Two-Stage Detect-Then-Classify Pipeline with DSAR-CNN for Robust Fragment Classification Under Padding and Bit-Flip Attacks
TL;DR
A novel two-stage detection-based defense framework tailored for file fragment classification that mitigates the accuracy-robustness trade-off commonly associated with adversarial training is presented, providing an approach for improving the robustness of forensic classification systems against byte-level adversarial attacks such as padding and bit-flipping.
Abstract
File fragment classification is fundamental to digital forensics and network security, enabling the recovery and identification of files when metadata is corrupted or absent. While state-of-the-art deep learning models on the FFT-75 benchmark achieve 65–79% accuracy on clean fragments, they exhibit vulnerability to byte-level adversarial perturbations, and evaluation across 39 byte-level attack variants shows that the baseline accuracy drops from 71.1% on clean fragments to an average of 15.8% under adversarial perturbations. This paper presents a novel two-stage detection-based defense framework tailored for file fragment classification that mitigates the accuracy-robustness trade-off commonly associated with adversarial training. The framework integrates three components: (1) an attention-based adversarial detector achieving 95.46% specificity and 91.34% recall (91.44% overall accuracy); (2) an existing baseline file fragment classifier preserving 71.1% accuracy on clean fragments; and (3) a novel Dual-Scale Attention-based Robust CNN (DSAR-CNN) specifically designed for adversarial fragment classification, achieving 68.4% accuracy on adversarially perturbed samples (evaluated on the test set of 4.6M fragments) through multi-scale depth wise separable convolution, CBAM-style dual attention, learnable position embeddings, and split global pooling. Developed and evaluated across 75 file types and 39 attack variants from the FFT-75 benchmark, the complete pipeline achieves 70.91% accuracy on clean data (0.19 percentage point penalty) and 63.84% on adversarial data, yielding 70.20% accuracy in realistic mixed-threat scenarios (90% clean, 10% adversarial) - outperforming both the undefended baseline and the standard adversarial training benchmark. The framework provides an approach for improving the robustness of forensic classification systems against byte-level adversarial attacks such as padding and bit-flipping.