2023 · Conference paper
XFL: Naming Functions in Binaries with Extreme Multi-label Learning
XFL treats function naming in stripped binaries as extreme multi-label classification: names are split into tokens, and PfastreXML ranks which tokens from a vocabulary of frequent labels fit each function. Its DEXTER embedding combines static-analysis features built on angr’s VEX IR with call-graph and whole-binary context, and a separate language model orders predicted tokens into a name string. On 741,724 functions from 10,047 x86-64 C binaries in Debian packages, with a 1,024-label vocabulary, the authors report precision 0.835, recall 0.575 and F1 0.681, ahead of Punstrip, Debin and Nero in precision and F1.
Scope and limitations
Predictions are token labels from a fixed vocabulary, ranked and optionally assembled into names; they are not recovered source names, and scoring matches tokens rather than exact names. Evaluation uses x86-64 ELF C binaries from Debian packages, built with mixed compilers and optimization settings, plus Nero’s smaller dataset; the trained model is specific to x86-64 GNU/Linux binaries. All tools receive function boundaries from symbol tables at test time, so boundary-detection errors are excluded. Many test names also occur in training; restricted to names never seen in training, F1 falls to 0.242. Obfuscated and adversarial binaries are out of scope. Debin and Dire figures on the Nero dataset are copied from the Nero paper rather than rerun.
Why it fits this collection
Adds function-name prediction for stripped binaries framed as multi-label learning over binary embeddings, complementing variable-name, type and data-structure recovery research.
Publication and review details
- Venue
- IEEE S&P 2023
- Status
- Conference paper
- Publication / posting date
- May 2023
- Date source
- IEEE Xplore and the publisher’s Crossref deposit both record publication in May 2023; IEEE added the article to Xplore on 21 July 2023. No publication day is asserted.
- First arXiv submission
- July 28, 2021
- arXiv
- 2107.13404
- Reviewed arXiv version
- v4
- DOI
- 10.1109/SP46215.2023.10179439
IEEE Xplore and Crossref agree on the title, three-author order, DOI, pages 2375–2390 and the May 2023 date. Reviewed arXiv v4 (2022-12-12; v1 2021-07-28), whose title and authors match; it was not compared page by page with the IEEE version. The paper’s code link github.com/unibw-patch/xfl now redirects to lmu-plai/xfl. The reviewed 2025-11-30 snapshot carries GPL-3.0 in COPYING. Its README describes xfl/ as partial original source with experiment data and logs and recommends the refactored xfl-r/ for comparisons; lm/ holds the name-generation language model. The README’s BibTeX lists pages 1677–1692 and DOI 10.1109/SP46215.2023.00096, which doi.org does not resolve, so this record uses the registered DOI. XFL-R setup requires Python 3.8, TensorFlow 2.13.1, PostgreSQL 13, radare2 5.5.4 and Ghidra 10.4, a PfastreXML build compiled from source downloaded separately, and a 46.9 GB Zenodo archive of models and tables (10.5281/zenodo.10733597) whose metadata names no license; pretrained DEXTER embeddings are linked from a separate download host. The paper reports about 850 GB of RAM for DEXTER training. Nothing was run or downloaded.
Sources reviewed
Source review only; experiments were not rerun for this collection. Cite the original authors using the linked paper or BibTeX.
Primary sources
- https://ieeexplore.ieee.org/document/10179439
- https://api.crossref.org/works/10.1109/SP46215.2023.10179439
- https://arxiv.org/abs/2107.13404
- https://arxiv.org/pdf/2107.13404v4
- README.md GitHub · lmu-plai/xfl · Revision 5ad2569
- COPYING GitHub · lmu-plai/xfl · Revision 5ad2569
- xfl-r/README.md GitHub · lmu-plai/xfl · Revision 5ad2569
- xfl-r/INSTALL.md GitHub · lmu-plai/xfl · Revision 5ad2569
- xfl/evaluation/README.md GitHub · lmu-plai/xfl · Revision 5ad2569
- https://zenodo.org/records/10733597