一句话：提出用静态不变式 ensue() 校验 ML 动态函数调用预测，区分误预测与攻击，降低攻击面与开销。
论文关注 ML 运行时预测缺乏保证的问题：在程序 debloating 与动态控制流监控等安全场景中，必须区分 ML 误预测与真实攻击。作者提出低开销框架，针对动态函数调用集预测，先用 ML 对整个程序预测，高精度消除约 90% 的代码复用 gadget；再定义函数的静态关系 ensue()，表示任意动态执行下可合法跟随该函数的集合，并用 Datalog 求解器高效静态计算。误预测发生时，框架触发轻量检查以判定攻击或误预测。在 SPEC CPU 2017 及低、高复杂度应用上，检查触发率分别为 3.8%、16%、2.3%，所有案例均符合静态调用关系；运行时开销为 7.5%（SPEC）与 3%（真实应用）。
Recent work has demonstrated the utility of machine learning (ML) in carrying out highly accurate predictions at runtime. One of the major challenges with using ML, however, is that the predictions lack certain guarantees. For such approaches to become practicable in security settings involving debloating and dynamic control flow monitoring, one must distinguish between mispredictions vs. attacks. In this work, we introduce a low overhead framework for tackling mispredictions of ML-based approaches using static invariants. In particular, we tackle the problem of dynamic function call set prediction encountered in program debloating. We first introduce an ML-based prediction technique that works on the whole application, providing high precision and reducing ~90% of code-reuse gadgets useful for staging attacks at runtime. We then propose an effective mechanism for dealing with the ML model's mispredictions: a new static relation called the ensue() of a function, which is a set of functions that could legally follow a given function under any dynamic execution. We develop efficient algorithms to statically compute such a set by modeling the relation in a Datalog-based solver. Upon misprediction, the framework invokes a lightweight mechanism to distinguish between an attack vs. misprediction. We show that the framework triggers misprediction checking in our experiments on a reasonable percentage of predictions invoked at runtime (3.8%, 16%, and 2.3% for SPEC CPU 2017 and low- and high-complexity applications, respectively), of which all cases are validated to conform to the static call relations. We contend that a low runtime overhead (7.5% for SPEC, 3% for real-world applications) and precise ML mechanism, along with the ability to effectively deal with mispredictions, yields a real-world solution.
@inproceedings{PorterKNP25,
title = {Tackling ML-based Dynamic Mispredictions using Statically Computed Invariants for Attack Surface Reduction},
author = {Chris Porter and Sharjeel Khan and Kangqi Ni and Santosh Pande},
booktitle = {ASPLOS},
year = {2025},
doi = {10.1145/3676641.3716276}
}