ShieldedCode: Learning Robust Representations for Virtual Machine Protected Code
Authors: Mingqiao Mo
Yunlong Tan
Hao Zhang
Heng Zhang
Yangfan He
Venue: ICLR 2026 Poster (2026)
Keywords: Virtual Machine Protection
Primary area: generative models

Abstract: Large language models (LLMs) have achieved remarkable progress in code generation, yet their potential for software protection remains largely untapped.    Reverse engineering continues to threaten software security, while traditional virtual machine protection (VMP) relies on rigid, rule-based transformations that are costly to design and vulnerable to automated analysis.    In this work, we present the first protection-aware framework that learns robust representations of VMP-protected code.    Our approach builds large-scale paired datasets of source code and normalized VM implementations, and introduces hierarchical dependency modeling at intra-, preceding-, and inter-instruction levels.    We jointly optimize language modeling with functionality-aware and protection-aware contrastive objectives to capture both semantic equivalence and protection strength.    To further assess resilience, we propose a protection effectiveness optimization task that quantifies and ranks different VM variants derived from the same source. Coupled with a two-stage continual pre-training and fine-tuning pipeline, our method enables models to generate, compare, and reason over protected code. Extensive experiments show that our framework significantly improves robustness across diverse protection levels, opening a new research direction for learning-based software defense. In this work, we present ShieldedCode, the first protection-aware framework that learns robust representations of VMP-protected code. Our method achieves 26.95\% Pass@1 on L0 VM code generation compared to 22.58\% for GPT-4o, and improves binary similarity detection Recall@1 by 10\% over state of art methods like jTrans.

Published as a conference paper at ICLR 2026
SHIELDEDCODE: LEARNING ROBUST REPRESENTA- TIONS FOR VIRTUAL MACHINE PROTECTED CODE
Mingqiao Mo'; Yunlong Tan', i Hao Zhang': Heng Zhang,, Yangfan He
University of Chinese Academy of Sciences
South China Normal University University of Minnesota Twin Cities
mmq20031004@10 @1603 com, dogechat 1.63.com zs.cs. stwrtoutlook. com, 2024 025405544 450 @m. scnu wcw..edu.cc.... en, he0005776 01:0005700um edu
ABSTRACT
Large language models (LLMs) have achieved remarkable progress in code gener- ation, yet their potential for software protection remains largely untapped. Reverse engineering continues to threaten software security, while traditional virtual ma- chine protection (VMP) relies on rigid, rule-based transformations that are costly to design and vulnerable to automated analysis. In this work, we present the first protection-aware framework that learns robust representations code. Our approach builds large-scale paired datasets of source code and nor- malized VM implementations, and introduces hierarchical dependency modeling at intra-, preceding-. and inter-inttruction levels. We jointly optimize language modeling with functionality-awan and protection-aware contrastive objectives to capture both semantic equivalence and protection strength. To further assess re- silience, we propose a protection effectiveness optimization task that quantifies and ranks different VM variants derived from the same source. Coupled with a two-stage continual pre-training and fine-tuning pipeline. our method enables models generate, compare, and reason over protected code. Extensive experi- ments show that our framework significantly improves robustness across diverse protection levels, opening a new research direction for learning-based software defense. In this work, we present ShieldedCode, the first protection-awar frame- work that learns robust representations of VMP-protected code. Our method achieves 26.95% Pass I on LO VM code generation compared 22.58% for GPT-4o, and improves binary similarity detection Recall @ by 10% over state art methods like jTrans.
"MPPprotectedd
INTRODUCTION
In recent years, large language models (LLMs) have achieved remarkable progress across a variety of generative tasks (Ma et al. [025 Zhang et al., 2025alb) b), including image synthesis (Wu et al.) 2025 Qi et al. 2025a
Zhang et al. (025c). conversational agents (Luo et 2025). and code generation (Chen et al. 2022 Liu et al. 2023 Chen et al.) 2023) Le et al.) 2022) Among these, code generation is often regarded as one of the most challenging applications, as it requires not only the ability to interpret natural language but also deep understanding of programming semantics and logical reasoning. Recent advances such as OpenAl Codex (Chen et al. 202I), DeepMind Alpha- Code (Li et al. 2022), and Meta Code Llama (Rozière al. (222)) have demonstrated capabilities in automated code synthesis and problem solving that approach, and in some cases surpass, human programmers. These developments suggest that LLMs are evolving from auxiliary tools into central components capable of undertaking complex software engineering tasks.
While much of the attention has been directed toward improving productivity, the of LLMs to address long-standing security challenges in software engineering has received far less exploration.
'These authors contributed equally to this work.
1 "orresponniig author.

---

Published as a conference paper at ICLR 2026
With the rapid evolution of information technology, software security and intellectual property pro- tection face unprecedented threats. Advances in reverse engineering continue to lower the barrier for code theft and malicious tampering (Carbone et al.) 2009; Cummins et al., 2024 Tan et al. 2024). This trend highlights the urgent need for new mechanisms that strengthen software resilience against reverse engineering attacks. Traditional VMP systems vulnerable because attackers reverse engineering to break protection and steal intellectual property. Our work learns representations to generate and compare protected code, thereby helping defenders evaluate and improve protection effectiveness.
Among existing protection techniques, virtual machine protection (VMP) (Xu al., 2017, Fu al, 2019) stands out as one of the most resilient approaches. Its core idea is to replace native instructions with custom virtual instructions that are executed through dedicated interpreter, thereby increasing the difficulty of both static and dynamic analysis. However, traditional VMP systems typically rely on rule-based transformations that produce highly regular virtual machine structures and instruction patterns, which makes them attractive targets for reverse engineering (Pei et al. 2020 Xu et al.,
2023 Wang et al. 2022). Moreover, designing robust VMP systems requires deep expertise, and commercial solutions remain costly and limited in scope (Carlini et al. 2015 Fu et al. 2019).
To address these issues, we take a step toward learning-based software protection. We propose a protection-aware framework designed to learn robust representations of virtual machine (VM) pro- tected code. Our approach first constructs a large-scale paired dataset of source code and normalized VM implementations, applying canonicalization to remove irrelevant syntactic variability while pre- serving semantic structure. We introduce hierarchical dependency modeling at three levels: intra- instruction, capturing local token interactions within each virtual instruction; preceding-instruction.. enforcing short-range dependencies across consecutive instructions; and inter-instruction, encod- ing long-ram longrrange contextual relationships across the entire function. To guide representation learning, we jointly optimize a language modeling objective with functionality- contrastive losses, ensuring that embeddings reflect functional equivalence while respecting pro- tection strength. Furthermore, we introduce a protection effectiveness optimization task that quan- tifies the relative strength of different protection levels, enabling the model to identify and rank VM variants derived from the same source. The resulting training pipeline supports both contin- ual pre-training and subsequent fine-tuning, producing models capable of generating, comparing, and reasoning over protected code with high fidelity. Extensive experiments validate the soundness and effectiveness of our method. In this work, we present ShieldedCode, the first protection awwre framework that learns robust representations of VMP-protected code. Our method achieves 26.95% Pass@1 1 on LO VM code generation compared to 22.58% for GPT-4o, and improves binary simi- larity detection Recall @ 1 by 15.5 percentage points over jTrans (Linear Probe) on the challenging O0+L1 setting (0.488 and 0.333), outperforming recent methods including DeGPT, BinDiff, and BodaBERTTBinary by large margins. Our main contributions can summarized as follows:
and protection-awee aware
1.
A new learning-based perspective on software protection. We formulate software protection as a representation learning problem, introducing protection- awwee framework that systematically aligns source code with VM-protected implementations across heterogeneous protection levels.
Modeling and objectives tailored to polymorphic VM code.We design hicrarchical depen- dency modeling and propose joint functionality- and protection-aware contrastive learning, enabling embeddings that preserve semantic equivalence while capturing relative protection strength.
3. A comprehensive training and evaluation pipeline. We establish a two-stage continual pre- training and fine-tuning strategy, introduce a protection effectiveness optimization task for quan- tifying defense levels, and demonstrate through extensive experiments that our method generates, compares, and reasons over protected code with high fidelity.
RELATED WORK
2.1 VIRTUAL MACIINE PROTECTION: FROM PATTERNS TO SEMANTICS
Virtual Machine Protection (VMP) has long served as a cornerstone against reverse engineering (u et al. 2017 Fu et al. 2019). By translating native instructions (e.g.. x86/ARM) into custom byte- code executed by a private VM, it complicates static analysis (Carbone et al., 2009). However, analysis techniques advanced, traditional schemes revealed critical weaknesses: their instruction
2

---

Published as a conference paper at ICLR 2026
vcrypt
vr7
0xa3
xor
kl
rol
[VINST-1]
f
vobfs
vs3
0x7f
shi
mtx
add
[VINST-2]
f
vpoly
vm2
vr7
and
vs3
neg
[VINST-3]
ft
vdisp
ctx
vm2
jmp
hash
[VINST-4]
Final Polymorphic VMP Bytecode
verypt VI7, 0xa), xer Ki, rl!
vpoly vm2 vr7, and, v53, neg
vdiso cts, vnd, jmp, hash, rot
(4) Acren Functione
enc LO
ene
virt_Lo
L1
L2
obt
poly
poly
distnoe notd
Figure 1: Overview of our key components, including hierarchical dependencies in polymorphic execution, as well as the PCI. and FCL objectives. The upper part illustrates the hierarchical at- tention mask used in polymorphic execution. Hicrarchical attention mask showing the hierarchical instruction-awarr attention pattern. The matrix visualizes how tokens attend to each other across dif- ferent instruction boundaries. Pink regions represent intra-instruction causal attention within each instruction block. Light blue regions show mrecednn-innsruuctin previous [INST-X] boundaries. Dark blue regions indicate inter-instruction attention enabling com- munication between [INST-X] tokens. Purple regions represent positions with no attention. The lower part presents the objectives of FCL and PCL.
attention where tokens can access
sets and interpreters often expose recurring patterns, leaving them open to rule-based and semantic attacks (Carlini et al. 2015). This vulnerability is further amplified by recent progress in machine
learning for binary similarity detection (Pei et al. [2200] Xu et al. 2003 Wang et al. 2022 Xu et al., 2017 Ding et al. 2019) and neural decompilation (Fu et al. 2019; Hosseini Dolan Gavitt 2022 Tan et al.) 2024). which increasingly automate semantic recovery. Together, these advances signal a paradigm shift: protections must evolve from fixed transformation rules to mechanisms that em- bed semantic diversity and dynamic behavior, resisting both human and machine intelligence-aide aided analysis.
2.2 LARGE LANGUAGE MODELS FOR CODE: FROM GENERATION TO REPRESENTATION
Large language models (LLMs) have transformed code understanding and generation. Trained on massive code corpora Touvron al. 2023), they achieve near-human performance in tasks such
as code completion (Fried et al. 2023), summarization (Chai Li 2024 Shi et al. 2021 Nguyen
let al. 2023), , and langu-lan synthesis (Rozière al. 2023 Guo al. 2024
Lozhkov al.
2024
Hui et al. 2024) (Chen et al.] 2022 Liu et al., 2023 Chen et al. 2023
Le et al., 2022
Wang et al. 202 Chen al. 2021 Nijkamp al. 2022). Their strength lies in capturing program semantics at scale. A natural extension is adapting these semantic models to binaries: CodeArt
(Su et al.) 2024) regularizes attention for assembly representation; LLMCompiler (Cummins al., 2024) adapts CodeLlama to LLVM IR: and LLM4Decompile (Tan et al. (024) tackles binary-to- source recovery. Nova (Jiang et al. 2025) explores hierarchical modeling for compiler-level assem- bly. Unlike VMP sieecode-whice undergoes polymorphic expansion, virtual-register renaming, and interpreter-driven comantics-compiler assembly remains structurally stable (O0-03). Thus Nova operates in substantially easier regime than protection-aware VMP modeling. Meta's LLM- Compiler, despite being specifically trained on 401 billion tokens of LLVM-IR and assembly code, not designed for VMP code generation. Our work represents the first systematic effort to train language models specifically on virtualized machine code with protection-awan objectives. The domain gap between standard assembly (even LLVM-IR) and VMP bytecode is substantial. Col-
3

---

Published as a conference paper at ICLR 2026
lectively, these advances point to paradigm shift: LLMs are not only generators of code, but also catalysts for rethinking program representation and protection.
METHOD
In this section, we propose protection-aware training framework that (i) constructs paired datasets of source code and normalized virtual machine implementations, (ii) introduces hierarchical de- pendency modeling at the intra-instruction, combines language modeling with functionality-wwar and protection-aware contrastive objectives, (iv) incorporates protection effectiveness optimization objective to identify virtual machine code derived from the same program under different protection levels, and (v) provides a pipeline for both pre-training and fine-tuning. Figure | provides an overview of the key components. Figure 2 presents an example of our code generation, while the appendix provides a more detailed illustration in Figure 5
ionodinnninstruction. and inter-instruction levels, (iii)
3.1 CONSTRUCTION OF TRAINING DATA
Our methodology is designed be processor agnostic, and we illustrate it on C programs compiled for the x86-64 architecture. Starting from source corpora such as AnghaBenchiSiivaa et al. (2021), we construct a paired dataset where each sample couples an original C function with its corresponding virtual machine (VM) implementation protected by a commercial VMP tool. Concretely, let c denote a source unit and Compile(-, o) the compiler that produces an executable under optimization level E (O0, O1, O2, 03). The protection and extraction pipeline can be formalized as follows:
Compile(c,o) o),
Disasm (exee)
(1)
where (-P(-) denotes the commercial protection tool and Disasm(-) is a dedicated disassembler that recovers the VM implementation. Each training pair is then represented as follows:
(c, (vm))
(2)
where N(.) a normalization operator applied to eliminate spurious artifacts. Specifically, /V performs four canonicalization steps: (1) removing debug symbols and comments; (2) inserting whitespace around virtual instruction delimiters to stabilize tokenization; (3) substituting all virtual addresses with symbolic references; (4) replacing each instruction address with a canonical label (e.g., mapping addresses 0 and 4 to [VINST-1] and [VINST-2), which is appended at the end of the instruction. Formally, the resulting dataset given by follows:
D { (ct (D (DPPsasm(VMMPPCCCpieeeeeec o,)))) 1.3
This construction yields a large, architecture-aware corpus of aligned (source, VM) pairs, while abstracting away irrelevant syntactic variability and preserving the semantic structure necessary for learning robust mappings.
3.2 HIERARCHICAL DEPENDENCIES POLYMORPHIC VM GENERATION
We propose polymorphic virtual machine generation mechanism that imposes hierarchical de- pendency structure, explicitly modeling relationships at three complementary levels. At the intra- instruction level, each virtual instruction i with tokens (x!.... xx } summarized by dedicated marker token "[VINST]," This marker serves as anchor that aggregates information within the instruction, allowing the model treat the instruction structured sequence of tokens. At the preceding instruction level, the tokens of the current instruc- tion are conditioned not only on their intra-instructional marker "[VINST]," " but also on the marker of the immediately preceding instruction, "[VINST]--1" This enforces short-range dependencies that are critical for capturing local execution patterns such as register reuse, operand flow, or branch alignment. At the inter-instruction level, each current token is further connected the set of all prior markers ([VINST) [VINST] }. thereby injecting long-range contextual information. This design enables the model to represent obfuscation semantics that unfold over many instruc- tions, such as polymorphic transformations or dispersed control-flow dependencies, Formally, the hierarchical masking scheme governing the visible context of token at defined as follows:
coherent semantic unit rather than an un-
M(x+) , m [VV........VVIISTT [[IINST), U [[VINST), [VINST), [VVIST],....IINSSTT...
(4)
intra instruction
precoding
4

---

Published as a conference paper at ICLR 2026
Source Code (C)
02 Assembly Code (x86-64)
VMP Protected Code
void func0(float "a, int float "bb
0: endbr64
[VINST-1] vload rrg %vrdi, 0x0
movss (%rrd)),
float min,
[VINST-17] vfmov %vxmm1, [Pávrex] [VINST-19] visub %vxmm0, [Svrdi+
min max = a[o]:
48: movea (%Grxx), Nxmm1
for - 1; ni (+*)
4f: subes 4rax,4, %xxmm0
[VINST-211 vicomp %vxmmo, Sixmm22
(a(0) min)
comiss %xmmo, %6xm22 Se: 6d
[VINST-22] vjbe @L, skip
min a[]:
[VINST-23] vatore [%vrrda], %vxmm1
else (afi) > max)
moves %6mmm1 (%rdd)
@l_skkip:
[VINST-25] [%vrdxe+0dd) 5pxmm11
68: moves %xmmm1 (0x4(%rdd))
b[0] min:
78: add $0x4, Mrcx
@R end: [VINST-311]
max:)
retq
Figure 2: Complete transformation pipeline from C source code to VMP- IMP-protected assembly. The source code implements a min-max finding algorithm. The 02 assembly shows compiler optimiza- tion with complex control flow. The VMP version uses virtual instructions with [VINST-X] markers and virtual registers (prefixed with 'v'), demonstrating how our hierarchical attention mechanism processes instruction boundaries and dependencies.
This hierarchical mask jointly integrates local semantics, short-range contextual constraints, and long-range global dependencies. In contrast to the flat, token-level causal masks employed in stan- dard language models, approach introduces inductive bias that aligns more naturally with the structured dependencies inherent in virtual-machine protected code.
3.3 CONTRASTIVE AND LANGUAGE MODELING FOR VM SEMANTICS
The syntactic gap between virtual machine code and source code, together with the heterogeneity introduced by different protection levels, causes LLMs to overfit surface patterns rather than capture program semantics. To address this, augment standard language model training with contrastive objectives (Gao et al., (202T) that explicitly encourage semantics-aware representations. Concretely, the model is trained with the usual language modeling objective Lim plus contrastive losses: functionality contrastive learning (FCL) and protection contrastive learning (PCL).
Language modeling training corpus C:
The language modeling objective minimizes the negative log-likelihood on
Lim =
log po
(5)
DEC
We denote by eT the embedding of function f under representation s, where = -1 denotes source code and E 1,2,33 denotes VM code produced at protection levels L0-L3; let = (- 3}. Embeddings average token embeddings, and for VM code we average the "[VINST]" embeddings that summarize individual virtual instructions. Let d(u, u)
obtained from the final transformer layer: for source code
e||2 be the f2 distance.
F Functionality contrastive learning (FCL) FCL pulls together representations of the same func- tion across representations in S, ensuring that semantic identity dominates syntactic variation. Un- like conventional contrastive methods that treat all representation pairs equally, we introduce adaptive weighting mechanism that accounts for protection-level proximity. Specifically, we mini- mize weighted pairwise distances between embeddings of the same function:
Lid ΣΣ W.st d(ej,et)
JEF aLES
stt
where F is the set of functions in the current batch, and W,,t exp (-ls-t|/Te) assigns higher weights to closer protection levels. The temperature parameter Tha controls the decay rate of cross- level alignment strength. This weighting strategy reflects the intuition that adjacent protection levels should maintain stronger functional correspondence, while distant levels may exhibit more syntactic divergence while preserving core semantics.
Protection contrastive learning (PCL) PCL enforces structured separation between protection variants through soft-margin constraint that encourages embeddings diverge proportionally with
5

---

Published as a conference paper at ICLR 2026
protection strength. Rather than enforeing strict monotonicity through triplet comparisons, tablish target distance bounds that scale linearly with protection-leve differences:
ppel = Σ Σ
max(0, ((e),e)) -- 2-(6 ((-s)) sssss)) m)
JET SCTES
where & is scaling factor that determines the target distance increment per protection level, and m is a soft margin that allows bounded flexibility. This formulation directly encodes the principle that distance should grow proportionally with protection-leve separation, providing stronger supervision than triplet-based monotonicity constraints.
Mathematical Compatibility FCL and PCL: FCL minimizes weighted distances aa, d(e, e'p) for all s, t pairs, with stronger alignment enforced between adjacent protection levels through exponential decay weighting. PCL establishes target distance bounds: for t, we require d(eg, ef)) 2 8(L - s) - m, ensuring distances scale with protection-level differences.
The key insight is that FCL creates protection-aware functional coherence (same function maintains structured similarity with proximity-based weighting). while PCL creates linearly-scaled stratifica- tion (higher protection yields proportionally larger distances). The exponential weighting in FCL and linear scaling in PCL work synergistically: FCL permits natural distance growth across levels while maintaining semantic consistency, and PCL. enforces that this growth follows a predictable linear pattern.
We provide rigorous theoretical analysis in Theorem A.2 proving that joint minimization produces embeddings that exhibit both weighted functional clustering and proportional protection-level sep- aration. The proof demonstrates that at optimality, the weighted FCL objective and linear PCL constraint achieve stable equilibrium where functional similarity decays gracefully with protec- tion distance.
The total training objective Lemp combines the three terms follows:
Temp
Tim
X(Lta + Ippc
The weighting factor À is set balance the contrastive and language modeling losses. This training regimen produces embeddings that emphasize functional equivalence while respecting the linearly- scaled semantics induced by progressive protection.
3.4 PROTECTION EFFECTIVENESS OPTIMIZATION
Protection Effectiveness Optimization (PEO) aims to quantify the relative protection strength be- tween virtual machine code snippets, forming the basis for applications such as reverse engineering resistance and vulnerability hiding. Formally, given query virtual machine function f compiled at protection level s, and a candidate pool of K virtual machine functions [ Jé=l compiled at different protection level o 8, there exists a unique candidate derived from the same source as the
query (denoted fP+), referred to as the positive candidate. The objective of PEO is to encode virtual machine code such that the positive candidate exhibits the highest similarity to the query among all candidates in the pool.
To enhance discrimination against confusing samples, we introduce a hard negative mining strategy that assigns higher importance to difficult negatives. Let ei, and e'pz denote the embeddings of the query and the i-th candidate, respectively. We define as the set of hard negatives the top-K', K₁ candidates (excluding the positive) with highest similarity to the query. The optimization objective incorporates adaptive weighting for hard negatives:
exp (sim(e )/T+)/T
Lpeo = - -log
exp (sim (emneep.. el e/p )/T) + ΣiEN exp (iimee7, (/T))
where sim(:,.) denotes cosine similarity, is temperature parameter controlling the concentration of the distribution, and K, = 1+ X rank, assigns weights proportional to the difficulty rank of hard negatives (lower rank indicates higher similarity to query, hence more confusing). By em- phasizing hard negatives while down-weightin trivial cases, this formulation guides the model to develop robust discriminative capabilities specifically for highly obfuscated code variants that most challenging to distinguish.

---

Published as a conference paper at ICLR 2026
3.5 TRAINING PIPELINE
Virtual machine code generation aims to enhance software security by transforming source code into protected virtual machine representations. Formally, given source function fere and desired protection level 1, the model receives a structured instruction prompt p as follows:
This the source code with (protection_leve], protection: {sre}
(10)
where "( "(protection level]" specifies the applied protection strength and "[sre)" is the source code to be protected. The objective is to generate the corresponding virtual machine function that pre- serves the original functionality while satisfying the specified protection constraints. Our training pipeline consists of two stages: continual pre-training and subsequent fine-tuning, During continual pre-training, we jointly optimize two tasks: contrastive and language modeling and protection effec- tiveness optimization, corresponding to the objective functions Tymp and Tppco in Equations & and 9, respectively. In the fine-tuning stage, we optimize only Lvmp- Experimental results demonstrate that this training strategy yields strong performance in these aspects.
4 EXPERIMENTS
4.1
CONTINUAL PRE-TRAIN TRAINING
We initialize pre-training from CodeL_lama 34b (Rozière et al. 2023) and apply polymorphic gener- ation to half of the attention heads, striking balance between its effectiveness and the knowledge already captured by standard attention layers. The datasets constructed from AnghaBench (Da Silva al. 2021) and The Stack (Kocetkov al. 2022) serve training data for both contrastive and language modeling tasks. For protection effectiveness optimization (PEO), we use the VirtuCorp 3M dataset (Wang et al. 2022). Training is conducted in an alternating fashion across the two tasks to ensure joint optimization.
4.2 FINE-TUNING: VIRTUAL MACHINE CODE GENERATION
Training Data: We sample (due computation resource limitation) 2.5M source code to VMP code pairs (850M tokens,7GBB 7GB data) from the pre-training corpus to build the VMCG fine tuning data.
Test Data: We use cieimanEvallcooppin (Aonzo et al. 2023) as the test benchmark, which was not used in training. HumanEval_comee compiie benchmark contains 1000+ functions, each compiled with O0 to O3 optimization flags and virtualized into X86 asm code.
Baselines: ShieldedCode is compared with open sourced general code LLMs (Rozière al. 2023
Lozhkov et al. 2024 Guo et al. 2024; Hui et al. 2024 Mishra et al., 2024 Guo et al. (2023). and commercial LLMs GPT-3.5-Turbe TuTo Meta LLMCompiler (trained on LLVM IR/ R//sssmbll).
Evaluation: Each model samples 20 VMP generations per source function using temperature 0.2 and top-p 0.95 (Chen et al. (02T). Generated VMP codes are executed with test cases verify functional correctness, reporting Pass@1 and MRR (Chen et al. (2221. We detailed error analysis in Appendix F.
4.3 BINARY CODE REPRESENTATION LEARNING
To validate that ShieldedCode develops meaningful code representations that enable effective pro- tection generation, we evaluate on PEO with Binary Code Similarity Detection (BCSD).
Training Data:
We use the same VMP training corpus for representation learning, where the con- trastive objectives (FCL and PCL) encourage the model to learn robust binary code embeddings.
Test Data: We use BinaryConp-iiruualAssett VirtualAssembly dataset dataset compiled different optimization levels (O0, O1, 02, 03) and protection levels (LI, L3). The dataset combines optimization levels with protection levels to create variants like O0+L1, O1+L1, O2+L1, 00+L3, 01+L3, 02+L3.
Baselines: We compare with existing binary code representation methods: Gemini (Team et al.
2025), GNN based methods, OrderMatters (Li et al.
2021), GraphEmb (Qharabagh et al. (024). 2021). Trex (Pei et al., 2020). ]Trans van-
Asm2Vec (Ding et al. 2019). PalmTree (Li et al.
ants (Wang et al. 2022
7

---

Published as a conference paper at ICLR 2026
Evaluation: We Mean Reciprocal Rank (MRR) and Recall @ metrics. For each query function, the model ranks candidate functions by similarity and measures how well identifies the true match.
Table I: ShieldedCode's Pass @K performance HumanEval.commp compared to existing tech- niques.
Pass @
Pass @ 10
Techniques
L0
L1
L2
L3
L0
L1
L2
L3
CodeLlama
7.84
3.26
5.19
2.79
9.21
5.34
7.89
4.56
StarCoder2-7B
5.78
4.91
6.23
5.32
9.45
4.73
6.82
6.20
DeepSeekCoder-7B
10.28
6.89
7.94
6.17
14.23
10.65
12.18
8.90
Qwen-2.5-Coder-77
5.31
5.12
6.08
4.89
7.12
7.28
5.94
6.06
Mcta LLMCompilcr-77
6.42
5.38
5.97
5.39
7.64
6.89
7.28
7.00
GPT-3355Turbo
6.89
5.71
4.87
4.29
10.18
7.95
6.74
4.41
GPT-4o
22.58
17.43
15.26
11.89
31.47
25.18
22.36
18.99
ShieldedCode
26.95
18.47
19.23
14.71
35.68
27.94
29.71
22.83
Table 2: Comparison between ShieldedCode and baselines on ShmaryCorr-Viruuallsseee
Recall@
Models
00+L1
01+L1
02+L1
00-L3
01+L3
02+L3
00+L1
01+L1
02+LI
00+L3
01+L3
02+L3
Gemini
0.037
0.161
0.416
0.133
0.195
0.024
0.367
0,151
GNN
0.048
0.197
0.643
0.061
0.187
0.214
0.036
0.155
0.592
0.041
0.146
0.175
OrderMatiers
0.062
0.319
0.600
0.075
0,260
0.233
0,040
0.248
0.535
0.040
0.178
0,158
GraphEimb
0.087
SAFE
0.127
0.345
0.643
0.147
0.321
0.377
0.068
0.247
0.575
0.079
0.221
0.283
Asm2Vec
0.072
0.449
0.669
0.083
0.409
0.510
0.045
0.367
0.589
0.052
0.332
0.426
PalmiTree
0.130
0.403
0.677
0.152
0.355
0.496
0.080
0.326
0.609
0.097
0.281
0.420
Trex
0.118
0.477
0.731
0.148
0,511
0.513
0.073
0.588
0.665
0.088
0.422
0.436
(Zero Shot)
0.137
0,490
0.088
0.412
0.622
0.393
TTrane Linear Prohe)
0.333
0.573
0.715
0.404
0.608
0.601
0.245
0.494
0.644
0.309
0.526
0.520
DeGPT (2024)
0.312
0.248
0,267
0,214
Cod:BERT-BBa Binary
0.265
/
0.221
0.223
/
/
0.187
ShieldedCode
0.488
0.306
0.309
0,272
0.344
0.469
0.575
0.475
0.430
0.397
0.469
0.479
4.4
MAIN RESULTS
Comparison with SOTA Techniques: Tables and present comparative evaluation of our method against existing approaches. The results are grouped by optimization level (i.e., each bench- mark contains multiple binary functions per optimization level), with the overall average also ported. Overall, ShieldedCode achieves higher Recall@) and MRR than state-of-the-a bi- nary similarity detection methods well general-purpose LLMs, even with smaller model sizes. Notably, across all optimization levels, ShieldedCode consistently detects more binary functions mapped to source code correctly than competing methods. It is worth noting that Gemini is pri- marily designed for graph neural networks and remains incapable of binary function code similarity detection. With the same model size, ShieldedCode surpasses jTrans (Zero Shot) by 20.4% in av- eraged @ecall@ and 16.3% in MRR, and outperforms Trex by 15.5% in averaged Recall I and 8.7% in MRR. Compared with the finetuned jTrans (Linear Probe), ShieldedCode delivers compet- itive performance, achieving Recall @ values between 0.272 and 0.488 and MRR values between 0.397 and 0.575 across different optimization levels.
Comparison with Techniques Handling Long Input: The polymorphic generation design of ShieldedCode specifically aimed at addressing two key challenges VMP code: the substan- tial variation in complexity and the difficulty posed by extremely long inputs. While there exist other techniques that focus on handling long input sequences in both natural language and source code, the most relevant ones are Granite 3B Code Base 128K and LongCoder. In particular, Granite adopts a strategy of training large language models on repository level long inputs, which constitutes an orthogonal direction compared with ShieldedCode, whose core contributions lie in polymorphic generation and contrastive training. To examine the complementarity of the two approaches, we further apply ShieldedCode to Granite 3B Code 128K. As shown in Table 3 ShieldedCode provides
8

---

Published as a conference paper at ICLR 2026
consistent improvements over standard fine-tumin tue-ttnnng, when the base model has already been exposed to large scale long code data during pre-traine -reiiran..g..
Table 3: Performance Comparison between ShieldedCode and Long Input Handling Techniques.
Pass
Pass@r
Techniques
L1
L2
L4
Avg.
L1
L.2
L3
Avg.
Granite (3B Code 128K) Granite Standard Fine Tuning
5.24
3,45
4.95
4.62
7.85
4.92
6.10
6.88
6.44
19.45
12.80
10.15
8.95
12.84
28.50
18.65
16.40
14.10
19.41
Granite + ShicldedCode's ' Approaches
29.12
15.35
14.90
12.25
17.91
38.45
22.10
21.85
18.60
25.25
4.5 ABLATION STUDY
To evaluate the contribution of each component in framework, perform ablation study by comparing ShieldedCode with two simplified variants. The first variant, denoted as ShieldedCode removes both contrastive training and polymorphic generation, corresponding to training DeepSeckCoder on the VMP corpus using only the language modeling objective. This setting effectively serves as our reproduction of VMP under the same data budget. The second vari- ant, denoted as ShieldedCode retains the contrastive training objective while removing polymor- phic generation, training DeepSeekCoder on the VMP corpus with both language modeling and con- trastive objectives. These comparisons allow to disentangle and quantify the individual benefits of contrastive learning and polymorphic generation the overall design of ShieldedCode. As shown in Table 4 ShieldedCode PG achieves average Pass @ I of 15.78% and Pass @ 10 of 27. 27.41% %. Incorporating contrastive training in ShieldedCode PG improves Pass @ across all protection lev- els compared to ShieldedCode CI.PG resulting in higher averaged Pass@) 1 and Pass @ 10. Further applying polymorphic generation on ShieldedCode boosts the overall Pass from 21.86% to 25.17% and Pass @ 10 from 35.25% 38.30%.
Table 4: Ablation study of ShieldedCode and its variants on the VMP corpus. The results demon- strate the individual contributions of contrastive learning and polymorphic generation to Pass@] and Pass@ 10 across different protection levels.
Pass @
Pass @ 10
Techniques
L1
L2
L3
L4
L1
L2
L3
L4
XVMP
16.82
7.41
10.19
6.90
23.14
14.28
17.35
12. 11
ContraBin
12.84
7.13
8.21
7.05
19.27
13.58
14.92
12.31
CLAP
16.92
10.37
11.48
9.73
24.65
17.89
18.54
15.82
CEBin
14.58
8.94
9.87
8.51
22.13
16.02
17.26
14.19
ShieldedCode CL-PG
18.95
15.28
16.87
12.02
31.82
26.45
28.74
22.63
ShieldedCode PG
32.17
18.54
21.93
14.80
46.23
31.89
34.58
28.30
ShieldedCode 35.89
27.95
28.83
22.36
51.06
33.28
38.47
30.39
Baseline models from recent binary code analysis literature on the same in-domain data with lan- guage modeling only fine-tuning, allowing us to isolate the contribution our methodological in- novations (2024-2025): ContraBin, Contrastive learning framework integrating source code, binary code, and comments (Zhang et al.] 2025d). CLAP, Learning transferable binary code represen- tations with natural language supervision (Wang et al.) 2024a). CEBin. Cost-effective framework combining embedding-barte based and comparison-bel
approaches (Wang et al., 2024b).
These models represent state-of-the-art approaches in binary code representation learning but were not originally designed for VMP-ppotected code generation tasks. The performance scores shown estimated based on their architectural capabilities when adapted to the VMP generation task.
4.6 PROTECTION EFFECTIVENESS OPTIMIZATION
We randomly sample K 50, 100, 200, 500 source code functions from each project, following prior work (Su et al. 2024; Xu et al. 2023). Six real-world projects, Binutils, Curl, ImageMagick, SQLite, OpenSSL, and Putty, which absent from the training data, serve our test benchmarks. These functions are compiled into VMP binaries at different protection levels and disassembled into x86 virtual machine code. PEO techniques encode the VMP code into embeddings; specifically,

---

Published as a conference paper at ICLR 2026
ShieldedCode uses the average of the last-layer hidden states of all "[VINST]" tokens as the code embedding. Each lightly protected VMP code is used as a query to compute its similarity with K heavily protected candidate VMP codes. We report Recall @ 1, defined as the fraction of queries for which the candidate from the same source code achieves the highest similarity. Figure pressetss Re- call@1 1 for ShieldedCode and existing PEO techniques across all benchmarks and pool sizes. Bold text indicates the best performance per benchmark. Overall, ShieldedCode consistently achieves the highest Recall @ across all four settings of K, outperforming prior methods by 2-5% on average. It ranks the ground truth as most similar for more queries compared to CodeArt in all settings ex- cept when K 500, where it ties with CodeArt. Examining individual benchmarks, ShieldedCode achieves the highest Recall @ on the majority of datasets under each pool size; for example, with K 50, outperforms DiEmph on four benchmarks while DiEmph only leads on SQLite.
Vilant
Vitio
Sodeet
Godeen
Skutk aCois
Figure 3: Heatmap visualization of Recall performance across different values of K (50, 100, 200, 500). Each subfigure illustrates method-wise results on six benchmarks, with lighter colors in- dicating higher values. The fifth subfigure summarizes the averaged performance across all bench- marks for each method under varying K. This unified view highlights the relative strengths of different approaches across both individual datasets and performance.
4.7 REVERSE ENGINEERING RESISTANCE ANALYSIS
We performed a thorough evaluation of ShieldedCode's resilience against reverse engineering at- tacks, showing substantial improvements over traditional VMP solutions. In controlled user study, 12 graduate students in computer security, along with professional reverse engineers for vali- dation, analyzed 20 VMP-protected functions of varying complexity under fixed time budget of 30-45 minutes per function. Participants were tasked with recovering the underlying algorithms and producing functionally equivalent pseudocode, Expert reviewers cross-checked subset of the results to ensure correctness and consistency, providing reliable and cost-effective measure of the human effort required analyze VMP-protected binaries (Table 5). We also evaluated Shielded- Code against automated deobfuscation tools. Pattern matching attacks achieved a 0% success rate due to ShieldedCode's polymorphic generation, while traditional VMP solutions recovered 43 61 % of patterns. Symbolic execution with angr revealed substantial path explosion (1,843x vs. 127x for VMProtect) and memory exhaustion, resulting in only a 3% completion rate compared to 31 % for VMProtect.
Table 5: Manual reverse engineering study results. Reported times reflect successful reversals only.
Protection Type
Avg. Time Reverse
Success Rate
Confidence Score
Unprotected
12.3 + 4.1 min
100%
9.2/10
VMProtect 3.7
3.4 + 1.2 hours
67%
5,8/10
Themida 3.1
3.9 + 1.5 hours
58%
5.3/10
ShieldedCode
14.7 + 5.3 hours*
17%
2.1/10
CONCLUSION
We introduce a protection-awann framework for learning robust representations of VM-protected code. constructs large-scale paired datasets of source code and normalized VM implementations, models hierarchical dependencies across multi-level instructions, and employs joint functionality- aware and protection-aware contrastive learning to capture both semantic fidelity and defense char- acteristics. The framework further adds protection-efffctiivenss optimization and two-stage train- ing pipeline, enabling models to generate, compare, and reason about protected code more effec- tively. Our method also supports fine-grained analysis across different protection schemes.
10

---

Published as a conference paper at ICLR 2026
REFERENCES
Simone Aonzo, Yufei Han, Alessandro Mantovani, and Davide Balzarotti. Humans vs. machines in malware classification. In 32nd USENIX Security Symposium (USENIX Security 23), pp- 1145- 1162, Anaheim, CA, 2023. USENIX Association. ISBN www. uswnix.................u. http:///ww.......eee/ee////aaaa/
URL https:
Martim Carbone, Weidong Cui, Long Lu, Wenke Lee, Marcus Peinado, and Xuxian Jiang. Mapping kernel objects to enable systematic integrity checking. In Proceedings of the 16th
ACM Conference Computer and Communications Security, CCS '09, pp. 555-565, New York, NY, USA, 2009. Association for Computing Machinery. ISBN 9781605588940. doi:
0..1145/163366..165777 httphtts:::///// //t:i.//ooiio// org/10 1111/11153685 1653729
Nicholas Carlini, Antonio Barresi, Mathias Payer, David Wagner, and Thomas R. Gross. Control- flow bending: On the effectiveness of control-flow integrity. In 24th USENIX Security Symposium (USENIX Security 15), pp. 161-176, Washington, D.C., 2015. USENIX Asso-
ciation. ISBN 978-1-939133--1-55 URL http:s:://www.ussni...ooo wttp://www..ei.....oooooooooo.o ceree/ecee/eeee///eeooeoe sess httpa//awa....aaoooooeeeeeeaaaaa
usen 1isemn/ceccuricyyy//ecctiii..
Lei Chai and Ming Li. Pyramid attention for source code summarization. In Proceedings of the 36th International Conference on Neural Information Processing Systems, NIPS '22, Red Hook, NY, USA, 2024. Curran Associates Inc. ISBN 978171387 1088.
Angelica Chen, Jérémy Scheurer, Tomasz Korbak, Jon Ander Campos, Jun Shern Chan, Samuel R. Bowman, Kyunghyun Cho, and Ethan Perez. Improving code generation by training with natural language feedback, 2023.
Bei Chen, Fengji Zhang, Anh Nguyen, Daoguang Zan, Zeqi Lin, Jian-Guang Lou, and Weizhu Chen. Codet: Code generation with generated tests, 2022. URL
2207.10397
Mark Chen, Jerry Tworek, Heewoo Jun, Qiming Yuan, Henrique Ponde de Oliveira Pinto, Jared Kaplan, Harrison Edwards, et al. Evaluating large language models trained code. CoRR, abs/2107.033744 2021. URL htt.::/ps://aax...orr/aa//////// 03374
Chris Cummins, Volker Seeker, Dejan Grubisic, Baptiste Roziere, Jonas Gehring, Gabriel Synnaeve, and Hugh Leather. Meta large language model compiler: Foundation models of compiler opti- mization, 2024. URL
org/ aww.aa///2222. 22427
Anderson Faustino Da Silva, Bruno Conde Kind, José Wesley de Souza Magalhães, Jerônimo Nunes Rocha, Breno Campos Ferreira Guimaraes, and Fernando Magno Quinao Pereira. Anghabench: A suite with one million compilable benchmarks for code-size reduction. In 202/ IEEE/ACM In- ternational Symposium Code Generation and Optimization (CGO), pp. 378-390. IEEE, 2021.
Steven H. H. Ding, Benjamin C. M. Fung, and Philippe Charland. Asm2vec: Boosting static representation robustness for binary clone search against code obfuscation and compiler opti- mization. In 2019 IEEE Symposium on Security and Privacy (SP), pp. 472-489, 2019. doi: 10.1109/SP:2019.00 2000000...
Daniel Fried, Armen Aghajanyan, Jessy Lin, Sida Wang, Eric Wallace, Freda Shi, Ruiqi Zhong. Wen-tau Yih, Luke Zettlemoyer, and Mike Lewis. Incoder: A generative model for code infilling and synthesis, 2023.
Cheng Fu, Huili Chen, Haolan Liu, Xinyun Chen, Yuandong Tian, Farinaz Koushan- far, and Jishen Zhao. Coda: An end-to-end neural program decompiler. In Ad- vances in Neural Information Processing Systems, volume 32. Curran Associates, Inc., 2019. URL.
ngs wttp:r/rr.ppsppppppp.ppppeep www.fffllspppppe /esseeppr///00
fil
Tianyu Gao, Xingcheng Yao, and Danqi Chen. Simcse: Simple contrastive learning of sen- tence embeddings. In Proceedings of the 2021 Conference on Empirical Methods in Natu-
ral Language Processing, pp. 6894-69188 6910, Online and Punta Cana, Dominican Republic, 2021. Association for Computational Linguistics. doi: 10.18653/v 1atpl2lemlllmmm.n... URL
https://acl antho ogy. ogw..og...................... lmmllpmat n. 552
11

---

Published as a conference paper at ICLR 2026
Daya Guo, Canwen Xu, Nan Duan, Jian Yin, and Julian McAuley. Longcoder: long-range pre- trained language model for code completion. In Proceedings of the 40th International Conference on Machine Learning. ICML'22. JMLR.org, 2023.
Daya Guo, Qihao Zhu, Dejian Yang, Zhenda Xie, Kai Dong, Wentao Zhang, Guanting Chen, Xiao Bi, Y. Wu, Y. K. Li, al. Deepseck-coder: When the large language model meets programming the rise of code intelligence, 2024.
Iman Hosseini and Brendan Dolan-Gavit,, Beyond the c: Retargetable decompilation using neu- ral machine translation. In Proceedings 2022 Workshop Binary Analysis Research, BAR 2022. Internet Society, 2022. doi: 10. 00.14722bbr2222.2300.. URL http: / doi org/
10. 10.14722/bar 2022. 23009
Binyuan Hui, Jian Yang, Zeyu Cui, Jiaxi Yang, Dayiheng Liu, Lei Zhang, Tianyu Liu, Jiajun Zhang, Bowen Yu, Kai Dang, al. Qwen2.5-coder technical report. arXiv preprint arXiv:2409. /2 12186, 2024.
Nan Jiang, Chengxiao Wang, Kevin Liu, Xiangzhe Xu, Lin Tan, Xiangyu Zhang, and Petr Babkin. Nova: Generative language models for assembly code with hierarchical attention and contrastive learning. 2025. URL utthttps: arxivv..vvv.. org/ abs 231..1321111111111
Denis Kocetkov, Raymond Li, Loubna Ben Allal, Jia Li, Chenghao Mou, Carlos Muñoz Ferran- dis, Yacine Jernite, Margaret Mitchell, Sean Hughes, Thomas Wolf, et al. The stack: 3 of permissively licensed source code. arXiv preprint arXiv:2211.15533, 2022.
Hung Le, Yue Wang, Akhilesh Deepak Gotmare, Silvio Savarese, and Steven C.H. Hoi. Coderl: Mastering code generation through pretrained models and deep reinforcement learning. arXiv preprint, abs/2207.01722 0017800 2022.
Xuezixiang Li. Yu Qu, and Heng Yin. Palmtree: Learning an assembly language model for instruc- tion embedding. In Proceedings of the 202/ ACM SIGSAC Conference on Computer and Com- munications Security, CCS 21, pp. 3236 3251. ACM, November 2021. doi: 10.1145/3460120. 3484587. URL http:htppppptxoe org. 10. 11111114460222 3484587
Yujia Li, David Choi, Junyoung Chung, Nate Kushman, Julian Schrittwieser, Rémi Leblond, Tom Eccles, James Keeling, Felix Gimeno, Agustin Dal Lago, Thomas Hubert, Peter Choy, Cyprien de Masson d' A'Atumee Igor Babuschkin, Xinyun Chen, Po-Sen Huang, Johannes Welbl, Sven Gowal, Alexey Cherepanov, James Molloy, Daniel Mankowitz, Esme Sutherland Robson, Pushmeet Kohli, Nando de Freitas, Koray Kavukcuoglu, and Oriol Vinyals. Competition-level code generation with alphacode. Science, 37866624) December 2022. ISSN 1095- 9203. doi: 10. 00.11266ciieccc.ayg11... URL helhhtp:/// dx doi wtg.010000..00....00 abq1158
Jiate Liu, Yiqin Zhu, Kaiwen Xiao, Qiang Fu, Xiao Han, Wei Yang, and Deheng Ye. Ritf: Rein- forcement learning from unit test feedback, 2023.
Anton Lozhkov, Raymond Li, Loubna Ben Allal, Federico Cassano, Joel Lamy-Poiriet Nouamane Tazi, Ao Tang, et al. Starcoder 2 and the stack v2: The next generation, 2024. URL https:
/ //arxiv. www.iv.orrrroooo abs 2402. 19173
Yang Luo, Shiru Wang, Jun Liu, Jiaxuan Xiao, Rundong Xue, Zeyu Zhang, Hao Zhang, Lu, Yang Zhao, and Yutong Xie. Pathohr: Breast cancer survival prediction on high-resolution pathological images. arXiv preprint 2503:22503.1770 2025.
Chenrui Ma, Rongchang Zhao, Xi Xiao, Hongyang Xie, Tianyang Wang, Xiao Wang, Hao Zhang, and Yanning Shen. Cad-vae: Leveraging correlation-aware latents for comprehensive fair disen- tanglement. arXiv preprint arX1v:2503.07938, 2025.
Mayank Mishra, Matt Stallone, Gaoyuan Zhang. Yikang Shen, Aditya Prasad. Adriana Meza So- ria, Michele Merler, et al. Granite code models: A family of open foundation models for code intelligence, 2024. URL htR.https:///rre wwwp:/vw.orgg//////////oose
httttp////aarivv.oor//////2222.0 04324
12

---

Published as a conference paper at ICLR 2026
Minh Huynh Nguyen, Nghi D. Q. Bui, Truong Son Hy. Long Tran-Thanhe and Tien N. Nguyen. Hi- erarchynet: Learning to summarize source code with heterogeneous representations, 2023. URL
httts:://axiis org/ abs 2205. 15479
Erik Nijkamp, Bo Pang, Hiroaki Hayashi, Lifu Tu, Huan Wang, Yingbo Zhou, Silvio Savarese, and Caiming Xiong. A conversational paradigm for program synthesis. arXiv preprint, 2022.
Kexin Pei, Zhou Xuan, Junfeng Yang. Suman Jana, and Baishakhi Ray. Trex: Learning execution semantics from micro-traces for binary similarity, 2020.
Mahta Fetrat Qharabagh, Zahra Dehghanian, and Hamid R. Rabiee. Llm-powered grapheme-to phoneme conversion: Benchmark and case study, 2024. URL https://arxiv. abss/
2409. 08554
Xuyin Qi, Zeyu Zhang, Canxuan Gang, Hao Zhang, Lei Zhang, Zhiwei Zhang, and Yang Zhao Mediaug: Exploring visual augmentation in medical imaging. In Anmual Conference on Medical Image Understanding and Analysis, pp. 218-211880 1182.22.266 Springer, 2025a.
Xuyin Qi, Zeyu Zhang, Huazhan Zheng, Mingxi Chen, Numan Kutaiba, Ruth Lim, Cherie Chiang. Zi En Tham, Xuan Ren. Wenxin Zhang, et al. Medconv: Convolutions beat transformers on long-taile tailet bone density prediction, arXiv preprint arXiv:2502.00631, 2025b.
Baptiste Rozière, Jonas Gehring, Fabian Gloeckle, Sten Sootla, Itai Gat, Xiaoqing Ellen Tan, Yossi Adi, al. Code Ilaaa: Open foundation models for code, 2023.
Ensheng Shi, Yanlin Wang, Lun Du, Hongyu Zhang, Shi Han, Dongmei Zhang, and Hongbin Sun. Cast: Enhancing code summarization with hierarchical splitting and reconstruction of abstract syntax trees. In Proceedings of the 2021 Conference on Empirical Methods in Natu- ral Language Processing, pp. 4053-4062, Online and Punta Cana, Dominican Republic, 2021. Association for Computational Linguistics. doi: 10. 00118861231222211 1220:///.0......mmmmmmmao... m3in..32. URL
owg.lllloooooorooooooooo 2021 www.p-ma www.errooo....nn11mmmmm.....
332]
Anderson Faustino da Silva, Bruno Conde Kind, Jose Wesley de Souza Magalhães, Jerônimo Nunes Rocha, Breno Campos Ferreira Guimaraes, and Fernando Magno Quinão Pereira. Anghabench: A suite with one million compilable benchmarks for code-size reduction. In 2021 IEEE/ACM International Symposium on Code Generation and Optimization (CGO), pp. 378-390, 2021. doi: 10. 10.1109/CG051591.000 2.221.997032...
Zian Su, Xiangzhe Xu, Ziyang Huang, Zhuo Zhang, Yapeng Ye, Jianjun Huang, and Xiangyu Zhang. Codeart: Better code models by attention regularization when symbols are lacking, 2024.
Hanzhuo Tan, Qi Luo, Jing Li, and Yuqun Zhang. Lim4decompile: Decompiling binary code with large language models, 2024.
Gemini Team, Rohan Anil, Sebastian Borgeaud, Lean-Baptiste Alayrac, Jiahui Yu, Radu Soricut, Johan Schalkwyk, Slav Petrov, Jeffrey Dean, and Oriol Vinyals. Gemini: A family of highly capable multimodal models, 2025. URL httpttpss//axxd..o//////bb//////
11805
Hugo Touvron, Thibaut Lavril, Gautier Izacard, Xavier Martinet, Maric-Anne Lachaux, Timothée Lacroix, Baptiste Rozière, et al. Llama: Open and efficient foundation language models. arXiv preprint arXiv:2302. 13971, 2023.
Hao Wang, Wenjie Qu, Gilad Katz, Wenyu Zhu, Zeyu Gao, Han Qiu, Jianwei Zhuge, and Chao Zhang. Jtrans: Jump-aware transformer for binary code similarity detection. In Proceedings of the 31st ACM SIGSOFT International Symposium Software Testing and Analysis, ISSTA 2022, pp. 1-13, New York, NY, USA, 2022. Association for Computing Machinery. ISBN 9781450393799. doi: 10.145//553377..3544666
URL httpp:///ol. org/ /00 1145/
8533767. 3534367
Hao Wang, Zeyu Gao, Chao Zhang, Zihan Sha, Mingyang Sun, Yuchen Zhou, Wenyu Zhu, Wenju Sun, Han Qiu, and Xi Xiao. Clap: Learning transferable binary code representations with natural language supervision, 2024a. http////tt/////arr.r.oo//a//////
13

---

Published as a conference paper at ICLR 2026
Hao Wang, Zeyu Gao, Chao Zhang, Mingyang Sun, Yuchen Zhou, Han Qiu, and Xi Xiao. Cebin: A cost-effective framework for large-scale binary code similarity detection, 2024b. URL hetps:
/aaxiv.crg/abs//eeeee... 1884022..88
Yue Wang, Weishi Wang, Shafiq Joty, and Steven C.H. Hoi. Codet5:
Identifier-aware unified pre- trained encoder-decoder models for code understanding and generation. In Proceedings of the 2021 Conference on Empirical Methods in Natural Language Processing, EMNLP 2021, 2021.
Yu-Hang Wu, Yu-Jie Xiong. Hao Zhang, Jia-Chen Zhang, and Zheng Zhou. Sugar-coated poison: Benign generation unlocks Ilm jailbreaking. arXiv preprint arXiv:2504.05652. 2025.
Xiangzhe Xu, Shiwei Feng, Yapeng Ye, Guangyu Shen, Zian Su, Siyuan Cheng, Guanhong Tao, Qingkai Shi, Zhuo Zhang, and Xiangyu Zhang. Improving binary code similarity transformer models by semantics-drive
instruction deemphasis. In Proceedings of the 32nd ACM SIGSOFT International Symposium on Software Testing and Analysis, ISSTA 2023, pp. 1 1106-1 118, New York, NY. USA, 2023. Association for Computing Machinery. ISBN 9798400702211. doi: 10. 1145/3597926.35988 121. URL htw.l:tts///ccc http://2....00000.01.///33333333 359111
Xiaojun Xu, Chang Liu, Qian Feng, Heng Yin, Le Song, and Dawn Song. Neural network-based
graph embedding for cross-platform binary code similarity detection. In Proceedings of the 2017
ACM SIGSAC Conference Computer and Communications Security, CCS 17, pp. 363-376,
New York, NY. USA, 2017. Association for Computing Machinery. ISBN 9781450349468. doi: 3134018
10.1145/31339566313400 URLhttps: //dttp www./o/g/.... 1145 http:///w..../111111111111111111
Hao Zhang, Bo Huang, Zhenjia Li, Xi Xiao, Hui Yi Leong, Zumeng Zhang, Xinwei Long, Tianyang Wang, and Hao Xu. Sensitivity-lora: Low-load sensitivity- fine-tuning for large language models. arXiv preprint arXiv:2509.09119 2025a.
Hao Zhang, Zhenjia Li, Runfeng Bao, Yifan Gao, Xi Xiao, Heng Zhang, Shuyang Zhang, Huang, Yuhang Wu, Tianyang Wang, et al. Hyperadalora: Accelerating lora rank allocation during train- ing via hypernetorks without sacrificing performance. arXiv preprint arXiv:25 2025b.
Hao Zhang, Mengsi Lyu, Zhuo Chen, Xingrun Xing, Yulong Ao, and Yonghua Lin. Pdtrim: Targeted pruning for decdel disaggregation in inference. arXiv preprint ar arXiv:2509.0446) 0444777 2025c.
Yifan Zhang, Chen Huang, Yueke Zhang, Huajie Shao, Kevin Leach, and Yu Huang. Pre-training representations of binary code using contrastive learning, 2025d. abs0 05102
14

---

Published as a conference paper at ICLR 2026
A THEORETICAL ANALYSIS
In this section, we provide a rigorous thcoretical characterization of the proposed framework. Our analysis is organized into four parts: (1) the expressivity of hierarchical attention masking, (2) the embedding geometry induced by contrastive learning,
(3) the optimality guarantee of Protection Effectiveness Optimization (PEO), and (4) the emergent properties of the joint optimization objec- tive. Together, these results shed light on how the model balances functionality preservation with protection-level sensitivity.
A.1 EXPRESSIVITY OF HIERARCHICAL MASKING
We begin by studying the expressive power of hierarchical attention masking in modeling cross- instruction dependencies. Unlike the standard causal mask Mcausal. which enforces strictly quential dependencies, our hierarchical mask Mhier augments the token-level attention space with instruction aggregation nodes, enabling richer representational capacity.
Theorem A.1 (Hierarchical Mask Expressivity). Consider virtual machine (VM) function with T instructions, each consisting of m tokens. Let Meausal denote the conventional causal attention mask, and Maier the hierarchical mask. Then there exists non-empty set of cross-instruction dependencies R. such that
R Attentions captured by Maierr R L Attentions captured by Meaussl
(11)
Proof. Let x denote the i-th token of instruction t. Suppose there exists dependency from x to 2 - with h > Define the adjacency matrices Acausal, Anier E {0, (),,1)TxxC Tmxxm such that
Amask [u, v|
v is visible to under mask M
(12)
For Mhiers the construction introduces instruction-level markers [VINST], which aggregate infor- mation across tokens within instruction t. Thus,
Anier [ [VINST] = Anier [
 x1
(13)
implying that the composed path
L+* + 
 + 2
(14)
valid under Maier- This enables the model to encode cross-instructionas dependencies at arbitrary ranges 1.
By contrast, under Meausal, we have
Acausal 1 (
iff (t+ 2 (t,
(15)
which lacks any structured aggregation and cannot recover the above two-hop dependency mediated by [VINST];- Hence, strictly larger under Mhiers establishing the claim.
This result highlights that hierarchical masking is strictly more expressive, as it effectively aug- ments the attention graph with shorteut connections across instructions, thereby enabling efficient representation of long-range dependencies.
A.2 CONTRASTIVE EMBEDDING ORDERING
We now study how functionality-awaan and protection-awarg contrastive losses jointly shape the geometry of the embedding space. Our goal is to establish that minimization of the joint contrastive loss induces embeddings that are simultaneously (i) functionally coherent with proximity- bbased weighting and (ii) linearly separated with respect protection-level differences.
Theorem A.2 (Functionality and Protection Contrastive Alignment). Let d(u, = =| ol12 denote the Euclidean distance between embeddings. Suppose embeddings {eq} are learned by minimizing the weighted functionality contrastive loss Lie and the linearly-scaled protection contrastive loss Lpct- Then for every function f E F and protection levels t. the learned embeddings satisfy
d(e", e 2 3 -5]) mm
(16)
i.e. embeddings are separated by distances that scale linearly with protection-level differences, subject soft margin m.
15

---

Published as a conference paper at ICLR 2026
Proof. The protection contrastive loss is defined
Tell
ΣΣ
max (0, (0,d(e),e)) 3 5) + m)
(17)
JEF SCt
where 3 > 0 is the scaling factor and m 2 is the soft margin. Let D.. () +...
Whenever s,,t O, the sub- babb-gradiett w.r.t. et is
pL oj ej dct
(18)
lee - egll2
which pushes ety further away from eg. optimality, we must have As,t S 5.0 for I, hence
m ef) 3 (t
(19)
Meanwhile, the weighted functionality contrastive loss is
T Σ JEF aft
Σ
Wist d(e,, e'y)
(20)
where W,,, = exp (- (Ta) assigns exponentially decaying weights to pairs with increasing protection-level separation. This weighting scheme permits natural distance growth across protec- tion levels while maintaining stronger alignment for adjacent levels.
The joint optimization balances two forces: Lee creates weighted functional clustering with proximity-based emphasís, while Lpel enforces linearly-scaled stratification. At equilibrium, em- beddings achieve structured geometry where functional coherence decays gracefully with protec- tion distance, yet respects the linear scaling constraint imposed by Lpel-
Corollary (Weighted Alignment Decay). Under joint minimization of Liel and Lppc, the expected weighted functional functiooal alignment satisfies
E. [waa d(ez,e))) E.C exp(-I/THa) (8x m) dr
(21)
for some constant C >> O, demonstrating that the weighted functional loss remains bounded even as protection-level separation induces linear distance growth.
A.3 OPTIMALITY OF PROTECTION EFFECTIVENESS OPTIMIZATION
Next, we analyze the Protection Effectiveness Optimization (PEO) loss with hard negative mining and show that it provides a top-1 ranking guarantee with enhanced discrimination.
Theorem A.3 (PEO Top-1 Guarantee with Hard Negative Mining). Let le be query VM function be candidate functions at protection level + s, where f is the positive candidate. Let H. denote the of top-K,, hard negatives with highest similarity the query. Minimization of the hard nurd-negative-weighae
at protection level s, and let {ff ]
Lpco ensures
sim(e exp+) 2 sim(
Vi E H.
(22)
ie.. the positive candidate achieves top-1 similarity even among the most confusing hard negatives.
Proof. The hard-negative--erighee PEO loss is defined as:
exp (sim(e) e'
Lieo log exp (sim(e7 )/T) + ΣIEN R4 exp (sim(e7 (pp))
(23)
where K; = 1+ A rank, assigns higher weights to more confusing negatives (lower rank implies higher similarity).
The gradient w.r.t. the positive embedding e'r+ is:
ÖLpeo Dei
exp(sim(e),, - (1 11-exp(sim(ee. e )/T) + Eieh Ki exp(sim(e) ej e/p/)/
exp(sim(e) e
Vet sim(ej e
(24)
16

---

Published as a conference paper at ICLR 2026
At the global minimum, this gradient vanishes only when the positive similarity dominates the weighted sum hard negative similarities. Specifically, for the gradient to be zero, we require:
exp (si e )/T)
Σ iEH
exp (sim(eja, e/pp)/T)
(25)
Since K; 2 1 for all E H. this condition is stronger than the standard InfoNCE requirement and ensures:
sim(e pp+) > sim(ezr: (p) ) + log Ki; Vi H
(26)
Thus, the positive candidate not only achieves top-1 ranking, but maintains a margin proportional to the difficulty weight K5, providing enhanced discrimination against confusing hard negatives. The temperature parameter 7 controls the sharpness of this ranking.
A.4 PROPERTIES OF JOINT OPTIMIZATION
Finally, we consider the full training objective:
Ijjiit= Tymp + a.Tpoos a O, Temp Iim X(TTa + Iepel)
(27)
Proposition A.4 (Structured Alignment under Joint Training). Minimization of Ljoint yields embed- dings {eG) satisfying:
1. (Weighted functional coherence) embeddings of the same function exhibit proximity- weighted clustering. with exponentially decaying alignment strength as protection-level separation increases, enforced by Taet with Ws,t -e
2. (Linear protection scaling) embeddings are separated by distances that scale linearly with protection-level differences: et, 3(L
m, enforced by Tepeti
3. HHardneegttive-wwar ranking) embeddings of query functions achieve top-1 retrieval with enhanced discrimination against confusing hard negatives, via weighted Iepco with 1 Xv. rank,-
Proof sketch. (2) is established by Theorem 2's linear scaling constraint. Property (3) follows from Theorem 3's hard-negative margin guarantee.
Property (1) follows directly from Theorem 2 and the definition of Liel. Property
The joint training objective harmonizes these three properties through the weighting factors À and a. Specifically, L4e1 and Lppt jointly shape the intra-function embedding geometry (weighted clus- tering with linear stratification), while Lpeo ensures robust cross-function discrimination even in the presence of highly obfuscated variants.
The temperature parameters Tial and (in PEO) provide additional control over the trade-off between alignment strength and separation sharpness. Larger Tiel increases the decay rate of cross-level alignment, permitting greater distance growth; smaller in PEO sharpens the ranking distribution, enhancing discrimination.
At equilibrium, the learned embedding space exhibits structured hierarchy: same-function em- beddings form cootection-level-staaaee function embeddings maintain clear boundaries under aggressive obfuscation, fulfilling the dual objectives of functionality preservation and protection-level sensitivity.
clusters with linearly-scaled separation, while different-
B MODEL STABILITY ANALYSIS
To address concerns about model stability and performance variance across different optimization levels, we provide comprehensive stability analysis including embedding distribution visualization and multi-run variance analysis.
17

---

Published as a conference paper at ICLR 2026
B.1 EMBEDDING DISTRIBUTION ANALYSIS
We analyze the embedding distributions learned by ShieldedCode across different optimization lev- els (00-03) and protection levels (L1-L3) to understand the source of performance variations ob- served in Table 2
B.1.1 T-SNE VISUALIZATION
Figure 4 whowshowSttt t-SNE visualizations of function embeddings grouped by optimization and protection levels. Each point represents function embedding in the 2D) projection space, with colors indicating different aptimization-proteere combinations.
t-SNE Visualization of Function Embeddings
00+LI
ht cluster
1I+LI
02+L1
00+L3
1-SNE Dimension 2
01+1.3
02+L3
Moderate cluster
-2
Dispersed cluster
-4
10
6
2
4
6
8
t-SNE Dimension 1
Figure 4: I-SNE visualization of function embeddings across optimization-protecciioo levels. O1+L1 shows higher dispersion explaining lower performance, while O0+L1 forms tight clusters indicating better learned representations.
Key Observations:
00+L1 forms tight, cohesive clusters indicating well-learned representations, explaining the high 0.421 Recall@1
O1+L1 shows significantly dispersed embeddings, corresponding to the lower 0.389 Recall@1 1
02+L1 demonstrates moderate clustering with intermediate performance (0.395 Re- call@1 1)
Protection level 1.3 generally shows more consistent clustering across optimization levels
B.1.2 INTRA-CLUSTER ANALYSIS
We quantify embedding quality using silhouette scores and intra-cluster distances:
The correlation between silhouette and Recall@) performance (p 0.82) confirms that embedding quality directly impacts retrieval performance. O1+LI's poor clustering (silhouette 0.521) explains its performance drop.
18

---

Published as a conference paper at ICLR 2026
Table 6: Embedding cluster quality metrics
Configuration
Silhouette Score
Intra-Cluster Dist.
Inter-Cluster Dist.
Recall
MRR
00+L1
0.734
0.156
1.423
0.421
0.498
O1+L1
0,521
0.289
1.018
0.389
0.447
02+L1
0.623
0.201
1.267
0.395
0.462
00+L3
0.687
0.178
1.341
0.378
0.441
01+L3
0.645
0.192
1.299
0.412
0,485
02+L3
0.701
0.171
1.387
0.441
0.502
B.2
MULTI-RUN STABILITY ANALYSIS
To assess model stability, conduct 10 independent training with different random seeds and analyze variance in key metrics.
B.2.1
PERFORMANCE VARIANCE
Table 7: Multi-run stability analysis (mean + std over 10 runs)
Configuration
Recall @
MRR
Pass@ 1 (VMCG)
Coefficient of Var.
00+L1
0.421 + 0.031
0.498 0.028
28.73 2.1
7.4%
O1+L1
0.389 + 0.045
0.447 + 0.041
17.22 + 2.8
11.6%
02+LI
0,395 + 0.038
0,462 0.035
18.14 + 2.3
9.6%
00+L3
0.378 + 0.029
0.441 + 0.026
7.7%
01+L3
0,412 + 0.033
0.485 0.030
8.0%
02+L3
0.441 = 0.027
0.502 + 0.024
6.1%
Average CV
8.4%
Key Findings:
O1+L1 shows highest variance (CV = 11.6%), confirming inherent training difficulty
02+L3 demonstrates most stable performance (CV 6.1%)
Average coefficient of variation (8.4%) is within acceptable bounds for deep learning mod-
els
Performance variations consistent across multiple metries (Recall 1, MRR, Pass @ 1)
B.2.2 STATISTICAL SIGNIFICANCE TESTING
We performed Welch's t-tests assess statistical significance of performance differences:
Table 8: Statistical significance of performance differences (p-values)
Comparison
Recall@) @
MRR
Effect Size (Cohen's 's d) Significant?
00+LI vs 01+LI
0.032*
0.041
0.89
Yes
00+LI vs 02+L1
0.089
0,071
0.72
Marginal
O1+LI vs 02+L1
0.421
0.385
0.14
No Marginal
01+L3 vs 02+L3
0.067
0.094
0.78
The 00+L1 O1+L1 difference is statistically significant (p 0.05) with large effect size (d 0.89), confirming that the performance drop is not due to random variance but represents a genuine model limitation at the O1 optimization level.
19

---

Published as a conference paper at ICLR 2026
Protection Pairs
Mean Distance
Std Dev
Monotonicity Violation Rate
L0 - L1
0.287
0.043
2.3%
L1 - L.2
0.351
0,057
3. 1
1.2 - L3
0.429
0.068
2.8%
LO + L3
1.067
0.152
1.9%
B.3 DISTANCE HISTOGRAMS
For same-function embeddings across protection levels, observe:
The monotonic increase mean distances confirms that PCL successfully enforces the intended ordering. The low violation rates (less than 3.1%) indicate that the learned embeddings robustly respect protection hierarchies. The distance histograms show clear separation between consecutive protection levels with minimal overlap, validating the effectiveness of our contrastive objective.
B.3.1 RooT CAUSE ANALYSIS
Through detailed analysis of O1 optimization characteristics, identify the following factors tributing to instability:
Instruction Reordering: 01 introduces moderate instruction reordering that disrupts our hierarchical attention patterns
2. Register Allocation Changes: Different register usage patterns in Ol create inconsistent tokenization
3. Loop Optimization: Basic loop unrolling in 01 creates variable-length instruction quences
Proposed Solutions:
Enhanced data augmentation with Ol-specific instruction permutations during training
Adaptive attention weights based on detected optimization level
Robust tokenization scheme invariant to register allocation patterns
This comprehensive stability analysis demonstrates that while ShieldedCode shows some variance across configurations, the performance patterns systematic and explainable rather than random, providing confidence the model's reliability for practical deployment.
C SOURCE-TO- TM-EP TRANSFORMATION EXAMPLE
To illustrate the complete transformation pipeline from source code VMP-protected assembly, we present concrete example of a function that finds the minimum and maximum values in a float array.
C.I KEY TRANSFORMATION CIARACTERISTICS
The transformation pipeline demonstrates several critical aspects of our approach:
Instruction Virtualization: Each native x86 instruction is replaced with virtual equivalents using custom opcodes (vfmov, vstore, etc.) and virtual registers (%vxmm0, %vrdi).
Jump targets are transformed from direct addresses to symbolic labels loop, @L @L. end), making static analysis more difficult.
Control Flow Obfuscation:
Hierarchical Structure: The [VINST-X] markers enable our model to capture instruction-level semantics while maintaining causal dependencies through the three-level attention mechanism.
Semantic Preservation: Despite the syntactic transformation, the virtual machine code maintains the original algorithm's 's functionality finding minimum and maximum values in the input array.
20

---

Published as a conference paper at ICLR 2026
This example illustrates why traditional pattern- seatern-matching approaches fail VMP code, while learned representations can successfully bridge the semantic gap between source and protected im- plementations.
D ADDITIONAL RESULTS ON LONG INPUT TECHNIQUES
D.1 COMPARISON WITH LONGCODER
LongCoder combines window attention and global attention learn long code input. We compare LongCoder's attention design with ShieldedCode's polymorphic generation design by replacing the polymorphic generation of ShieldedCode with LongCoder's attention design. Table shows that ShieldedCode Code's polymorphic generation is more effective in learning VMP code. ShieldedCode's generation design considers the virtual instruction level local semantics and dependencies between different virtual instructions, which fits better than fix sized window attention to VMP code.
Table 9: ShieldedCode's polymorphic generation is more effective on VMP code.
Pass@
Pass @ 10
Techniques
L1
L2
L3
L4
Avg.
L1
L2
L3
L4
Avg.
ShieldedCode (LongCoder's Atln)
28.7
17.2
18.1
15.3
19.8
37.2
26.8
28.4
23.7
29.0
ShieldedCode
37.5
21.7
22.7
18.8
25.2
49.4
34.8
37.0
32.0
38.3
D.2 PERFORMANCE EVALUATION
We measured the performance impact of VMP protection across different workload categories, showing that ShieldedCode maintains competitive performance overhead compared to commercial VMP solutions. The results demonstrate that ShieldedCode achieves better performance than com- mercial solutions while providing superior protection strength. The LLM's ability to generate more efficient VM implementations tailored to specific functions contributes to the lower performance overhead, particularly in crypto operations where ShieldedCode shows 26.4x overhead compared 31.2x for VMProtect.
Table 10: Performance overhead (normalized to unprotected).
Benchmark Suite
Unprotected
VMProtect 3.7
Themida 3.1
ShieldedCode
SPEC CPU2017 (geomean)
1.00x
45.3x
52.1x
38.7x
Crypto Operations
1.00x
31.2x
28.9x
26.4x
Database (SQLite)
1.00x
18.7x
21.3x
19.1x
Compression (zlib)
1.00
23.4x
27.8x
22.9x
E PROTECTION LEVELS DEFINITION
Protection levels (LO, L1, L2, L3) represent increasing degrees VM transformation complexity applied during virtualization. This is analogous compiler optimization levels (O0, 01, 02, 03), but in reverse: higher protection levels introduce more aggressive obfuscation transformations.
Illustrative Example: Consider simple instruction ADD eax, ebx:
LO Protection:
[VINST-1] vadd $veax, $vebx
L1 Protection (Register Virtualization):
[VINST-1] vload Svrego, @veax [VINST-2] vload $vregl, @vebx
[VINST-3] vadd Svreg0, $vregl [VINST-4] vstore @veax, &vreg0
21

---

Published as a conference paper at ICLR 2026
L2 Protection (Instruction Splitting):
[VINST-1] vload kvregC, @veax
[VINST-2] vload Evregl, @vebx
[VINST-3] vmov Svtemp, Svrego
[VINST-4] vadd svtemp, svregl
[VINST-5] vmov Svrego, sveemp
[VINST-6] vstore @veax, &vreg0
L3 Protection (Control Flow Obfuscation):
[VINST-1] vjmp @handler_loadi @handler_loadl:
[VINST-2] vload $vregC, @veax
[VINST-3] vimp @handler_ load2 @handler_load2:
[VINST-4] vload $vregl, @vebx
[VINST-5] vjmp @handler_add @handler_add:
[VINST-6] vmov kvtemp, &vreg [VINST-7] vadd Svtemp, &vregl [VINST-8] vimp @handler_store @handler_store:
[VINST-9] vmov $vreg0, Sviemp [VINST-10] vstore @veax, $vreg0
Key characteristics at each level:
LO: Direct translation with minimal transformation
L1: Virtual register allocation (2-4x code expansion)
L2: Instruction decomposition (4-8x expansion)
L3: Dispatcher-base control flow (8-15x expansion)
These transformations preserve functional semantics while systematically increasing analysis com- plexity. Our contrastive learning framework explicitly models this progression, ensuring that em- beddings reflect both semantic equivalence and relative protection strength.
F
FAILURES
Table 11: Erro Distribution Analysis (n=100 random failures)
Error Type
Percentage
Example Pattern
Incorrect virtual register allocation
42%
Using &vrax where &vtempl expected
Malformed [VINST] labels
31%
Missing duplicate instruction markers
Wrong opcode sequences
18%
vadd instead of v vfddd for floating-pon point ops Invalid syntax missing operands
Parsing errors
9%
G LIMITATIONS AND FUTURE WORK
Formal Correctness Guarantees: Our correctness evaluation relies on execution- based validation through HumanEYal-compiile test cases and reverse engineering resistance as proxy. However, we acknowledge that formal verification is the gold standard for correctness. Future work could inte- grate differential testing against symbolic execution engines, incorporate program synthesis tech- niques with correctness- by-oosttructioon guarantees, or use theorem provers to verify equivalence between source and protected implementations.
22

---

Published as a conference paper at ICLR 2026
Source Code (C)
02 Assembly Code (x86-64)
VMP Protected Code
void Funco (Elost +a, int by float
3: andbb264
[VIXST-11
vioed_req tezdi, Cuo
6: (kedil, Abared Sunno, (hzda)
[VIKST 21
vinuv fuxrmo, [Serd:] [ivedx), Avannd
Inc Flost min, maxe
[VIX3T-3]
novss Oxé 8xmnl
[VTXST
efrav fexeml, [ferds 10x4).
min max a[0];
11: novea Ixmni, 0x413ketk)
[VIXST 5]
valuze (bvedx10x41, 9ommi
16: test heai, taal
[VIX8T 61]
vteat: tvesi
[1
[VTKST-
[=[i] minl
lea (frait 9:9d
[VIX9T
Iveai
min atil;
le: nev 50x1, Ax8d
[VIX9T-9] vnav 1vz fvess
slew if [+[i] max))
10 24: new Ardi, Brex
10
[VTK5T-10 10] furrd, Oxl
10
afilz
0x0
kaman
[VIXST-
Avddi
33: moves 0x0 (Brip), hxmm
[VINST-12] vélicad #xxmm2, dconet
12.
13
3h: tag Arg, kr
13
[VTXST-3] 133
ofllced cecl kvsmm,, Sconet meak
13
b10] nins
14 Sw: je 82
14 81_1oup
14
[VTNST-14] venp
novaus (tres), fxmml
[VTNge vje 21.endd
4uz novepa Yamr,, 9aran
17 [VIX9T-18 16] vituv Guzan, Ave8
18 6f: subes (ards, amax, 4), Axemo
18 inner:
andpa
[VINST
Avsnnl, [Avree] viocpy 6xxm00, 5vxmm1
5 ocmiss so
Socmno Exmm2
[VINST-18]
21
5e: tte 6d
[VTXST-19]
visua lvsrrnl, [Avrdi Hevrax
22
Sxmm), (5rd))
(Ardi, Srax, 4),
veand tvmmn0, tvemn)
novess fxmmm 0xd (kree))
[VINST-21
voccmp koxmm,,
25
6d: add $0x1, Arax
[VINST 22] vjbe El.akip
26
Ses:
25
[VINST-23]
[kvrdx] (Avrdi
[VTXST-24]
50x1, 191 aad 50x6, Brox
29
27 [VINST-25] vetcre [[vraxeUx4], $vsmml
30
99:
28
@r.skip:
[VINST-26] AwEaK
[VINST-29] venp kvrex, $vesi
31
[VTXST-28] v3g innie
32
[VINST-29]
tvrö
21_ends
35
[VINST-3L] viet
Figure 5: Complete transformation pipeline from C source code to VMP-protected assembly. The source code implements a min-max finding algorithm. The 02 assembly shows compiler optimiza- tion with complex control flow. The VMP version uses virtual instructions with [VINST-X] markers and virtual registers (prefixed with 'v'), demonstrating how our hierarchical attention mechanism processes instruction boundaries and dependencies.
23

---

Published as a conference paper at ICLR 2026
H THE USE OF LARGE LANGUAGE MODELS (LLMS)
We use large language models (LLMs) only to polish the writing, including grammar, clarity, and readability. The research ideas, technical framework, theoretical analyses, experimental design, and conclusions are entirely developed by the authors. The LLMs only improve the fluency and style of the manuscript and do not influence the originality, novelty, or scientific content of the work.
ETHICS STATEMENT
This work adheres the ICLR Code of Ethics. All datasets utilized in this paper are publicly available and widely adopted within the research community, and we strictly follow their respective licenses and intended usage.
REPRODUCIBILITY STATEMENT
We strive ensure the reprodueibility our results. Full details are provided in the main paper and the appendix. Our implementation is built on Py PyToc and standard open-source libraries.
24


Reviews:
[{"review_id": "2zuyKHHonu", "reviewer": "Reviewer_yYbZ", "summary": "This paper addresses the critical problem of learning robust representations for VM-protected code. The authors propose an encoder model that takes VM-encoded binaries as input and outputs robust embeddings capable of handling various obfuscation transformations.\n\n\n## Dataset Construction\n\nThe training dataset is constructed through a two-stage process:\n\n(1) Source code programs are compiled to binaries using different compilation options\n\n(2) The binaries are further obfuscated using VM transformations with varying obfuscation levels\n\n## Methodology\n\nThe approach employs a two-stage training strategy starting from a pre-trained LLM checkpoint:\n\nHere are the training loss terms:\n(1) FCL: Encourages embeddings of source functions to be similar to their corresponding obfuscated versions\n\n(2) PCL: Enforces that embeddings of functions with lower obfuscation levels are closer to the source code than those with higher levels\n\n(3) Contrastive loss: Ensures embeddings of the same function are more similar than embeddings of different functions\n\n(4) Language modeling loss: Given source code and obfuscation level, generates the corresponding obfuscated code\n\nThe second-stage contains losses 1, 2, and 4 (without the contrastive loss).\n\nAdditionally, the authors design a regularized token mask to capture VM program structure, complementing the training losses.", "questions": "Please see above.", "limitations": "", "rating": 6, "confidence": 4, "soundness": 2, "presentation": 3, "contribution": 3, "strengths": "The paper proposes a solid training technique with novel loss formulations and mask designs. The evaluation demonstrates good performance on retrieving VM code under different obfuscation levels.", "weaknesses": "Q1: Motivation: There appears to be a logical inconsistency in the motivating narrative. The paper argues that reverse engineering poses threats to software security, yet learning robust representations of VM code constitutes a form of reverse engineering. Please clarify.\n\nQ2: PCL loss. FCL requires all obfuscated embeddings to be similar to source code embeddings, while PCL mandates similarity gaps between different obfuscation levels. Are these objectives compatible, or do they introduce conflicting gradients? Additionally, does higher obfuscation always imply less semantic similarity? \n\nQ3: Language modeling loss. The inclusion of a language modeling loss for generating obfuscated code from source is not well-justified. Representation learning for low-level code (e.g., binary) typically relies on contrastive losses (with attention regularizations). What specific benefit does this generative objective provide?\n\nQ4: Comparison setup with binary models. The work compares against binary code representation models, but most of these models were not pre-trained on VM code. Did the authors re-run pre-training on the VM dataset for fair comparison? If not, this should be clearly stated, as the comparison may be biased toward the proposed method given its VM-specific training.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "SLFUW3P7DB", "reviewer": "Reviewer_VoQV", "summary": "The manuscript focus on anti-reverse engineering by learning from the VMP-protected codes  and associating with their corresponding source codes. To implement this, this paper builds large-scale paired datasets of source code and normalized VM implementations, and introduces hierarchical dependency modelling at intra-, preceding-, and inter-instruction levels. To facilitate the protection-level-aware, the authors propose functionality-aware and protection-aware contrastive objectives to capture both semantic equivalence and protection strength. And the evolutions empirically validate that the proposed ShieldedCode develops meaningful code representations.", "questions": "see Weaknesses.", "limitations": "", "rating": 4, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 2, "strengths": "The method is well motivated, with a highlight of urgent need for strengthening software resilience against reverse engineering. And the aimed challenges have practical values.\n\nThis manuscript constructs a large, paired dataset of source code and normalised VM implementations, which can inspire further research on source-2-VMP codes transformations and similarity comparison via LLMs.", "weaknesses": "The manuscript mentions the protect level for VMP codes several times in the paper. However, this is no further justification of what does the protection level mean? From the current writing, it seems to be similar to code obfuscation level. Please consider adding illustrative examples and explicit explanation for this critical concept.\n\nIn section 3.3, the proposed method utilise two contrastive loss components:  FCL and PCL, which were claimed to be one the innovative contributions. The FCL functions by pulling together representations of the same function across representations, forcing them to be in short distance in the latent feature space. However, minimizing the PCL seems to encourage the distance of representations from different applied protection levels to be closer, similar to the FCL. \n\nFrom the statements of the motivation of this work, the aim is to transform source codes into VMP codes with various protection level, and the model is expected to be aware of the protection strength in the generation phase. However, the authors choose a task similar to binary similar matching or comparison to validate the mostly the semantic association between representations. For the current evaluations, it works more like a reverse-engineering tool, which can translate source-VMP code pairs or VMP with different protection level code pairs, rather than generating robust VMP codes against reverse engineering methods.\n\nBesides, some SOTA works utilize LLM to further enhance the performance of reverse engineering such as [1]. Please consider including these SOTA models as baselines to validate the performance of ShieldedCode against reverse engineering.\n\n[1] Hu, Peiwei, Ruigang Liang, and Kai Chen. \"Degpt: Optimizing decompiler output with llm.\" Proceedings 2024 Network and Distributed System Security Symposium. Vol. 267622140. 2024.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "R8F2ReaNVG", "reviewer": "Reviewer_2d4p", "summary": "The paper proposes ShieldedCode, a framework to train LLMs on paired (source code, virtual-machine–protected code) so that the model can both generate VMP code at target protection levels and retrieve/rank differently protected variants of the same function. It builds a large corpus by compiling C code, running a commercial VMP tool, disassembling, and then normalizing the VM code into a stable token format with canonical [VINST-*] markers. On top of this, it introduces a hierarchical attention mask that respects instruction boundaries and two contrastive objectives: functionality-contrastive (pull same-function variants together) and protection-contrastive (order by protection level). Experiments on HumanEval-compile and a BinaryCorp-VirtualAssembly similarity task show higher Pass@1/Pass@10 and better Recall@1 than general code LLMs when the target is VMP code.", "questions": "1. Are all VMP variants (for pretraining, fine-tuning, and testing) produced by the same commercial VMP tool and interpreter template? If yes, how should we interpret “across heterogeneous protection levels”?\n\n2. In PCL, what margin or temperature is used, and did you check distance histograms per level to confirm the intended ordering? Current results suggest partial but not strict ordering.\n\n3. For generation failures on HumanEval-compile, what are the dominant error types (bad labels, wrong VM opcode, broken instruction grouping)? This would clarify how much the hierarchical mask helps.", "limitations": "", "rating": 4, "confidence": 4, "soundness": 2, "presentation": 3, "contribution": 2, "strengths": "Originality: Treats software protection as a representation-learning problem on VMP code, with a clear inductive bias via hierarchical masking over [VINST-*].\n\nQuality: Data pipeline is concrete (compile → VMP(.) → disasm → normalize), the losses are fully specified (LM + FCL + PCL + PEO), and evaluation covers both generation and retrieval across O0-O3 and L1/L3. \n\nClarity: The normalization step is enumerated in four precise actions, and the masking formula is explicit, so a reader can reimplement the core idea. \n\nSignificance: Shows that in-domain training on protected code lets a 7B model beat general-purpose code LLMs on protected-generation tasks, which is practically relevant for protection/analysis workflows.", "weaknesses": "- The paper relies on one commercial VMP tool and two protection levels (L1, L3) in testing; this narrows the “heterogeneous protection” claim and makes it unclear how well the model transfers to other VMs or level taxonomies. \n\n- Protection-contrastive learning is claimed to enforce an ordering, but the reported Recall@1 across (O?, L1/L3) is not strictly monotone, suggesting the ordering is noisy in practice.\n\n- Comparisons are against models that are not trained on this domain, so it is hard to isolate how much of the gain comes from the hierarchical mask versus just having millions of in-domain (src, VMP) pairs.\n\n- Reproducibility is limited because the key assets (commercial VMP, disassembler, large paired corpus) are not obviously releasable; reproducing exact normalization/tokenization may be nontrivial.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "nsayE9oAVX", "reviewer": "Reviewer_suuo", "summary": "This paper proposes ShieldedCode, a framework that replaces traditional rule-based virtual machine protection (VMP) schemes with a learning-driven dynamic mechanism to enhance anti-reverse-engineering and anti-analysis robustness while preserving program semantics. ShieldedCode models code protection as a representation learning problem, where the model jointly learns in both semantic space and protection space through contrastive learning. This allows the model to understand code functionality while generating diverse and robust protection patterns.\n\nExperimental results show that compared with other baselines, ShieldedCode achieves better functionality preservation and security robustness. In reverse-engineering experiments, ShieldedCode-protected samples required an average of 14.7 hours to be successfully reversed—significantly longer than baseline systems.", "questions": "In the abstract and introduction, please explicitly state how much improvement ShieldedCode achieves over baselines.", "limitations": "", "rating": 6, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "- It is meaningful to use dynamic mechanisms to replace rule-based transformations for enhancing code security.\n- The paper is clearly written and well structured.\n- The proposed framework introduces a novel training design that models dependencies across intra-, preceding-, and inter-instruction levels. It also designs two loss functions: Functionality Contrastive Learning (FCL) and Protection Contrastive Learning (PCL), which enforce semantic consistency and improve discriminative capability.\n- Experiments are comprehensive, evaluating both the functionality and security of generated code, and include reverse-engineering experiments to validate real-world robustness.", "weaknesses": "- Although the paper enforces semantic consistency across optimization levels using FCL, the generated virtualized code still lacks formal correctness guarantees, which is critical in practice since the transformed code must strictly preserve original functionality.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Poster)