AI-extracted code features match embeddings while staying human-readable

Identifying functionally similar code across different architectures and optimization levels is essential for malware analysis and security research, yet existing methods force researchers to choose between accuracy, scalability, and understandability.

The interpretability-generality trade-off#

Traditional approaches rely on manually designed statistics—such as counts of specific instructions or operation ratios—that are easy to understand and verify but lack the nuance needed to capture semantic similarity across different contexts. Embedding-based methods, by contrast, learn powerful representations that generalize well across settings but produce opaque vectors that resist human inspection and require approximations for large-scale search, ultimately hurting accuracy.

A new middle ground#

A research team led by Charles Edward Gagnon tackled this impasse by enlisting a language model to perform structured reasoning on assembly code. Rather than producing a single dense vector, the system generates a bundle of interpretable features:

• Input and output types that describe what data the code expects and returns
• Side effects revealing interactions with memory, hardware, or system calls
• Notable constants embedded in the binary
• Algorithmic intent describing the high-level purpose of the code

Because these features are human-readable and discrete, they work naturally with standard database indexes rather than requiring costly nearest-neighbor approximations.

Performance without training#

Remarkably, the method achieved competitive results with no similarity-matching training at all. In cross-architecture comparisons, it reached 42% recall@1 (finding the correct match in the top result); on cross-optimization tasks, it hit 62%—broadly matching or outperforming purely embedding-based approaches that require explicit training (39% and 34%, respectively). When combined with embeddings, the hybrid approach significantly improved state-of-the-art performance, proving that accuracy, speed, and transparency need not be mutually exclusive.