Universal implication checking for YARA specializations

Prove universal implication for the full YARA language, namely that every byte sequence accepted by an Aray-generated constructive specialization also satisfies the original YARA rule.

Background

Aray constructs a sufficient specialization of a selected YARA rule to obtain one concrete positive witness. The intended soundness direction is that any file matching the specialization should also match the original rule, although the specialization may match fewer files.

The paper establishes deterministic proofs only for a restricted fragment and uses candidate validation or bounded model judging outside that fragment. Consequently, universal implication across the full YARA language—including general Boolean, arithmetic, module, and other unsupported semantics—remains unresolved. A formal or solver-backed implication check is identified as necessary to establish this stronger guarantee.