SHAP flips sign on malware features it never uses

A new proof argues SHAP scores a coalition game, not a file's real behavior, when it explains why a malware classifier flagged something. That distinction carries a real cost: the game only stays fixed once someone picks the players, the missing-feature rule, the background distribution and the input mapping, and conditional SHAP splits credit for one real signal by 1/m across m-1 redundant features carrying that same information, per arXiv preprint 2609.04626.

Static PE feature spaces make the dilution worse. Byte histograms, entropy scores, strings, headers, sections and imports aren't independent. File structure, packing and compiler behavior shape several of them at once, so a feature doing all the real detection work can end up looking like it barely matters once SHAP spreads its credit across every correlated stand-in.

The paper also proves a sharper point. Under distribution shift, conditional SHAP can reverse the attribution sign on a feature the model never uses at all. A feature the detector ignores can show up in the explanation pushing the verdict the opposite direction from what a second run, on a different background distribution, would show. Neither failure needs a bug. SHAP is working exactly as built, on a game that was never designed to match the detector's real decision.