Control Flow Integrity (CFI)

Secures indirect call and indirect jump instructions by verifying that the target address belongs to a legitimate function entry point.

• Implements coarse-grained checks by restricting targets to functions with compatible signatures.
• Fine-grained approaches use context-sensitive analysis to limit targets based on the specific call site.
• Prevents attackers from diverting execution to arbitrary library functions or gadget chains.

Defends return instructions by validating that the return address on the stack matches the one stored at the corresponding call site.

• Typically implemented via a shadow stack: a separate, hardware-protected memory region that stores return addresses.
• On function return, the processor compares the main stack's return address against the shadow stack copy.
• A mismatch triggers an immediate security violation, halting the exploit before control is hijacked.

The foundation of CFI is a statically or dynamically generated Control Flow Graph that maps all valid execution paths.

• Static analysis parses the binary or source code to identify all legal call targets and return edges.
• Dynamic profiling observes runtime behavior to refine the graph, reducing false positives.
• The CFG is embedded into the binary or enforced by a runtime monitor, acting as the security policy.

CFI policies are enforced by inserting inline reference monitors—small code snippets—before every control-flow transfer instruction.

• Compiler-based instrumentation (e.g., Clang CFI) adds checks during the build process.
• Binary rewriting tools apply CFI to legacy software without requiring source code.
• Enforcement mechanisms use label checking or jump table indexing to validate targets with minimal performance overhead.

CFI implementations balance security guarantees against runtime overhead.

• Coarse-grained CFI (e.g., restricting calls to any function) adds <2% overhead but is vulnerable to gadget stitching.
• Fine-grained CFI enforces strict per-call-site targets, offering stronger security at a 5-15% performance cost.
• Modern hardware features like Intel CET and ARM PAC provide hardware-assisted CFI, reducing the performance penalty for fine-grained enforcement.

An obfuscation technique that dismantles the natural conditional branching structure of a program and replaces it with a single flat dispatch loop controlled by a state variable. The original logical sequence becomes opaque to static analysis because all basic blocks appear to have equal precedence. When combined with CFI, flattening adds a layer of static analysis resistance while CFI enforces runtime integrity on the flattened graph.

Conditional statements inserted into the control flow whose outcome is deterministically known at obfuscation time but is computationally difficult for a static analyzer to deduce. These create dead code paths and false branches that confuse reverse engineers attempting to reconstruct the legitimate control flow graph. CFI policies must be carefully constructed to accommodate these predicates without weakening the security invariant.

The practice of modifying a compiled model binary to make its underlying logic unintelligible to decompilers while preserving runtime behavior. Techniques include:

• Instruction substitution with functionally equivalent but complex sequences
• Dead code insertion to bloat disassembly output
• Symbol stripping to remove semantic metadata CFI complements binary obfuscation by ensuring that even if obfuscation is partially reversed, the attacker cannot hijack execution flow.

A set of integrity-checking mechanisms embedded within a model's runtime that detect unauthorized modifications to code or data segments. Upon detecting tampering, responses include:

• Zeroization of cryptographic keys and model weights
• Graceful shutdown to prevent further analysis
• Deceptive execution that feeds false outputs to the attacker CFI enforces that these integrity checks are always reached in the correct sequence and cannot be bypassed via control flow hijacking.

A technique that translates native machine code into a custom, randomized bytecode executed by an embedded virtual machine interpreter. The original x86 or ARM instructions are never directly exposed to static analysis. The VM's dispatch loop itself becomes a critical control flow target—CFI protects this dispatch mechanism from being subverted to execute arbitrary bytecode sequences that could expose the underlying model logic.

A class of defenses that eliminate or mask physical information leakage—timing, power consumption, electromagnetic emanations—from a processor running model inference. Even with perfect CFI enforcement, an attacker monitoring cache access patterns or branch predictor states can infer the control flow graph. Combined mitigations ensure that CFI's protection is not undermined by hardware-level observation channels.