{"id":"https://openalex.org/W7214743701","doi":"https://doi.org/10.48550/arxiv.2609.33547","title":"Neuro-Symbolic Indirect-Call Analysis under Opaque Pointers","display_name":"Neuro-Symbolic Indirect-Call Analysis under Opaque Pointers","publication_year":2026,"publication_date":"2026-09-27","ids":{"openalex":"https://openalex.org/W7214743701","doi":"https://doi.org/10.48550/arxiv.2609.33547"},"language":"en","primary_location":{"id":"pmh:oai:arXiv.org:2609.33547","doi":null,"is_oa":true,"landing_page_url":"https://arxiv.org/abs/2609.33547","pdf_url":"https://arxiv.org/pdf/2609.33547","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},"volume":null,"type":"preprint","is_traditional":true,"indexed_in":["arxiv","datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://arxiv.org/pdf/2609.33547","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5153429592","display_name":"Kaixuan Li","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I172675005","display_name":"Nanyang Technological University","ror":"https://ror.org/02e7b5302","country_code":"SG","type":"education","lineage":["https://openalex.org/I172675005"]}],"countries":["SG"],"is_corresponding":false,"raw_author_name":"Li, Kaixuan","raw_affiliation_strings":["Nanyang Technological University , Singapore , Singapore ,","Nanyang Technological University , Singapore BOZHI WU , Nanyang Technological University , Singapore"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Nanyang Technological University , Singapore , Singapore ,","institution_ids":["https://openalex.org/I172675005"]},{"raw_affiliation_string":"Nanyang Technological University , Singapore BOZHI WU , Nanyang Technological University , Singapore","institution_ids":["https://openalex.org/I172675005"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5101944861","display_name":"Bozhi Wu","orcid":"https://orcid.org/0000-0002-0360-2248","observed_orcids":["https://orcid.org/0000-0002-0360-2248"]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Wu, Bozhi","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5153443193","display_name":"Jian Zhang","orcid":null,"observed_orcids":[]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Zhang, Jian","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5153443349","display_name":"Peixin Wang","orcid":null,"observed_orcids":[]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Wang, Peixin","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5043441209","display_name":"Ting Su","orcid":"https://orcid.org/0000-0003-1628-9796","observed_orcids":["https://orcid.org/0000-0003-1628-9796"]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Su, Ting","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5100355692","display_name":"Yang Liu","orcid":"https://orcid.org/0000-0001-7300-9215","observed_orcids":["https://orcid.org/0000-0001-7300-9215","https://orcid.org/0000-0002-6276-1468","https://orcid.org/0000-0001-9704-8120","https://orcid.org/0009-0003-6607-861X"]},"institutions":[{"id":"https://openalex.org/I172675005","display_name":"Nanyang Technological University","ror":"https://ror.org/02e7b5302","country_code":"SG","type":"education","lineage":["https://openalex.org/I172675005"]}],"countries":["SG"],"is_corresponding":false,"raw_author_name":"Liu, Yang","raw_affiliation_strings":["Nanyang Technological University , Singapore","Nanyang Technological University , Singapore , Singapore ,"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Nanyang Technological University , Singapore","institution_ids":["https://openalex.org/I172675005"]},{"raw_affiliation_string":"Nanyang Technological University , Singapore , Singapore ,","institution_ids":["https://openalex.org/I172675005"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":true,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10743","display_name":"Software Testing and Debugging Techniques","score":0.8901000022888184,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10743","display_name":"Software Testing and Debugging Techniques","score":0.8901000022888184,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10126","display_name":"Logic, programming, and type systems","score":0.06129999831318855,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10260","display_name":"Software Engineering Research","score":0.021900000050663948,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/call-graph-construction","display_name":"call graph construction","score":0.9319999814033508},{"id":"https://openalex.org/keywords/type-based-analysis","display_name":"type-based analysis","score":0.5270000100135803},{"id":"https://openalex.org/keywords/llvm-ir","display_name":"LLVM IR","score":0.5889999866485596},{"id":"https://openalex.org/keywords/facets","display_name":"facets","score":0.7080000042915344},{"id":"https://openalex.org/keywords/large-language-models","display_name":"large language models","score":0.6370000243186951},{"id":"https://openalex.org/keywords/c-programs","display_name":"C programs","score":0.7120000123977661}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7106000185012817},{"id":"https://openalex.org/C150202949","wikidata":"https://www.wikidata.org/wiki/Q107602","display_name":"Pointer (user interface)","level":2,"score":0.628000020980835},{"id":"https://openalex.org/C102379954","wikidata":"https://www.wikidata.org/wiki/Q2589940","display_name":"Call graph","level":2,"score":0.5903000235557556},{"id":"https://openalex.org/C2778692605","wikidata":"https://www.wikidata.org/wiki/Q4041866","display_name":"Joins","level":2,"score":0.5059999823570251},{"id":"https://openalex.org/C34388435","wikidata":"https://www.wikidata.org/wiki/Q2267362","display_name":"Bounded function","level":2,"score":0.48980000615119934},{"id":"https://openalex.org/C80444323","wikidata":"https://www.wikidata.org/wiki/Q2878974","display_name":"Theoretical computer science","level":1,"score":0.4790000021457672},{"id":"https://openalex.org/C25343380","wikidata":"https://www.wikidata.org/wiki/Q277521","display_name":"Relation (database)","level":2,"score":0.42239999771118164},{"id":"https://openalex.org/C132525143","wikidata":"https://www.wikidata.org/wiki/Q141488","display_name":"Graph","level":2,"score":0.4156999886035919},{"id":"https://openalex.org/C9652623","wikidata":"https://www.wikidata.org/wiki/Q190109","display_name":"Field (mathematics)","level":2,"score":0.4049000144004822},{"id":"https://openalex.org/C165064840","wikidata":"https://www.wikidata.org/wiki/Q1321061","display_name":"Matching (statistics)","level":2,"score":0.3855000138282776},{"id":"https://openalex.org/C60056205","wikidata":"https://www.wikidata.org/wiki/Q691914","display_name":"Opacity","level":2,"score":0.38499999046325684},{"id":"https://openalex.org/C48044578","wikidata":"https://www.wikidata.org/wiki/Q727490","display_name":"Scalability","level":2,"score":0.37059998512268066},{"id":"https://openalex.org/C2777299769","wikidata":"https://www.wikidata.org/wiki/Q3707858","display_name":"Type (biology)","level":2,"score":0.3425999879837036},{"id":"https://openalex.org/C162319229","wikidata":"https://www.wikidata.org/wiki/Q175263","display_name":"Data structure","level":2,"score":0.32109999656677246},{"id":"https://openalex.org/C14036430","wikidata":"https://www.wikidata.org/wiki/Q3736076","display_name":"Function (biology)","level":2,"score":0.31380000710487366},{"id":"https://openalex.org/C43122875","wikidata":"https://www.wikidata.org/wiki/Q5428522","display_name":"Facet (psychology)","level":4,"score":0.31130000948905945},{"id":"https://openalex.org/C153083717","wikidata":"https://www.wikidata.org/wiki/Q6535263","display_name":"Leverage (statistics)","level":2,"score":0.30559998750686646},{"id":"https://openalex.org/C2777904410","wikidata":"https://www.wikidata.org/wiki/Q7397","display_name":"Software","level":2,"score":0.2957000136375427},{"id":"https://openalex.org/C162307627","wikidata":"https://www.wikidata.org/wiki/Q204833","display_name":"Enhanced Data Rates for GSM Evolution","level":2,"score":0.28780001401901245},{"id":"https://openalex.org/C68859911","wikidata":"https://www.wikidata.org/wiki/Q1503724","display_name":"Pattern matching","level":2,"score":0.28130000829696655},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.28040000796318054},{"id":"https://openalex.org/C11413529","wikidata":"https://www.wikidata.org/wiki/Q8366","display_name":"Algorithm","level":1,"score":0.27880001068115234},{"id":"https://openalex.org/C199360897","wikidata":"https://www.wikidata.org/wiki/Q9143","display_name":"Programming language","level":1,"score":0.27649998664855957},{"id":"https://openalex.org/C168065819","wikidata":"https://www.wikidata.org/wiki/Q845566","display_name":"Debugging","level":2,"score":0.26829999685287476},{"id":"https://openalex.org/C128107574","wikidata":"https://www.wikidata.org/wiki/Q182003","display_name":"Injective function","level":2,"score":0.2678000032901764},{"id":"https://openalex.org/C119024030","wikidata":"https://www.wikidata.org/wiki/Q759899","display_name":"Call stack","level":3,"score":0.26170000433921814},{"id":"https://openalex.org/C138958017","wikidata":"https://www.wikidata.org/wiki/Q190087","display_name":"Data type","level":2,"score":0.25519999861717224}],"mesh":[],"locations_count":2,"locations":[{"id":"pmh:oai:arXiv.org:2609.33547","doi":null,"is_oa":true,"landing_page_url":"https://arxiv.org/abs/2609.33547","pdf_url":"https://arxiv.org/pdf/2609.33547","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},{"id":"doi:10.48550/arxiv.2609.33547","doi":"https://doi.org/10.48550/arxiv.2609.33547","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2609.33547","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"pmh:oai:arXiv.org:2609.33547","doi":null,"is_oa":true,"landing_page_url":"https://arxiv.org/abs/2609.33547","pdf_url":"https://arxiv.org/pdf/2609.33547","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},"sustainable_development_goals":[],"study_designs":[],"awards":[],"funders":[],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W7214743701.pdf","grobid_xml":"https://content.openalex.org/works/W7214743701.grobid-xml"},"referenced_works_count":48,"referenced_works":["https://openalex.org/W198969604","https://openalex.org/W1810163311","https://openalex.org/W1966831167","https://openalex.org/W1996567876","https://openalex.org/W2014323361","https://openalex.org/W2043100293","https://openalex.org/W2080573945","https://openalex.org/W2109219878","https://openalex.org/W2117426803","https://openalex.org/W2131135493","https://openalex.org/W2133824159","https://openalex.org/W2135389226","https://openalex.org/W2140021378","https://openalex.org/W2148755014","https://openalex.org/W2151360539","https://openalex.org/W2153578567","https://openalex.org/W2167363133","https://openalex.org/W2258876169","https://openalex.org/W2368550879","https://openalex.org/W2511015845","https://openalex.org/W2617348763","https://openalex.org/W2626029330","https://openalex.org/W2762112776","https://openalex.org/W2799226481","https://openalex.org/W2884704156","https://openalex.org/W2900044545","https://openalex.org/W2959352824","https://openalex.org/W2962823786","https://openalex.org/W2987375469","https://openalex.org/W3030148664","https://openalex.org/W3214111992","https://openalex.org/W4206770190","https://openalex.org/W4284671049","https://openalex.org/W4297677548","https://openalex.org/W4379536072","https://openalex.org/W4384948588","https://openalex.org/W4385187234","https://openalex.org/W4399567214","https://openalex.org/W4403536714","https://openalex.org/W4411337674","https://openalex.org/W4411522861","https://openalex.org/W4411552876","https://openalex.org/W4414564554","https://openalex.org/W4415034317","https://openalex.org/W6948369276","https://openalex.org/W7127342223","https://openalex.org/W7163917959","https://openalex.org/W7212318068"],"related_works":["https://openalex.org/W4387674224","https://openalex.org/W4411337674","https://openalex.org/W6997171492","https://openalex.org/W4391724812","https://openalex.org/W7096863","https://openalex.org/W4390699864","https://openalex.org/W2987375469","https://openalex.org/W2014323361","https://openalex.org/W7171379129","https://openalex.org/W2123900782"],"abstract_inverted_index":{"Resolving":[0],"indirect":[1,24,114],"calls":[2,25],"is":[3],"central":[4],"to":[5,22,29,86,92,126,206,214,231,247],"call-graph":[6,152],"construction":[7],"for":[8,158,255],"C.":[9],"Scalable":[10],"type-based":[11],"analyses":[12,59],"such":[13],"as":[14],"MLTA":[15],"use":[16],"type":[17,38,79],"information":[18],"in":[19,52,242],"LLVM":[20,47],"IR":[21,223],"associate":[23],"with":[26,221],"functions":[27,82,124],"assigned":[28,125],"the":[30,41,65,69,75,78,83,87,95,108,123,138,165,174,200,234,248],"corresponding":[31],"structure":[32,109],"fields.":[33],"However,":[34],"a":[35,43,185,190,257],"single":[36],"pointee":[37,50],"often":[39],"misrepresents":[40],"memory":[42],"pointer":[44],"addresses,":[45],"and":[46,132,161,163,189,208],"17":[48,239],"removed":[49],"types":[51,67],"favor":[53],"of":[54,226,252],"opaque":[55,104],"pointers.":[56],"Therefore,":[57],"field-sensitive":[58],"lose":[60],"their":[61],"matching":[62,70],"key.":[63],"Recovering":[64],"erased":[66],"restores":[68],"key":[71],"but":[72],"still":[73],"misses":[74],"relation":[76,102],"that":[77,98,127],"encoded:":[80],"which":[81,112],"program":[84],"assigns":[85],"field.":[88],"We":[89],"present":[90],"Facet,":[91],"our":[93],"knowledge":[94],"first":[96],"analysis":[97,182],"reconstructs":[99],"this":[100],"dispatch":[101],"over":[103,256],"IR.":[105],"Facet":[106,149,198],"identifies":[107],"field":[110,128,141,218],"from":[111,204,212,245],"an":[113,145],"call":[115,187,192,236],"loads":[116],"its":[117],"function":[118],"pointer.":[119],"It":[120,135],"separately":[121],"recovers":[122],"through":[129],"initializers,":[130],"stores,":[131],"aggregate":[133],"copies.":[134],"then":[136],"joins":[137],"two":[139],"by":[140],"identity,":[142],"without":[143],"requiring":[144],"end-to-end":[146],"value-flow":[147],"path.":[148],"classifies":[150],"proposed":[151],"changes":[153],"under":[154],"distinct":[155],"evidence":[156],"rules":[157],"edge":[159],"addition":[160],"removal":[162],"records":[164],"assumption":[166],"behind":[167],"each":[168],"refinement.":[169],"An":[170],"LLM":[171],"decides":[172],"only":[173],"residual":[175],"cases":[176],"among":[177],"symbolically":[178],"bounded":[179],"candidates.":[180],"One":[181],"yields":[183],"both":[184],"recall-preserving":[186],"graph":[188,237],"refined":[191,235],"graph.":[193],"On":[194],"14":[195],"C":[196,243],"programs,":[197],"reduces":[199],"mean":[201],"target-set":[202],"size":[203],"25.9":[205],"5.2":[207],"raises":[209],"observed":[210],"recall":[211],"0.79":[213],"0.99.":[215],"Its":[216],"recovered":[217],"identities":[219],"agree":[220],"typed":[222],"at":[224],"98.1%":[225],"jointly":[227],"resolved":[228],"sites.":[229],"Applied":[230],"bug":[232],"detection,":[233],"found":[238],"deep":[240],"bugs":[241],"software":[244],"nginx":[246],"Linux":[249],"kernel,":[250],"three":[251],"them":[253],"latent":[254],"decade;":[258],"12":[259],"are":[260],"confirmed.":[261]},"counts_by_year":[],"updated_date":"2026-11-07T11:25:07.637180","created_date":"2026-09-30T00:00:00"}