Why Is SHAP Not a Reliable Standalone Explanation Framework for Malware Detection?

Why Is SHAP Not a Reliable Standalone Explanation Framework for Malware Detection? Seyedreza Mohseni∗ , Edward Raff†∗ , Manas Gaur∗ ∗ University of Maryland Baltimore County, Baltimore, USA

[email protected], [email protected]

arXiv:2609.04626v1 [cs.CR] 4 Sep 2026

† CrowdStrike, New York, USA, [email protected]

Abstract—Machine learning is widely used for malware detection, but its decisions must be explained. An analyst needs to know whether a model has learned genuine malicious behavior or only dataset-specific patterns [1]. SHapley Additive exPlanations (SHAP) is the standard tool for this, backed by formal properties such as local accuracy, missingness, and consistency. We argue that these guarantees are insufficient for reliable malware interpretation. We claim SHAP explains a chosen feature-coalition game, not malware behavior in the data. That game is fixed only after the analyst selects the feature players, the missing feature rule, the background distribution, and the simplified input mapping. In static Portable Executable feature spaces, groups such as byte histograms, byte-entropy, strings, headers, sections, imports, and data-directories are not independent signals but are jointly shaped by file structure, packing, compiler behavior, and family conventions. We prove that this dependence makes conditional SHAP dilute a model’s feature credit by a factor of 1/m across m − 1 redundant features, attributes importance to features the model never uses, and even reverses the sign of an unused feature’s attribution when the data distribution changes; interventional SHAP, meanwhile, queries off-manifold coalitions that no real executable would exhibit. Experiments on EMBER2018, EMBER-2024, and BODMAS with fixed LightGBM and XGBoost detectors confirm these effects. We therefore position SHAP as a limited diagnostic that requires an explicitly stated data distribution and domain validation, not a standalone account of malware behavior. Index Terms—Explainable machine learning, SHAP, Shapley values, feature attribution, malware detection, static PE analysis, feature dependence, interpretability, model explanation.

I. I NTRODUCTION Machine learning is now a core component of modern malware detection, processing large volumes of files and uncovering discriminative patterns that are difficult for human analysts to identify manually [2]–[5]. In static analysis of Portable Executable (PE) files, gradient-boosted trees and deep networks routinely achieve high detection rates and are increasingly deployed in operational security pipelines [6]. In these settings, raw accuracy is not sufficient. An analyst who must triage an alert, justify a quarantine, or audit a model before deployment needs to know why a file was flagged, whether the model relies on genuine malicious behavior or on incidental dataset artifacts, and whether the same explanation would hold for similar files [7]–[10]. This demand for accountability has made post-hoc feature attribution a standard part of the malware-ML toolchain [11]–[14]. Among these methods, SHapley Additive exPlanations (SHAP) [15] is the most widely adopted. Rooted in coopera-

tive game theory [16], SHAP assigns each feature an additive importance value and unifies a family of attribution methods under formal properties such as local accuracy, missingness, and consistency. Efficient estimators such as TreeSHAP [17] and KernelSHAP [18] have lowered the cost of applying SHAP to high-dimensional malware feature spaces, and SHAP attributions now frequently serve as de facto evidence that a classifier has learned the right thing. This paper argues that such trust is misplaced when SHAP is used as a standalone interpreter of static PE malware models. Our concern is not that SHAP computes incorrect numbers. For a fixed value function and simplified input mapping, its attributions are well-defined, and its axioms hold. Our concern is not the numerical validity of SHAP attributions for a fixed value function and simplified input mapping. Rather, it is the semantic object those attributions characterize: SHAP explains the selected feature-coalition game, which need not correspond to the malware behavior represented by the data [19]. That game is fixed only after the analyst has selected the feature players, the missing feature rule, the background distribution, and the simplified input mapping; in the malware setting, these choices are neither neutral nor obvious, and different choices yield different attributions for the same model and file [20], [21]. This gap between the features and malware matters more for malware than for many domains because of feature dependence. In static PE feature representations such as EMBER-2018 [22], EMBER-2024 [23] and BODMAS [24], the standard feature groups such as byte-histograms, byte-entropy, strings, headers, sections, imports, and data-directories are not independent signals. They come from the same executable and are jointly shaped by file structure, packing, compiler behavior, family conventions, and time-dependent collection effects known to bias malware benchmarks [25] (e.g., obfuscations transform all features together [26], [27]). SHAP’s coalition mechanism, however, treats features as separable players that can be added to or removed from a coalition. Under such dependence, the two ways of realizing this mechanism diverge, and each becomes problematic. Interventional SHAP replaces missing features with background draws, producing combinations that no real PE file would exhibit and evaluating the model in regions it never learned [28], [29]; we show empirically that the measured

group-level dependence in these datasets makes such offmanifold coalitions the rule rather than the exception. Conditional SHAP respects the data distribution but can instead credit proxy features that merely predict others, absorb dataset artifacts such as family signatures, and require estimating highdimensional conditional densities that are themselves errorprone [30], [31]; we make these failures precise as lemmas in Section III. The analyst is thus pushed toward either an explanation of artificial interventions or one of indirect statistical association, neither of which is guaranteed to describe the malicious behavior under study. These tensions are not new in general machine learning. Kumar et al. [32] show that Shapley-based importance behaves counterintuitively under dependence and redundancy in features. Janzing et al. [28] frame feature relevance as a causal problem motivating the interventional formulation; Chen et al. [33] crystallize the choice as true to the model or true to the data; and Sundararajan and Najmi [20] show that incompatible value functions yield many Shapley values for the same prediction. Reliability concerns extend even to adversarial manipulation of SHAP outputs [34], and global Shapley-style importance inherits the same dependence sensitivities [35]. In security specifically, Warnecke et al. [8] found that explanation methods struggle with structured security data and produce unstable outputs. What has been missing is a focused, mathematically explicit account of how these abstract failure modes manifest on the static PE feature groups the community actually uses, and what they imply for an analyst reading a SHAP plot as evidence of malware behavior. This paper provides that account, a set of lemmas for the interventional and conditional cases with the underlying classifiers held fixed, together with a controlled empirical study, so that any instability is attributable to the explanation process rather than to model quality. Contributions. This article supports its results through a combination of theoretical exposition showing that multiple issues can occur, followed by empirical validation. • A domain-specific articulation of the problem. We formalize, for static PE malware feature groups, why interventional and conditional SHAP diverge under feature dependence, and we identify the resulting failure modes: off-manifold coalition queries for interventional SHAP, and redundancy dilution, proxy crediting, and sign instability for conditional SHAP. • An interventional off-manifold failure (Lemma 1). We prove that whenever PE feature groups are statistically dependent (IP (XC ; XC̄ ) > 0), interventional SHAP evaluates the classifier on synthetic group-mixed coalitions whose distribution differs from the real data distribution. • Conditional attribution failures (Lemmas 2–4). We prove that conditional SHAP (i) dilutes the attribution of a model-used feature by a factor 1/m when m − 1 redundant features (proxies) encoding the same latent malware factor are added (Lemma 2, redundancy); (ii) assigns nonzero attribution to a feature that the classifier never uses whenever that feature is statistically informa-

tive about a used feature (Lemma 3, proxy attribution); and (iii) can reverse the attribution sign of such an unused feature across two valid dataset distributions (Lemma 4, sign instability). • A controlled empirical demonstration. On EMBER2018 [22], EMBER-2024 [23], and BODMAS [24], we (i) measure the group-level dependence structure and show that PE feature groups are far from the independent players that SHAP’s coalition mechanism assumes, and (ii) for EMBER-2018, with strong LightGBM and XGBoost detectors held fixed, we sweep injected redundant features and observe attribution migrating off the model used features in close agreement with the 1/m prediction of Lemma 2, while predictive performance remains unchanged, isolating the instability to the explanation process rather than the detector. II. BACKGROUND OF SHAP SHAP explains a model’s prediction by treating the input features as players in a game and assigning each feature a value, called a Shapley value, which reflects its contribution to the final prediction. For a model f , an input x, and a set of features D, the SHAP value for feature i is usually written as ϕi (x) =

X S⊆D\{i}

i |S|!(d − |S| − 1)! h vx (S ∪ {i}) − vx (S) d!

where vx (S) (S ⊆ D) is the value of the model when only the features in S are known; three main properties support SHAP. Assume z ′ ∈ {0, 1}d is a simplified binary input, ϕ0 is the base value, and each ϕi is the attribution assigned to feature i. We the explanation model g(z ′ ) as Pdcan define ′ ′ g(z ) = ϕ0 + i=1 ϕi zi . The SHAP paper defines additive feature attribution methods as explanation models that are linear functions of binary variables. Missingness means that a feature that is not present should receive no credit, so if zi′ = 0, then ϕi = 0. Consistency means that if a feature contributes more to a model after the model changes, its assigned value should not decrease. The original SHAP paper shows that, under these conditions, there is a unique additive attribution method for a chosen simplified input mapping hx (z ′ ). However, these are the key limitations for malware analysis: 1- How do we define vx (S)? 2- How do we map missing features back to real inputs? 3- How do we handle the conditional relationship between features? If the value function uses conditional expectations, interventional sampling, or an independence approximation, then the resulting SHAP values can change. Therefore, the formal SHAP guarantees hold only after the malware analyst has chosen the feature players, the missing-feature rule, the background distribution, and the simplified input mapping. This is especially important for malware datasets, where features are dependent, and removing one feature may not represent a real executable file.

III. T HEORETICAL E XPLANATION A. Failure of Interventional SHAP Lemma 1 (Invalid Coalition Failure of Interventional SHAP in Malware Feature Spaces). Let X ∼ Pdata be a real static malware feature vector extracted from PE files. Assume that the feature vector is partitioned into malware-relevant feature groups G = {g1 , . . . , gm }. For a nonempty proper group coalition C ⊂ G, define a synthetic group-mixed coalition
e C = X a , X b (X e C representing the entire sample by X C C̄ e C . Then feature set). Let QC denote the distribution of X QC = Pdata (XC ) ⊗ Pdata (XC̄ ) (⊗ denotes the product measure) If the malware feature groups are statistically dependent, IP (XC ; XC̄ ) > 0, then QC ̸= Pdata Therefore, interventional SHAP can evaluate the malware classifier on synthetic group coalitions that are not distributed like real malware or benign PE feature vectors.

SHAP fills missing features from their marginal distribution, breaking the dependence that binds PE feature groups within a single executable. It thus queries the malware classifier on synthetic, off-manifold coalitions that no real benign or malicious file would produce. Hence, its attributions reflect model behavior in unlearned regions of feature space rather than the malicious behavior an analyst seeks to interpret. B. Failure of Conditional SHAP

Conditional SHAP is often presented as a safer alternative to interventional SHAP because it respects the data distribution; instead of replacing missing features independently, it defines the coalition value as Vxcond (S) = E[f (X) | XS = xS ]. In principle, this avoids some artificial feature combinations. However, it does not make conditional SHAP a reliable explanation method for malware. The reason is the strong dependence among PE features discussed above: most feaProof. The real malware dataset distribution over the selected ture groups are linked, repeated, or jointly shaped by file and missing feature groups is Pdata (XC , XC̄ ). However, the structure, so conditional SHAP explains a model over highly group mixed coalition construction draws XC from one real correlated variables. Therefore, the conditional distribution file and XC̄ from another independent real file. Therefore, P (XS̄ | XS = xS ) is not a minor technical detail; it becomes the synthetic coalition distribution is the product of the two the core object that determines the explanation. We identify marginal distributions QC = Pdata (XC )Pdata (XC̄ ). The mu- three resulting failure modes. In static PE malware representations, a single latent factor, tual information between the two group blocks is such as packing, encryption, obfuscation, polymorphic mutaIP (XC ; XC̄ ) = DKL (Pdata (XC , XC̄ ) ∥ Pdata (XC )Pdata (XC̄ )) tion, metamorphic code rewriting, or family-specific implementation style, often manifests through multiple observable By the non-negativity property of KL divergence, features simultaneously. For example, a packing-related latent IP (XC ; XC̄ ) = 0 if and only if factor Z may be encoded in a byte-entropy feature R1 as Pdata (XC , XC̄ ) = Pdata (XC )Pdata (XC̄ ) well as in related histogram, opcode-frequency, section, string, or API-pattern features R2 , . . . , Rm . Because these Thus, if IP (XC ; XC̄ ) > 0 then features are extracted from the same executable, they carry redundant information about Z and are not independent playPdata (XC , XC̄ ) ̸= Pdata (XC )Pdata (XC̄ ) ers. Lemma 2 shows that this redundancy causes conditional and therefore QC ̸= Pdata . This distributional SHAP to dilute and misattribute credit. mismatch directly affects interventional SHAP. Lemma 2 (Redundancy Failure of Conditional SHAP). Let The group-level interventional value function is R = (R , . . . , R ) with R = h (Z) for injective h , so 1 m j j j Vxint (C) = EZC̄ ∼Pdata (XC̄ ) [f (xC , ZC̄ )] [28]. This value that P (Z | R = h (z)) = δ . Let f (R , . . . , R ) = g(R ) j j z 1 m 1 function evaluates the classifier on hybrid samples of the for measurable g, so ∂f = 0 for every j ≥ 2 whenever ∂Rj form (xC , ZC̄ ) where xC comes from the explained file and the derivative is defined. Let Conditional SHAP use the value ZC̄ is sampled from the marginal distribution of missing function v cond (S) = E [f (R , . . . , R ) | R = r ]. 1 m S S x groups. However, the real data-consistent conditional value is For a sample x with Z = z, the Conditional SHAP value Vxcond (C) = EZC̄ ∼Pdata (XC̄ |XC =xC ) [f (xC , ZC̄ )] When the malware feature groups are dependent, Pdata (XC̄ | XC = xC ) ̸= Pdata (XC̄ ) Consequently, Vxcond (C)−Vxint (C) =

Z f (xC , z) [pdata (z | xC ) − pdata (z)] dz

which need not be zero. Therefore, interventional SHAP may compute marginal contributions using artificial coalition samples rather than realistic PE feature vectors. Interventional

assigned to every feature is g(h1 (z)) − E[g(h1 (Z))] j = 1, . . . , m m Therefore, Conditional SHAP assigns nonzero attribution to features Rj and j ≥ 2, which the classifier does not use, and the attribution of the used feature R1 is reduced by a factor of 1/m. Conditional SHAP is not invariant to redundant feature representation. ϕcond Rj (x) =

Proof. Since each redundant malware feature satisfies Rj = hj (Z) and each hj is injective, observing any nonempty subset of the redundant features reveals the same latent malware factor Z = z. Therefore, for any nonempty coalition S ̸= ∅,

is statistically informative about another feature used by the model.

Vxcond (S) = E [g(R1 ) | RS = rS ] = g(h1 (z)) For the empty coalition, vxcond (∅) = E[g(R1 )] = E[g(h1 (Z))]. The Conditional SHAP value of feature Rj is X

where M = {1, . . . , m}. If S = ∅, then vxcond ({j}) − = g(h1 (z)) − E[g(h1 (Z))]. If S ̸= ∅, then both S and S ∪ {j} reveal the same latent factor Z = z, so vxcond (S ∪ {j}) − vxcond (S) = g(h1 (z)) − g(h1 (z)) = 0. Thus, the only nonzero marginal contribution occurs when S = ∅. The Shapley weight of the empty coalition is 0!(m−1)! 1 =m . Therefore, m! vxcond (∅)

ϕcond Rj (x) =

1 [g(h1 (z)) − E[g(h1 (Z))]] m

j = 1, . . . , m

This proves that all redundant features receive equal attribution, including features that the classifier does not directly use. If only the model-used feature R1 were present, its single-feature attribution would be ϕsingle (x) = R1 g(h1 (z)) − E[g(h1 (Z))]. After adding m − 1 redundant = malware features, its attribution becomes ϕcond R1 (x) single 1 cond (x) = m [g(h1 (z)) − E[g(h1 (Z))]]. Hence, ϕR1 (x)/ϕR1 1/m. As m increases, ϕcond R1 (x) → 0, even though the classifier and the underlying malware signal are unchanged. Therefore, Conditional SHAP attribution depends on how many redundant feature encodings are included in the malware feature table. This proves the redundancy failure. Beyond exact redundancy, PE feature spaces often include features that are merely statistically correlated with a modelused feature, rather than deterministic functions of the same latent factor. For instance, a classifier may use only a byteentropy measurement B. In contrast, a related histogram bin, opcode-frequency statistic, API-call pattern, CFG metric, section statistic, or another entropy-derived measurement R is included in the feature table. Even though the classifier is functionally independent of R, statistical dependence between B and R in the data allows conditional SHAP to assign nonzero attribution to R, as Lemma 3 shows. Lemma 3 (Proxy Attribution Failure of Conditional SHAP). ∂f Let f (B, R) = g(B) for integrable g, so ∂R = 0 whenever the derivative is defined. Let Conditional SHAP use the value function vxcond (S) = E [f (B, R) | XS = xS ]. For a sample x = (b, r), the Conditional SHAP attribution assigned to R is ϕcond (x) = R

1 [E[g(B) | R = r] − E[g(B)]] 2

1 1 [v({R}) − v(∅)] + [v({B, R}) − v({B})] 2 2 Since the classifier satisfies f (B, R) = g(B), we have v(∅) = E[g(B)], v({R}) = E[g(B) | R = r], v({B}) = E[g(B) | B = b] = g(b), and v({B, R}) = f (b, r) = g(b). Therefore, v({B, R}) − v({B}) = g(b) − g(b) = 0. Substituting these values into the Conditional SHAP formula gives Eq. 1 Thus, whenever conditioning on R = r changes the expected value of the model-used feature response g(B), the proxy feature receives nonzero attribution: ϕcond (x) = R

|S|!(m − |S| − 1)! m! S⊆M \{j}  cond  vx (S ∪ {j}) − vxcond (S)

ϕcond Rj (x) =

Proof. For two features, the Conditional SHAP attribution of R is

(1)

Therefore, if E[g(B) | R = r] ̸= E[g(B)], then ϕcond (x) ̸= R 0 even though the classifier does not use R. Conditional SHAP can assign attribution to a feature solely because it

E[g(B) | R = r] ̸= E[g(B)]

=⇒

ϕcond (x) ̸= 0 R

However, the classifier is functionally independent of R. The nonzero attribution therefore arises from statistical dependence in the malware dataset, not from the classifier’s direct use of R. This proves the proxy attribution failure. Lemma 3 generalizes the m = 2 case of Lemma 2 by relaxing the requirement from exact deterministic redundancy (injective hj ) to mere statistical dependence between R and B. In Lemma 2, conditioning on R reveals Z exactly and hence determines B, so E[g(B) | R = r] = g(b) and the two-player attribution reduce to exactly 12 [g(b) − E[g(B)]]. In Lemma 3, the proxy R needs only to be statistically informative about B, producing a potentially weaker but still nonzero attribution. The exact redundancy setting thus represents the worst case within the broader proxy attribution failure. The proxy attribution failure of Lemma 3 is not merely quantitative; it can also reverse sign across dataset distributions. Lemma 4 shows that this causes the conditional SHAP sign of R to flip. Lemma 4 (Sign Instability Failure of Conditional SHAP). ∂f Let f (B, R) = g(B) for integrable g, so ∂R = 0 whenever the derivative is defined. Let Conditional SHAP use cond the value function vx,P (S) = EP [f (B, R) | XS = xS ], where P is the dataset distribution. For a sample x = (b, r), the Conditional SHAP value of R is ϕcond R,P (x) = 1 2 (EP [g(B) | R = r] − EP [g(B)]) Therefore,
sign ϕcond R,P (x) = sign (EP [g(B) | R = r] − EP [g(B)]) Consequently, for the same classifier f (B, R) = g(B) and the same feature R not used by the model, two valid malware dataset distributions P + and P − can produce opposite Conditional SHAP signs if EP + [g(B) | R = r] > EP + [g(B)] and EP − [g(B) | R = r] < EP − [g(B)]. In that case, cond ϕcond R,P + (x) > 0 and ϕR,P − (x) < 0. Thus, Conditional SHAP can assign opposite signs to an unused malware feature solely because the dataset dependence between R and the model-used feature B changes.

B. Experiments

Fig. 1. Detection performance of the two fixed baseline detectors, LightGBM and XGBoost, on EMBER-2018, EMBER-2024, and BODMAS, reported as bootstrap means with 95% confidence intervals over five seeds. Takeaway: Because the classifiers being explained are uniformly accurate, any subsequent change in SHAP attribution must be attributed to the explanation settings rather than to poor model quality.

Proof. For two features, the Conditional SHAP attribution of R is ϕcond R,P (x) =

1 1 [v({R}) − v(∅)] + [v({B, R}) − v({B})] 2 2

Since the classifier depends only on B, we have v(∅) = EP [g(B)], v({R}) = EP [g(B) | R = r], v({B}) = EP [g(B) | B = b] = g(b), and v({B, R}) = f (b, r) = g(b). Therefore, v({B, R}) − v({B}) = g(b) − g(b) = 0. Substituting into the Conditional SHAP formula gives ϕcond R,P (x) =

1 (EP [g(B) | R = r] − EP [g(B)]) 2

Thus, the sign of the Conditional SHAP value assigned to R is determined by whether conditioning on R = r increases or decreases the expected value of the model-used feature response g(B). If EP [g(B) | R = r] > EP [g(B)] then ϕcond R,P (x) > 0. If EP [g(B) | R = r] < EP [g(B)] then ϕcond R,P (x) < 0. This proves that the attribution sign of R can change even though the classifier has no direct dependence on R. The sign is caused by the conditional data law P (B | R = r), not by direct model use of R. IV. P RACTICAL E XPERIMENTS A. Experimental environments and features We implemented all experiments in Google Colab using an NVIDIA A100 GPU. We used three malware datasets, EMBER-2018 1 , EMBER-2024 2 , and BODMAS 3 , and we limited the feature space to static PE features that are common and meaningful for malware analysis. We excluded non-feature information, such as hashes and other metadata that do not directly describe the executable structure. Code is available in the Malware-SHAP repository 4 for reproducibility. 1 https://github.com/elastic/ember 2 https://github.com/futurecomputing4ai/ember2024 3 https://github.com/whyisyoung/BODMAS 4 https://github.com/MohseniMalwareLab/Malware-SHAP

In this section, we briefly present a series of experiments to demonstrate the performance of the SHAP explanation process in malware classification. We used LightGBM with num leaves = 64 and XGBoost with max leaves = 64, with a learning rate of 0.05 and five different seeds = {2026, 2027, 2028, 2029, 2030}. The key takeaway is that these baseline models serve as fixed base detectors, not the main scientific claim. The purpose is to test whether SHAP explanations remain reliable when the classifier is already strong. Since both models perform well, later changes in SHAP attribution can be attributed to explanation settings such as the value function, background distribution, proxy features, or invalid coalitions, rather than to poor classifier quality. Dependencies: The first experiment measured dependency in the feature space. For each pair of feature groups Ga and Gb , we computed the group-level mean absolute correlation. This experiment tested whether malware features behave like independent players. If the feature groups were independent, then P (XS̄ | XS = xS ) ≈ P (XS̄ ). Our motivation was to show that this condition is unrealistic for PE malware data because byte content, entropy, strings, headers, imports, sections, and data-directories are all linked through the same executable file structure. The dependency experiment is a verification of Lemma 1, 3 and 4. Feature Redundancy: In the proxy redundancy experiment, we added exact duplicates of features, Cj = Xj , and checked whether model performance remained stable as SHAP credit moved from the original feature to its copy. The proxy redundancy experiment verifies Lemma 2. C. Baseline Figure 1 reports the performance of the two fixed detectors, LightGBM and XGBoost, across EMBER-2018, EMBER2024, and BODMAS, as bootstrap means with 95% confidence intervals over five seeds. All six detectors are uniformly strong. LightGBM attains an AUC of 0.990 (precision 0.991) on EMBER-2018, 0.964 (precision 0.972) on EMBER-2024, and 0.996 (precision 0.995) on BODMAS, while XGBoost reaches 0.990 (precision 0.943) on EMBER-2018, 0.953 (precision 0.962) on EMBER-2024, and 0.996 (precision 0.994) on BODMAS. Because the classifiers are already accurate, any subsequent change in SHAP attribution must be due to the explanation settings, the value function, the background distribution, proxy features, or invalid coalitions, rather than poor model quality. D. Dependency Figure 2 reports the group-level dependence structure of the static PE feature space across three benchmarks. The two left panels measure the mean absolute correlation between every pair of feature groups for EMBER-2018 (upper Left) and BODMAS (lower Left). In contrast, the right panel reports pairwise interaction information (in bits) for EMBER2024. In both correlation maps, the dominant structure is a content-based cluster binding the histogram, strings,

Fig. 2. Group-level dependence of the static PE feature space. Left : mean absolute correlation for EMBER-2018 (Top) and BODMAS (Bottom), both dominated by a redundant histogram, strings, and byte-entropy cluster. Right: pairwise interaction information (bits) for EMBER-2024, dominated by synergy among the structural groups data-directories, header, authenticode, and imports. Takeaway: the groups are not independent; redundancy violates independence in EMBER-2018/BODMAS (hurting conditional SHAP, Lemmas 2–4), synergy in EMBER-2024 (hurting interventional SHAP, Lemma 1).

and byte-entropy groups, with a weaker but consistent association extending to the section and header groups. BODMAS shows this clustering more strongly than EMBER2018, most clearly in the histogram-strings relationship. These maps measure statistical association rather than causation, and the natural reading is that the clustered groups share common latent sources, such as packing, file size, compiler behavior, or family-specific implementation style, which simultaneously imprint the byte frequency, entropy, and string statistics extracted from the same executable. Operationally, for many feature subsets S, the data satisfy P (XS̄ | XS = xS ) ̸= P (XS̄ ); the feature groups are not the independent players SHAP’s coalition mechanism presupposes. The EMBER-2024 panel exposes a complementary and equally damaging mode of dependence. Rather than the redundancy captured by correlation, the interaction information quantifies how much two groups jointly determine the prediction beyond their individual contributions. Positive values denote synergy, where the groups carry information only when observed together, and negative values denote redundancy, where they duplicate the same signal. EMBER-2024 is dominated by synergy rather than redundancy, with the largest interactions (≈ 0.20 bits) concentrated among the PE structural groups data-directories, header, authenticode, and imports that jointly encode how the file is laid out and signed. This is the information-theoretic counterpart of the correlation clusters in the left panels, where the content groups of EMBER-2018 and BODMAS are redundantly dependent;

the structural groups of EMBER-2024 are synergistically dependent. Both patterns violate the separable player assumption, but they fail in opposite directions, and a single correlation statistic would not have revealed the synergistic case at all. These panels provide the empirical basis for our position and lemmas. The redundancy visible in the EMBER-2018 and BODMAS content clusters is exactly the regime of Lemma 2. When several groups encode the same latent factor Z, conditioning on any one of them reveals the others; thus, conditional SHAP dilutes a model used feature’s credit by 1/m and transfers it to proxies that the classifier never uses, while the more general statistical association across these groups drives the proxy attribution and sign-instability failures of Lemmas 3 and 4. The synergy in EMBER-2024, in turn, indicts the interventional value function because synergistic groups are informative only in combination. Replacing one with an independent background draw destroys the joint configuration. It produces an off-manifold coalition that no real executable would exhibit, so the model is queried in regions it never learned. The figure therefore shows that neither realization of SHAP escapes the data structure: redundancy undermines the conditional formulation, and synergy undermines the interventional one. This is why the chosen coalition game, rather than malware behavior, governs attribution and why SHAP cannot serve as a standalone explanation of these detectors. E. Proxy Redundancy Figure 3, top plot, shows the proxy redundancy for EMBER-2018 with the LightGBM model. The LightGBM

Fig. 3. Proxy-redundancy sweep on EMBER-2018. X: injected proxies per group (0–100); Y: drop in original-feature attribution (%). Top (LightGBM): smooth convergence to 40–50%, matching the m = 2 prediction 1 − 1/m = 0.50 (Dg ≈ 0.495). Bottom (XGBoost): the same failure, but unstable and non-monotonic. Accuracy is unchanged; only SHAP allocation shifts. Takeaway: redundant proxies divert credit from model-used features without affecting predictions, demonstrating the redundancy failure of Lemma 2.

panel offers the closest empirical match to Lemma 2. In the pairwise case, which instantiates the m = 2 regime of the lemma, each feature used by the model is paired with a single exact proxy, so the original features are predicted to retain a fraction 1/m = 1/2 of their attribution, resulting in an Original Loss of
1 − 1/m = 0.50. Defining Dg = P Attribution aug
 P base 1− A over the 20 original/redundant i i i Ai pairs, we measure Dg = 1 − 2.061/4.08 ≈ 0.495, within half a percentage point of the closed form value. At the same P time, the displaced credit reappears on the proxy copies ( i Aaug = 2.262) that the classifier does not functionally ci require. As the sweep increases the number of injected duplicates from 0 to 100, the curves converge to a stable band in the 40–50% range, with an overall mean original drop of about 44.6% and a median of about 44.3% across the first 100 settings. This smooth convergence is consistent with the lemma: the idealized 1/m collapse holds for the exact conditional value function, whereas LightGBM, when applied to a fitted gradient-boosted ensemble, routes splits through a bounded set of redundancy representatives. Thus, additional exact copies enter few or no splits, and the estimator effectively continues to observe the two-player regime (meff ≈ 2). The detector is held fixed, and its predictive performance is unchanged; only the SHAP allocation moves. LightGBM demonstrates the redundancy failure of Lemma 2: roughly half of the original

attribution is reassigned to redundant proxies, although the model and underlying malware signal are unchanged. The XGBoost panel (Figure 3, bottom plot) exhibits the same qualitative failure predicted by Lemma 2, a substantial transfer of attribution from original features to redundant proxies, but in a markedly less stable form. Rather than the smooth 40–50% convergence seen for LightGBM, the XGBoost curves are highly non-monotonic across the sweep. Some feature groups drop by more than 80–90%, while others remain low or briefly register negative drops, in which the original features receive more attribution after proxy augmentation than before. The overall mean original drop across the first 100 settings is about 37.9%, but the median is only about 28.9%, reflecting a far more uneven distribution than LightGBM. This behavior remains consistent with Lemma 2 rather than contradicting it. The lemma fixes the redundancy mechanism but not the magnitude of the realized split, which is determined by how the estimator distributes credit among observationally equivalent features; the negative and oscillating drops do not indicate that any proxy became causally important, but rather that XGBoost’s greedy split selection and tie-breaking among exact duplicates redistribute credit in an unstable, pathdependent manner. The contrast with LightGBM is itself the point: for the same datasets, the same duplicate construction, and equally strong fixed detectors, the amount of attribution that moves and its stability depend on the tree learner and the SHAP allocation rather than on the malware. XGBoost thus reinforces the paper’s central position that SHAP credit is not invariant to redundant feature encoding, while showing that the instability the lemma anticipates can manifest far more severely than the idealized 1/m value suggests. V. C ONCLUSION SHAP should not be treated as a standalone explanation of static PE malware classifiers. For a fixed value function and simplified input mapping, its attributions are formally valid and satisfy local accuracy, missingness, and consistency; however, these guarantees describe a chosen coalition game, not the malicious behavior an analyst seeks to understand. Because PE feature groups are not independent players but linked parts of the same executable, jointly shaped by file structure, packing, compiler behavior, and family conventions, the choice of game is neither neutral nor obvious and materially determines the result. Conditional SHAP dilutes a modelused feature’s credit by a factor of 1/m across m−1 redundant proxies, assigns nonzero importance to features the classifier never uses, and can reverse an unused feature’s sign as the data distribution changes, while interventional SHAP queries off-manifold coalitions that no real executable would exhibit. Our experiments confirm this account while isolating it from model quality. We therefore position SHAP as a constrained diagnostic requiring an explicitly stated data distribution and domain validation, rather than a self-sufficient account of malware behavior [36].

R EFERENCES [1] M. Gaur, K. Faldu, and A. Sheth, “Semantics of the black-box: Can knowledge graphs help make deep learning systems more interpretable and explainable?” IEEE Internet Computing, vol. 25, no. 1, pp. 51–59, 2021. [2] J. Saxe and K. Berlin, “Deep neural network based malware detection using two dimensional binary program features,” in 2015 10th international conference on malicious and unwanted software (MALWARE). IEEE, 2015, pp. 11–20. [3] D. Arp, M. Spreitzenbarth, M. Hubner, H. Gascon, K. Rieck, and C. Siemens, “Drebin: Effective and explainable detection of android malware in your pocket.” in Ndss, vol. 14, no. 1. San Diego, CA, 2014, pp. 23–26. [4] E. Raff, J. Barker, J. Sylvester, R. Brandon, B. Catanzaro, and C. K. Nicholas, “Malware detection by eating a whole EXE,” in Workshops at the 32nd AAAI Conf. Artificial Intelligence, 2018. [5] E. Raff, M. Ashkenazi, S. Samtani, D. J. Elkind, and S. Krasser, “Cybersecurity is the True Frontier for Generative AI Success or Failure,” in 2026 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW), Jul. 2026, pp. 242–252, iSSN: 2768-0657. [Online]. Available: https://ieeexplore.ieee.org/document/ 11632077/authors [6] E. Raff and C. Nicholas, “A Survey of Machine Learning Methods and Challenges for Windows Malware Classification,” in NeurIPS 2020 Workshop: ML Retrospectives, Surveys & Meta-Analyses (ML-RSA), 2020, arXiv: 2006.09271. [Online]. Available: http: //arxiv.org/abs/2006.09271 [7] C. Rudin and J. Radin, “Why are we using black box models in ai when we don’t need to? a lesson from an explainable ai competition,” Harvard Data Science Review, vol. 1, no. 2, pp. 1–9, 2019. [8] A. Warnecke, D. Arp, C. Wressnegger, and K. Rieck, “Evaluating explanation methods for deep learning in security,” in 2020 IEEE European Symposium on Security and Privacy (EuroS&P). IEEE, 2020, pp. 158–174. [9] M. Nandan, T. Jaymes, M. Brautbar, and E. Raff, “Towards Improved Anomaly Detection for Cloud Cybersecurity via Graph Neural Networks,” in 2026 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW), Jul. 2026, pp. 233–241, iSSN: 2768-0657. [Online]. Available: https://ieeexplore.ieee.org/document/11631921 [10] F. Störtz, C.-A. Stan, A. Dinu, S. Servia-Rodrı́guez, M. Gaman, C. Miron, and E. Raff, “Large Byte Model: Teaching Language Models About Compiled Code,” Jun. 2026, arXiv:2606.02834 [cs.CR]. [Online]. Available: http://arxiv.org/abs/2606.02834 [11] M. T. Ribeiro, S. Singh, and C. Guestrin, ““why should i trust you?”: Explaining the predictions of any classifier,” in Proceedings of the ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, 2016. [12] M. Sundararajan, A. Taly, and Q. Yan, “Axiomatic attribution for deep networks,” in International conference on machine learning. PMLR, 2017, pp. 3319–3328. [13] E. Raff, R. Zak, G. L. Munoz, W. Fleming, H. S. Anderson, B. Filar, C. Nicholas, and J. Holt, “Automatic Yara Rule Generation Using Biclustering,” in 13th ACM Workshop on Artificial Intelligence and Security (AISec’20), 2020, arXiv: 2009.03779. [Online]. Available: http://arxiv.org/abs/2009.03779 [14] R. Zak, E. Raff, and C. Nicholas, “What can N-grams learn for malware detection?” in 2017 12th International Conference on Malicious and Unwanted Software (MALWARE). IEEE, Oct. 2017, pp. 109–118. [Online]. Available: http://ieeexplore.ieee.org/document/8323963/ [15] S. M. Lundberg and S.-I. Lee, “A unified approach to interpreting model predictions,” Advances in neural information processing systems, vol. 30, 2017. [16] L. S. Shapley, “A value for n-person games,” in Contributions to the Theory of Games II. Princeton University Press, 1953. [17] S. M. Lundberg, G. G. Erion, and S.-I. Lee, “Consistent individualized feature attribution for tree ensembles,” arXiv preprint arXiv:1802.03888, 2018. [18] I. Covert and S.-I. Lee, “Improving kernelshap: Practical shapley value estimation using linear regression,” in International conference on artificial intelligence and statistics. PMLR, 2021, pp. 3457–3465. [19] M. Gaur and A. Sheth, “Building trustworthy neurosymbolic ai systems: Consistency, reliability, explainability, and safety,” AI Magazine, vol. 45, no. 1, pp. 139–155, 2024.

[20] M. Sundararajan and A. Najmi, “The many shapley values for model explanation,” in International conference on machine learning. PMLR, 2020, pp. 9269–9278. [21] L. Merrick and A. Taly, “The explanation game: Explaining machine learning models with cooperative game theory,” arXiv preprint arXiv:1909.08128, 2019. [22] H. S. Anderson and P. Roth, “Ember: an open dataset for training static pe malware machine learning models,” arXiv preprint arXiv:1804.04637, 2018. [23] R. J. Joyce, G. Miller, P. Roth, R. Zak, E. Zaresky-Williams, H. Anderson, E. Raff, and J. Holt, “Ember2024-a benchmark dataset for holistic evaluation of malware classifiers,” in Proceedings of the 31st ACM SIGKDD Conference on Knowledge Discovery and Data Mining V. 2, 2025, pp. 5516–5526. [24] L. Yang, A. Ciptadi, I. Laziuk, A. Ahmadzadeh, and G. Wang, “Bodmas: An open dataset for learning based temporal analysis of pe malware,” in 2021 IEEE Security and Privacy Workshops (SPW). IEEE, 2021, pp. 78–84. [25] F. Pendlebury, F. Pierazzi, R. Jordaney, J. Kinder, and L. Cavallaro, “Tesseract: Eliminating experimental bias in malware classification across space and time,” in USENIX Security Symposium, 2019. [26] S. Mohseni, S. Mohammadi, D. Tilwani, Y. Saxena, G. K. Ndawula, S. Vema, E. Raff, and M. Gaur, “Can LLMs Obfuscate Code? A Systematic Analysis of Large Language Models into Assembly Code Obfuscation,” Proceedings of the AAAI Conference on Artificial Intelligence, vol. 39, no. 23, pp. 24 893–24 901, Apr. 2025, number: 23. [Online]. Available: https://ojs.aaai.org/index.php/AAAI/article/view/ 34672 [27] S. Mohseni, S. Baskar, E. Raff, and M. Gaur, “Analyzing Chain of Thought (CoT) Approaches in Control Flow Code Deobfuscation Tasks,” in 2026 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW), Jul. 2026, pp. 221–232, iSSN: 2768-0657. [Online]. Available: https://ieeexplore.ieee.org/document/11632089 [28] D. Janzing, L. Minorics, and P. Blöbaum, “Feature relevance quantification in explainable ai: A causal problem,” in International Conference on artificial intelligence and statistics. PMLR, 2020, pp. 2907–2916. [29] G. Hooker, L. Mentch, and S. Zhou, “Unrestricted permutation forces extrapolation: Variable importance requires at least one more model, or there is no free variable importance,” Statistics and Computing, vol. 31, no. 6, p. 82, 2021. [30] K. Aas, M. Jullum, and A. Løland, “Explaining individual predictions when features are dependent: More accurate approximations to shapley values,” Artificial Intelligence, 2021. [31] C. Frye, C. Rowat, and I. Feige, “Asymmetric shapley values: incorporating causal knowledge into model-agnostic explainability,” Advances in neural information processing systems, vol. 33, pp. 1229–1239, 2020. [32] I. E. Kumar, S. Venkatasubramanian, C. Scheidegger, and S. Friedler, “Problems with shapley-value-based explanations as feature importance measures,” in International conference on machine learning. PMLR, 2020, pp. 5491–5500. [33] H. Chen, J. D. Janizek, S. Lundberg, and S.-I. Lee, “True to the model or true to the data?” arXiv preprint arXiv:2006.16234, 2020. [34] D. Slack, S. Hilgard, E. Jia, S. Singh, and H. Lakkaraju, “Fooling lime and shap: Adversarial attacks on post hoc explanation methods,” in AAAI/ACM Conference on AI, Ethics, and Society, 2020. [35] I. Covert, S. M. Lundberg, and S.-I. Lee, “Understanding global feature contributions with additive importance measures,” Advances in neural information processing systems, vol. 33, pp. 17 212–17 223, 2020. [36] M. Gaur, K. Gunaratna, S. Bhatt, and A. Sheth, “Knowledge-infused learning: A sweet spot in neuro-symbolic ai,” IEEE Internet Computing, vol. 26, no. 4, pp. 5–11, 2022.