Deep Learning Android Malware Detectors Pass Accuracy Tests but Fail Reliability Audits

Android malware detection has become one of the most active proving grounds for deep learning, with convolutional networks, recurrent models, transformers, and hybrid architectures all competing to spot malicious apps before they reach users. A new systematic review and empirical validation published in Frontiers in Artificial Intelligence argues that this architectural boom has outpaced the evidence supporting it, and that high benchmark accuracy is a poor proxy for reliable, robust, explainable, reproducible, or deployable malware detection.

The study, led by Syed Shuja Hussain of Universiti Malaysia Pahang Al-Sultan Abdullah with colleagues at Universiti Teknologi PETRONAS and other institutions, took a deliberately skeptical approach. Rather than asking which architecture reports the highest accuracy, the team conducted a PRISMA-guided systematic review of deep learning-based Android malware detection studies published between 2021 and 2026, then complemented the review with a controlled reliability audit of representative CNN, GRU, Transformer, and Hybrid CNN-LSTM models on the CICMalDroid 2020 dataset.

The review began with 739 records retrieved from IEEE Xplore, ACM Digital Library, Scopus, Web of Science, ScienceDirect, Springer, Wiley, and Google Scholar. After removing 214 duplicates and screening out 421 records that fell outside the Android malware detection scope or lacked deep learning components, 104 full-text articles were assessed for eligibility. Forty-three were excluded for insufficient Android focus, missing deep learning detection components, or weak empirical detail. The final synthesis retained 61 studies, including 33 primary technical studies that formed the architecture-level evidence base.

That evidence base is architecturally diverse. CNN and image-based models dominated the landscape, appearing in 51.5 percent of primary technical studies, typically learning from DEX images, bytecode images, opcode images, manifest features, or permission encodings. Sequential models such as LSTM, GRU, and BiGRU accounted for 24.2 percent, processing API-call sequences, system-call traces, and network flows. Transformer and attention-based models made up 21.2 percent, tokenizing traffic, opcode, API, or DEX representations to capture long-range contextual dependencies. Graph neural networks, autoencoders, hybrid multimodal systems, lightweight deployment-oriented models, and explainable AI-oriented architectures rounded out the field.

But the review’s central finding is one of caution rather than celebration. When the team scored 28 non-redundant representative studies across nine evidence dimensions, including dataset transparency, artifact clarity, architecture clarity, metric adequacy, validation realism, robustness evidence, explainability grounding, reproducibility support, and deployment evidence, the aggregate pattern revealed that architectural innovation is running ahead of evidence maturity. Metric adequacy was consistently reported across all 28 studies, and dataset transparency, artifact clarity, and architecture clarity were generally well represented. Yet only 2 of 28 studies provided clear robustness or evasion evidence, only 5 offered clear explainability evidence mapped to Android artifacts, and none provided complete reproducibility support. Deployment evidence was clearly reported in just 5 studies.

The controlled empirical validation on CICMalDroid 2020 reinforced this argument. All four representative architectures achieved competitive clean cross-validation performance, with macro F1-scores between 0.895 and 0.955. The Hybrid CNN-LSTM achieved the best clean profile with an accuracy of 0.945 ± 0.004 and macro F1-score of 0.955, followed by the Transformer at 0.928 ± 0.006 accuracy and 0.925 macro F1, the GRU at 0.907 ± 0.008 and 0.910, and the CNN at 0.911 ± 0.005 and 0.895. But clean accuracy was only the starting point of the audit.

Class-wise analysis revealed that adware remained the most challenging category for every architecture evaluated, even when aggregate performance looked strong. The malware false-negative rate, a security-critical metric measuring undetected malicious applications, ranged from 0.054 for the Hybrid CNN-LSTM to 0.119 for the CNN. Repeated-run stability across multiple random seeds showed the Hybrid CNN-LSTM achieving the highest mean macro F1-score of 0.955 with the least variation, while the CNN, GRU, and Transformer showed progressively lower stability. Multi-level test-time feature masking at 5, 10, 20, and 30 percent perturbation levels exposed architecture-dependent robustness differences invisible to aggregate accuracy. Under 30 percent masking, the CNN’s macro F1 dropped from 0.895 to 0.706, the GRU fell from 0.910 to 0.744, the Transformer declined from 0.925 to 0.768, and the Hybrid CNN-LSTM retained the best masked performance at 0.814 from 0.955.

The study proposes an architecture-artifact-validation triad as the correct unit of evaluation, arguing that a CNN trained on DEX images, a GRU trained on API-call sequences, a Transformer trained on traffic tokens, and a graph neural network trained on function-call graphs are not simply different models for the same evidence but fundamentally different evidence systems with distinct failure modes. Image-based models may learn visual separability without preserving meaningful malware semantics. Sequential models depend on trace completeness and whether malicious behavior is actually triggered during observation. Graph-based evidence relies on fragile call-graph extraction vulnerable to reflection, dynamic loading, and obfuscation. Attention maps and saliency outputs are useful only when mapped back to verifiable Android artifacts such as APIs, permissions, DEX methods, or manifest elements.

The authors introduce a claim-aligned reliability audit that matches each layer of evaluation to the type of claim it can legitimately support. Clean accuracy authorizes only baseline benchmark discrimination. Class-wise F1-scores and malware recall authorize threat-category reliability. Robustness claims require perturbation, obfuscation, adversarial, temporal, or cross-dataset evidence reported separately. Deployment claims require model size, inference latency, memory footprint, preprocessing cost, hardware setting, energy impact, and real-device or edge feasibility. The audit also subjects the study’s own empirical validation to the same standard, acknowledging that it uses a single public dataset, a shared hyperparameter protocol, and feature-level perturbation rather than APK-level obfuscation or real-world adversarial transformation.

The findings support a transition from accuracy-centric benchmarking to reliability-centric evaluation, where deep learning-based Android malware detection is assessed using credible datasets, realistic validation protocols, robustness testing, artifact-grounded interpretability, reproducibility assets, and operational feasibility evidence. The authors argue that future studies should report class-wise metrics, false-negative analysis, repeated-run stability, temporal or cross-dataset validation, adversarial or obfuscation-aware testing, transparent implementation details, and deployment-relevant evaluation rather than collapsing results into a single headline accuracy score.

Subject of Research: Deep learning Android malware detection under realistic evaluation constraints

Article Title: Deep learning-based android malware detection under realistic evaluation constraints: an architecture-centric review and reliability-aware empirical validation

Article References: Hussain, S. S., Razak, M. F. A., Ismail, I., Firdaus, A., Azeem, A., Zara, J., & Akhter, S. (2026). Deep learning-based android malware detection under realistic evaluation constraints: an architecture-centric review and reliability-aware empirical validation. Frontiers in Artificial Intelligence, 9, Article 1964400. https://doi.org/10.3389/frai.2026.1964400

Image Credits: AI Generated

DOI: 10.3389/frai.2026.1964400

Keywords: Android malware detection, deep learning, reliability audit, systematic review, CICMalDroid 2020, robustness, explainable AI, Deep, learning-based, android, malware, detection