[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"doc-detail-83967-en":3,"doc-seo-83967-105":29,"detail-sidebar-cat-0-en-105":91},{"code":4,"msg":5,"data":6},0,"success",{"doc_id":7,"user_id":8,"nickname":9,"user_avatar":10,"doc_module":4,"category_id":11,"category_name":12,"doc_title":13,"doc_description":14,"doc_content":15,"file_id":16,"file_url":17,"file_type":18,"file_size":19,"view_count":20,"is_deleted":4,"is_public":20,"is_downloadable":20,"audit_status":20,"page_count":21,"language":22,"language_code":23,"site_id":24,"html_lang":23,"table_of_contents":25,"faqs":26,"seo_title":13,"seo_description":14,"update_tm":27,"read_time":28},83967,687197207639,"Asher","https://ap-avatar.wpscdn.com/davatar_a8503ba1806abce46bf441b54a3ca4cd",8,"Research & Report","ShadowProbe: Language-Extensible Detection of Hidden Algorithmic Complexity Vulnerabilities","Algorithmic Complexity Vulnerabilities (ACVs) enable adversaries to trigger worst-case execution through specially crafted inputs, causing severe performance degradation and denial-of-service. A major but underexplored root cause is shadow complexity, where substantial hidden computational costs are embedded within seemingly benign standard library APIs and are invisible at the call site. ShadowProbe introduces a language-extensible framework using lightweight static screening, automated reconstruction of execution contexts, and LLM-assisted test generation. Runtime measurements and robust statistical growth inference validate candidates, separating true algorithmic blowups from noise effects such as GC and JIT.","ShadowProbe: Language-Extensible Detection of Hidden Algorithmic Complexity Vulnerabilities  \nYuanmin Xie∗1, Xiangfan Wu†‡1, Wenhao Wu§‡, Lingyun Ying‡, Puzhuo Liu∗ , Haipeng Qu†, Zhongyuan Chen†‡, Min Zhou∗ , Chengnian Sun¶  \n∗ Tsinghua University †Ocean University of China ‡QI-ANXIN Technology Research Institute  \n§ Southeast University ¶ University of Waterloo  \n{xieym23@mails,liupz@mail,[mzhou}@tsinghua.edu.cn](mzhou}@tsinghua.edu.cn)[ ](mzhou}@tsinghua.edu.cn){wuxiangfan@stu,[quhaipeng}@ouc.edu.cn](quhaipeng}@ouc.edu.cn) , [yinglingyun@qianxin.com](yinglingyun@qianxin.com)[ ](yinglingyun@qianxin.com){ch4ml1nx, [christychen516}@gmail.com](christychen516}@gmail.com) , [cnsun@uwaterloo.ca](cnsun@uwaterloo.ca)  \narXiv :2607 .05474v 1 [ cs .CR] 6 Jul 2026  \nAbstract—Abstract—Algorithmic Complexity Vulnerabilities (ACVs) are a class of software flaws in which adversarial or carefully crafted inputs trigger worst case execution behavior, leading to severe performance degradation and Denial-of-Service (DoS) conditions. A key but underexplored source of such vulnerabilities is shadow complexity, where non-trivial computational costs are hidden inside seemingly benign standard library APIs. These costs are not visible at the call site and can be systematically exploited to induce unexpected superlinear runtime behavior. Existing ACV detection techniques primarily rely on fuzzing, symbolic execution, or hybrid analysis. However, they are often specific to individual programming languages, require substantial manual effort to construct execution harnesses, and depend on heavy runtime instrumentation. This limits their scalability across large and diverse codebases.  \nIn this work, we present ShadowProbe, a scalable and language extensible framework for discovering ACVs through lightweight static analysis, automated reconstruction of execution contexts, and Large Language Model (LLM) assisted test generation. Rather than relying on zero shot LLM inference, ShadowProbe uses a structured multi stage pipeline. It first performs static screening guided by signals from shadow complexity to identify candidate functions. It then reconstructs minimal executable contexts from project level symbols, and finally synthesizes inputs with controlled size to probe worst case execution behavior. Execution time measurements are used for validation, and robust statistical growth inference is applied to separate true algorithmic blowups from runtime noise, including garbage collection and JIT compilation effects.  \nWe evaluate ShadowProbe on the WISE benchmark and show that it consistently outperforms existing approaches in analysis efficiency. We further apply ShadowProbe to large scale software systems, including CPython, the JDK, Zig, Rustc, and vLLM, where it uncovers many previously unknown ACVs, a large portion of which have been confirmed and partially remediated by maintainers. These results demonstrate the effectiveness of ShadowProbe in identifying hidden algorithmic risks across diverse real world codebases.  \nI. INTRODUCTION  \nSoftware performance—typically characterized by time efficiency and execution predictability—is a fundamental pillar of software quality. While performance degradation is generally viewed as a routine engineering concern, it escalates into a critical security threat when adversaries can intentionally exploit structural bottlenecks to mount Denial-of-Service (DoS)  \n1Both authors contributed equally to this research.  \nattacks. The primary vector for these attacks is Algorithmic Complexity Vulnerabilities (ACVs) [1]–[6], classified by MITRE as CWE-407 [7] . ACVs stem from inefficient algorithms that remain latent during normal operation but exhibit catastrophic runtime slowdowns when triggered by specific, worst-case inputs. Real-world incidents, such as the quadratictime behavior in Python’s integer conversion (CVE-2020- 10735) [8] and Perl’s email parsing (CVE-2014-1474) [9], demonstrate how a single ACV can paralyze ","cbCaieC0DOIeDc8O","https://ap.wps.com/l/cbCaieC0DOIeDc8O","pdf",583711,1,12,"English","en",105,"# Abstract\n# Introduction\n## Algorithmic Complexity Vulnerabilities (ACVs)\n## Shadow Complexity\n## Core Challenges","[{\"question\":\"What problem does ShadowProbe address?\",\"answer\":\"ShadowProbe targets Algorithmic Complexity Vulnerabilities caused by hidden worst-case behaviors, especially those arising from shadow complexity in standard library APIs.\"},{\"question\":\"What is “shadow complexity” and why is it important?\",\"answer\":\"Shadow complexity refers to non-trivial computational costs hidden inside APIs that look trivial at the call site. These hidden costs can be exploited to induce unexpected superlinear runtime behavior and create blind spots in audits.\"},{\"question\":\"How does ShadowProbe scale detection across programming languages and large codebases?\",\"answer\":\"ShadowProbe uses a structured multi-stage pipeline: lightweight static screening guided by shadow complexity signals, automated reconstruction of minimal executable contexts from project symbols, and input synthesis with controlled size. Validation relies on execution-time measurements plus statistical growth inference to distinguish true blowups from runtime noise.\"}]",1784191712,30,{"code":4,"msg":30,"data":31},"ok",{"site_id":24,"language":23,"slug":32,"title":13,"keywords":33,"description":14,"schema_data":34,"social_meta":86,"head_meta":88,"extra_data":90,"updated_unix":27},"shadowprobe-language-extensible-detection-of-hidden-algorithmic-complexity-vulnerabilities","",{"@graph":35,"@context":85},[36,53,68],{"@type":37,"itemListElement":38},"BreadcrumbList",[39,43,47,50],{"item":40,"name":41,"@type":42,"position":20},"https://docshare.wps.com","Home","ListItem",{"item":44,"name":45,"@type":42,"position":46},"https://docshare.wps.com/document/","Document",2,{"item":48,"name":12,"@type":42,"position":49},"https://docshare.wps.com/document/research-report/",3,{"item":51,"name":13,"@type":42,"position":52},"https://docshare.wps.com/document/shadowprobe-language-extensible-detection-of-hidden-algorithmic-complexity-vulnerabilities/83967/",4,{"url":51,"name":13,"@type":54,"author":55,"headline":13,"publisher":57,"fileFormat":60,"inLanguage":23,"description":14,"dateModified":61,"datePublished":62,"encodingFormat":60,"isAccessibleForFree":63,"interactionStatistic":64},"DigitalDocument",{"name":9,"@type":56},"Person",{"url":40,"name":58,"@type":59},"DocShare","Organization","application/pdf","2026-07-21","2026-07-16",true,{"@type":65,"interactionType":66,"userInteractionCount":20},"InteractionCounter",{"@type":67},"ViewAction",{"@type":69,"mainEntity":70},"FAQPage",[71,77,81],{"name":72,"@type":73,"acceptedAnswer":74},"What problem does ShadowProbe address?","Question",{"text":75,"@type":76},"ShadowProbe targets Algorithmic Complexity Vulnerabilities caused by hidden worst-case behaviors, especially those arising from shadow complexity in standard library APIs.","Answer",{"name":78,"@type":73,"acceptedAnswer":79},"What is “shadow complexity” and why is it important?",{"text":80,"@type":76},"Shadow complexity refers to non-trivial computational costs hidden inside APIs that look trivial at the call site. These hidden costs can be exploited to induce unexpected superlinear runtime behavior and create blind spots in audits.",{"name":82,"@type":73,"acceptedAnswer":83},"How does ShadowProbe scale detection across programming languages and large codebases?",{"text":84,"@type":76},"ShadowProbe uses a structured multi-stage pipeline: lightweight static screening guided by shadow complexity signals, automated reconstruction of minimal executable contexts from project symbols, and input synthesis with controlled size. Validation relies on execution-time measurements plus statistical growth inference to distinguish true blowups from runtime noise.","https://schema.org",{"og:url":51,"og:type":87,"og:title":13,"og:site_name":58,"og:description":14},"article",{"robots":89,"canonical":51},"index,follow",{"doc_id":7,"site_id":24},{"code":4,"msg":5,"data":92},[93,97,101,105,110,115,120,122,127,130,134],{"id":20,"doc_module":4,"doc_module_name":45,"category_name":94,"show_sort_weight":95,"slug":96},"Story & Novel",90,"story-novel",{"id":46,"doc_module":4,"doc_module_name":45,"category_name":98,"show_sort_weight":99,"slug":100},"Literature",80,"literature",{"id":52,"doc_module":4,"doc_module_name":45,"category_name":102,"show_sort_weight":103,"slug":104},"Exam",70,"exam",{"id":106,"doc_module":4,"doc_module_name":45,"category_name":107,"show_sort_weight":108,"slug":109},5,"Comic",60,"comic",{"id":111,"doc_module":4,"doc_module_name":45,"category_name":112,"show_sort_weight":113,"slug":114},6,"Technology",50,"technology",{"id":116,"doc_module":4,"doc_module_name":45,"category_name":117,"show_sort_weight":118,"slug":119},7,"Healthcare",40,"healthcare",{"id":11,"doc_module":4,"doc_module_name":45,"category_name":12,"show_sort_weight":28,"slug":121},"research-report",{"id":123,"doc_module":4,"doc_module_name":45,"category_name":124,"show_sort_weight":125,"slug":126},9,"Religion & Spirituality",20,"religion-spirituality",{"id":125,"doc_module":4,"doc_module_name":45,"category_name":128,"show_sort_weight":125,"slug":129},"World Cup","world-cup",{"id":131,"doc_module":4,"doc_module_name":45,"category_name":132,"show_sort_weight":131,"slug":133},10,"Lifestyle","lifestyle",{"id":135,"doc_module":4,"doc_module_name":45,"category_name":136,"show_sort_weight":106,"slug":137},19,"General","general"]