PhilaeX: Explaining the Failure and Success of AI Models in Malware Detection

Explainability is critical for high-stakes AI decisions: The paper emphasizes that in cybersecurity applications like malware detection, AI models must explain their predictions because incorrect decisions can cause severe damage to critical assets and potentially endanger lives—making transparency non-negotiable rather than optional.

Most AI security tools lack explanation capabilities: Despite strong performance metrics, existing malware detection models typically cannot explain why they flagged something as malicious, creating a trust and accountability gap that PhilaeX aims to address.

PhilaeX outperforms existing explanation methods: The proposed method demonstrated higher "fidelity" (accuracy of explanations) compared to established techniques like LIME and SHAP, suggesting meaningful progress in making AI security decisions more interpretable and trustworthy.

The method can identify which features trigger borderline decisions: PhilaeX specifically identifies the features (data characteristics) that cause uncertain predictions, which is valuable for security analysts who need to understand edge cases and potential vulnerabilities in AI decision-making.

Explanations can be validated through testing: The paper demonstrates that explanation quality can be rigorously tested—for example, by checking whether removing identified features actually changes the model's prediction—providing a concrete way to verify that explanations are genuine rather than misleading.