor (ASR below 50%, common attacks resisted) is not met. Not placed at 0.00 because the record publishes no success-rate measurement establishing failure above 80%; placement is from the qualitative criterion. | Skylight Cyber produced a universal bypass string that evades the Cylance AI malware detector when appended to a malicious file. The perturbation is a crafted addition of known-good file attributes, derived from reputation information the product itself logged, and it succeeded because the secondary reputation model's positive assessment overrode the core model.source: secureflow/atlas |
| Fairness (Fa) NOT APPLICABLE — axis-level applicability rule (Person-Outcome Surface test): The assessed system is a malware-detection classifier whose outputs are benign/malicious verdicts on executable files; it allocates, denies, ranks or describes no natural person and no protected-class attribute or proxy is present in the file-attribute inputs that drive the verdict. Its tier weight is redistributed across the remaining axes and its MVT is not evaluated. | |||
| Transparency (Tr) — scenario interval 0.00–1.00 (midpoint 0.50), Tier 2 MVT 0.50 indeterminate | |||
| Privacy (Pr) — scenario interval 0.00–1.00 (midpoint 0.50), Tier 2 MVT 0.55 indeterminate | |||
| Containment (Cn) — scenario interval 0.00–0.73 (midpoint 0.36), Tier 2 MVT 0.55 indeterminate | |||
| Cn-4Side-Channel Resistance | 0.00w 0.27 | Cn-4 = 0.00: the anchor condition is met literally, as a log channel revealed model information (decision internals and ensemble structure) to an unprivileged adversary holding the product. The 0.25 anchor requires basic protection with residual exploitable channels; no redaction, access restriction or other protection on the logging channel is evidenced. | Verbose logging, enabled by the researchers on their own installation, exposed the inner workings of the ML model, specifically reputation scoring and model ensembling. That logged information was sufficient to reverse-engineer attribute reputations and to discover the override model on which the bypass was built.source: secureflow/atlas |
Unknown, not N/A: 18 applicable sub-metrics lack admissible public evidence. The lower, midpoint, and upper scenarios evaluate each at 0.00, 0.50, and 1.00 respectively; no weight is redistributed merely because evidence is missing.
Architecture-based NOT APPLICABLE: NOT APPLICABLE by design for this architecture class: Cn-8, Cn-9; excluded with the Fairness axis.
Layer 2 — Operational Risk Posture
| Dimension | Score | Justification |
|---|---|---|
| AaAutonomy Amplification | 0.50w 0.25 | Human-on-the-loop. The detector issues malware verdicts on files without per-file human review, which is routine autonomous action within the product's pre-defined boundary; the record documents no broader decision authority, tool use or transaction capability that would support the 0.75 or 1.00 anchors. |
| AsAttack Surface Exposure | 0.85w 0.35 | Documented intermediate above the 0.75 anchor. The detector's entire input is files of arbitrary origin, which are wholly attacker-controllable rather than the anchor's 'partially trusted' external data, and the adversary can obtain the product and query it offline without limit, as the researchers did. It is below 1.00 because no untrusted RAG, external agent channel or MCP tool integration exists. elevated |
| CpCascade Potential | 1.00w 0.20 | No System Dependency Graph is published for the assessed product, so the DGC gate is not met and the Section 3.2 worst-case default applies. The evidence records the detection bypass itself but no observed downstream path, so the default is not independently corroborated.GDCP: worst-case default — no verified dependency graph published elevated |
| RfRemediation Feasibility | 0.50w 0.20 | The 0.50 anchor. Closing the bypass requires changing how the reputation override model is trained and how its verdict is composed with the core model, i.e. retraining or re-engineering the model ensemble with probabilistic effectiveness and re-evaluation. Restricting the verbose log channel is a deterministic configuration change, but it removes only the reconnaissance aid, not the evasion. |
Nelevated = 2 (dimensions strictly above 0.75) → CRM = 1.15.
Compound Risk Alert. Two or more dimensions are simultaneously elevated (spec 3.2.2); architectural decomposition is recommended before deployment.
Layer 3 — Public-evidence confidence diagnostic
| Component | Score | Basis |
|---|---|---|
| Pc — Public provenance evidence | 0.25 | At the 0.25 anchor. Product names and vendor are documented, and public talks and patent submissions describe the detector at a high level, but no AIBOM, training-data lineage, deployment inventory or cryptographic evidence exists for the assessed configuration. |
| Ec — Public evaluation coverage | 0.09 | coverage 0.10 (2 of 20 applicable sub-metrics) × independence 1.00 × fidelity 0.85. No Full, Standard, or Lite pathway is claimed for a retrospective article. |
| Tf — Public-evidence freshness | 0.00 | Evidence dated 2019-07-18; age 2649 days on the workpaper reference date. Components: T_calendar 0.00 · C_monitor 0.65 · C_event 0.65 · C_evidence 0.85. Binding term: T_calendar. evidence_date 2019-07-18 is the date carried in the permalink of Skylight Cyber's primary disclosure, which predates the ATLAS incident date of 2019-09-07; dt_days = 2649, measured from originating evidence to the 2026-10-18 evidence reference date, so the calendar term dominates. C_monitor 0.65: the bypass was found by external researchers and no vendor-side detection of the adversarial samples is evidenced. C_event 0.65: a working, publicly disclosed bypass of the shipping detector is a moderate event; no in-the-wild exploitation is recorded. C_evidence 0.85: the record documents no remediation or retest. agentic = false and baw = false: the classifier has no runtime-mutable permission boundary and the record shows no online learning or persistent behavioural state. |
Public-evidence ACI = (Pc × Ec × Tf)1/3 = 0.00 — diagnostic status: Invalid as assessment-of-record evidence. It describes the evidence available to this case study, not the assurance of the underlying system, and is not inserted into the normalized-assurance scenario ERS.
Indicative ERS — normalized-assurance scenario
Published CVSS beside indicative ERS
Each published CVSS record is shown exactly as its scorer published it, one per vulnerability record, with the version, metric group and vector when stated, plus its source and access date. Records are never combined or inferred from a CVE's existence.
INDICATIVE ERS · NORMALIZED-ASSURANCE SCENARIO
5.1 midpoint, interval 2.1–8.1; Moderate scenario band; ACI fixed at 1.00. The published CVSS records do not enter this calculation.
PUBLISHED CVSS
CVSS — no applicable published score verified.
CVSS describes an individual vulnerability as its scorer published it. Indicative ERS describes the assessed AI deployment under the normalized-assurance scenario, so the two values are not direct equivalents and neither replaces the other.
AIDEFEND defences → AITBM sub-metrics
Identifiers are quoted as they appear on the AIDEFEND in Action brief or in the AIDEFEND SecureFlow defense map (audited AIDEFEND dataVersion 2026.10.15); the sub-metric mapping is AITBM's own, from the specification's AIDEFEND tables reconciled at catalogue data version 2026.10.15. AIDEFEND renumbers identifiers between releases, so the data version travels with every mapping and neither side's IDs should be cited without one. A mapping identifies a possible evidence route; a recommendation does not prove that the control was implemented or effective and receives no scoring credit by itself.
| Technique | Defence | Priority | Evidences |
|---|---|---|---|
| AID-H-032.003 | Inference Telemetry & Debug Surface RestrictionExact SecureFlow defense-map identifier (flow atlas-aml-cs0003-bypassing-cylance-ai-malware-detection), verified against AIDEFEND dataVersion 2026.10.15; matched to attack steps step-3, step-4. Presence supplies no score credit. | Candidate evidence route | Pr-2 Pr-4 Cn-4 |
| AID-H-004.001 | User & Privileged Access ManagementExact SecureFlow defense-map identifier (flow atlas-aml-cs0003-bypassing-cylance-ai-malware-detection), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-3. Presence supplies no score credit. | Candidate evidence route | Tr-3 Cn-5 |
| AID-D-005.001 | AI System Log Generation & CollectionExact SecureFlow defense-map identifier (flow atlas-aml-cs0003-bypassing-cylance-ai-malware-detection), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-3. Presence supplies no score credit. | Candidate evidence route | Tr-3 Cn-7 |
| AID-M-003.002 | General Predictive Performance & Operational BaseliningExact SecureFlow defense-map identifier (flow atlas-aml-cs0003-bypassing-cylance-ai-malware-detection), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-6. Presence supplies no score credit. | Candidate evidence route | Ro-2 Fa-2 Fa-4 Tr-1 Tr-2 |
| AID-H-014 | Ensemble Methods for RobustnessExact SecureFlow defense-map identifier (flow atlas-aml-cs0003-bypassing-cylance-ai-malware-detection), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-6. Presence supplies no score credit. | Candidate evidence route | Ro-1 Ro-2 |
| AID-D-002.002 | Labeled Performance Tracking with Ground Truth Feedback LoopExact SecureFlow defense-map identifier (flow atlas-aml-cs0003-bypassing-cylance-ai-malware-detection), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-6. Presence supplies no score credit. | Candidate evidence route | Ro-2 Fa-1 Fa-2 Tr-2 Cn-7 |
| AID-D-005.003 | Proactive AI Threat HuntingExact SecureFlow defense-map identifier (flow atlas-aml-cs0003-bypassing-cylance-ai-malware-detection), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-6. Presence supplies no score credit. | Candidate evidence route | Tr-3 Cn-7 |
| AID-H-007.004 | Evaluation Data Integrity, Sufficiency Assurance & Promotion GovernanceExact SecureFlow defense-map identifier (flow atlas-aml-cs0003-bypassing-cylance-ai-malware-detection), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-6. Presence supplies no score credit. | Candidate evidence route | Ro-4 |
| AID-R-001.002 | Model Retraining for RemediationExact SecureFlow defense-map identifier (flow atlas-aml-cs0003-bypassing-cylance-ai-malware-detection), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-6. Presence supplies no score credit. | Candidate evidence route | Ro-4 |
WHAT THIS CASE TEACHES
An ensemble whose secondary reputation model can override the primary classifier inherits the weaker model's robustness, and a log channel that exposes decision internals turns that weakness into a universal bypass: Ro-1 and Cn-4 carry the evidence while every other sub-metric stays UNKNOWN.
Sources: AIDEFEND SecureFlow — Bypassing Cylance's AI Malware Detection · MITRE ATLAS case study AML.CS0003 · Skylight Cyber Blog Post, "Cylance, I Kill You!" (skylightcyber.com) · Statements from Skylight Cyber CEO (security7.net)
SecureFlow attack flow
This record mirrors an AIDEFEND SecureFlow flow (MITRE ATLAS case-study conversion): an ordered attack path with MITRE ATLAS tactic and technique labels and the AIDEFEND controls matched to each step. The scenario above places only the control outcomes this flow and its primary references observed; the matched AIDEFEND controls are evidence routes and earn no score credit.
| MITRE ATLAS case study | AML.CS0003 (exercise) |
|---|---|
| Target | CylancePROTECT, Cylance Smart Antivirus |
| Actor | Skylight Cyber |
| Primary evidence date | 2019-09-07 |
| SecureFlow record updated | 2026-08-02 |
| AI layers | Predictive ML / computer vision |
| Risk impact | Model evasion / bypass |
| Affected components | CylancePROTECT, Cylance Smart Antivirus, AI malware detector, verbose model logs, reputation scoring and override model |
Attack steps
| # | Step | ATLAS tactic / technique |
|---|---|---|
| 1 | Study Public Cylance MaterialsThe researchers read publicly available information about Cylance's AI Malware detector. They gathered this information from various sources such as public talks as well as patent submissions by Cylance. | AML.TA0002 AML.T0000 |
| 2 | Access Cylance Malware DetectorThe researchers had access to Cylance's AI-enabled malware detection software. | AML.TA0000 AML.T0047 |
| 3 | Enable Verbose Model LoggingThe researchers enabled verbose logging, which exposes the inner workings of the ML model, specifically around reputation scoring and model ensembling. | AML.TA0008 AML.T0063 |
| 4 | Reverse Engineer Reputation OverrideThe researchers used the reputation scoring information to reverse engineer which attributes provided what level of positive or negative reputation. Along the way, they discovered a secondary model which was an override for the first model. Positive assessments from the second model overrode the decision of the core ML model. | AML.TA0003 AML.T0017.000 |
| 5 | Fuse Goodware Attributes into MalwareUsing this knowledge, the researchers fused attributes of known good files with malware to manually create adversarial malware. | AML.TA0001 AML.T0043.003 |
| 6 | Bypass Cylance AI Malware DetectionDue to the secondary model overriding the primary, the researchers were effectively able to bypass the ML model. | AML.TA0007 AML.T0015 |
Threat references
Summary and attack steps reproduced from AIDEFEND SecureFlow (https://aidefendlabs.com/en/secureflow/?flow=atlas-aml-cs0003-bypassing-cylance-ai-malware-detection; AIDEFEND content CC BY 4.0), converted from MITRE ATLAS case study AML.CS0003 (Apache License 2.0; MITRE ATLAS is a trademark of The MITRE Corporation).