Formal soundness of common-path detection across SysCDGs

Establish formal soundness that the signature product graph and program-location-based node signatures identify every common violating path representing the same actually possible information flow across multiple SystemC dependence graphs, as required for the soundness of the non-cumulative information-flow refinement procedure.

Background

The information-flow refinement procedures compare paths across SystemC dependence graphs (SysCDGs) generated under different abstractions. Because abstraction refinement can change the graph structure substantially, the paper represents paths using signatures and uses a signature product graph to identify common paths across multiple SysCDGs.

The authors explain that, for the non-cumulative refinement procedure, soundness requires every common violating path corresponding to the same concrete information flow to be found. They propose program locations as node signatures and state that this approach is believed to be sound, but they do not provide a formal proof or assurance. Establishing that result would justify the soundness of the non-cumulative procedure.

References

However, for the non-cumulative procedure, it is relevant to soundness that, if a common violating path exists (i.e. one that represents the same actually possible information flow), then it must be found by the analysis. Otherwise, we could erroneously report secure information flow. Overapproximating common paths on the other hand is fine for soundness, with the same consequences for performance or false positives as with the cumulative procedure. We believe that our approach with the signature product graph and program locations as node signatures is sound, but currently do not provide formal assurances of that.

— Automated Abstraction Refinement for Information Flow Security in Embedded Systems  (2609.29645 - Becker-Kupczok et al., 24 Sep 2026) in Section 3.4, subsection “Identifying Paths in Different SysCDGs”