Long-Range Indirect Control-Flow Prediction in Stripped Binaries via Dual Virtual Hubs and Multi-Task Graph Learning

Long-Range Indirect Control-Flow Prediction in Stripped Binaries via Dual Virtual Hubs and Multi-Task Graph Learning Kun Liu

Tulane University New Orleans, Louisiana, USA kliu14@tulane.edu

arXiv:2609.03280v1 [cs.CR] 3 Sep 2026

Tianyi Xu

Tulane University New Orleans, Louisiana, USA txu9@tulane.edu

Zhengming Ding

Tulane University New Orleans, Louisiana, USA zding1@tulane.edu

Zizhan Zheng

Tulane University New Orleans, Louisiana, USA zzheng3@tulane.edu

Chenke Luo

Tulane University New Orleans, Louisiana, USA cluo6@tulane.edu

Haotian Zhang

New Jersey Institute of Technology Newark, New Jersey, USA haotian.zhang@njit.edu

Jiang Ming

Tulane University New Orleans, Louisiana, USA jming@tulane.edu

Keywords

Abstract Recovering indirect control-flow (ICF) edges is fundamental to binary security analysis, yet existing methods struggle with longrange dependencies, isolate different ICF types, and are often evaluated under protocols vulnerable to label noise and data leakage. We present ICFlowNet, a unified framework for long-range ICF prediction in stripped binaries. ICFlowNet introduces candidateaware Dual Virtual Hubs—a Global Code Hub and a Global Data Hub—to create short routing paths between distant code and data evidence, and combines them with multi-task graph learning to jointly model indirect calls, indirect tail calls, jump tables, and returns. To enable credible evaluation, we further develop a leakageaware, noise-controlled pipeline with package-level splits, functionlevel mnemonic-hash deduplication, and a clean test protocol built from dynamic positives and absolute negatives. Using this pipeline, we construct a dataset of 15, 901 unique stripped x86_64 binaries, including 1, 351 with dynamic ground truth. Experiments show that simply scaling static supervision yields only marginal gains, whereas our structural and multi-task designs are essential: Dual Virtual Hubs improve long-range F1 by up to 9.13 points, multi-task learning adds up to 5.81 points, and the final model outperforms prior baselines by more than 13 F1 on long-range indirect calls while adding only 11.44% topological overhead.

Executable binaries, Indirect Control Flow, Graph Learning ACM Reference Format: Kun Liu, Zhengming Ding, Chenke Luo, Tianyi Xu, Zizhan Zheng, Haotian Zhang, and Jiang Ming. 2026. Long-Range Indirect Control-Flow Prediction in Stripped Binaries via Dual Virtual Hubs and Multi-Task Graph Learning. In CCS ’26: 2026 ACM SIGSAC Conference on Computer & Communications Security Nov. 15–19, 2026, The Hague, The Netherlands. ACM, New York, NY, USA, 19 pages. https://doi.org/XXXXXXX.XXXXXXX

1

Introduction

Executable code forms the invisible backbone of modern computing, powering everything from personal devices and IoT systems to large-scale cloud services and sophisticated malware. Yet, in many security settings, analysts must reason about binaries without source code. A central challenge in this setting is recovering the control-flow graph (CFG), which serves as the structural foundation for many downstream analyses and defenses. Among all CFG edges, indirect control-flow (ICF) transfers—whose targets are computed dynamically at runtime—remain particularly difficult to resolve statically. This uncertainty directly weakens downstream applications such as binary rewriting [1–3], recompilation [4–6], software hardening [7–10], and binary diffing [11–14]. ICF transfers arise from diverse programming constructs and compiler optimizations [15–18]. Representative cases include indirect calls through function pointers, indirect tail calls that collapse call-return pairs into jumps, jump tables used for multi-way dispatch, and ret instructions whose destinations depend on dynamic call history. When source code is available, compilers retain rich semantic cues such as types, function boundaries, and structural layouts that make these transfers comparatively easier to recover. In stripped binaries, however, those cues are largely absent, forcing analysis tools to infer dynamic targets from low-level instruction patterns and incomplete structural evidence. Existing approaches remain fragmented. Traditional binary analysis tools [19–21] and classical control-flow integrity techniques [22– 25] recover only a limited subset of dynamic targets, a limitation

CCS Concepts • Security and privacy → Software reverse engineering.

Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than the author(s) must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. Request permissions from permissions@acm.org. CCS ’26, The Hague, The Netherlands © 2026 Copyright held by the owner/author(s). Publication rights licensed to ACM. ACM ISBN 978-1-4503-XXXX-X/2018/06 https://doi.org/XXXXXXX.XXXXXXX 1

CCS ’26, November 15-19, 2026, The Hague, The Netherlands

Kun Liu, Zhengming Ding, Chenke Luo, Tianyi Xu, Zizhan Zheng, Haotian Zhang, and Jiang Ming

also highlighted by Callee [26]. Recent learning-based methods improve individual subproblems, but they still operate in isolation: Callee [26] and AttnCall [27] focus exclusively on indirect-call prediction and rely on sliced, linearized context representations rather than explicit whole-program graph structure, which can limit their ability to preserve fine-grained structural relations such as code-data cross-references. Their evaluation protocols also do not enforce the stricter package-level isolation and deduplication scheme that we adopt later to better control in-package bias [28]. SJA [29], a strong jump-table analyzer, is evaluated only on an outdated LLVM 6.0 toolchain whose emitted patterns are substantially simpler than those of modern binaries. By contrast, CupidCall [30] shows that graph-based representations enriched with code-data cross-references can better preserve structural dependencies and outperform sequence-based modeling on indirect-call prediction. These advances suggest that graph learning is a promising foundation for binary ICF prediction, but a practical solution must still overcome four key challenges. Challenge 1. Even graph-based models degrade when the evidence governing an ICF transfer lies many hops away from where the transfer is executed, because standard message-passing GNNs have a limited effective receptive field and are known to struggle with long-range dependencies due to graph bottlenecks and over-squashing [31–33]. Although CupidCall [30] uses code-data cross-reference (xref) edges to expose data-flow evidence, static analysis cannot reliably guarantee that such bridges are recovered close to the relevant endpoints. In practice, critical pointer initializations may be missing entirely or may only appear several hops away from the source or candidate target, beyond the effective receptive field of ordinary message passing. Once those bridges are absent, the model is forced to rely on isolated local context. While recent advances in global graph attention [34–36] are designed to capture long-range dependencies, directly applying them to heterogeneous binary graphs is non-trivial due to their scale, sparsity, and mixed code-data semantics. Challenge 2. Current solutions are also problematically compartmentalized, treating indirect calls, jump tables, tail calls, and returns as separate tasks. This misses useful cross-type structure: return targets depend on preceding calls, and tail calls blur the boundary between call-like and jump-like behavior. Modeling each ICF type independently leaves supervision underutilized and weakens generalization, especially on rare or structurally ambiguous cases. Challenge 3. Unlike deterministic algorithms, ML models are highly sensitive to ground-truth quality. Prior studies [37, 38] show that undetected label errors can substantially distort benchmark reliability. However, existing datasets such as Callee [26] and CupidCall [30] rely on single-source labels that are inherently prone to either over-approximation or under-approximation, and they lack a clean, standardized test protocol. As a result, it is often unclear whether reported gains reflect real semantic understanding or artifacts of noisy supervision. A clean test set is therefore necessary for credible evaluation. Challenge 4. Data leakage remains a pervasive pitfall in learningbased binary analysis [28, 39]. Static linking, library reuse, and code sharing routinely introduce overlap between training and test sets. Without strict partitioning, models can memorize recurring

artifacts rather than learn transferable features, inflating reported performance. Our own re-evaluation of the Callee dataset [26] confirms this risk: after enforcing package-level separation and function-level deduplication, the F1 score drops from the reported 94.6% to 90.92%. This gap underscores the need for leakage-aware dataset construction and evaluation. To address Challenges 1 and 2, we present ICFlowNet, a unified framework for long-range indirect control-flow prediction in stripped binaries. At the architectural level, ICFlowNet augments heterogeneous binary graphs with candidate-aware Dual Virtual Hubs: a Global Code Hub (GCH), which provides short routing paths among task-relevant code candidates, and a sparsified Global Data Hub (GDH), which aggregates only a small neighborhood of data nodes around those candidates rather than the entire program. This design preserves long-range reachability while reducing irrelevant global aggregation. On top of this topology, ICFlowNet adopts multi-task graph learning to jointly model indirect calls, indirect tail calls, jump tables, and returns, enabling cross-type transfer while retaining task-specific decision boundaries. To address Challenges 3 and 4, we pair the model with a leakage-aware, noise-controlled evaluation pipeline. We construct a dataset of 15, 901 unique stripped x86_64 binaries, including 1, 351 binaries with dynamic ground truth, and evaluate under packagelevel splits, function-level mnemonic-hash deduplication, and a clean test protocol built from verified dynamic positives and absolute negatives. Under this protocol, simply scaling static supervision yields only limited gains. In contrast, the Dual Virtual Hubs improve long-range F1 by up to 9.13 points, multi-task learning adds up to 5.81 points, and the final model outperforms prior baselines by more than 13 F1 on long-range indirect calls. In a nutshell, we make the following key contributions: • A unified framework for long-range ICF prediction. We present ICFlowNet, a unified multi-task graph learning framework that leverages Dual Virtual Hubs to jointly predict all indirect control-flow transfers in stripped binaries, effectively resolving long-range dependency and single-task fragmentation issues. • A large-scale dataset and rigorous evaluation protocol. We construct a dataset of 15, 901 unique stripped x86_64 binaries, including 1, 351 with dynamic ground truth, and evaluate under package-level splits, function-level mnemonichash deduplication, and a clean test protocol built from verified dynamic positives and absolute negatives. • Strong empirical gains and practical insights. We show that merely scaling static supervision offers limited benefit, whereas structural repair and cross-type transfer are both important. ICFlowNet achieves robust, cross-dataset generalization across both static and dynamic settings, with particularly notable gains on long-range dependencies and structurally complex inter-procedural ICF edges.

2

Background and Related Work

We begin by motivating our categorization of ICF types, which serves as the foundation for our unified modeling approach. We then survey prior efforts to resolve ICF in binaries, highlighting 2

ICFlowNet

CCS ’26, November 15-19, 2026, The Hague, The Netherlands

Table 1: ICF types and statistics. The “Share” column reports the proportion of each type among dynamic ICF pairs. Type Indir. Call Indir. Tail Call Jump Table Return

Instr.

Share

Direction

Inter-proc.?

call jmp jmp ret (pop+jmp)

34.2% 3.3% 15.0% 47.5%

Forward Forward Forward Backward

✓ ✓ ✗ ✓

noisy. Existing solutions make different trade-offs. Signature-based systems such as TypeArmor [24] and TypeSqueezer [45] rely on recovered type compatibility to prune callees, but their effectiveness depends on the quality of inferred signatures. Pointer-analysisbased systems, including BPA [25] and BinDSA [46], instead reason through memory abstractions and points-to relations. In particular, BinDSA improves precision with field- and context-sensitive analysis, context-sensitive heap reconstruction, and recovered type information, but its effectiveness still depends on accurate lifting, boundary recovery, and memory abstractions, and it explicitly makes precision-soundness trade-offs in difficult cases. Disa [47] addresses a complementary prerequisite by improving function/instruction and memory-block boundary recovery for BPA-style CFG construction, while SchedExec [48] uses scheduled runtime execution to eliminate infeasible targets at the cost of scalability. From our perspective, what remains under-exploited across these lines of work is the explicit use of code-data cross-references (xRefs) as firstclass representational objects for target prediction. As a result, code regions that interact through the same referenced memory may still remain only weakly coupled during indirect-call reasoning.

limitations and key gaps that motivate our work. Finally, we outline the technical foundations underpinning our proposed framework.

2.1

Indirect Control Flow (ICF) Categorization

Recovering ICF edges in stripped binaries is challenging due to the loss of high-level semantics and aggressive compiler optimizations, such as bit-test dispatches and merged switch constructs [15, 18, 40]. Unlike rule-based methods, our deep learning approach infers these edges from instruction semantics and structural features. To ensure the model captures subtype-specific behaviors and avoids majorityclass bias, we categorize indirect jumps into three distinct subtypes based on their unique control-flow directions and structural patterns: jump tables, indirect tail calls, and returns. In contrast, we treat all indirect calls as a single unified category. Despite varying dispatch mechanisms, they share a uniform instruction form (i.e., a call to a function entry) and consistent semantics. Our model leverages data nodes and cross-reference edges [30] to contextually disambiguate these calls within the graph representation. Table 1 summarizes the features and distribution of these ICF types, with further rationale provided in Appendix C.

2.2

2.3

The Rise of ML-based Single-Task Models

Machine learning has recently emerged as a powerful alternative, capable of capturing subtle patterns that rule-based techniques often miss. However, existing ML-based approaches are predominantly limited to a single ICF type—indirect calls. Sequence-/slice-based learning. Callee [26] and AttnCall [27] are representative learning-based approaches for indirect-call prediction. Callee applies inter-procedural slicing with expert knowledge, symbolizes the resulting contexts, embeds them with doc2vec, and uses a Siamese network to match callsites and candidate callees; it further transfers knowledge from direct calls to indirect calls via pretraining and fine-tuning [26]. AttnCall replaces the Siamese backbone with a Transformer-style dual-encoder and cross-attention architecture, and introduces an end-to-end instruction representation based on structured instruction vectors and pooling; it also explicitly assumes that semantic matching patterns learned from direct calls transfer to indirect-call prediction [27]. However, these designs still operate on linearized top/bottom contexts rather than an explicit whole-program graph. Consequently, they do not naturally preserve code-data xRefs as first-class relations, which can limit long-range structural reasoning when evidence is distributed across distant basic blocks, shared data objects, or non-local control/data interactions. Moreover, both methods focus only on indirect calls, leaving the unified modeling of multiple ICF types unexplored. Graph-based approach. To address the representational limits of NLP models, CupidCall [30] leverages heterogeneous graphs enriched with cross-references (xRefs). However, applying standard Graph Neural Networks (GNNs) [49] to these structures introduces certain architectural trade-offs. First, the local message passing typical of standard GNNs can blur the distinct semantics of controlflow versus data-flow dependencies. Second, these models are often constrained by limited receptive fields and multi-hop decay [31– 33]. Consequently, if static analysis misses a critical xRef, or if the topological distance between nodes exceeds the GNN’s effective

Traditional ICF Resolution Techniques

Traditional methods have long attempted to resolve ICF, but are often limited by rigid assumptions about control-flow structures, compiler behavior, or memory access patterns. Indirect jump resolution. Indirect jump resolution has primarily focused on recovering switch-case jump tables. Early approaches such as RJTCS [41] relied on matching predefined patterns but struggled with complex dispatch mechanisms involving multi-level indirection. Subsequent methods combined static and dynamic analysis (e.g., HRA [42]) or employed intermediate representations with SMT-based reasoning (e.g., JTR [43]); however, these techniques were limited by the fidelity of binary lifting and the scope of their analyses. The current SOTA static tool, SJA [29], introduces a forward abstract interpretation framework that avoids pattern matching entirely. Nevertheless, its evaluation was conducted on LLVM 6.0, which applies simpler jump table lowering, i.e., translating switch statements into predictable indirect jump patterns, than modern compilers that employ more diverse and optimized lowering schemes [40, 44]. Additionally, SJA’s precision degrades at control-flow merge points, and it lacks comprehensive modeling of heap and global memory, which are essential for resolving targets involving indirect memory accesses. Notably, no prior work has explicitly addressed the resolution of indirect tail calls at the binary level, which are more complex as they combine the behavior of indirect calls and returns. Indirect call resolution. Resolving indirect calls in stripped binaries remains difficult because source-level type information is unavailable and calling-convention evidence can be incomplete or 3

CCS ’26, November 15-19, 2026, The Hague, The Netherlands

Kun Liu, Zhengming Ding, Chenke Luo, Tianyi Xu, Zizhan Zheng, Haotian Zhang, and Jiang Ming

reach, the localized message passing may become unreliable. Ultimately, while CupidCall significantly advances single-task indirect call resolution, these structural constraints can limit its broader applicability to more complex ICF behaviors.

2.4

the evidence governing it actually appears. In recovered binaries, the relevant evidence may reside several hops away, may flow through data objects rather than direct control-flow edges, or may be only partially exposed because code-data xRefs are incompletely recovered. Consequently, even graph-based models such as CupidCall [30] can degrade when ordinary message passing must carry semantic information across distant or fragmented structures. To address this, ICFlowNet introduces candidate-aware Dual Virtual Hubs inspired by global graph attention [34–36]: a Global Code Hub (GCH) and a Global Data Hub (GDH). At a high level, the GCH provides sparse fallback routes among task-relevant code candidates, while the GDH aggregates data-side evidence associated with those candidates rather than indiscriminately mixing the entire program. By synchronizing these two hubs, ICFlowNet creates short cross-domain communication paths between distant code and data evidence. This design alleviates long-range bottlenecks while preserving the sparse, heterogeneous structure of binary graphs.

Graph Representation Learning for Binaries

Graph-based models are increasingly used in binary analysis because they preserve non-sequential structural relations that are difficult to encode in linearized disassembly. Prior work has shown their usefulness for tasks such as binary provenance analysis, similarity detection, and type inference [39, 50, 51]. These applications naturally involve heterogeneous entities and relations, motivating graph models that can distinguish code from data and control-flow from cross-references [52–54]. Heterogeneous graph attention networks. To model this structure, we construct heterogeneous program graphs whose node and edge types reflect different program entities and relationships. Graph Attention Networks (GATs) [55] are a natural backbone because attention weights can adapt aggregation to noisy and irregular neighborhoods, and prior work has demonstrated the effectiveness of attention-based graph learning on binary code [50, 51]. In heterogeneous settings, type-aware attention mechanisms [56] further allow message passing to depend on node and edge types, which is important when code semantics and data semantics must remain distinguishable. Long-range reasoning on binary graphs. Despite these strengths, standard message-passing GNNs still have a limited effective receptive field and often struggle to propagate useful information across many hops [31–33]. This limitation is particularly relevant to binaries, where the evidence needed to resolve an indirect transfer may be distributed across distant basic blocks, shared data objects, and incompletely recovered cross-reference edges. Recent long-range remedies, such as graph transformers and virtual-node style connections [34–36], are promising, but they are not directly tailored to binary graphs, which are heterogeneous, candidate-sparse, and often only partially recovered. These observations motivate the binary-specific design choices introduced next.

3

3.2

Motivation and Overview

3.3

We formulate indirect control-flow (ICF) prediction as a task-aware edge classification problem on an augmented control-flow graph recovered from a stripped binary. Let

ICFlowNet Workflow

Figure 1 summarizes both the offline supervision pipeline used for training/evaluation and the model pipeline used at inference. To avoid ambiguity, only Stage I is offline; Stages II–IV constitute the deployable prediction path. I. Offline supervision pipeline (§4.1). For training and evaluation only, we collect two complementary supervision sources: compilerderived static ICF pairs obtained from a custom LLVM toolchain, and dynamic ICF traces collected with Intel Pin [60]. These labels are never used as runtime input; they serve solely as supervision and evaluation signals. II. Augmented CFG construction (§4.2). Given a stripped binary, we use angr [21] to recover a base control-flow graph and codedata xRefs via symbolization, which interprets immediate values and memory references as potential references between code and data [61]. We then augment this recovered graph with candidateaware Dual Virtual Hubs so that task-relevant code candidates and

T = {ret, icall, itcall, jt} denote the set of ICF types. For each task 𝜏 ∈ T , we construct task-specific candidate basic-block pairs (𝑢, 𝑣) and predict a score 𝑝𝜏 (𝑢, 𝑣) ∈ [0, 1] indicating whether an ICF edge of type 𝜏 exists from 𝑢 to 𝑣. Collectively, these four tasks recover both the existence and the subtype of indirect control-flow edges. This task-aware formulation is necessary because different ICF types share useful structural regularities, yet they do not share identical source/destination spaces or inductive biases.

3.1

Key Insight 2: Multi-Task Learning

A second obstacle is task fragmentation. Existing models [26, 27, 29, 30] typically address only one ICF subtype at a time, even though the underlying behaviors are related. Return targets depend on earlier calls, indirect tail calls combine call-like and jump-like behavior, and the same recovered graph may contain evidence that is useful across multiple ICF types. Training separate models therefore underutilizes supervision and is especially brittle for rare or structurally ambiguous cases. This motivates our use of Multi-Task Learning (MTL) [57–59]. ICFlowNet employs a shared representation to capture reusable structural patterns across ICF types, while preserving task-specific decision boundaries through separate prediction heads. This arrangement enables inductive transfer: abundant tasks (e.g., returns) help regularize and guide the learning of rarer tasks (e.g., indirect tail calls), improving generalization without collapsing all ICF types into a single homogeneous objective.

Key Insight 1: Dual Virtual Hubs

The central architectural obstacle is not merely graph size, but the mismatch between where an ICF transfer is executed and where 4

ICFlowNet

CCS ’26, November 15-19, 2026, The Hague, The Netherlands

Code Node Augmented Data Node CFG Global Code Hub Global Data Hub

Multi-Task Heterogeneous GATs

Disassembly & Symbolization

Node Embeddings

(Embedded) Code Node Data Node Global Code Hub Global Data Hub

Node Pair …

Compilation

Type = return P(N1, N2) = 0.99 P(N3, N6) = 0.01

Statically/Dynamically Collected ICF Pairs

Compiler-level Type Analysis

Multi-Layer Perceptron

Instruction Label Parser

Dynamic Tracing

Figure 1: The overview of ICFlowNet’s architecture.

JTID

ITCID

OriginTag

JTID

ICID

Source

JTEID RETID

4.1

CalleeType

Destination

IsFuncEntry

FuncType

Figure 2: Instruction label. OriginTag: JTID: ITCID: ICID: CalleeType: JTID-JTEID: RetID: isFuncEntry: FuncType:

Identifier of the source file. Identifier of the jump table. Identifier of the indirect tail call. Identifier of the indirect call. Callee type of the call instruction. Entry index for the jump table ID. Return site ID (for functions with multiple rets). 1 = Function entry; 0 = Not an entry. Type identifier for the current function.

nearby data evidence can interact through sparse long-range routes even when explicit xRef chains are incomplete. III. Heterogeneous graph encoding and edge scoring (§4.3). A Heterogeneous Graph Attention Network (HGAT) encodes the augmented graph into relation-aware node representations. For each task-specific candidate pair, ICFlowNet combines the source and destination embeddings and predicts the probability that the corresponding ICF edge exists. To study the effect of supervision quality without changing the architecture, we train the same model under separate static and dynamic supervision regimes. IV. Task-aware multi-task learning (§4.4). On top of the shared HGAT encoder, ICFlowNet adds task-specific graph heads and classifiers for ICF variants. This design allows the model to share structural knowledge across tasks while preserving subtype-specific prediction boundaries. During inference, the same statically recoverable graph construction path is used, and the task-aware heads score candidate pairs across all four ICF types.

4

Clean Evaluation and Source Separation

Static ICF pairs. We customize the LLVM frontend and backend to collect ground-truth ICF pairs during compilation. For indirect calls and indirect tail calls, we use LLVM-CFI [62] annotations and address-taking criteria, following a type-based strategy inspired by Modular CFI [63]. For jump tables, we intercept instruction selection to recover dispatch-target mappings. Return edges are reconstructed by pairing callsites with their fall-through successors while accounting for tail-call optimization. All collected pairs are indexed by our instruction-labeling system and later mapped back to final binary addresses. We provide more details in Appendix D. Instruction-level labeling. An instruction may serve as a source, destination, or both across multiple ICF transfers. To represent this, we design a compact, delimiter-separated labeling format that encodes both source and destination metadata into a single string (see Figure 2). The source segment records outgoing edge attributes (e.g., dispatch context), while the destination segment captures incoming properties (e.g., target type). This compositional structure allows one instruction to support multiple ICF types and incremental updates. Post-generation, ICFlowNet parses these labels to reconstruct ICF pairs and lifts them to the basic block level. Dynamic ICF pairs. We complement static supervision with dynamic traces collected by a customized Intel Pin tool [60]. Tracing is triggered by each project’s native test suite and supplementary tests when available. Dynamic indirect jumps are post-classified into subtypes by matching dispatch sites against known tail-call and jump-table locations. All traced events are then lifted to basic blocks using the same mapping pipeline as our static representation. Clean test protocol. Static and dynamic supervision have complementary failure modes: static analysis over-approximates, whereas dynamic tracing is incomplete. We therefore evaluate with a clean test protocol that treats dynamically observed targets as positives and samples an equal number of negatives only from the region outside the static candidate set. This avoids penalizing dynamically unseen but statically plausible edges. For example, if an indirect callsite has 3 dynamic targets and 10 static candidates among 1,000 total functions, then the 3 dynamic edges are treated as positives, and 3 negatives are sampled only from the remaining 1,000−10 = 990 noncandidate functions. In our dataset, this absolute-negative region covers 98.7% of the inter-procedural control-flow space. For jump tables, whose compiler-derived labels are highly reliable, we later use the static labels as ground truth rather than dynamic positives.

System Design

This section instantiates the four stages summarized in Figure 1: offline supervision collection, augmented CFG construction, heterogeneous graph encoding, and task-aware multi-task learning. 5

CCS ’26, November 15-19, 2026, The Hague, The Netherlands

Kun Liu, Zhengming Ding, Chenke Luo, Tianyi Xu, Zizhan Zheng, Haotian Zhang, and Jiang Ming

Table 2: Taxonomy of ICF transfers and their candidates. Type (𝜏)

𝜏 ) Potential Source (𝐶𝑠𝑟𝑐

𝜏 ) Potential Destination (𝐶𝑑𝑠𝑡

Indir. Call Indir. Tail Call Jump Table Return

Indir. call sites Indir. jump sites Indir. jump sites Return basic blocks

Function entry blocks Function entry blocks Intra-function basic blocks Post-callsite basic blocks

of connecting to all data nodes, it connects only to the task-specific data neighborhood 𝜏 𝜏 𝐷𝜏 = {𝑑 ∈ 𝑉𝑑 | dist𝑥𝑟𝑒 𝑓 (𝑑, 𝐶𝑠𝑟𝑐 ∪ 𝐶𝑑𝑠𝑡 ) ≤ 2},

where dist𝑥𝑟𝑒 𝑓 (𝑑, 𝐶) = min dist𝐺𝑥𝑟𝑒 𝑓 (𝑑, 𝑢),

Supervision source separation. Static and dynamic supervision also provide different trade-offs: the former offers broader coverage, while the latter offers higher precision. Unlike prior work that relies on a single source [26, 30], we treat compiler-derived and dynamically traced ICF pairs as two independent supervision sources. We therefore train two architecturally identical models, one under static supervision and the other under dynamic supervision, and evaluate both on the same clean test set. This design isolates the effect of supervision quality from architectural differences and enables a fair comparison between comprehensive-but-noisy and precise-but-incomplete supervision regimes.

4.2

𝑢 ∈𝐶

and 𝐺𝑥𝑟𝑒 𝑓 is the subgraph induced by explicit code-data relations in the recovered base graph. This definition preserves nearby data evidence that is often useful for ICF resolution while filtering out unrelated global data nodes. We select the 2-hop radius empirically after evaluating 1, 2, and 3 hops (detailed in Appendix J). A further requirement is that the same graph-construction procedure must be available during inference. Hence, all candidate sets must be derivable purely from static frontend outputs. This creates an ambiguity for indirect jumps: as shown in Table 2, jump tables and indirect tail calls may originate from similar indirect-jump sites but have different destination spaces. Rather than forcing a brittle frontend subtype decision, we disable static indirect-jump resolution and conservatively route unresolved indirect-jump blocks to the GCH as generic source candidates. This slightly increases hub edges, but preserves source-side recall and leaves subtype disambiguation to the downstream model. Consequently, the statically 𝜏 , 𝐶 𝜏 , and 𝐷 serve only as structural priors constructed sets 𝐶𝑠𝑟𝑐 𝜏 𝑑𝑠𝑡 for graph construction, not as supervision labels. Node initial embedding. We define initial node representations tailored to their specific roles. Ordinary code nodes are initialized with PalmTree embeddings [64] to capture fine-grained instruction semantics. For data nodes, we advance beyond CupidCall’s bare normalized addresses [30] by concatenating them with lightweight structural features. Finally, the two newly proposed hub nodes (GCH & GDH) use learnable type embeddings rather than binaryderived features to capture their overarching semantic roles.

Augmented CFG Construction

Base graph construction. Given a stripped binary, we recover a heterogeneous augmented CFG (ACFG) using angr [21] and symbolization [61]. Symbolization interprets immediate values and memory references as potential code-data xRefs. Compared with prior ACFG formulations [30], we additionally preserve deterministic direct jumps as explicit edge types because they expose the intra-procedural skeleton needed for jump-table and return reasoning. To maintain strict feature/label separation, all target ICF edges are excluded from the input graph and used only as supervision. Dual global hubs. Ideally, an explicit local cross-reference path (e.g., src → data → dst) provides the strongest structural evidence for ICF prediction [30]. In recovered binary graphs, however, such paths are often incomplete: the exact shared data object may be missing, only part of the chain may be recovered, or the relevant evidence may be fragmented across nearby wrappers and basic blocks. Under ordinary message passing, these breaks either sever connectivity or force useful evidence to travel through many local hops, where it weakens. To mitigate this bottleneck, we augment the graph with two virtual nodes: a Global Code Hub (GCH, 𝑣 GCH ) and a Global Data Hub (GDH, 𝑣 GDH ). The GCH provides a sparse codeside fallback among task-relevant code candidates, while the GDH aggregates nearby data evidence associated with those candidates. A bidirectional link between the two hubs allows control-side and data-side summaries to interact within constant depth. We call them “global” because they enable long-range communication across the graph, not because they connect densely to all nodes. Candidate-aware pruning. Binary graphs are large, but ICF prediction is candidate-sparse. Standard global attention connects all node pairs and incurs O (𝑁 2 ) cost; even restricting attention to one 𝜏 | · |𝐶 𝜏 |) direct routing. task would still require O (|𝐶𝑠𝑟𝑐 𝑑𝑠𝑡 We therefore connect only task-relevant candidates through the hubs, reducing the additional routing footprint to a sparse, nearlinear form. Formally, for each task 𝜏 ∈ T = {ret, icall, itcall, jt}, 𝜏 and a destination candidate we define a source candidate set 𝐶𝑠𝑟𝑐 𝜏 set 𝐶𝑑𝑠𝑡 according to Table 2. The GCH connects only to nodes in these two code candidate sets. The GDH is also sparsified: instead

4.3

Heterogeneous Graph Attention Networks

After constructing the augmented graph in Section 4.2, we encode it with a Heterogeneous Graph Attention Network (HGAT) [56]. Compared with homogeneous GNNs, HGAT preserves the semantics of different relation types, which is important in our setting because control-flow edges and code-data xRefs play distinct roles in ICF reasoning. Base graph formulation. We represent each recovered program as a heterogeneous graph 𝐺 = (𝑉 , 𝐸, 𝑅,𝑇 ), where 𝑉 = 𝑉𝑐 ∪ 𝑉𝑑 contains code nodes and data nodes, 𝑅 is the relation-type set, 𝑇 = {code, data} is the node-type set, and 𝐸 ⊆ 𝑉 × 𝑅 × 𝑉 contains typed control-flow and xRef relations. Following prior ACFG-style formulations [30], we preserve direct control-flow edges and explicit cross-references, and we optionally add reverse relations for bidirectional message passing. To avoid leakage from frontend heuristics, we disable angr’s [21] indirect-jump resolver, so no heuristically recovered indirect targets appear in the input graph. Relation-aware HGAT encoder. Let N𝑣𝑟 = {𝑢 | (𝑢, 𝑟, 𝑣) ∈ 𝐸} denote the neighbors of node 𝑣 under relation 𝑟 . For each relation 𝑟 , target node 𝑣, and layer 𝑙, the 𝐾-head attention coefficients and 6

ICFlowNet

CCS ’26, November 15-19, 2026, The Hague, The Netherlands

relation-specific aggregated message are      (𝑟,𝑘 ) , = softmax𝑢 ∈ N𝑣𝑟 LeakyReLU (a𝑟(𝑘 ) ) ⊤ W𝑟(𝑘 ) h𝑢(𝑙 ) ∥ W𝑟(𝑘 ) h𝑣(𝑙 ) 𝛼𝑢𝑣 (1) 𝐾 1 ∑︁ ∑︁ (𝑟,𝑘 ) (𝑘 ) (𝑙 ) m𝑣(𝑟,𝑙 ) = (2) 𝛼𝑢𝑣 W𝑟 h𝑢 , 𝐾 𝑟

Indirect Call

Code Node Data Node Global Code Hub Global Data Hub

FWD

T = Return

𝑘=1 𝑢 ∈ N𝑣

where h𝑣(𝑙 ) is the hidden state of node 𝑣, ∥ denotes concatenation, and W𝑟(𝑘 ) and a𝑟(𝑘 ) are relation-specific learnable weights. These base messages m𝑣(𝑟,𝑙 ) elegantly encapsulate localized, relation-aware context prior to integration with global routing signals. Extended graph definition. For a single task 𝜏, we extend 𝐺 to

Indirect Tail Call

BP Augmented CFG

Shared GATs

FWD: Forward Propagation BP: Backpropagation

Jump Table

Positive Edges Type Prediction

Return

Task-Aware GATs

Figure 3: The overview of multi-task learning architecture.

𝐺𝜏+ = (𝑉𝜏+, 𝐸𝜏+, 𝑅𝜏+,𝑇𝜏+ ),

where 𝑓 is a nonlinearity (we use ELU), 𝛼𝜙 (𝑣) is a learnable scalar, and LN𝜙 (𝑣) is a node-type-specific LayerNorm. Only ordinary nodes 𝑉𝜏+ = 𝑉 ∪ {𝑣 GCH, 𝑣 GDH }, 𝑇𝜏+ = 𝑇 ∪ {gcode, gdata}, use this gated fusion; hub nodes follow the standard HGAT update. Mitigating hub-side bottlenecks. To prevent information botand tlenecks, we mitigate hub-side oversquashing via three structural 𝑅𝜏+ = 𝑅 ∪ {𝑟𝑠𝑟𝑐2𝑔𝑐ℎ , 𝑟𝑔𝑐ℎ2𝑠𝑟𝑐 , 𝑟𝑑𝑠𝑡 2𝑔𝑐ℎ , 𝑟𝑔𝑐ℎ2𝑑𝑠𝑡 , constraints. First, candidate-aware sparse connectivity restricts links 𝑟𝑑𝑎𝑡𝑎2𝑔𝑑ℎ , 𝑟𝑔𝑑ℎ2𝑑𝑎𝑡𝑎 , 𝑟𝑔𝑐ℎ2𝑔𝑑ℎ , 𝑟𝑔𝑑ℎ2𝑔𝑐ℎ }. exclusively to task-specific nodes, minimizing noise influx. Second, 𝜏 , 𝐶 𝜏 , and 𝐷 defined in Section 4.2, Using the candidate sets 𝐶𝑠𝑟𝑐 𝜏 𝑑𝑠𝑡 relation-specific multi-head attention preserves distinct semantic we add the hub edges subspaces for diverse interactions (e.g., src-to-hub vs. data-to-hub) ℎ𝑢𝑏 𝜏 𝜏 𝐸𝜏 = {(𝑢, 𝑟𝑠𝑟𝑐2𝑔𝑐ℎ , 𝑣 GCH ) | 𝑢 ∈ 𝐶𝑠𝑟𝑐 } ∪ {(𝑣 GCH, 𝑟𝑔𝑐ℎ2𝑠𝑟𝑐 , 𝑢) | 𝑢 ∈ 𝐶𝑠𝑟𝑐 } rather than collapsing them. Finally, hub-gated fusion selectively injects global context, ensuring hubs act as routing shortcuts that 𝜏 𝜏 ∪ {(𝑢, 𝑟𝑑𝑠𝑡 2𝑔𝑐ℎ , 𝑣 GCH ) | 𝑢 ∈ 𝐶𝑑𝑠𝑡 } ∪ {(𝑣 GCH, 𝑟𝑔𝑐ℎ2𝑑𝑠𝑡 , 𝑢) | 𝑢 ∈ 𝐶𝑑𝑠𝑡 } complement, rather than overwhelm, local ACFG evidence. To∪ {(𝑢, 𝑟𝑑𝑎𝑡𝑎2𝑔𝑑ℎ , 𝑣 GDH ) | 𝑢 ∈ 𝐷𝜏 } ∪ {(𝑣 GDH, 𝑟𝑔𝑑ℎ2𝑑𝑎𝑡𝑎 , 𝑢) | 𝑢 ∈ 𝐷𝜏 } gether, these mechanisms support efficient long-range communication without reducing hubs to dense, undifferentiated sinks. ∪ {(𝑣 GCH, 𝑟𝑔𝑐ℎ2𝑔𝑑ℎ , 𝑣 GDH ), (𝑣 GDH, 𝑟𝑔𝑑ℎ2𝑔𝑐ℎ , 𝑣 GCH )}. Task-specific edge scoring. The extended HGAT model is trained The final edge set is end-to-end using a binary edge classification objective. For each 𝐸𝜏+ = 𝐸 ∪ 𝐸𝜏ℎ𝑢𝑏 . task 𝜏, let 𝜏 𝜏 P𝜏 ⊆ 𝐶𝑠𝑟𝑐 × 𝐶𝑑𝑠𝑡 Routing intuition. These hub edges implement a gather-andbroadcast mechanism. Source and destination candidates send taskdenote the candidate source–destination pairs to be scored on 𝐺𝜏+ . relevant code semantics to the GCH, while data nodes in 𝐷𝜏 provide For each (𝑢, 𝑣) ∈ P𝜏 , we concatenate the source and destination nearby data evidence to the GDH. The bidirectional GCH↔GDH representations and apply a task-specific two-layer MLP:  h i  link then exchanges control-side and data-side summaries. When 𝜏 r𝑢𝑣 = GELU W𝜏,1 h𝑢(𝐿) ∥ h𝑣(𝐿) + b𝜏,1 , a local src → data → dst chain is missing or fragmented, (5)
𝜏 ⊤ 𝜏 the model can still exploit two complementary fallback routes: 𝑦ˆ𝑢𝑣 = 𝜎 w𝜏,2 r𝑢𝑣 + 𝑏𝜏,2 , a code-side route through the GCH, and a data-side route through 𝜏 ∈ R256 . where W𝜏,1 ∈ R256×512 , b𝜏,1 ∈ R256 , w𝜏,2 ∈ R256 , and r𝑢𝑣 {src, dst} → GCH → GDH → 𝐷𝜏 . Each task 𝜏 uses an independent endpoint-scoring MLP. We opti+ + Hub-gated fusion. Let 𝜙 : 𝑉𝜏 → 𝑇𝜏 denote the node-type mapmize the weighted binary cross-entropy loss ping. For each ordinary node 𝑣, we partition its incident relations ∑︁  ℎ𝑢𝑏 𝜏 𝜏 𝜏 𝜏
𝜏
 into local relations 𝑅𝑙𝑜𝑐 𝑣 and hub relations 𝑅 𝑣 , and aggregate them L𝜏BCE = − 𝑤 pos 𝑦𝑢𝑣 log 𝑦ˆ𝑢𝑣 + 1 − 𝑦𝑢𝑣 log 1 − 𝑦ˆ𝑢𝑣 , (6) separately: (𝑢,𝑣) ∈ P𝜏 ∑︁ ∑︁ 𝜏 ∈ {0, 1} is the label for task 𝜏, and 𝑤 𝜏 is the task-specific (𝑙 ) (𝑙 ) where 𝑦𝑢𝑣 m𝑣,𝑙𝑜𝑐 = m𝑣(𝑟,𝑙 ) , m𝑣,ℎ𝑢𝑏 = m𝑣(𝑟,𝑙 ) . pos positive weight computed from the training split. 𝑙𝑜𝑐 ℎ𝑢𝑏 𝑟 ∈𝑅 𝑟 ∈𝑅

where

𝑣

𝑣

To prevent global routing from overwhelming strong local evidence, we compute a scalar local-conditioned gate    (𝑙 )  𝑔𝑣(𝑙 ) = 𝜎 (w𝜙 (𝑣) ) ⊤ m𝑣,𝑙𝑜𝑐 ∥ h𝑣(𝑙 ) + 𝑏𝜙 (𝑣) , (3)

4.4

Multi-Task Heterogeneous GATs

To jointly predict all four ICF types, we extend the HGAT into a multi-task learning (MTL) architecture, as depicted in Figure 3. A shared heterogeneous encoder (comprising the computationally intensive lower layers) feeds four lightweight task-specific GATs, each driving a dedicated binary edge classifier. To strictly prevent label contamination, each classifier trains exclusively on its own positive edges and independently sampled negatives. This isolation

where 𝑔𝑣(𝑙 ) ∈ (0, 1) and 𝜎 is the sigmoid function. The updated node state is   (𝑙 ) (𝑙 ) (𝑙 )
h𝑣(𝑙+1) = 𝑓 LN𝜙 (𝑣) m𝑣,𝑙𝑜𝑐 + 𝛼𝜙 (𝑣) 𝑔𝑣(𝑙 ) m𝑣,ℎ𝑢𝑏 + W𝑟𝑒𝑠 h , (4) 𝑣 𝜙 (𝑣) 7

CCS ’26, November 15-19, 2026, The Hague, The Netherlands

Kun Liu, Zhengming Ding, Chenke Luo, Tianyi Xu, Zizhan Zheng, Haotian Zhang, and Jiang Ming

Table 3: The statistics of our collected ICF edges. (𝑠 ) = static (compiler-level), (𝑑 ) = dynamic.

preserves task-specific nuances while enabling reciprocal crosstype transfer, substantially outperforming independent single-task models. Additionally, an auxiliary edge-type classification head— trained solely on positive edges—forces the shared encoder to explicitly separate semantically similar behaviors, yielding highly type-discriminative representations. Unified MTL graph. The MTL framework aggregates all task can+ didates into a unified graph 𝐺 𝑀𝑇 𝐿 . To avoid brittle frontend subtype decisions and keep graph construction inference-available, we uniformly route all ambiguous indirect-jump sources (tail-calls vs. jump tables) to the GCH. Crucially, this is paired with an asymmetric routing design where jump-table targets (intra-procedural blocks) are strictly excluded. We enforce this isolation to prevent injecting intra-procedural noise into the global hub—an issue we empirically observed to degrade jump-table prediction in single-task settings. As a result, the GCH explicitly avoids absorbing local target semantics, preserving its integrity as a predominantly inter-procedural anchor. Ultimately, this asymmetric topology provides an elegant structural prior for the MTL framework: it naturally restricts the task-specific jump-table head to rely on the local ACFG topology, while enabling the tail-call head to exploit the GCH for global reachability, thereby maintaining precision across all scales. Shared encoder without label leakage. Our shared encoder serves solely to extract common topological features, while task-specific GATs train exclusively on their respective labels. This strict isolation prevents label leakage [65, 66]—a critical flaw where groundtruth from one task inadvertently influences another. By fully decoupling the supervision signals, our architecture exploits the generalization benefits of multi-task learning while maintaining the rigorous evaluation bounds of independent single-task models. Overall loss. We optimize L𝑡𝑜𝑡𝑎𝑙 =

∑︁

𝜆𝜏 L𝜏BCE + 𝜆𝑡 𝑦𝑝𝑒 L𝑡CE 𝑦𝑝𝑒 ,

Type Indir. Call (𝑠 ) Indir. Tail Call (𝑠 ) Jump Table (𝑠 ) Return (𝑠 ) Indir. Call (𝑑 ) Indir. Tail Call (𝑑 ) Jump Table (𝑑 ) Return (𝑑 )

# of Sites 2.6M 42.3k 325.8k 6.3M 58.1k 3.1k 15.1k 68.6k

# of Pairs 63.4M 2.9M 2.6M 180.1M 92.1k 8.8k 40.3k 128.1k

This section proceeds as follows. We first describe the construction of our training dataset, which is designed to provide reliable supervision across all four ICF types. We then present the experimental setup, including strict package-level splitting, function-level deduplication, and hyperparameter tuning. The evaluation itself is organized along three main axes: supervision source (Dynamic vs. Static vs. Large Static), structural difficulty (Overall vs. Long-range), and training paradigm (Single-task vs. Multi-task). Concretely, we first evaluate the full single-task model with Dual Hubs under different supervision regimes to determine the strongest training setting (RQ1). We then isolate the contribution of the Dual Virtual Hubs, focusing on long-range and otherwise hard-to-reach pairs where local message passing is most challenged (RQ2). Next, we introduce multi-task learning (MTL) to measure the additional gains from cross-type transfer under the same setting (RQ3). We subsequently compare the resulting system with prior state-of-the-art (SOTA) approaches on both established benchmarks and our curated dataset (RQ4). Finally, we assess the practical efficiency and scalability of the MTL framework and Dual Virtual Hubs (RQ5). • RQ1 (Single-task performance with Dual Hubs): Under the same clean-test protocol, how does our single-task model with Dual Hubs perform under dynamic, static, and largescale static supervision? • RQ2 (Long-range ICF pairs analysis): How critical are the Dual Virtual Hubs for resolving long-range and otherwise unreachable ICF pairs? • RQ3 (Multi-task model performance): How does the multitask model compare with the single-task model under the same supervision setting? • RQ4 (Comparative evaluation): How does our model compare with existing ICF prediction approaches on both prior benchmarks and our comprehensive curated dataset? • RQ5 (Efficiency and scalability): What are the computational costs and scalability characteristics of our MTL framework and Dual Virtual Hubs?

(7)

𝜏∈T

where L𝑡CE 𝑦𝑝𝑒 is an optional auxiliary type-classification loss computed only on positive training pairs to encourage subtype-discriminative shared representations. In our experiments, we set 𝜆𝜏 = 1 for all tasks and 𝜆𝑡 𝑦𝑝𝑒 = 1 when the auxiliary head is enabled. This formulation encourages the model to make consistent and accurate predictions across tasks while leveraging auxiliary supervision to strengthen learning during training.

5

# of Bin. 12.6k 2.1k 13.3k 12.7k 858 209 1171 928

Evaluation

Prior work [26, 30] has shown that more accurate ICF recovery strengthens downstream security analyses such as binary diffing and hybrid fuzzing by providing a more faithful structural backbone. In this paper, however, our goal is to evaluate that foundational layer directly. Downstream applications introduce many additional components and confounding factors, which can obscure whether an observed gain truly comes from improved ICF recovery. We therefore focus our evaluation on ICFlowNet’s core predictive capability itself: recovering high-fidelity ICF edges across all major ICF types—not merely indirect calls—in stripped binaries. By delivering high-fidelity predictions, ICFlowNet provides the comprehensive control-flow recovery essential for robust downstream defenses.

5.1

Training Dataset Construction

To train and evaluate ICFlowNet consistently, we require a unified corpus with reliable ground truth covering all four indirect controlflow (ICF) types. Existing datasets are fragmented and each captures only part of this space. SJA [29] focuses on jump tables collected with an older LLVM toolchain; CupidCall [30] is trained exclusively on statically inferred indirect-call pairs; and Callee [26] relies solely 8

ICFlowNet

CCS ’26, November 15-19, 2026, The Hague, The Netherlands

on dynamically traced indirect-call pairs. Such single-source supervision schemes limit diversity, complicate fair comparison, and prevent comprehensive multi-task training across ICF types. We therefore construct a new large-scale dataset explicitly designed to provide consistent supervision and reliable ground truth for all four ICF transfers. Our dataset is built from 12,972 C/C++ projects in the Arch Linux ecosystem. Each package is compiled from source using a custom LLVM-based toolchain (v19.1.5) integrated with Arch’s makepkg and PKGBUILD infrastructure. After deduplication, we retain only binaries containing at least one static ICF pair, extracted via our instruction-labeling parser. For packages with native test suites, we additionally perform dynamic tracing to obtain precise runtime ICF pairs. To reduce the coverage bias of native tests on more complex software, we further select 20 ubiquitous medium-sized real-world projects (e.g., PostgreSQL and Wireshark) and use LLMgenerated supplementary tests to trigger deeper execution paths. This augmentation substantially enriches the dynamic ground truth for complex applications. Appendix E provides the detailed dataset construction pipeline. Ultimately, this pipeline yields 15, 901 unique stripped binaries, including 1,351 with dynamic ground truth—substantially larger than prior dynamic resources such as Callee [26]. Table 3 summarizes the resulting edge-level statistics. As expected, indirect tail calls remain much rarer than indirect calls and returns, reflecting the fact that tail-call optimization is governed by strict optimization and Application Binary Interface (ABI) constraints [67].

5.2

test robustness under broader but noisier supervision. Evaluation remains strictly noise-free: for inter-procedural tasks, our clean test protocol uses verified dynamic positives as true labels and samples negatives only from the absolute-negative region outside the static candidate set. To compare supervision sources fairly, we first restrict attention to the subset of binaries for which both static and dynamic labels are available. We split this common-source subset using the same package-level multi-label stratified procedure described above (approximately 80% train, 10% validation, and 10% test), and then train two architecturally identical models: one under dynamic supervision and one under static supervision. Both are evaluated on the same clean test set, so any performance difference can be attributed to the supervision source rather than to architectural or evaluation differences. We then enlarge the static training set to the full static corpus while keeping the test set unchanged, which isolates the effect of training scale under the same evaluation protocol. This yields the three supervision regimes used later in Section 5.3: dynamic, static, and large-scale static. Long-range test subset. To evaluate whether Dual Hubs help precisely where local message passing is weakest, we derive a longrange subset from the test set. For each labeled pair, we compute the shortest-path distance between its source and destination on the base ACFG, i.e., before adding any hub edges [30]. We classify a pair as long-range if either: (1) its shortest path is greater than 4 hops, or (2) the source and destination are disconnected even though both endpoints are present in the recovered graph. We define pairs separated by more than 4 hops, together with disconnected pairs, as long-range cases. This threshold is motivated by prior observations that the ability of message-passing GNNs to propagate and preserve task-relevant information degrades as graph distance increases [31, 33]. Disconnected pairs represent the limiting case, as no information can be exchanged through local message passing. We therefore report performance on both the full test set (Overall) and this long-range subset. The latter provides a targeted stress test of long-distance reasoning and allows us to assess whether the Dual Hubs improve information exchange beyond conventional local propagation. Function-level deduplication. Existing datasets like Callee [26] and CupidCall [30] exhibit significant function-level overlap between training and test splits (15.9% and 13.6%, respectively). This redundancy allows models to trivially memorize control-flow patterns, artificially inflating evaluation metrics. To rigorously evaluate true generalization, we enforce strict function-level deduplication. For each labeled function, we compute a SHA-256 hash over its sequence of assembly mnemonics to generate a structural fingerprint. After splitting, we strictly purge any test-set labels whose function fingerprint appears in the training set. This per-edge-type filtering removes 1.18% to 15.32% of overlapping test instances (Table A1), eliminating structural data leakage within the GAT’s message-passing scope (details in Appendix G). Hyperparameter tuning. We utilize Optuna [69] to maximize validation F1 and identify a near-optimal configuration for our architecture. To ensure stable performance and fair comparability across all settings, we consistently apply the resulting configuration: 256 hidden units, 4 GAT layers, 8 attention heads, a dropout

Experimental Setup

All experiments were conducted on a server equipped with an Intel Xeon 8358 CPU, 512GB RAM, and four 80GB NVIDIA A100 GPUs. Our implementation relies on PyTorch 2.3, Deep Graph Library (DGL) 2.4, and angr 9.2.157. Package-level stratified data splitting. To prevent data leakage and ensure fair evaluation, we adopt a package-level multi-label proportional sampling strategy [68]. Because binaries within the same package often share code templates, compiler options, and library dependencies, we assign entire packages to a single split. This design preserves structural independence across datasets while maintaining a balanced distribution of ICF edge types. Please refer to Appendix F for more details. Noise-aware training, noise-free evaluation. We deliberately separate the rules for training from those for evaluation. During training, we tolerate some label noise to preserve coverage; during evaluation, we use only low-noise labels. For jump tables, compilerderived labels are sufficiently reliable and therefore serve as the ground truth for all models. For indirect calls, indirect tail calls, and returns, verified dynamic targets define the true edges. When training with dynamic supervision, however, tracing incompleteness makes it unsafe to treat every unobserved candidate as a negative. We therefore depart from Callee [26]: if an unobserved candidate remains statically type-consistent, we discard it from the negative pool rather than labeling it negative, thereby reducing false negatives (𝐹 𝑁 ) introduced by incomplete execution coverage. In contrast, when training with static supervision, we keep the statically collected positives—including unavoidable false positives—to 9

CCS ’26, November 15-19, 2026, The Hague, The Netherlands

Kun Liu, Zhengming Ding, Chenke Luo, Tianyi Xu, Zizhan Zheng, Haotian Zhang, and Jiang Ming

Figure 4: Performance comparison of single-task models utilizing Dual Virtual Hubs under dynamic , static , and large-scale static supervision across ICF types . The x-axis corresponds, in order, to indirect calls, indirect tail calls, jump tables, and returns. Detailed results are provided in Appendix Table A2. Table 4: Ablation of the Dual Hub architecture on the longrange subset. All models are trained with the large-scale static supervision selected in RQ1.

rate of 0.4, weight decay of 10−5 , and a learning rate of 0.001. Comprehensive details regarding the hyperparameter search space and training regimen are deferred to Appendix H.

5.3

Setting

RQ1: Single-task performance with Dual Hubs

Baseline GCH GCH + GDH

To examine (1) the effect of dynamic versus static supervision on the same set of binaries and (2) the influence of training-set size, we evaluate single-task model performance incorporating the Dual Hub architecture under three supervision regimes (Figure 4):

Baseline GCH GCH + GDH

(1) Dynamic supervision ( bars): models trained on binaries whose ICF edges are derived from dynamic tracing; (2) Static supervision ( bars): models trained on the same set of binaries but using compiler-level analysis labels in place of dynamic traces; (3) Large-scale static supervision ( bars): models trained on the full static dataset, expanding the size of available training data.

Baseline GCH GCH + GDH Baseline GCH GCH + GDH

All models are tested on a common clean test set, constructed from the test split of the dynamic dataset using our clean test protocol. The comparison between (1) dynamic and (2) static supervision isolates the effect of complementary ground truths, whereas the comparison between (2) static and (3) large-scale static supervision highlights how training-set size influences model performance. Note that in RQ1, we use Dual Hubs for all ICF types simply to isolate the effect of supervision sources. We evaluate and select the best architecture for each type (e.g., using no hubs for jump tables) later in RQ2. Intra-procedural edges. Dynamic supervision performs significantly worse on jump-table edges because runtime traces seldom capture all dispatch targets, resulting in incomplete labels and lower overall precision, recall, and F1. Inter-procedural edges. Figure 4 compares static and dynamic supervision across three inter-procedural edge types. Trained on the same set of binaries, the two models exhibit complementary error profiles driven by their label sources. Dynamic supervision achieves higher precision because runtime traces include only verified execution edges, yielding very few false positives (𝐹 𝑃). However, as many legitimate edges are never executed during tracing, the number of

Precision (%)

Recall (%)

Indirect Call (ic) 84.73 85.89 88.42 90.87 90.28 92.44 Indirect Tail Call (itc) 80.61 81.85 86.72 88.35 89.54 91.19 Jump Table (jt) 97.35 97.68 96.12 96.45 95.10 95.64 Return (ret) 86.27 86.41 91.13 90.75 91.60 91.16

F1 (%)

𝚫𝑭 1(%)

85.31 89.63 91.35

– +4.32 +6.04

81.23 87.53 90.36

– +6.30 +9.13

97.51 96.28 95.37

– -1.23 -2.14

86.34 90.94 91.38

– +4.60 +5.04

false negatives (𝐹 𝑁 ) increases, leading to lower recall. In contrast, static supervision produces a broader set of positive candidates (𝑇 𝑃 + 𝐹 𝑃) by including all statically inferable control-flow edges. This broader coverage introduces more 𝐹 𝑃 during training but also captures many true positives (𝑇 𝑃) that dynamic tracing misses, resulting in higher recall and F1. As shown in Figure 4, scaling the training data by 10× (_st_large) yields only marginal performance gains. This plateau suggests that the main bottleneck is label quality rather than data volume: simply adding more statically supervised data does not overcome the noise and bias inherent in static labels.

5.4

RQ2: Long Range ICF Pairs Analysis

As shown in Table 4, RQ2 isolates the structural contribution of the Dual Virtual Hubs on the long-range subset defined in Section 5.2. We compare three variants: Baseline (no hubs), GCH (code-side hub only), and GCH + GDH (the full Dual Hub architecture). Inter-procedural tasks. For the three inter-procedural tasks— indirect calls, indirect tail calls, and returns—the baseline is clearly limited by local propagation, with F1 ranging from 81.23% to 86.34%. 10

ICFlowNet

CCS ’26, November 15-19, 2026, The Hague, The Netherlands

Table 5: Performance comparison of Single-Task, Multi-Task (MTL), and the auxiliary type-prediction variant (MTL_t) on the Long-range test dataset. All models are trained on the large-scale static dataset. Note: † Dual hub setting; ‡ No hub setting.

Table 6: Performance comparison of Single-Task, Multi-Task (MTL), and MTL with type prediction (MTL_t) on the Overall test dataset. Same training setting and notation as Table 5. Task Type

Setting

Precision (%)

Recall (%)

F1 (%)

𝚫𝑭 1(%)

91.73 96.55 95.82

94.28 95.82 96.85

92.99 96.18 96.33

– +3.19 +3.34

Task Type

Setting

Precision (%)

Recall (%)

F1 (%)

𝚫𝑭 1(%)

Indirect Call (ic)

Indirect Call (ic)

Single† MTL MTL_t

90.28 94.68 95.36

92.44 96.35 96.30

91.35 95.51 95.83

– +4.16 +4.48

Single† MTL MTL_t

Indirect Tail Call (itc)

89.54 96.15 95.81

91.19 96.19 95.17

90.36 96.17 95.49

– +5.81 +5.13

91.29 97.28 97.66

92.88 96.32 95.18

92.08 96.80 96.40

– +4.72 +4.32

Indirect Tail Call (itc)

Single† MTL MTL_t

Single† MTL MTL_t

Jump Table (jt)

97.35 97.05 98.25

97.68 98.01 97.65

97.51 97.53 97.95

– +0.02 +0.44

98.63 98.95 98.65

98.21 98.01 97.97

98.42 98.48 98.31

– +0.06 -0.11

Jump Table (jt)

Single‡ MTL MTL_t

Single‡ MTL MTL_t

Return (ret)

91.60 96.81 96.11

91.16 96.81 96.47

91.38 96.81 96.29

– +5.43 +4.91

92.93 98.05 98.12

93.01 96.55 95.80

92.97 97.29 96.95

– +4.32 +3.98

Return (ret)

Single† MTL MTL_t

Single† MTL MTL_t

Table 7: Performance on the Callee [26], SJA [29], and our ICFlowNet datasets. Note: MTL is evaluated only on our dataset because Callee and SJA each cover a single ICF type.

Adding the Global Code Hub already yields substantial gains (ic: +4.32, itc: +6.30, ret: +4.60), indicating that code-side long-range routing is useful when the source and target are far apart or disconnected in the base ACFG. Adding the Global Data Hub brings a further improvement for all three tasks, raising the total gains to +6.04 for ic, +9.13 for itc, and +5.04 for ret. The largest improvement appears on itc, suggesting that this task benefits most from combining code-side reachability with additional data-side evidence. Jump tables. The behavior is different for jump tables. Because jump-table resolution is predominantly intra-procedural and depends on localized arithmetic patterns (e.g., base-plus-offset style dispatch), the baseline already performs strongly at 97.51% F1. Adding global routing slightly hurts performance (-1.23 with GCH and -2.14 with GCH + GDH), suggesting that hub-based aggregation introduces unnecessary inter-procedural noise for this task. Takeaway. These results support a task-aware structural design. Dual Hubs are beneficial for inter-procedural tasks (ic, itc, and ret), where long-range routing is often necessary, whereas jump-table prediction is better kept local. We therefore carry this per-type architectural choice forward in RQ3: inter-procedural tasks retain hub routing, while jump-table targets remain outside global routing.

5.5

Dataset

Model

Precision (%)

Recall (%)

F1 (%) (𝚫F1)

Callee

Callee CupidCall Our STL

91.85 94.26 98.22

90.00 92.57 96.83

90.92 (−6.60) 93.41 (−4.11) 97.52 (—)

ICFlowNet (Overall)

Callee CupidCall Our MTL

88.12 91.03 96.55

88.62 89.35 95.82

88.37 (−7.81) 90.18 (−6.00) 96.18 (—)

ICFlowNet (Long-range)

Callee CupidCall Our MTL

80.25 81.16 94.68

84.37 83.84 96.35

82.26 (−13.25) 82.48 (−13.03) 95.51 (—)

SJA

SJA Our STL

97.43 99.28

99.80 99.70

98.60 (−0.89) 99.49 (—)

ICFlowNet (Overall)

SJA Our MTL

95.35 98.95

94.32 98.01

94.83 (−3.65) 98.48 (—)

ICFlowNet (Long-range)

SJA Our MTL

94.56 97.05

93.17 98.01

93.86 (−3.67) 97.53 (—)

are much smaller because this task is already highly localized and near saturation; nevertheless, MTL does not degrade performance, and MTL_t yields a small improvement (+0.44 F1) on the long-range subset. On the Overall test set (Table 6), the same trend remains, although the relative gains are smaller because the distribution is dominated by easier local pairs. MTL still improves F1 over the single-task baseline for all four ICF types. For jump tables, all three variants operate in a near-ceiling regime (98.31%–98.48% F1). Here, MTL remains slightly better than the single-task baseline, while MTL_t shows a minor trade-off between auxiliary type prediction and task-specific optimization. We therefore treat MTL as the most stable overall predictive model, and MTL_t as an auxiliary variant that encourages subtype-discriminative representations rather than uniformly maximizing every per-task metric. As a control, Appendix K shows that removing the Dual Hubs reduces the average MTL gain to only 1.33%, indicating that task sharing alone is insufficient. We also refer the reader to Appendix L, where a simple feature-fusion baseline shows some benefit on datarich tasks, but unlike our architecture, it does not consistently

RQ3: Multi-Task Model (MTL) Performance

As Figure 4 shows, scaling the static training set by 10× yields only a marginal 0.27% average F1 improvement. This saturation suggests that single-task models have largely exhausted the gains obtainable from simply adding more static supervision. Motivated by RQ2, we therefore introduce multi-task learning with task-aware routing: inter-procedural tasks (ic, itc, ret) retain hub-based routing, while jump-table targets remain local. This design encourages cross-type transfer without forcing highly localized tasks to absorb unnecessary global context. Tables 5 and 6 show that MTL consistently improves over the corresponding single-task baselines. Efficacy of MTL. On the Long-range subset (Table 5), where local message passing is most limited, the gains are largest for the three inter-procedural tasks: +4.16 F1 for ic, +5.81 for itc, and +5.43 for ret. These improvements indicate that, once Dual Hubs provide the necessary structural reachability, shared training can further transfer useful semantics across related ICF types. For jump tables, the gains 11

CCS ’26, November 15-19, 2026, The Hague, The Netherlands

Kun Liu, Zhengming Ding, Chenke Luo, Tianyi Xu, Zizhan Zheng, Haotian Zhang, and Jiang Ming

Table 8: Topological overhead introduced by the Dual Virtual Hubs, measured as edge inflation relative to the pruned base ACFG.

improve all task types. Finally, Appendix I shows that the MTL model remains robust across compiler optimization levels O0–O3. Recall improvements. Beyond F1, MTL also improves recall for the inter-procedural tasks, especially on the long-range subset. This is important for binary analysis, where missing valid targets is often more harmful than introducing a small number of extra candidates. Intuitively, shared training allows abundant tasks such as ret to regularize rarer tasks such as itc, reducing false negatives while preserving strong precision.

5.6

Task Type

GCH (%)

GDH (%)

Total (%)

Indir. Call Ret Indir. Tail Call†

+1.70 +2.13 +1.92

+3.28 +3.96 +3.73

+4.98 +6.09 +5.65

MTL (Unified)‡

+3.72

+7.72

+11.44

Note: † Tail-call candidates include ambiguous indirect jumps unresolved

RQ4: Comparative Evaluation

by angr. ‡ MTL is measured on binaries containing at least one inter-procedural edge.

Comparison scope. Since prior studies do not cover ret and tailcall edges, we restrict our direct baseline comparison in the main text to indirect calls and jump tables. For indirect calls, we focus on Callee [26] and CupidCall [30], which are the closest learned baselines in task formulation and available reproducibility. We do not include AttnCall [27] in the main empirical baseline set because its released artifacts do not support a controlled reproduction, and its reported setup is not aligned with real binary indirect-call supervision [30]. We do not treat TypeArmor [24], TypeSqueezer [45], BPA [25], SchedExec [48], BinDSA [46], or Disa [47] as direct baselines, because they make materially different assumptions and produce different outputs, ranging from signature-based pruning and pointer-analysis-based call-graph refinement to disassemblyassisted CFG recovery. Among them, we reserve the closest recent program-analysis systems [46, 47] for external comparison in Appendix M rather than claim a strict artifact-level apples-to-apples reproduction. For jump tables, we compare directly against the state-of-the-art analyzer SJA [29]. Evaluation methodology. We evaluate prior baselines in two settings. First, on the original Callee [26] and SJA [29] datasets, we assess our single-task model (STL) under the same benchmark conventions, while enforcing strict function-level deduplication. Second, on our dataset, we compare our multi-task model against these baselines on both the Overall test set and the structurally harder Long-range subset. Table 7 reports the results. Indirect call prediction. On the original Callee dataset, strict deduplication lowers the reported performance of prior baselines: Callee and CupidCall reach 90.92% and 93.41% F1, respectively, whereas our STL attains 97.52%. On our Overall dataset, the gap widens further: our MTL reaches 96.18% F1, compared with 88.37% for Callee and 90.18% for CupidCall. The difference is largest on the Long-range subset, where Callee and CupidCall fall to 82.26% and 82.48% F1, while our model maintains 95.51%. These results suggest that direct-call-transfer and local graph propagation alone are insufficient for difficult long-range cases, whereas our Dual-Hub design remains effective when the source and target are far apart or disconnected in the base graph. Jump table prediction. On SJA’s original dataset, our STL slightly exceeds SJA (99.49% vs. 98.60% F1). On our dataset, however, the gap becomes larger: SJA reaches 94.83% F1 on the Overall set and 93.86% on the Long-range subset, whereas our MTL achieves 98.48% and 97.53%, respectively. A likely reason is compiler drift: SJA was developed and evaluated on older lowering patterns, while our LLVM 19 binaries contain more aggressive transformations, including merged switch constructs, that are harder to capture with fixed

rules. In contrast, our learned model adapts better to these newer structural patterns.

5.7

RQ5: Efficiency and Scalability

Beyond predictive accuracy, we evaluate the practical cost of the Dual Virtual Hubs and the multi-task learning (MTL) design. Topological overhead of Dual Virtual Hubs. A naive dense routing scheme that connects the GCH to all code nodes and the GDH to all data nodes would substantially enlarge the graph. In contrast, our candidate-aware routing keeps the added edges modest: +4.98% for indirect calls, +6.09% for returns, and +5.65% for indirect tail calls (Table 8). Importantly, this overhead does not stack linearly in the unified MTL graph. Because the inter-procedural tasks share many code candidates and nearby data nodes, the same hubs can be reused across tasks, so the total overhead remains only +11.44%. These results indicate that Dual Hubs provide long-range routing while keeping graph growth limited. Temporal efficiency of MTL. We compare one unified MTL model against a suite of four independent single-task (ST) models. By sharing the lower GAT layers and executing a single data pipeline per graph, MTL reduces cumulative per-graph training time from 9.19 s to 4.08 s (≈ 2.25× speedup). The benefit is even clearer at inference time: the ST baseline requires four separate forward passes, whereas MTL requires only one, reducing per-graph latency from 3.79 s to 1.57 s. Thus, the multi-task design improves not only predictive performance but also end-to-end throughput.

6

Discussion and Conclusion

Design trade-offs and remaining scalability challenges. Our dual-hub design provides a compact compromise between longrange routing and structural sparsity. The GCH shortens distant code-side dependencies, while the GDH aggregates nearby data evidence that may be missing from direct xRef chains. This design is intentionally minimal: adding more hubs could distribute information further, but might also lengthen routing paths and weaken the distance-compression effect that makes virtual routing useful in the first place. More broadly, our results suggest that long-range binary graph reasoning is governed by a tension between two competing forces: shortening communication distance and avoiding excessive information mixing. Pushing too far toward global routing risks introducing structural noise, especially for highly localized mechanisms such as jump tables; pushing too far toward local sparsity, 12

ICFlowNet

CCS ’26, November 15-19, 2026, The Hague, The Netherlands

however, leaves distant inter-procedural evidence unreachable. In addition, although candidate-aware routing already keeps graph growth modest, memory remains a practical concern for very large binaries. A natural next step is candidate-centric graph compression, where the model encodes only task-relevant subgraphs around candidate source/destination sets and their data neighborhoods. Limitations for security-critical deployment. ICFlowNet is designed as a high-fidelity prediction framework, but it is not a universal replacement for conservative program-analysis pipelines. Like other neural approaches, it depends on the training distribution and inherits some optimization variability across datasets and runs. Although our evaluation shows strong and stable performance, these properties can limit direct applicability to safetycritical tasks that require strict completeness guarantees. A representative example is fine-grained control-flow integrity (CFI), where even a small number of missed legitimate targets may be unacceptable. In such settings, ICFlowNet is better viewed as a complementary component—for example, to prioritize candidates, improve binary understanding, shrink search spaces, or augment conservative analyses—rather than as a drop-in substitute for methods that require a hard 100% recall guarantee. Conclusion. ICFlowNet is a unified framework for indirect controlflow prediction in stripped binaries. By combining Dual Virtual Hubs, multi-task heterogeneous graph learning, and a leakageaware evaluation pipeline, it improves both robustness and generalization. Our experiments show that structural repair and cross-type transfer are both important for accurate long-range ICF recovery.

Shared Libraries. In Proceedings of the 27th International Conference on Architectural Support for Programming Languages and Operating Systems (ASPLOS ’22), 2022. [9] Soumyakant Priyadarshan, Huan Nguyen, and R. Sekar. Accurate Disassembly of Complex Binaries Without Use of Compiler Metadata. In Proceedings of the 28th ACM International Conference on Architectural Support for Programming Languages and Operating Systems (ASPLOS ’23), 2023. [10] Chenke Luo, Jiang Ming, Mengfei Xie, Guojun Peng, and Jianming Fu. Retrofitting XoM for Stripped Binaries without Embedded Data Relocation. In Proceedings of the 32nd Network and Distributed System Security Symposium (NDSS ’25), 2025. [11] Yaniv David, Nimrod Partush, and Eran Yahav. Similarity of Binaries through re-Optimization. In Proceedings of the 38th ACM SIGPLAN Conference on Programming Language Design and Implementation (PLDI ’17), 2017. [12] Yaniv David, Nimrod Partush, and Eran Yahav. FirmUp: Precise Static Detection of Common Vulnerabilities in Firmware. In Proceedings of the Twenty-Third International Conference on Architectural Support for Programming Languages and Operating Systems (ASPLOS ’18), 2018. [13] Xiaolei Ren, Michael Ho, Jiang Ming, Yu Lei, and Li Li. Unleashing the Hidden Power of Compiler Optimization on Binary Code Difference: An Empirical Study. In Proceedings of the 42nd ACM SIGPLAN Conference on Programming Language Design and Implementation (PLDI ’21), 2021. [14] Yue Duan, Xuezixiang Li, Jinghan Wang, and Heng Yin. DeepBinDiff: Learning Program-Wide Code Representations for Binary Diffing. In Proceedings of the 27th Network and Distributed System Security Symposium (NDSS ’20), 2020. [15] Dennis Andriesse, Xi Chen, Victor Van Der Veen, Asia Slowinska, and Herbert Bos. An In-Depth Analysis of Disassembly on Full-Scale x86/x64 Binaries. In Proceedings of the 25th USENIX Security Symposium (USENIX Security’16), 2016. [16] Xiaozhu Meng and Barton P. Miller. Binary Code is Not Easy. In Proceedings of the 25th International Symposium on Software Testing and Analysis (ISSTA ’16), 2016. [17] Nathan Burow, Scott A. Carr, Joseph Nash, Per Larsen, Michael Franz, Stefan Brunthaler, and Mathias Payer. Control-Flow Integrity: Precision, Security, and Performance. ACM Computing Surveys (CSUR), 50(1):16:1–16:33, 2017. [18] Chengbin Pang and Ruotong Yu and Yaohui Chen and Eric Koskinen and Georgios Portokalidis and Bing Mao and Jun Xu. SoK: All You Ever Wanted to Know About x86/x64 Binary Disassembly But Were Afraid to Ask. In Proceedings of the 42nd IEEE Symposium on Security and Privacy (S&P ’21), 2021. [19] Hex-Rays. IDA Pro: A Cross-Platform Multi-Processor Disassembler and Debugger. [20] National Security Agency (NSA). Ghidra: Software Reverse Engineering Framework. [21] Yan Shoshitaishvili, Ruoyu Wang, Christopher Salls, Nick Stephens, Mario Polino, Andrew Dutcher, John Grosen, Siji Feng, Christophe Hauser, Christopher Kruegel, and Giovanni Vigna. SoK: (State of) The Art of War: Offensive Techniques in Binary Analysis. In Proceedings of the 37th IEEE Symposium on Security and Privacy (S&P ’16), 2016. [22] Chao Zhang, Tao Wei, Zhaofeng Chen, Lei Duan, László Szekeres, Stephen McCamant, Dawn Song, and Wei Zou. Practical control flow integrity and randomization for binary executables. In 2013 IEEE Symposium on Security and Privacy, pages 559–573, 2013. [23] Viktor Van der Veen, Dennis Andriesse, Enes Göktaş, Ben Gras, Lionel Sambuc, Asia Slowinska, Herbert Bos, and Cristiano Giuffrida. Practical Context-Sensitive CFI. In Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security (CCS ’15), pages 927–940. ACM, 2015. [24] Victor van der Veen, Enes G𝑜¥ ktas, Moritz Contag, Andre Pawoloski, Xi Chen, Sanjay Rawat, Herbert Bos, Thorsten Holz, Elias Athanasopoulos, and Cristiano Giuffrida. A Tough Call: Mitigating Advanced Code-Reuse Attacks at the Binary Level. In Proceedings of the 37th IEEE Symposium on Security and Privacy (S&P’16), 2016. [25] Sun Hyoung Kim, Cong Sun, Dongrui Zeng, and Gang Tan. Refining Indirect Call Targets at the Binary Level. In Proceedings of the 28th Network and Distributed System Security Symposium (NDSS ’21), 2021. [26] Wenyu Zhu, Zhiyao Feng, Zihan Zhang, Jianjun Chen, Zhijian Ou, Min Yang, and Chao Zhang. Callee: Recovering Call Graphs for Binaries with Transfer and Contrastive Learning. In Proceedings of the 44th IEEE Symposium on Security and Privacy (S&P ’23), 2023. [27] Rui Sun, Yinggang Guo, Zicheng Wang, and Qingkai Zeng. AttnCall: Refining Indirect Call Targets in Binaries with Attention. In Gene Tsudik, Mauro Conti, Kaitai Liang, and Georgios Smaragdakis, editors, Proceedings of the 28th European Symposium on Research in Computer Security (ESORICS ’23), 2023. [28] Miltos Allamanis. The Adverse Effects of Code Duplication in Machine Learning Models of Code. In Proceedings of the 2019 ACM SIGPLAN International Symposium on New Ideas, New Paradigms, and Reflections on Programming and Software, October 2019. [29] Huan Nguyen, Soumyakant Priyadarshan, and R. Sekar. Scalable, Sound, and Accurate Jump Table Analysis. In Proceedings of the 33rd ACM SIGSOFT International Symposium on Software Testing and Analysis (ISSTA ’24), 2024.

Acknowledgments We thank all CCS anonymous reviewers for their valuable comments to improve this paper. This work is supported by NSF grants 2417055 & 2555093 and Google Research Scholar Award.

References [1] Gregory J. Duck, Xiang Gao, and Abhik Roychoudhury. Binary Rewriting without Control Flow Recovery. In Proceedings of the 41st ACM SIGPLAN International Conference on Programming Language Design and Implementation (PLDI ’20), 2020. [2] Sushant Dinesh, Nathan Burow, Dongyan Xu, and Mathias Payer. RetroWrite: Statically Instrumenting COTS Binaries for Fuzzing and Sanitization. In Proceedings of the 41st IEEE Symposium on Security and Privacy (S&P ’20), 2020. [3] Xiaozhu Meng and Weijie Liu. Incremental CFG Patching for Binary Rewriting. In Proceedings of the 26th ACM International Conference on Architectural Support for Programming Languages and Operating Systems (ASPLOS ’21), 2021. [4] Niranjan Hasabnis and R. Sekar. Lifting Assembly to Intermediate Representation: A Novel Approach Leveraging Compilers. In Proceedings of the 21st International Conference on Architectural Support for Programming Languages and Operating Systems (ASPLOS ’16), 2016. [5] Anil Altinay, Joseph Nash, Taddeus Kroes, Prabhu Rajasekaran, Dixin Zhou, Adrian Dabrowski, David Gens, Yeoul Na, Stijn Volckaert, Cristiano Giuffrida, Herbert Bos, and Michael Franz. BinRec: Dynamic Binary Lifting and Recompilation. In Proceedings of the 15th European Conference on Computer Systems (EuroSys ’20), 2020. [6] David Williams-King, Hidenori Kobayashi, Kent Williams-King, Graham Patterson, Frank Spano, Yu Jian Wu, Junfeng Yang, and Vasileios P. Kemerlis. Egalito: Layout-Agnostic Binary Recompilation. In Proceedings of the 25th ACM International Conference on Architectural Support for Programming Languages and Operating Systems (ASPLOS ’20), 2020. [7] Volodymyr Kuznetzov, László Szekeres, Mathias Payer, George Candea, R Sekar, and Dawn Song. Code-Pointer Integrity. In Proceedings of the 11th USENIX Symposium on Operating Systems Design and Implementation (OSDI’14), 2014. [8] Haotian Zhang, Mengfei Ren, Yu Lei, and Jiang Ming. One Size Does Not Fit All: Security Hardening of MIPS Embedded Systems via Static Binary Debloating for 13

CCS ’26, November 15-19, 2026, The Hague, The Netherlands

Kun Liu, Zhengming Ding, Chenke Luo, Tianyi Xu, Zizhan Zheng, Haotian Zhang, and Jiang Ming

[30] Haotian Zhang, Kun Liu, Cristian Garces, Chenke Luo, Yu Lei, and Jiang Ming. Resolving Indirect Calls in Binary Code via Cross-Reference Augmented Graph Neural Networks. arXiv preprint arXiv:2507.18801, 2025. [31] Uri Alon and Eran Yahav. On the Bottleneck of Graph Neural Networks and its Practical Implications. In Proceedings of the 9th International Conference on Learning Representations (ICLR ’21), 2021. [32] Jake Topping, Francesco Di Giovanni, Benjamin Paul Chamberlain, Xiaowen Dong, and Michael M. Bronstein. Understanding Over-Squashing and Bottlenecks on Graphs via Curvature. In Proceedings of the 10th International Conference on Learning Representations (ICLR ’22), 2022. [33] Vijay Prakash Dwivedi, Ladislav Rampášek, Mikhail Galkin, Ali Parviz, Guy Wolf, Anh Tuan Luu, and Dominique Beaini. Long Range Graph Benchmark. In Proceedings of the 36th International Conference on Neural Information Processing Systems (NIPS ’22), 2022. [34] Seongjun Yun, Minbyul Jeong, Raehyun Kim, Jaewoo Kang, and Hyunwoo J Kim. Graph Transformer Networks. In Proceedings of 33rd Conference on Neural Information Processing Systems (NeurIPS ’19), 2019. [35] Hamed Shirzad, Ameya Velingker, Balaji Venkatachalam, Danica J Sutherland, and Ali Kemal Sinop. Exphormer: Sparse Transformers for Graphs. In Proceedings of the 40th International Conference on Machine Learning (ICML ’23), 2023. [36] Dongqi Fu, Zhigang Hua, Yan Xie, Jin Fang, Si Zhang, Kaan Sancak, Hao Wu, Andrey Malevich, Jingrui He, and Bo Long. VCR-Graphormer: A Mini-batch Graph Transformer via Virtual Connections. In Proceedings of the 12th International Conference on Learning Representations (ICLR ’24), 2024. [37] Curtis G. Northcutt, Anish Athalye, and Jonas Mueller. Pervasive Label Errors in Test Sets Destabilize Machine Learning Benchmarks. In Proceedings of the 35th Conference on Neural Information Processing Systems (NeurIPS 2021), Datasets and Benchmarks Track, 2021. [38] Vaishaal Shankar, Rebecca Roelofs, Horia Mania, Alex Fang, Benjamin Recht, and Ludwig Schmidt. Evaluating Machine Accuracy on ImageNet. In Proceedings of the 37th International Conference on Machine Learning (ICML ’20), 2020. [39] Chang Zhu, Ziyang Li, Anton Xue, Ati Priya Bajaj, Wil Gibbs, Yibo Liu, Rajeev Alur, Tiffany Bao, Hanjun Dai, Adam Doupé, Mayur Naik, Yan Shoshitaishvili, Ruoyu Wang, and Aravind Machiry. TYGR: Type Inference on Stripped Binaries using Graph Neural Networks. In Proceedings of the 33rd USENIX Security Symposium (USENIX Sec ’24), 2024. [40] Anton Korobeynikov. Improving Switch Lowering for The LLVM Compiler System. In Proceedings of the 2007 Spring Young Researchers Colloquium on Software Engineering (SYRCoSE’2007), 2007. [41] Walter Landi. Recovery of Jump Table Case Statements from Binary Code. Science of Computer Programming, 40(1):1–23, February 2001. [42] Alessandro Di Federico and Giovanni Agosta. A Jump-Target Identification Method for Multi-Architecture Static Binary Translation. In Proceedings of the 2016 International Conference on Compilers, Architectures, and Synthesis for Embedded Systems (CASES ’16), 2016. [43] Lucian Cojocar, Taddeus Kroes, and Herbert Bos. JTR: A Binary Solution for Switch-Case Recovery. In Proceedings of the 9th International Symposium on Engineering Secure Software and Systems (ESSoS ’17), 2017. [44] Roger Anthony Sayle. A Superoptimizer Analysis of Multiway Branch Code Generation. In Proceedings of the 2008 GCC Developers’ Summit, 2008. [45] Ziyi Lin, Jinku Li, Bowen Li, Haoyu Ma, Debin Gao, and Jianfeng Ma. TypeSqueezer: When Static Recovery of Function Signatures for Binary Executables Meets Dynamic Analysis. In Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security (CCS ’23), 2023. [46] Lian Gao and Heng Yin. BinDSA: Efficient, Precise Binary-Level Pointer Analysis with Context-Sensitive Heap Reconstruction. Proceedings of the ACM on Software Engineering, 2(ISSTA), June 2025. [47] Peicheng Wang, Monika Santra, Mingyu Liu, Cong Sun, Dongrui Zeng, and Gang Tan. Disa: Accurate Learning-based Static Disassembly with Attentions. In Proceedings of the 2025 ACM SIGSAC Conference on Computer and Communications Security (CCS ’25), 2025. [48] Yangyang Shi, Linan Tian, Liwei Chen, Yanqi Yang, and Gang Shi. Scheduled Execution-Based Binary Indirect Call Targets Refinement. In Proceedings of 29th European Symposium on Research in Computer Security (ESORICS ’24), 2024. [49] Thomas N. Kipf and Max Welling. Semi-Supervised Classification with Graph Convolutional Networks. In Proceedings of the 5th International Conference on Learning Representations (ICLR ’17), 2017. [50] Yuede Ji, Lei Cui, and H. Howie Huang. Vestige: Identifying Binary Code Provenance for Vulnerability Detection. In Proceedings of the 19th International Conference on Applied Cryptography and Network Security (ACNS ’21), 2021. [51] Chao Qu, Rongqian Zhou, Ke Liu, Zhuo Yan, and Haipeng Qu. BSGAT: A Graph Attention Network for Binary Code Similarity Detection. In Proceedings of the 28th IEEE Pacific Rim International Symposium on Dependable Computing, 2023. [52] Kechi Zhang, Wenhan Wang, Huangzhao Zhang, Ge Li, and Zhi Jin. Learning to Represent Programs with Heterogeneous Graphs. In Proceedings of the 30th IEEE/ACM International Conference on Program Comprehension (ICPC ’22), 2022.

[53] Xiao Wang, Deyu Bo, Chuan Shi, Shaohua Fan, Yanfang Ye, and Philip S. Yu. A Survey on Heterogeneous Graph Embedding: Methods, Techniques, Applications and Sources. IEEE Transactions on Big Data, 9(2), 2023. [54] Rui Bing, Guan Yuan, Mu Zhu, Fanrong Meng, Huifang Ma, and Shaojie Qiao. Heterogeneous Graph Neural Networks Analysis: A Survey of Techniques, Evaluations and Applications. Artificial Intelligence Review, 56(8), 2023. [55] Petar Veličković, Guillem Cucurull, Arantxa Casanova, Adriana Romero, Pietro Lio, and Yoshua Bengio. Graph Attention Networks. In Proceedings of the 6th International Conference on Learning Representations (ICLR ’18), 2018. [56] Xiao Wang, Houye Ji, Chuan Shi, Bai Wang, Yanfang Ye, Peng Cui, and Philip S Yu. Heterogeneous Graph Attention Network. In The World Wide Web Conference (WWW ’19), 2019. [57] Theodoros Evgeniou and Massimiliano Pontil. Regularized Multi–Task Learning. In Proceedings of the 10th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining (KDD ’04), 2004. [58] Shibin Parameswaran and Kilian Q. Weinberger. Large Margin Multitask Metric Learning. In Proceedings of the 23rd International Conference on Neural Information Processing Systems (NIPS ’10), 2010. [59] Theodoros Evgeniou, Charles A. Micchelli, and Massimiliano Pontil. Learning Multiple Tasks with Kernel Methods. Journal of Machine Learning Research, 2005. [60] Chi-Keung Luk, Robert Cohn, Robert Muth, Harish Patil, Artur Klauser, Geoff Lowney, Steven Wallace, Vijay Janapa Reddi, and Kim Hazelwood. Pin: Building Customized Program Analysis Tools with Dynamic Instrumentation. In Proceedings of the 2005 ACM SIGPLAN Conference on Programming Language Design and Implementation (PLDI ’05), 2005. [61] Shuai Wang, Pei Wang, and Dinghao Wu. Reassembleable Disassembling. In Proceedings of the 24th USENIX Security Symposium (USENIX Sec ’15), 2015. [62] Clang 22.0.0git documentation. Control Flow Integrity. https://clang.llvm.org/ docs/ControlFlowIntegrity.html, 2025. [63] Ben Niu and Gang Tan. Modular Control-Flow Integrity. In Proceedings of the 35th ACM SIGPLAN Conference on Programming Language Design and Implementation (PLDI ’14), pages 577–587, 2014. [64] Xuezixiang Li, Yu Qu, and Heng Yin. PalmTree: Learning an Assembly Language Model for Instruction Embedding. In Proceedings of the 28th ACM Conference on Computer and Communications Security (CCS ’21), 2021. [65] Oscar Li, Jiankai Sun, Xin Yang, Weihao Gao, Hongyi Zhang, Junyuan Xie, Virginia Smith, and Chong Wang. Label Leakage and Protection in Two-party Split Learning. In International Conference on Learning Representations, 2022. [66] Yige Liu, Yiwei Lou, Yang Liu, Yongzhi Cao, and Hanpin Wang. Label Leakage in Vertical Federated Learning: A Survey. In International Joint Conference on Artificial Intelligence, 2024. [67] Yasuhiko Minamide. Selective Tail Call Elimination. In Proceedings of the 10th Static Analysis Symposium (SAS ’03), 2003. [68] Konstantinos Sechidis, Grigorios Tsoumakas, and Ioannis Vlahavas. On the Stratification of Multi-label Data. In Proceedings of the 2011 European Conference on Machine Learning and Knowledge Discovery in Databases (ECMLPKDD ’11), 2011. [69] Takuya Akiba, Shotaro Sano, Toshihiko Yanase, Takeru Ohta, and Masanori Koyama. Optuna: A Next-generation Hyperparameter Optimization Framework. In Proceedings of the 25th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining (KDD ’19), 2019. [70] Gabriel Ryan, Siddhartha Jain, Mingyue Shang, Shiqi Wang, Xiaofei Ma, Murali Krishna Ramanathan, and Baishakhi Ray. Code-Aware Prompting: A Study of Coverage-Guided Test Generation in Regression Setting using LLM. Proceedings of the ACM on Software Engineering, 1(FSE), 2024. [71] Zejun Wang, Kaibo Liu, Ge Li, and Zhi Jin. HITS: High-coverage LLM-based Unit Test Generation via Method Slicing. In Proceedings of the 39th IEEE/ACM International Conference on Automated Software Engineering (ASE ’24), 2024. [72] Zongze Jiang, Ming Wen, Jialun Cao, Xuanhua Shi, and Hai Jin. Towards Understanding the Effectiveness of Large Language Models on Directed Test Input Generation. In Proceedings of the 39th IEEE/ACM International Conference on Automated Software Engineering (ASE ’24), 2024. [73] Diederik P. Kingma and Jimmy Ba. Adam: A Method for Stochastic Optimization. In Proceedings of the 3rd International Conference on Learning Representations (ICLR ’15), 2015.

A

Open Science

The implementation artifact contains the code and scripts needed to reproduce the main ICFlowNet workflow, including graph construction, model training, and evaluation. The accompanying data/model package contains the corresponding binaries, metadata, groundtruth labels, model resources, and other files required to run the artifact. 14

ICFlowNet

CCS ’26, November 15-19, 2026, The Hague, The Netherlands

Due to the size of the full data/model package, we stage it separately from the code-only artifact. During the review period, all released artifacts are made available through anonymized access points, and the artifact contents have been checked to avoid authoridentifying information. The code-only artifact is available through an anonymous repository: https://anonymous.4open.science/r/icflownet_artifact-2005 The data and model artifacts are staged separately: https://zenodo. org/records/19893277

B

function execution, typically executed as pop rax; jmp rax, and depend on stack-based historical context to resume execution after a prior call. These subtypes also differ in their structural characteristics: jump table targets generally reside within the same function, indirect tail calls jump across function boundaries, and returns reconnect to the caller’s successor block. These distinctions give rise to unique instruction embeddings and control-flow signatures. Moreover, their frequency distributions are highly imbalanced—returns appear far more often than jump tables, and jump tables more than indirect tail calls. Modeling them as a single category would bias the model toward the majority class, reducing predictive accuracy on rarer yet semantically critical constructs like indirect tail calls. To account for their distinct semantic roles, structural behaviors, and distributional properties, we treat these indirect jump subtypes as separate edge types. Unified treatment of indirect calls. In traditional static analysis and control-flow integrity techniques, indirect calls are often divided into three categories: function pointer dispatch, virtual table dispatch, and dynamic method lookup, based on how the call target is computed. This classification helps enforce fine-grained control policies. In contrast, in our learning-based approach, all indirect calls exhibit highly consistent patterns at the assembly level: the source is a call instruction to a register or memory operand (with varying addressing patterns), and the destination is always a function entry point. These structural similarities lead to strong overlap in instruction-level features for both source and destination. More importantly, since our heterogeneous graph includes data nodes and cross-reference edges between data nodes and code nodes, the model can reason about different dispatch patterns contextually. We therefore treat all indirect calls as a unified edge type, which simplifies supervision while preserving the ability to learn nuanced call resolution behavior.

Ethical Considerations

This work studies indirect control-flow prediction for binary analysis. Our goal is to improve the completeness and fidelity of recovered control-flow graphs for defensive and scientific uses, including program understanding, binary hardening, and evaluation of downstream analysis tools. At the same time, we recognize that binary-analysis techniques are inherently dual-use: more accurate recovery of indirect control-flow edges could also be used to support offensive reverse engineering or to improve the precision of attack planning against existing binaries. We mitigate this risk in several ways. First, our paper does not introduce a new exploit, attack payload, bypass, or vulnerability trigger, nor does it disclose previously unknown vulnerabilities in deployed software. The contribution is a prediction and evaluation framework for control-flow recovery. Second, all binaries in our dataset are built from publicly available open-source software, and our experiments are conducted in an offline research setting on locally compiled binaries. We do not instrument or probe thirdparty production systems, and we do not collect private user data, credentials, or telemetry from end users. Third, our dynamic tracing is used only to collect execution traces necessary for ground-truth construction and evaluation; it is not used to tamper with software behavior in deployed environments. Overall, we believe the defensive and scientific benefits outweigh the limited dual-use risk.

Appendix C Indirect Control Flow Categorization

D

In deep learning-based approaches to indirect control-flow prediction, the existence of an edge between a source and destination basic block is inferred from their instruction semantics—typically captured via learned embeddings. This differs from traditional rulebased methods that rely on symbolic matching or static patterns. Consequently, the way we categorize edge types must align with patterns that are learnable from instruction-level representations. Three indirect jump subtypes. In our formulation, we divide the general category of indirect jumps into three subtypes—jump table, indirect tail call, and return—each treated as a distinct prediction task. Although all three manifest as indirect jump-based instructions at the binary level, their semantic origins, structural patterns, and frequencies differ significantly. Jump tables are compilergenerated constructs for implementing switch-case statements, resulting in intra-procedural, data-dependent control flow through a dispatch table. Indirect tail calls emerge from tail-call optimization, where a function concludes by jumping to another without allocating a new stack frame, yielding inter-procedural transfers that mimic calls without returns. Return edges restore control after

Static ICF Pairs Collection

We extend Clang to insert callee function type annotations at each indirect callsite, based on LLVM-CFI [62]. These type annotations are essential for resolving indirect calls and indirect tail calls, as they enable precise identification of valid callee functions. A custom LLVM pass is then integrated into the x86 backend to encode the dispatch and target positions of all ICF pairs using our instruction labeling system, ensuring accurate extraction by the final parser. For switch-case jump tables, we leverage LLVM’s X86 DAG→DAG Instruction Selection pass, which explicitly emits jump table constructs and records both dispatch sites and valid target addresses. For indirect calls and indirect tail calls, we adopt a type-based strategy inspired by Modular CFI [63]. Specifically, callee type annotations are propagated from Clang through the Machine IR (MIR) stage, where potential callees are tagged with their function signatures. The candidate set is then restricted according to LLVM’s internal criteria—namely, functions that are externally visible or have their addresses taken. Customized parsing scripts subsequently match each indirect callsite to its valid callees using these propagated type signatures. 15

CCS ’26, November 15-19, 2026, The Hague, The Netherlands

Kun Liu, Zhengming Ding, Chenke Luo, Tianyi Xu, Zizhan Zheng, Haotian Zhang, and Jiang Ming

Table A1: Overlap rate of source ground truth-labeled functions between training and test splits (dynamic vs. static).

Finally, return edges are reconstructed based on the history of indirect calls. For returns originating from indirect calls, we trace the call stack to associate each return site with the basic block immediately following its corresponding callsite. In the case of indirect tail calls—where the callee does not return to the immediate caller—we identify the original caller of the function containing the tail call and link the return to the first basic block following the callsite in that original caller. This approach enables accurate recovery of return edges, even in the presence of tail-call optimization.

E

Edge Type Indir. Call Indir. Tail Call Jump Table Return

Static (%) 12.35 1.46 9.25 14.75

the entire package—rather than individual binaries or graphs—to a single split therefore helps prevent cross-split information leakage. Our splitting procedure is rarity-aware. We process edge types from rarest to most common so that low-frequency labels are not underrepresented in evaluation. For each edge type, we consider packages containing that label in randomly shuffled order and greedily assign each package to the split that is currently most underfilled for that label, targeting approximate per-type ratios of 80% training, 10% validation, and 10% testing. We prioritize test → validation → train during this process to ensure that the evaluation splits receive sufficient positive coverage even for scarce edge types. Because a package may contain multiple binaries and multiple ICF types, each assignment may simultaneously affect several labels. The greedy procedure therefore respects both multi-label cooccurrence and package-level isolation. Once the evaluation targets are satisfied, the remaining packages are assigned to the training split. In this way, we preserve package-level independence while maintaining balanced per-type coverage across train, validation, and test sets. Finally, we reuse the same package-level split for both singletask and multi-task experiments. This ensures that each single-task model is evaluated under conditions that are statistically consistent with the multi-task setting, enabling fair comparison while reducing the risk of type skew and cross-split leakage.

Detailed Dataset Construction Pipeline

We begin by compiling a large corpus of binaries from the Arch Linux ecosystem (version 2024.02.01), encompassing all packages from the official core and extra repositories, along with a curated subset from the Arch User Repository (AUR). In total, we selected 12,972 unique C/C++ projects, of which approximately 77% were successfully compiled. Each package was built from source using a custom LLVM-based toolchain (version 19.1.5) and integrated with Arch Linux’s native makepkg and PKGBUILD infrastructure. Following compilation, we deduplicate binaries using a normalized binary hash to eliminate redundant outputs. We retain only those binaries that contain at least one static ICF pair, extracting them using a custom instruction-labeling parser. To establish a dynamic ground truth, we additionally apply a dynamic tracing pipeline for packages whose PKGBUILD includes a check() function (i.e., native test suites), which successfully annotated 1,351 binaries. LLM-driven dynamic test augmentation. Although native test suites provide an essential foundation, we identified a critical coverage bias when relying exclusively on them. For medium-to-large applications commonly encountered in everyday computing, native tests often fail to adequately exercise complex indirect control flow paths, resulting in a sparse yield of dynamic ICF pairs. To construct a fairer and more representative evaluation baseline, we deliberately selected 20 ubiquitous medium-sized real-world projects (e.g., PostgreSQL, Wireshark) from the initial pool of 1,351 binaries. For selected complex applications, we leveraged Large Language Models (LLMs) to automatically generate supplementary test suites. This engineering choice was motivated by recent work showing that LLM-based test generation can improve code coverage and steer execution toward previously uncovered branches or more complex execution paths [70–72]. In our setting, these deeper executions increased the number of unique dynamically observed ICF pairs by approximately 25% over native tests alone. By enriching the dynamic ground truth for these heavy-duty applications, our dataset prevents subsequent evaluations from over-indexing on trivial paths found in smaller utilities, ensuring a benchmark that accurately reflects real-world software complexity.

F

Dynamic (%) 15.32 1.18 8.23 12.36

G

Function-Level Deduplication for Leakage-Free Evaluation

To ensure a fair evaluation, we split the Callee [26] dataset according to the prescribed proportions while also enforcing a package-level split to reduce information leakage. Despite this effort, we observed that approximately 15.9% of ground truth-labeled functions overlapped between the training and testing sets. And we further found that CupidCall [30] exhibited a similar issue with 13.6% overlap. This indicates that identical functions containing control-flow labels are frequently duplicated across splits. Such redundancy poses a significant issue, as it enables the model to memorize function behaviors during training and trivially reproduce them during testing. Consequently, this memorization effect can artificially inflate performance metrics, undermining the validity of the evaluation. To prevent structural data leakage in inductive evaluation, we apply function-level deduplication, excluding any ground truth edge whose surrounding control-flow context—the function in which it resides—shares a structural fingerprint with one in the training set. Specifically, for each ground-truth-labeled function (i.e., a function containing at least one labeled source address) encountered during ACFG construction, we extract its instruction mnemonics from basic blocks, concatenate them in control-flow order, and compute a SHA-256 hash of the resulting string. This hash serves

Package-Level Stratified Data Splitting

To obtain fair, representative, and leakage-resistant data splits for ICF prediction, we adapt multi-label proportional sampling [68] to the package level. We treat each package as the split unit, and assign to it a multi-label vector indicating whether any binary produced by that package contains at least one edge of each ICF type. This choice is important because binaries from the same package often share code templates, compiler options, and dependencies. Assigning 16

ICFlowNet

CCS ’26, November 15-19, 2026, The Hague, The Netherlands

Table A2: Performance comparison of single-task models trained under dynamic, static, and large-scale static supervision across ICF types. Setting

Precision (%)

Recall (%)

F1 (%)

ic_dy ic_st ic_st_large

Indirect Call (ic) 93.13 90.08 91.26 94.12 91.73 94.28

91.58 92.67 92.99

itc_dy itc_st itc_st_large

Indirect Tail Call (itc) 92.53 88.12 90.85 92.63 91.29 92.88

90.27 91.73 92.08

jt_dy jt_st jt_st_large

Jump Table (jt) 95.78 93.29 97.59 97.27 97.92 97.34

94.52 97.43 97.63

ret_dy ret_st ret_st_large

Return (ret) 94.07 92.81 92.93

91.48 92.75 92.97

89.03 92.69 93.01

performance degradation remains strictly bounded. Across all optimization levels (O0–O3), the model consistently maintains F1 scores above 93%. Notably, specific instruction types such as jumptable show exceptional resilience (maintaining F1 scores near 97%–98% even at O3). Although icall exhibits a slight sensitivity to higher optimization levels, the overall performance remains highly stable. This consistent accuracy across structural variations confirms the MTL architecture’s practical viability for analyzing heavily optimized real-world binaries.

J

Table A3: Ablation study of the Dual Hub architecture with varying GDH neighborhood radii (hops) on long-range ICF pairs. Setting

as a content-based structural fingerprint that remains consistent across duplicated code. The hashing is performed independently for each edge type, and the results are stored in per-binary JSON files (e.g., {binary}_retfunchashes.json). By enforcing this constraint, we ensure that no test label is structurally equivalent to any training example within the GAT’s message-passing radius, thereby preserving the validity of generalization evaluation.

Recall (%)

F1 (%)

91.00 92.44 92.13

89.97 91.35 91.23

90.32 91.19 90.23

88.29 90.36 89.01

94.13 95.64 95.01

93.28 95.37 94.33

91.03 91.16 91.28

91.27 91.38 91.16

Note. GCH + 𝑘-hop GDH integrates the Global Data Hub restricted to a 𝑘-hop radius of code candidates.

Hyperparameter Tuning

Optuna [69] is used to maximize validation F1 across all singletask models, and training is conducted for up to 50 epochs with early stopping (patience = 15), using the Adam optimizer [73] and a fixed prediction threshold of 0.5. The hyperparameter search spans hidden dimensions 64, 128, 256, 512, attention heads 4, 8, 16, GAT layers 2, 3, 4, 5, dropout rates 0.1, 0.2, 0.3, 0.4, 0.5, weight decay 10−6, 10−5, 10−4, 10−3 , and learning rates 10−4, 10−3, 10−2 . A nearoptimized configuration—256 hidden units, 4 GAT layers, 8 attention heads, dropout of 0.4, weight decay of 10−5 , and a learning rate of 0.001—is adopted for training and evaluation across all singletask models, demonstrating stable and generalizable performance on both static and dynamic datasets. This configuration is applied consistently in all experiments to ensure comparability and fair evaluation across training regimes.

I

Precision (%)

Indirect Call (ic) GCH + 1-hop GDH 88.96 GCH + 2-hop GDH 90.28 GCH + 3-hop GDH 90.35 Indirect Tail Call (itc) GCH + 1-hop GDH 86.35 GCH + 2-hop GDH 89.54 GCH + 3-hop GDH 87.82 Jump Table (jt) GCH + 1-hop GDH 92.45 GCH + 2-hop GDH 95.10 GCH + 3-hop GDH 93.66 Return (ret) GCH + 1-hop GDH 91.51 GCH + 2-hop GDH 91.60 GCH + 3-hop GDH 91.04

Note. Each block compares models trained with dynamic (_dy), static (_st), and large-scale static (_st_large) supervision, all evaluated on the same dataset with clean test set.

H

GDH Pruning

Impact of GDH neighborhood radius. To determine the optimal structural context for data nodes, we evaluated the Dual Hub architecture across varying GDH connection radii (Table A3). The empirical results reveal a clear trade-off: a restricted 1-hop radius provides insufficient data context, leading to suboptimal predictive performance. Conversely, expanding the radius to 3 hops introduces excessive structural noise from irrelevant data nodes, causing F1 scores to systematically degrade across all task types. The 2-hop radius strikes the optimal balance—it successfully captures essential data references while aggressively pruning irrelevant structural noise, thereby consistently yielding the highest F1 scores. Consequently, we adopt the 2-hop threshold for all GDH configurations.

K

MTL Optimization Robustness

MTL Performance Without Dual Hubs

As illustrated in Table A4, in the absence of the Dual Hub architecture, the model achieves a strictly marginal average F1 improvement of only 1.33%. This pronounced performance plateau empirically exposes a fundamental limitation of standard Graph Neural Networks (GNNs): conventional local message-passing mechanisms suffer from severe multi-hop information decay and over-squashing

As demonstrated in Table A5 and Table A6, the proposed MTL model exhibits strong optimization robustness across both the Long-range and Overall test datasets. While aggressive compiler optimizations (O2 and O3) introduce complex binary transformations that inherently increase the difficulty of the prediction task, the model’s 17

CCS ’26, November 15-19, 2026, The Hague, The Netherlands

Kun Liu, Zhengming Ding, Chenke Luo, Tianyi Xu, Zizhan Zheng, Haotian Zhang, and Jiang Ming

Table A4: Performance comparison of Single-Task and MultiTask (MTL) paradigms evaluated without Dual Hubs on the Long-range test Dataset. All models were trained using the large-scale static dataset. Task Type

Setting

Precision (%)

Recall (%)

F1 (%)

𝚫𝑭 1(%)

Indirect Call (ic)

Single MTL

84.73 87.87

85.89 86.72

85.31 87.29

– +1.98

Indirect Tail Call (itc)

Single MTL

80.61 82.75

81.85 82.87

81.23 82.81

– +1.58

Jump Table (jt)

Single MTL

97.35 97.05

97.68 98.01

97.51 97.53

– +0.02

Return (ret)

Single MTL

86.27 89.16

86.41 86.99

86.34 88.06

– +1.72

Table A6: Optimization Robustness of the MTL Model under O0–O3 on the overall test dataset, supervised by a Large Static Dataset. No indirect tail call rows are shown for O0/O1 because these subsets contain no tail-call-eliminated instances.

Note. All models in this table are evaluated in the foundational baseline setting (completely without GCH and GDH routing).

across extended topological distances. Consequently, without explicit global routing to bridge these structural gaps, standard GNNs remain bottlenecked by topological unreachability and struggle to capture the long-range dependencies required for complex ICF resolution.

L

Type

O0

Precision (%)

Recall (%)

F1 (%)

icall jumptable ret

96.16 98.25 97.16

95.72 97.99 96.52

95.94 98.12 96.84

O1

icall jumptable ret

94.29 98.28 95.81

95.99 97.70 96.49

95.13 97.99 96.15

O2

icall itailcall jumptable ret

93.78 97.22 98.11 95.39

94.36 95.28 95.99 96.17

94.07 96.24 97.04 95.78

O3

icall itailcall jumptable ret

93.46 96.82 98.11 95.08

93.88 95.43 95.68 94.98

93.67 96.12 96.88 95.03

Type

O0

Precision (%)

Recall (%)

F1 (%)

icall jumptable ret

98.49 99.11 98.28

96.00 98.13 96.42

97.23 98.62 97.34

O1

icall jumptable ret

97.79 98.31 97.85

97.13 97.93 96.64

97.46 98.12 97.24

O2

icall itailcall jumptable ret

95.72 97.53 98.42 97.32

94.98 96.44 97.64 95.89

95.35 96.98 98.03 96.60

O3

icall itailcall jumptable ret

94.52 96.85 98.05 96.23

94.06 95.99 97.63 95.35

94.29 96.42 97.84 95.79

do not provide cross-task structural awareness. A similar limitation also applies to simple feature-fusion schemes, which combine task-specific representations in a shallow manner but still lack joint task-level optimization. As shown in Table A7, Feat-fusion yields only limited and inconsistent improvements over the Single-Task baseline. In particular, it provides a relatively larger gain on the return task (+4.61 F1), which suggests that simple fusion can be more effective for task types with a larger number of supervision pairs, where richer training signals may help stabilize the fused representation. However, this advantage does not generalize to lower-resource task types. For tasks with fewer supervision pairs, the fusion process may introduce undesirable side effects, such as feature interference, noise propagation, or negative transfer across tasks. This is reflected by the performance drops on itc (−1.57) and jt (−0.62), and by the much smaller gain on ic (+1.37). In contrast, the MTL variant with auxiliary type prediction (MTL_t) consistently improves over the single-task baseline on all task types, with gains of +4.48, +5.13, +0.44, and +4.91 F1 on ic, itc, jt, and ret, respectively. On average, Feat-fusion improves F1 by only 0.95 points over the Single-Task baseline, whereas MTL_t achieves an average gain of 3.74 points. These results indicate that naïvely combining features from isolated models may offer some benefit for data-rich tasks, but it is not a reliable solution overall. By contrast, jointly optimized MTL can better exploit shared structural regularities while avoiding the side effects of shallow fusion, resulting in more robust improvements across all task types.

Table A5: Optimization Robustness of the MTL Model under O0–O3 on the long-range test dataset, supervised by a Large Static Dataset. No indirect tail call rows are shown for O0/O1 because these subsets contain no tail-call-eliminated instances. Op level

Op level

Feature Level Fusion vs. MTL

M

Why simple feature fusion is insufficient. To assess whether the gains of our multi-task design could be reproduced by ensemblestyle alternatives, we first note that simple ensemble strategies (e.g., majority voting or probability averaging) only aggregate the predictions of independently trained single-task models and therefore

External Comparison

To complement the main-text comparison against learned baselines, we also report external comparisons to recent program-analysis systems under their published benchmark conventions. These results should not be interpreted as strict artifact-level reproductions: 18

ICFlowNet

CCS ’26, November 15-19, 2026, The Hague, The Netherlands

Table A7: Performance comparison of Single-Task, Featfusion, and the auxiliary type-prediction variant (MTL_t) on the Long-range test dataset. All models are trained on the large-scale static dataset. Note: † Dual hub setting; ‡ No hub setting. Task Type

Setting

Precision (%)

Recall (%)

F1 (%)

𝚫𝑭 1(%)

Indirect Call (ic)

Single† Feat-fusion MTL_t

90.28 92.51 95.36

92.44 92.93 96.30

91.35 92.72 95.83

– +1.37 +4.48

Indirect Tail Call (itc)

Single† Feat-fusion MTL_t

89.54 88.25 95.81

91.19 89.34 95.17

90.36 88.79 95.49

– -1.57 +5.13

Jump Table (jt)

Single‡ Feat-fusion MTL_t

97.35 96.36 98.25

97.68 97.42 97.65

97.51 96.89 97.95

– -0.62 +0.44

Return (ret)

Single† Feat-fusion MTL_t

91.60 95.78 96.11

91.16 96.21 96.47

91.38 95.99 96.29

– +4.61 +4.91

Table A9: External comparison under the BPADisa AICT/recall convention of Disa [47].

Program-Opt

Table A8: External comparison under BinDSA’s profilingbased precision/recall protocol [46]. Program 401.bzip2 458.sjeng 433.milc 456.hmmer 464.h264ref 445.gobmk 400.perlbench 403.gcc

BinDSA

ICFlowNet

Precision

Recall

Precision

Recall

1.00 0.86 1.00 0.91 0.65 0.56 0.53 0.46

1.00 1.00 1.00 1.00 1.00 0.95 0.86 0.67

1.00 0.92 1.00 0.92 0.95 0.92 0.94 0.90

1.00 1.00 1.00 1.00 1.00 1.00 0.99 0.97

# Csite

BPADisa

ICFlowNet

AICT

Recall

AICT

Recall

hmmer-00 hmmer-01 hmmer-02 hmmer-03

9 11 10 10

2.8 4.3 2.8 2.8

100 100 100 100

2.4 3.9 2.5 2.5

100 100 100 100

h264ref-00 h264ref-01 h264ref-02 h264ref-03

369 353 352 355

4.3 5.2 26.9 18.6

100 99.7 100 100

3.6 3.9 18.3 18.2

100 100 100 99.5

gobmk-00 gobmk-01 gobmk-02 gobmk-03

44 44 44 44

846.9 1336.3 1337.2 1416.2

100 100 100 100

532.3 1218.2 1292.1 1272.7

100 100 100 100

perlbench-00 perlbench-01 perlbench-02 perlbench-03

139 139 110 237

387.6 379.7 373.9 456.4

99.1 100 100 100

328.6 317.3 313.2 364.3

99.6 99.6 98.4 98.2

gcc-00 gcc-01 gcc-02 gcc-03

459 473 450 727

447.1 338.1 431.1 454.1

95.3 95.8 96.2 96.2

327.2 351.4 381.3 392.9

95.3 95.7 97.1 96.7

smaller indirect-call candidate sets while preserving similar recall. The reductions are especially visible on larger optimized binaries: for example, ICFlowNet reduces AICT from 456.4 to 364.3 on perlbench-03, from 454.1 to 392.9 on gcc-03, and from 1416.2 to 1272.7 on gobmk-03, while maintaining nearly identical recall. This indicates that ICFlowNet can tighten target sets without relying on iterative block-memory analysis. Inference-time cost profile. These systems differ not only in accuracy, but also in deployment cost. BinDSA [46] performs contextsensitive heap reconstruction and pointer reasoning, while BPADisa [47] still inherits BPA-style block-memory analysis. Their runtime therefore grows from minutes to hours on large binaries. For example, on gcc, BPA reports 27, 619 seconds and BinDSA reports 1, 865 seconds [25, 46]. In contrast, ICFlowNet amortizes model fitting into an offline training phase. At deployment time, inference reduces to a single feed-forward pass over the recovered binary graph, taking about 25 seconds of end-to-end wall-clock time on the same gcc binary. This lighter inference-time cost makes ICFlowNet substantially more practical for whole-system downstream analyses where formal program-analysis pipelines may time out.

BinDSA [46] reports profiling-based precision/recall on a SPECstyle benchmark, while Disa [47] evaluates indirect-call refinement through the BPADisa pipeline using AICT and recall across optimization levels. We therefore compare against the same benchmark families and metrics used in those papers, and use the results as cross-framework reference points rather than exact apples-toapples reproductions. Comparison to BinDSA. Table A8 compares ICFlowNet with BinDSA [46] under BinDSA’s profiling-based precision/recall convention. On simpler programs such as 401.bzip2 and 433.milc, both systems are essentially perfect. On larger and more structurally complex binaries, however, ICFlowNet maintains substantially higher precision while keeping recall comparable or better. The difference is most pronounced on 403.gcc, where BinDSA reports precision/recall of 0.46/0.67, while ICFlowNet reaches 0.90/0.97. Similar trends appear on 445.gobmk and 400.perlbench. These results suggest that learned structural representations remain robust even when precise formal reasoning becomes harder to scale. Comparison to BPADisa. Table A9 compares ICFlowNet with BPADisa, i.e., the Disa-facilitated BPA [25] pipeline evaluated in [47]. Here the comparison metric is AICT (lower is better) together with recall. Across optimization levels, ICFlowNet generally yields 19

Related documents

• Needles at Scale: LLM-Assisted Target Selection for Windows Vulnerability Research#246442
• CVE-2026-97262 — MEDIUM 6.5#1159308
• 40 CFR Part 434 — Coal Mining Point Source Category BPT, BAT, BCT Limitations and New Source Performance Standards#509591
• CVE-2026-62138 — MEDIUM 6.5#781595
• Droop-Aware Foundation Model Power Flow#1049459