New ML Tool Detects Unsafe Rust Code in Compiled Binaries Without Source Access

A novel machine-learning technique can now pinpoint unsafe code regions in compiled Rust binaries—addressing a long-standing blind spot in binary security analysis. The approach, called Ruby, requires only the executable itself, not the original source code, making it practical for auditing third-party software and closed-source applications.

The Problem with Rust's Safety Features#

Rust's memory safety guarantees depend on compile-time checks, but developers can opt out of these protections using the unsafe keyword when interfacing with low-level systems or for performance-critical code. Security tools have historically focused on finding bugs within these unsafe blocks, yet existing approaches require access to source code where the unsafe markers are visible. Once compiled into a binary, this information vanishes—leaving security researchers unable to efficiently target their analysis.

How Ruby Identifies Hidden Unsafe Regions#

Ruby applies machine learning to the patterns and nuances embedded in compiled instruction sequences. By training on binaries where unsafe regions are known, the model learns to distinguish the subtle differences in how unsafe operations manifest compared to safe code. In testing, the tool correctly identified 91.75% of all unsafe regions while maintaining a false positive rate of just 6.16%—outperforming contemporary large language models tested on the same task.

Real-World Security Impact#

The technique proves its value beyond detection alone. When Ruby's findings were used to guide two complementary debugging approaches—symbolic execution and fuzzing—each saw measurable performance gains of 57.95% and 21.26% respectively. The methodology uncovered five previously unknown vulnerabilities in Google's Android library, all of which have since been confirmed and patched, demonstrating concrete security benefits.

Research Context#

The work was published as a computer science research paper on arXiv (identifier 2211.00111), originally submitted in October 2022 and most recently updated in July 2026. It addresses the cryptography and security domain, contributing a novel method for binary-level vulnerability discovery in a language increasingly used for systems programming.