[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"doc-detail-81548-en":3,"doc-seo-81548-105":30,"detail-sidebar-cat-0-en-105":91},{"code":4,"msg":5,"data":6},0,"success",{"doc_id":7,"user_id":8,"nickname":9,"user_avatar":10,"doc_module":4,"category_id":11,"category_name":12,"doc_title":13,"doc_description":14,"doc_content":15,"file_id":16,"file_url":17,"file_type":18,"file_size":19,"view_count":20,"is_deleted":4,"is_public":21,"is_downloadable":21,"audit_status":21,"page_count":22,"language":23,"language_code":24,"site_id":25,"html_lang":24,"table_of_contents":26,"faqs":27,"seo_title":13,"seo_description":14,"update_tm":28,"read_time":29},81548,687197100911,"Himbo","https://ap-avatar.wpscdn.com/avatar/a000239b6f1da00475?x-image-process=image/resize,m_fixed,w_180,h_180&k=1782698725881665579",8,"Research & Report","Beyond Embeddings Interpretable Feature Extraction for Binary Code Similarity","Binary code similarity detection underpins reverse engineering tasks such as malware analysis and vulnerability discovery by finding semantically similar compiled code across differing contexts. The progression from handcrafted statistics to embedding-based representations improves generalization, yet embeddings remain opaque and introduce a scalability–accuracy trade-off due to high-dimensional approximate nearest-neighbor search. A language model-based agent extracts structured, human-readable features—types, side effects, constants, and intent—training-free. It attains recall@1 comparable to embedding methods and, when combined with embeddings, surpasses state-of-the-art performance while preserving interpretability and scalability.","Beyond Embeddings: Interpretable Feature Extraction for Binary Code Similarity  \nCharles Edward Gagnon  \nDefence Research and Development Canada McGill University  \nPhilippe Charland  \nDefence Research and Development Canada  \nSteven H. H. Ding McGill University  \nBenjamin C. M. Fung McGill University  \narXiv :2509 .23449v2 [ cs .AI] 10 Jul 2026  \nAbstract—Binary code similarity detection is a core task in reverse engineering. It supports malware analysis and vulnerability discovery by identifying semantically similar code in different contexts. Modern methods have progressed from manually engineered features to vector representations. Hand-crafted statistics (e.g., operation ratios) are interpretable, but shallow and fail to generalize. Embedding-based methods overcome this by learning robust cross-setting representations, but these representations are opaque vectors that prevent rapid verification. They also face a scalability–accuracy trade-off, since high-dimensional nearestneighbor search requires approximations that reduce precision. Current approaches thus force a compromise between interpretability, generalizability, and scalability.  \nWe bridge these gaps using a language model-based agent to conduct structured reasoning analysis of assembly code and generate features such as input/output types, side effects, notable constants, and algorithmic intent. Unlike hand-crafted features, they are richer and adaptive. Unlike embeddings, they are human-readable, maintainable, and directly searchable with inverted or relational indexes. Without any matching training, our method respectively achieves 42% and 62% for recall@1 in cross-architecture and cross-optimization tasks, comparable to embedding methods with training (39% and 34%). Combined with embeddings, it significantly outperforms the state-of-the-art, demonstrating that accuracy, scalability, and interpretability can coexist.  \nI. INTRODUCTION  \nModern software development heavily relies on external libraries. For security researchers, detecting whether an executable invokes vulnerable library functions is critical for assessing and mitigating exposure [33], [40] . For reverse engineers, identifying redundant assembly functions accelerates analysis and enables them to focus on the unique logic of a binary. Binary Code Similarity Detection (BCSD) provides a means to address these requirements by identifying whether two compiled code fragments exhibit similar behavior. Its importance is amplified by the growing size, modularity, and production rate of modern software, which make manual inspection infeasible. Beyond vulnerability assessment, BCSD also plays an important role in malware analysis, software supply-chain auditing, and firmware security, where statically  \nNetwork and Distributed System Security (NDSS) Symposium 2027  \n22 -26 March 2027 , Seoul, Republic of Korea ISBN 979-8-9919276-8-0  \n[https://dx.doi.org/10.14722/ndss.2027](https://dx.doi.org/10.14722/ndss.2027).[23|24]xxxx [www.ndss-symposium.org](www.ndss-symposium.org)  \nlinked libraries are common and reused components can be difficult to identify [5], [6] . For instance, when a vulnerability is discovered in a library, BCSD enables efficient identification of affected binaries or firmware, supporting both defensive security and large-scale reverse engineering.  \nEarly approaches to BCSD used human-defined heuristics to extract a “feature vector” from a binary code fragment [2],[15], [41] . These heuristics could be derived statically by examining a function and its control-flow graph (CFG)—for example, by measuring the number of basic blocks, the ratio of arithmetic to control-flow instructions, or the sequence of opcodes—or dynamically by executing the function in an emulator to capture instruction counts, memory access patterns, or system call traces [14] . Such methods were deterministic and had the advantage of producing human-understandable feature vectors, but they suffered key limitations. Purel","cbCaiq3BElwHlkdb","https://ap.wps.com/l/cbCaiq3BElwHlkdb","pdf",766718,3,1,15,"English","en",105,"# Abstract\n# Introduction\n## Binary Code Similarity Detection (BCSD)\n## From Handcrafted Heuristics to ML Embeddings\n## Limitations: Interpretability and Scalability-Accuracy Trade-off\n# Proposed Approach (LLM-Generated Structured Features)","[{\"question\":\"Why is binary code similarity detection important in security research?\",\"answer\":\"Binary code similarity detection helps identify semantically similar compiled fragments, supporting malware analysis and vulnerability discovery by efficiently locating affected binaries or firmware.\"},{\"question\":\"What limitations exist in handcrafted features and embedding-based approaches?\",\"answer\":\"Handcrafted statistical features can be too shallow to capture semantic similarity and CFG-based comparisons may be computationally intractable. Embedding methods improve performance but produce opaque vectors and require approximate nearest-neighbor search, creating an interpretability and scalability–accuracy trade-off.\"},{\"question\":\"How does the proposed method generate features for BCSD, and what advantages does it offer?\",\"answer\":\"The method uses a language model-based agent to perform structured reasoning on assembly code and generate human-readable features such as input/output types, side effects, constants, and algorithmic intent. It is training-free and directly searchable with inverted/relational indexes, improving interpretability and scalability while maintaining competitive accuracy.\"}]",1784174240,38,{"code":4,"msg":31,"data":32},"ok",{"site_id":25,"language":24,"slug":33,"title":13,"keywords":34,"description":14,"schema_data":35,"social_meta":86,"head_meta":88,"extra_data":90,"updated_unix":28},"beyond-embeddings-interpretable-feature-extraction-for-binary-code-similarity","",{"@graph":36,"@context":85},[37,53,68],{"@type":38,"itemListElement":39},"BreadcrumbList",[40,44,48,50],{"item":41,"name":42,"@type":43,"position":21},"https://docshare.wps.com","Home","ListItem",{"item":45,"name":46,"@type":43,"position":47},"https://docshare.wps.com/document/","Document",2,{"item":49,"name":12,"@type":43,"position":20},"https://docshare.wps.com/document/research-report/",{"item":51,"name":13,"@type":43,"position":52},"https://docshare.wps.com/document/beyond-embeddings-interpretable-feature-extraction-for-binary-code-similarity/81548/",4,{"url":51,"name":13,"@type":54,"author":55,"headline":13,"publisher":57,"fileFormat":60,"inLanguage":24,"description":14,"dateModified":61,"datePublished":62,"encodingFormat":60,"isAccessibleForFree":63,"interactionStatistic":64},"DigitalDocument",{"name":9,"@type":56},"Person",{"url":41,"name":58,"@type":59},"DocShare","Organization","application/pdf","2026-07-24","2026-07-16",true,{"@type":65,"interactionType":66,"userInteractionCount":20},"InteractionCounter",{"@type":67},"ViewAction",{"@type":69,"mainEntity":70},"FAQPage",[71,77,81],{"name":72,"@type":73,"acceptedAnswer":74},"Why is binary code similarity detection important in security research?","Question",{"text":75,"@type":76},"Binary code similarity detection helps identify semantically similar compiled fragments, supporting malware analysis and vulnerability discovery by efficiently locating affected binaries or firmware.","Answer",{"name":78,"@type":73,"acceptedAnswer":79},"What limitations exist in handcrafted features and embedding-based approaches?",{"text":80,"@type":76},"Handcrafted statistical features can be too shallow to capture semantic similarity and CFG-based comparisons may be computationally intractable. Embedding methods improve performance but produce opaque vectors and require approximate nearest-neighbor search, creating an interpretability and scalability–accuracy trade-off.",{"name":82,"@type":73,"acceptedAnswer":83},"How does the proposed method generate features for BCSD, and what advantages does it offer?",{"text":84,"@type":76},"The method uses a language model-based agent to perform structured reasoning on assembly code and generate human-readable features such as input/output types, side effects, constants, and algorithmic intent. It is training-free and directly searchable with inverted/relational indexes, improving interpretability and scalability while maintaining competitive accuracy.","https://schema.org",{"og:url":51,"og:type":87,"og:title":13,"og:site_name":58,"og:description":14},"article",{"robots":89,"canonical":51},"index,follow",{"doc_id":7,"site_id":25},{"code":4,"msg":5,"data":92},[93,97,101,105,110,115,120,123,128,131,135],{"id":21,"doc_module":4,"doc_module_name":46,"category_name":94,"show_sort_weight":95,"slug":96},"Story & Novel",90,"story-novel",{"id":47,"doc_module":4,"doc_module_name":46,"category_name":98,"show_sort_weight":99,"slug":100},"Literature",80,"literature",{"id":52,"doc_module":4,"doc_module_name":46,"category_name":102,"show_sort_weight":103,"slug":104},"Exam",70,"exam",{"id":106,"doc_module":4,"doc_module_name":46,"category_name":107,"show_sort_weight":108,"slug":109},5,"Comic",60,"comic",{"id":111,"doc_module":4,"doc_module_name":46,"category_name":112,"show_sort_weight":113,"slug":114},6,"Technology",50,"technology",{"id":116,"doc_module":4,"doc_module_name":46,"category_name":117,"show_sort_weight":118,"slug":119},7,"Healthcare",40,"healthcare",{"id":11,"doc_module":4,"doc_module_name":46,"category_name":12,"show_sort_weight":121,"slug":122},30,"research-report",{"id":124,"doc_module":4,"doc_module_name":46,"category_name":125,"show_sort_weight":126,"slug":127},9,"Religion & Spirituality",20,"religion-spirituality",{"id":126,"doc_module":4,"doc_module_name":46,"category_name":129,"show_sort_weight":126,"slug":130},"World Cup","world-cup",{"id":132,"doc_module":4,"doc_module_name":46,"category_name":133,"show_sort_weight":132,"slug":134},10,"Lifestyle","lifestyle",{"id":136,"doc_module":4,"doc_module_name":46,"category_name":137,"show_sort_weight":106,"slug":138},19,"General","general"]