Pith. sign in

REVIEW 5 major objections 6 minor 5 cited by

This paper claims that an unsupervised translator trained only on open-source binaries can map six ISAs to X86-64 well enough for a single-ISA malware detector to achieve AUC above 0.93.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

FlowMalTrans uses normalizing flows to map basic blocks across ISAs, letting a single X86-64-trained malware detector handle code from six other architectures.

T0 review reviewed 2026-08-05 challenge →

load-bearing objection Useful architecture and a plausible cross-ISA malware detection pipeline, but the AUCs need variance estimates and the packing/obfuscation gap means the generalization claim is not fully established. the 5 major comments →

arxiv 2508.20212 v2 pith:VKIVKV2L submitted 2025-08-27 cs.CR cs.SE

FlowMalTrans: Unsupervised Binary Code Translation for Malware Detection Using Flow-Adapter Architecture

Minghao Hu , Junzhe Wang , Weisen Zhao , Qiang Zeng , Lannan Luo This is my paper
classification cs.CR cs.SE
keywords malware detectionbinary code translationcross-ISA transfernormalizing flowsunsupervised neural machine translationLSTMlow-resource ISAs
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper tries to establish that binary code can be translated across instruction-set architectures (ISAs) with no paired examples and no malware labels, using only open-source programs for training. The payoff is practical: a malware detector built once on X86-64, where labeled malware is plentiful, can be reused on six other ISAs where labeled malware is scarce, with reported AUC values between 0.931 and 0.996. The mechanism is a pair of normalizing-flow adapters that map each ISA's latent basic-block representation to a shared Gaussian space, making translation an invertible composition of two flows. If the claim is right, cross-ISA malware detection stops requiring large labeled collections for every architecture.

Core claim

The paper's central claim is that code semantics survive cross-ISA binary translation better when each ISA keeps its own encoder, decoder, and latent space, and the latent spaces are aligned by normalizing flows rather than forced into a single shared representation. FlowMalTrans learns source-to-target translation by composing two invertible RealNVP maps: the source flow sends a basic block's latent code z_src to the Gaussian base code epsilon, and the target flow sends epsilon to a code z_tgt that the target decoder can read. The model is trained without any malware, on disassembled basic blocks from open-source programs, using denoising auto-encoding, back-translation, and maximum-likelih

What carries the argument

The load-bearing mechanism is a matched pair of RealNVP (Real-valued Non-volume Preserving) normalizing-flow adapters. The source flow maps the source basic-block latent representation z_src to a standard-Gaussian base code epsilon; the target flow maps epsilon to the target representation z_tgt. Because both maps are invertible, translation is the composition G(z_src->epsilon) then G(epsilon->z_tgt), allowing each ISA to keep its own latent space while the two spaces are aligned through the common base distribution. The flows are trained by maximum likelihood, and the surrounding Transformer encoder-decoder is trained with denoising auto-encoding and back-translation to make the decoder rea

Load-bearing premise

The load-bearing premise is that ordinary open-source binaries compiled on seven ISAs are representative enough of real malware—including register conventions and obfuscation—that a translator trained only on those binaries preserves the features the X86-64 detector needs; if malware blocks fall outside that training distribution, the reported AUCs overstate real-world detection.

What would settle it

A direct check would be to run FlowMalTrans on a held-out set of packed or obfuscated malware from M68K and PPC32, translate every basic block, and compare LSTM detection AUC against unpacked samples from the same ISAs; a sharp drop on the obfuscated set would show the generalization claim fails outside the training distribution.

Watch this falsifier. Get emailed when new claim-graph text bears on it.

If this is right

  • A malware detector trained only on X86-64 can classify binaries from six other ISAs with AUC between 0.931 and 0.996, so low-resource ISAs do not need their own labeled malware training sets.
  • The translator's training data is entirely open-source, non-malware binaries compiled across seven ISAs, so translation quality is not gated on collecting malware.
  • FlowMalTrans outperforms the state-of-the-art unsupervised binary translation baseline, UNSUPERBINTRANS, on BLEU for all six ISA pairs and on downstream detection AUC.
  • For ARM64, PPC32, and M68K, translation-based detection beats a same-ISA detector trained on the available low-resource malware samples, because the X86-64 model saw far more training data.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • A natural test the paper leaves open: measure translation BLEU and detection AUC separately on obfuscated or packed malware from the same ISAs; if those samples fall outside the training distribution, the headline AUCs would drop.
  • The flow-adapter design may transfer to other cross-ISA binary-analysis tasks the paper names but does not evaluate, such as code-clone search or vulnerability discovery, because the latent alignment is not specific to malware detection.
  • Because the paper only translates into X86-64 and evaluates Linux ELF binaries, a direct extension is training with ARM32 as target or testing on Windows/Mach-O malware.
  • The vocabulary-matching heuristic (<15% size discrepancy, <12k tokens) is an empirical design choice rather than a theoretical guarantee, and is worth re-examining as training corpora grow.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

5 major / 6 minor

Summary. The paper proposes FlowMalTrans, an unsupervised binary-to-binary translation model that maps basic blocks from source ISAs (i386, ARM32, ARM64, MIPS32, PPC32, M68K) to X86-64 using a pair of RealNVP normalizing flows as flow adapters between ISA-specific Transformer encoders/decoders. Training uses only open-source compiled programs, with denoising auto-encoding, back-translation, and maximum-likelihood objectives; no malware is seen during translation training. The central claim is that the translated binaries are faithful enough that an LSTM malware detector trained solely on X86-64 achieves AUC ≥ 0.931 on six other ISAs (Table 3a), outperforming prior cross-ISA transfer baselines and an IR-based baseline. The paper also reports higher BLEU than the prior UNSUPERBINTRANS baseline across all ISA pairs (Table 2).

Significance. If the central claim holds, this is a practically valuable result: it would reduce the need for per-ISA labeled malware corpora and extend deep-learning malware detection to low-resource architectures, going beyond the two-ISA scope of prior work. The empirical scope is substantial — seven ISAs, real VirusShare malware, four baselines, and a Same-ISA reference — and the authors state that code and datasets are open-sourced. However, the evidence as presented does not yet establish the claim. The detector's input layer consumes FlowMalTrans's own token embeddings, so the AUC numbers conflate translation quality with representation quality. The malware test sets are very small for low-resource ISAs (e.g., 128 ARM64 samples total, roughly 26 positives at 20% test split) and no confidence intervals or repeated runs are reported. The generalization from open-source training binaries to real-world, possibly obfuscated malware is acknowledged as untested in the Limitations. These are fixable with additional experiments, but they are load-bearing for the paper's main conclusion.

major comments (5)
  1. [Section 4.2, Eq. (3)] The composition is written as G(z_src→ε) ∘ G(ε→z_tgt). Under the standard convention (f∘g)(x) = f(g(x)), this applies G(ε→z_tgt) before G(z_src→ε), which is the reverse of the described 'first transform to ε, then to target'. If left-to-right composition is intended, the convention should be stated explicitly. This is the core latent transformation, so the notation should not be ambiguous.
  2. [Section 5.4, 'Malware Detection Model'] The LSTM input layer uses 'token embeddings extracted from FLOWMALTRANS'. The detection experiment therefore does not measure translation quality in isolation: the detector receives FlowMalTrans's learned representation space. If translated text is poor but the embeddings carry ISA-independent or source-ISA discriminative signal, AUC can be high regardless of translation fidelity. Please clarify whether baseline translations (UNSUPERBINTRANS, UNIMAP, CROSSINS2VEC) are also embedded with FlowMalTrans's embeddings. To support the claim that translation enables detection, the evaluation should use fixed or independent embeddings for all methods, or otherwise separate the contribution of textual translation from that of the shared embedding.
  3. [Section 5.4, Tables 3(a) and 3(b)] Test sets are small for the low-resource ISAs central to the paper: ARM64 has 128 malware samples, so the 20% test split gives about 26 malware positives; M68K has 545, about 109. No confidence intervals, bootstrap estimates, or repeated runs are reported. An AUC of 0.965 on ~26 positives has a wide interval, and the claim of 'superior' performance across all ISAs is not supported without variance reporting. Please report per-ISA test sizes and confidence intervals.
  4. [Limitations, 'Malware Packing and Obfuscation'] Packing is excluded and the paper states that no definitive obfuscation metadata is available for the VirusShare samples. Since FlowMalTrans is trained only on non-malware open-source programs, the load-bearing premise is that malware basic blocks fall in the learned source-ISA distribution and are mapped to the same ε-space. Invertibility alone does not guarantee this. The paper should include a density-based OOD check (e.g., flow log-likelihood on malware blocks vs. held-out benign blocks) or a reconstruction/latent-distance diagnostic, and ideally an evaluation on a small obfuscated malware set. Without this, the real-world detection claims rest on an untested distributional assumption.
  5. [Section 5.5 and Table 3(b)] There are internal numeric inconsistencies. The text reports Same-ISA AUC values of 0.952 for MIPS32 and 0.949 for PPC32, but Table 3(b) lists 0.974 and 0.849. The text also says for M68K 'only 80% of 245 malware samples are used for training', while Section 5.4 reports 545 M68K malware samples. These discrepancies undermine confidence in the reported results and must be reconciled before the evaluation can be assessed.
minor comments (6)
  1. [Section 5.1] The 'Same-ISA model' is mislabeled as 'Same-SIA model' in the bullet list. Please fix the typo.
  2. [Appendix A.6, Table 8 caption] The caption contains a stray token 'UNSUPERBINTRANS ˙Then' and should be cleaned up.
  3. [Figure 3] The legend appears garbled: 'ANDANDSXORPXORANDANDNEAND.WEORSLogical Opcodes' is not readable as a list of opcode categories. Please regenerate the figure with a clean legend.
  4. [Section 4.1] The text says 'The first and last token of an input basic block is a special token [/s]', but to mark both start and end one would need two [/s] tokens. Please clarify.
  5. [Appendix A.9] The reference to Glow as '(Diederik P. Kingma, 2014)' is not the standard citation for the Glow architecture; please cite Kingma and Dhariwal (2018).
  6. [Section 4.4] Training is described as continuing 'until the loss drops <0.3'. This threshold is vague; please report the number of epochs, learning-rate schedule, and training curves.

Circularity Check

0 steps flagged

No significant circularity: the claimed predictions are grounded in held-out external data and independent baselines.

full rationale

FlowMalTrans's core derivation is an invertible-flow composition (Eq. 3): G(z_src→z_tgt)=G(z_src→ε)∘G(ε→z_tgt). This is an identity for invertible normalizing flows, not a fitted prediction. The flows are trained with MLE on basic-block latent representations from open-source programs (Eq. 6), and translation is then evaluated on held-out packages (zlib, coreutils, diffutils) via BLEU against independently compiled reference binaries. The malware-detection experiment is also externally grounded: the LSTM is trained on X86-64 malware/benign labels from VirusShare and open-source programs, and tested on translated malware and benign samples that were not seen during FlowMalTrans training. The fact that the malware detector consumes FlowMalTrans embeddings is part of the proposed end-to-end system, not a circular input; the labels are external. The baseline UNSUPERBINTRANS is from the same research group, but it is used as a comparative baseline and retrained on the same datasets for additional ISA pairs, so it does not supply the paper's predictions. The Limitations section candidly states that packing is excluded and obfuscation methods in VirusShare samples are unknown; these are robustness/validity limitations, not circularity. No self-citation is load-bearing for the central claim. Therefore no circular step can be exhibited by the paper's own equations or construction.

Axiom & Free-Parameter Ledger

3 free parameters · 4 axioms · 0 invented entities

No invented entities. The method's dependency is mostly on domain assumptions about binary semantics, not on free physical parameters. The listed free parameters are hyperparameters selected via the reported test AUC, which is a mild form of fitting to the evaluation set.

free parameters (3)
  • BPE merge times = 9,000 to 22,000 per pair
    Chosen per pair to keep vocabulary discrepancy below 15% and vocabulary size below 12k (Table 1).
  • Number of sequential flows K = 3
    Selected via ablation in Appendix A.9 using malware detection AUC.
  • Embedding dimension = 64
    Selected via ablation (Table 12) using malware detection AUC.
axioms (4)
  • domain assumption Basic blocks from different ISAs compiled from the same source share enough semantic structure to be aligned through a shared Gaussian latent space.
    Equations (1) through (3) assume both source and target flows map to the same base distribution epsilon. This is the core alignment assumption.
  • domain assumption Back-translation over mono-architecture datasets yields valid pseudo-parallel pairs for training.
    Section 4.4 and Appendix A.1 use DAE and BT without any parallel corpus.
  • standard math RealNVP is an invertible, tractable normalizing flow with a computable Jacobian determinant.
    Section 4.2 relies on RealNVP's change-of-variables formula for density estimation.
  • ad hoc to paper Translating each basic block independently and concatenating the results preserves the information needed for malware detection.
    The testing pipeline does not model inter-block control flow (Section 4.4, final paragraph).

reviewed 2026-08-05 · how reviews work

0 comments
Cite this review

Pith. "Pith review of FlowMalTrans: Unsupervised Binary Code Translation for Malware Detection Using Flow-Adapter Architecture." pith.science (2026). https://pith.science/paper/VKIVKV2L

@misc{pith2026250820212,
  author       = {Pith},
  title        = {Pith review of: FlowMalTrans: Unsupervised Binary Code Translation for Malware Detection Using Flow-Adapter Architecture},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/VKIVKV2L}},
  note         = {Machine review of arXiv:2508.20212}
}
Share X Bluesky LinkedIn Reddit HN
read the original abstract

Applying deep learning to malware detection has drawn great attention due to its notable performance. With the increasing prevalence of cyberattacks targeting IoT devices, there is a parallel rise in the development of malware across various Instruction Set Architectures (ISAs). It is thus important to extend malware detection capacity to multiple ISAs. However, training a deep learning-based malware detection model usually requires a large number of labeled malware samples. The process of collecting and labeling sufficient malware samples to build datasets for each ISA is labor-intensive and time-consuming. To reduce the burden of data collection, we propose to leverage the ideas of Neural Machine Translation (NMT) and Normalizing Flows (NFs) for malware detection. Specifically, when dealing with malware in a certain ISA, we translate it to an ISA with sufficient malware samples (like X86-64). This allows us to apply a model trained on one ISA to analyze malware from another ISA. Our approach reduces the data collection effort by enabling malware detection across multiple ISAs using a model trained on a single ISA.

Figures

Figures reproduced from arXiv: 2508.20212 by Junzhe Wang, Lannan Luo, Minghao Hu, Qiang Zeng, Weisen Zhao.

Figure 1
Figure 1. Figure 1: Applying FLOWMALTRANS to detect malware in a source ISA using a malware detection model trained on the target ISA (e.g., X86-64). tions while maintaining alignment with a shared cross-ISA space. This is achieved by employing NFs. By transforming the source-ISA representa￾tions into the target-ISA representations via NFs, the decoder can leverage the representations to gen￾erate better aligned target-ISA bi… view at source ↗
Figure 2
Figure 2. Figure 2: Model architecture of FLOWMALTRANS, which contains a pair of flow adapters for modeling the distributions of basic block representations in the source ISA and target ISA, respectively. latent representations, which abstract away ISA￾specific details. However, this can be overly re￾strictive, as different ISAs exhibit distinct syntactic and structural characteristics that are not always easily aligned in a … view at source ↗
Figure 3
Figure 3. Figure 3: Visualization of opcode embeddings. which determine the operation to be performed, capture more semantics compared to operands; we thus focus on opcodes for this demonstration. We extract the embeddings of 138 X86-64 opcodes and 247 ARM32 opcodes from FLOWMALTRANS, and visualize them using t-SNE, as shown in Fig￾ure 3. Four categories of opcodes are selected for demonstration. We can see that opcodes perfo… view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Forward citations

Cited by 5 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score.

  1. ClassEval-Pro: A Cross-Domain Benchmark for Class-Level Code Generation

    cs.SE 2026-04 unverdicted novelty 7.0

    ClassEval-Pro benchmark shows frontier LLMs achieve at most 45.6% Pass@1 on class-level code tasks, with logic errors (56%) and dependency errors (38%) as dominant failure modes.

  2. CodeOCR: On the Effectiveness of Vision Language Models in Code Understanding

    cs.CL 2026-02 unverdicted novelty 7.0

    Multimodal LLMs process code as images to achieve up to 8x token compression, with visual cues like syntax highlighting aiding tasks and clone detection remaining resilient or even improving under compression.

  3. GlimpRouter: Efficient Collaborative Inference by Glimpsing One Token of Thoughts

    cs.AI 2026-01 unverdicted novelty 6.0

    GlimpRouter uses the entropy of the first token in each reasoning step to decide whether to invoke a large model, yielding 10.7% higher accuracy and 25.9% lower latency than a standalone large model on AIME25.

  4. Sustainable Hybrid Document-Routed Retrieval for Financial RAG: Resolving the Robustness-Precision Trade-off

    cs.CL 2026-03 unverdicted novelty 5.0

    HDRR combines document-level semantic routing with scoped chunk retrieval to outperform both pure chunk-based retrieval and semantic file routing on the FinDER benchmark, delivering higher average scores, lower failur...

  5. Sustainable Hybrid Document-Routed Retrieval for Financial RAG: Resolving the Robustness-Precision Trade-off

    cs.CL 2026-03 conditional novelty 5.0

    Hybrid Document-Routed Retrieval (HDRR) filters financial filings with LLM document routing then scopes chunk retrieval, beating pure chunk and pure file routing on FinDER accuracy and efficiency.

Reference graph

Works this paper leans on

58 extracted references · 50 canonical work pages · cited by 4 Pith papers · 2 internal anchors

  1. [1]

    Iftakhar Ahmad and Lannan Luo. 2023. https://doi.org/10.18653/v1/2023.findings-emnlp.971 Unsupervised binary code translation with application to code clone detection and vulnerability discovery . In Findings of the Association for Computational Linguistics: EMNLP 2023, Singapore. Association for Computational Linguistics

    work page doi:10.18653/v1/2023.findings-emnlp.971 2023

  2. [2]

    Bastidas F Andr \'e s and Mar \' a P \'e rez. 2017. Transpiler-based architecture for multi-platform web applications. In 2017 IEEE Second Ecuador Technical Chapters Meeting (ETCM), pages 1--6. IEEE

    work page 2017

  3. [3]

    angr . 2024. Intermediate representation. https://docs.angr.io/advanced-topics/ir

    work page 2024

  4. [4]

    Mikel Artetxe, Gorka Labaka, Eneko Agirre, and Kyunghyun Cho. 2018. Unsupervised neural machine translation. In ICLR

    work page 2018

  5. [5]

    \"O mer Aslan, Merve Ozkan-Okay, and Deepti Gupta. 2021. Intelligent behavior-based malware detection system on cloud computing environment. IEEE Access

    work page 2021

  6. [6]

    Sunny Behal, Amanpreet Singh Brar, and Krishan Kumar. 2010. Signature-based botnet detection and prevention. In Proceedings of International Symposium on Computer Engineering and Technology, pages 127--132

    work page 2010

  7. [7]

    Iker Burguera, Urko Zurutuza, and Simin Nadjm-Tehrani. 2011. Crowdroid: behavior-based malware detection system for android. In Proceedings of the 1st ACM workshop on Security and privacy in smartphones and mobile devices

    work page 2011

  8. [8]

    Iacer Calixto, Miguel Rios, and Wilker Aziz. 2019. Latent variable model for multi-modal translation. In Proceedings of the 57th Annual Meeting of the Association for Computational Linguistics, pages 6392--6405

    work page 2019

  9. [9]

    Luca Caviglione, Micha Chora \'s , Igino Corona, Artur Janicki, Wojciech Mazurczyk, Marek Pawlicki, and Katarzyna Wasielewska. 2020. Tight arms race: Overview of current malware threats and trends in their detection. IEEE Access, 9:5371--5396

    work page 2020

  10. [10]

    Ricky TQ Chen, Yulia Rubanova, Jesse Bettencourt, and David K Duvenaud. 2018. Neural ordinary differential equations. Advances in neural information processing systems, 31

    work page 2018

  11. [11]

    Anton Chernoff, Mark Herdeg, Ray Hookway, Chris Reeve, Norman Rubin, Tony Tye, S Bharadwaj Yadavalli, and John Yates. 1998. Fx! 32: A profile-directed binary translator. IEEE Micro, 18(02):56--64

    work page 1998

  12. [12]

    Cristina Cifuentes and Mike Van Emmerik. 2000. Uqbt: Adaptable binary translation at low cost. Computer, 33(3):60--66

    work page 2000

  13. [13]

    Alexis Conneau, Kartikay Khandelwal, Naman Goyal, Vishrav Chaudhary, Guillaume Wenzek, Francisco Guzm \'a n, \'E douard Grave, Myle Ott, Luke Zettlemoyer, and Veselin Stoyanov. 2020. Unsupervised cross-lingual representation learning at scale. In Proceedings of the 58th Annual Meeting of the Association for Computational Linguistics

    work page 2020

  14. [14]

    Alexis Conneau and Guillaume Lample. 2019. Cross-lingual language model pretraining. Advances in neural information processing systems

    work page 2019

  15. [15]

    Ali Davanian and Michalis Faloutsos. 2022. Malnet: A binary-centric network-level profiling of iot malware. In Proceedings of the 22nd ACM Internet Measurement Conference, pages 472--487

    work page 2022

  16. [16]

    Diederik P

    Jimmy Ba. Diederik P. Kingma. 2014. Adam: A method for stochastic optimization

    work page 2014

  17. [17]

    Steven H. H. Ding, Benjamin C. M. Fung, and Philippe Charland. 2019. https://doi.org/10.1109/SP.2019.00003 Asm2vec: Boosting static representation robustness for binary clone search against code obfuscation and compiler optimization . In 2019 IEEE Symposium on Security and Privacy (SP)

    arXiv 2019

  18. [18]

    Laurent Dinh, David Krueger, and Yoshua Bengio. 2014. Nice: Non-linear independent components estimation. arXiv preprint arXiv:1410.8516

    Pith/arXiv arXiv 2014

  19. [19]

    Laurent Dinh, Jascha Sohl-Dickstein, and Samy Bengio. 2022. Density estimation using real nvp. In International Conference on Learning Representations

    work page 2022

  20. [20]

    Dummy name . 2023. Dummy name prefixes. https://hex-rays.com/blog/igors-tip-of-the-week-34-dummy-names/

    work page 2023

  21. [21]

    Kemal Ebcioglu, Erik Altman, Michael Gschwind, and Sumedh Sathaye. 2001. Dynamic binary translation and optimization. IEEE Transactions on computers, 50(6):529--548

    work page 2001

  22. [22]

    Bryan Eikema and Wilker Aziz. 2019. Auto-encoding variational neural machine translation. In Proceedings of the 4th Workshop on Representation Learning for NLP (RepL4NLP-2019), pages 124--141

    work page 2019

  23. [23]

    Isaac Feldman and Rolando Coto-Solano. 2020. Neural machine translation models with back-translation for the extremely low-resource indigenous language bribri. In Proceedings of the 28th International Conference on Computational Linguistics, pages 3965--3976

    work page 2020

  24. [24]

    Mohana Gopinath and Sibi Chakkaravarthy Sethuraman. 2023. A comprehensive survey on deep learning based malware detection techniques. Computer Science Review

    work page 2023

  25. [25]

    Thamme Gowda and Jonathan May. 2020. Finding the optimal vocabulary size for neural machine translation. arXiv preprint arXiv:2004.02334

    work page internal anchor Pith review Pith/arXiv arXiv 2020

  26. [26]

    Hamed HaddadPajouh, Ali Dehghantanha, Raouf Khayami, and Kim-Kwang Raymond Choo. 2018. https://doi.org/10.1016/j.future.2018.03.007 A deep recurrent neural network based approach for internet of things malware threat hunting . Future Gener. Comput. Syst., 85(C)

    work page doi:10.1016/j.future.2018.03.007 2018

  27. [27]

    Jonathan Ho, Xi Chen, Aravind Srinivas, Yan Duan, and Pieter Abbeel. 2019. Flow++: Improving flow-based generative models with variational dequantization and architecture design. In International conference on machine learning, pages 2722--2730. PMLR

    work page 2019

  28. [28]

    IDA. 2023. IDA Pro: A powerful disassembler and a versatile debugger . https://hex-rays.com/ida-pro/

    work page 2023

  29. [29]

    S \'e bastien Jean, Kyunghyun Cho, Roland Memisevic, and Yoshua Bengio. 2014. On using very large target vocabulary for neural machine translation. arXiv preprint arXiv:1412.2007

    Pith/arXiv arXiv 2014

  30. [30]

    Marie-Anne Lachaux, Baptiste Roziere, Lowik Chanussot, and Guillaume Lample. 2020. Unsupervised translation of programming languages. arXiv preprint arXiv:2006.03511

    Pith/arXiv arXiv 2020

  31. [31]

    Xuezixiang Li, Yu Qu, and Heng Yin. 2021. Palmtree: Learning an assembly language model for instruction embedding. In Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security

    work page 2021

  32. [32]

    Wu Liu, Ping Ren, Ke Liu, and Hai-xin Duan. 2011. Behavior-based malware analysis and detection. In 2011 first international workshop on complexity and data mining. IEEE

    work page 2011

  33. [33]

    Xuezhe Ma, Chunting Zhou, Xian Li, Graham Neubig, and Eduard Hovy. 2019. Flowseq: Non-autoregressive conditional sequence generation with generative flow. In Proceedings of the 2019 Conference on Empirical Methods in Natural Language Processing and the 9th International Joint Conference on Natural Language Processing (EMNLP-IJCNLP), pages 4282--4292

    work page 2019

  34. [34]

    OllyDbg . 2000. OllyDbg . Url= https://www.ollydbg.de

    work page 2000

  35. [35]

    George Papamakarios, Theo Pavlakou, and Iain Murray. 2017. Masked autoregressive flow for density estimation. Advances in neural information processing systems, 30

    work page 2017

  36. [36]

    PEiD . 2008. PEiD . Url= https://github.com/wolfram77web/app-peid?tab=readme-ov-file

    work page 2008

  37. [37]

    Matt Post. 2018. https://www.aclweb.org/anthology/W18-6319 A call for clarity in reporting BLEU scores . In Proceedings of the Third Conference on Machine Translation: Research Papers, Belgium, Brussels. Association for Computational Linguistics

    work page 2018

  38. [38]

    Mila Dalla Preda, Mihai Christodorescu, Somesh Jha, and Saumya Debray. 2008. A semantics-based approach to malware detection. ACM Transactions on Programming Languages and Systems (TOPLAS)

    work page 2008

  39. [39]

    Cheerala Rohith and Gagandeep Kaur. 2021. A comprehensive study on malware detection and prevention techniques used by anti-virus. In 2021 2nd international conference on intelligent engineering and management (iciem). IEEE

    work page 2021

  40. [40]

    Baptiste Roziere, Marie-Anne Lachaux, Lowik Chanussot, and Guillaume Lample. 2020. Unsupervised translation of programming languages. Advances in neural information processing systems, 33:20601--20611

    work page 2020

  41. [41]

    Andrea Saracino, Daniele Sgandurra, Gianluca Dini, and Fabio Martinelli. 2016. Madam: Effective and efficient behavior-based android malware detection and prevention. IEEE Transactions on Dependable and Secure Computing

    work page 2016

  42. [42]

    V Sai Sathyanarayan, Pankaj Kohli, and Bezawada Bruhadeshwar. 2008. Signature generation and detection of malware families. In Information Security and Privacy: 13th Australasian Conference, ACISP 2008, Wollongong, Australia, July 7-9, 2008. Proceedings 13. Springer

    work page 2008

  43. [43]

    Stefano Sebastio, Eduard Baranov, Fabrizio Biondi, Olivier Decourbe, Thomas Given-Wilson, Axel Legay, Cassius Puodzius, and Jean Quilbeuf. 2020. Optimizing symbolic execution for malware behavior classification. Computers & Security, 93

    work page 2020

  44. [44]

    Hendra Setiawan, Matthias Sperber, Udhyakumar Nallasamy, and Matthias Paulik. 2020. Variational neural machine translation with normalizing flows. In Proceedings of the 58th Annual Meeting of the Association for Computational Linguistics, pages 7771--7777

    work page 2020

  45. [45]

    Mohit Sewak, Sanjay K Sahay, and Hemant Rathore. 2018. An investigation of a deep learning based malware detection system. In Proceedings of the 13th International Conference on Availability, Reliability and Security

    work page 2018

  46. [46]

    Bor-Yeh Shen, Jiunn-Yeu Chen, Wei-Chung Hsu, and Wuu Yang. 2012. Llbt: an llvm-based static binary translator. In Proceedings of the 2012 international conference on Compilers, architectures and synthesis for embedded systems, pages 51--60

    work page 2012

  47. [47]

    Raphael Shu, Jason Lee, Hideki Nakayama, and Kyunghyun Cho. 2020. Latent-variable non-autoregressive neural machine translation with deterministic inference using a delta posterior. In Proceedings of the aaai conference on artificial intelligence, volume 34, pages 8846--8853

    work page 2020

  48. [48]

    Dhiren Tripuramallu, Swapnil Singh, Shrirang Deshmukh, Srinivas Pinisetty, Shinde Arjun Shivaji, Raja Balusamy, and Ajaganna Bandeppa. 2024. Towards a transpiler for c/c++ to safer rust. arXiv preprint arXiv:2401.08264

    work page internal anchor Pith review Pith/arXiv arXiv 2024

  49. [49]

    A Vaswani. 2017. Attention is all you need. Advances in Neural Information Processing Systems

    2017

  50. [50]

    VirusShare . 2020. Virusshare: An open-source repository of malware samples. https://virusshare.com/

    work page 2020

  51. [51]

    Junzhe Wang, Matthew Sharp, Chuxiong Wu, Qiang Zeng, and Lannan Luo. 2023 a . https://www.usenix.org/conference/usenixsecurity23/presentation/wang-junzhe Can a deep learning model for one architecture be used for others? Retargeted-Architecture binary code analysis . In 32nd USENIX Security Symposium (USENIX Security 23), Anaheim, CA. USENIX Association

    work page 2023

  52. [52]

    Junzhe Wang, Matthew Sharp, Chuxiong Wu, Qiang Zeng, and Lannan Luo. 2023 b . Can a deep learning model for one architecture be used for others? \ Retargeted-Architecture \ binary code analysis. In 32nd USENIX Security Symposium (USENIX Security 23), pages 7339--7356

    work page 2023

  53. [53]

    Junzhe Wang, Qiang Zeng, and Lannan Luo. 2024. Learning cross-architecture instruction embeddings for binary code analysis in low-resource architectures. In Findings of the Association for Computational Linguistics: NAACL 2024, pages 1320--1332

    work page 2024

  54. [54]

    Justin D Weisz, Michael Muller, Stephanie Houde, John Richards, Steven I Ross, Fernando Martinez, Mayank Agarwal, and Kartik Talamadupula. 2021. Perfection not required? human-ai partnerships in code translation. In Proceedings of the 26th International Conference on Intelligent User Interfaces, pages 402--412

    work page 2021

  55. [55]

    Yucheng Xie Xie, Xiaonan Guo, Yan Wang, Jerry Q Cheng, Tianfang Zheng, Yingying Chen, Yi Wei, and Yuan Ge. 2024. mmpalm: Unlocking ubiquitous user authentication through palm recognition with mmwave signals. IEEE Conference on Communications and Network Security (CNS),

    work page 2024

  56. [56]

    Fei Zuo, Xiaopeng Li, Patrick Young, Lannan Luo, Qiang Zeng, and Zhexin Zhang. 2018. Neural machine translation inspired binary code similarity comparison beyond function pairs. arXiv preprint arXiv:1808.04706

    Pith/arXiv arXiv 2018

  57. [57]

    online" 'onlinestring :=

    ENTRY address archivePrefix author booktitle chapter edition editor eid eprint eprinttype howpublished institution journal key month note number organization pages publisher school series title type volume year doi pubmed url lastchecked label extra.label sort.label short.list INTEGERS output.state before.all mid.sentence after.sentence after.block STRING...

  58. [58]

    write newline

    " write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 global.max substring 't := if while FUNCTION word.in bbl.in capitalize " " * FUNCT...

This paper was first reviewed by deepseek-v4-flash on August 5, 2026.