CFI Filters: Cross-Domain Interpretations

• CFI filters are a domain-dependent shorthand that encompass cryogenic microwave filters, security control-flow validators, and quantum graph filters, each defined by its disciplinary context.
• In computer security, CFI filters enforce runtime policies by restricting indirect control transfers through allowed-target sets, with effectiveness measured via metrics like CTR and relative CTR ratios.
• In cryogenic physics and graph theory, CFI filters function respectively as low-pass coaxial attenuators for noise suppression and as quantum graph devices that isolate homomorphism types to establish complexity lower bounds.

“CFI filters” is not a single standardized term across the research literature. In low-temperature experimental physics, the phrase maps naturally onto cryogenic coaxial microwave filters: distributed, dissipative low-pass filters made from lossy semi-rigid coax and mounted at the mixing chamber to suppress broadband electromagnetic noise in millikelvin experiments (Tancredi et al., 2013). In computer security, “CFI” usually denotes Control-Flow Integrity, and a “CFI filter” is the mechanism that restricts the legal destination set of indirect branches, returns, or speculative control transfers (Muntean et al., 2019). In counting complexity and Weisfeiler–Leman lower bounds, “CFI” refers to Cai–Fürer–Immerman constructions, and “filters” are quantum-graph devices that isolate desired homomorphism types or preserve parity obstructions under compression (Curticapean, 2023). The term is therefore best understood as a domain-dependent shorthand whose meaning is fixed by the surrounding literature.

1. Terminological scope

The computer-security literature treats a CFI filter primarily as a target-restriction policy. LLVM-CFI describes a policy as a matching relation $M$ over callsites, targets, and policy metadata, and operationally reduces analysis to the residual allowed-target set at each indirect callsite (Muntean et al., 2019). Reckon adopts the same viewpoint: static CFI defenses are evaluated by the legitimate target sets that remain after filtering, rather than by a binary protected/unprotected distinction (Muntean, 2018). SPECCFI extends this idea into speculation, using CFI metadata as a runtime filter over speculative branch targets rather than only over architecturally committed control flow (Koruyeh et al., 2019).

The low-temperature physics literature uses the phrase very differently. The cryogenic coaxial microwave filter work explicitly states that if one refers to “CFI filters,” that design maps naturally onto the category of cryogenic coaxial microwave filters for dilution-refrigerator wiring (Tancredi et al., 2013). Here the “filter” is an RF component, not a control-transfer validator.

The graph-theoretic literature uses “CFI” in the Cai–Fürer–Immerman sense. “Count on CFI graphs for #P-hardness” formalizes filters by quantum graphs whose homomorphism counts are $1$ on desired pattern types and $0$ on undesired ones, while “Compressing CFI Graphs and Lower Bounds for the Weisfeiler–Leman Refinements” uses compressed CFI constructions as information-hiding barriers for $k$-WL (Curticapean, 2023).

A further source of ambiguity is that some signal-processing and analog-filter papers use nearby acronymic territory without standardizing “CFI filters” as a named class. The survey on variable cutoff frequency FIR filters explicitly states that “CFI filters” is not used as a named category there; if “CFI” is interpreted as cutoff-frequency interpolation, the relevant techniques are discussed instead under interpolation / frequency-response masking, fractional-delay / Farrow-based tuning, spectral parameter approximation, and hybrid structures (Dhabu et al., 2018).

2. Control-Flow Integrity filters as target-restriction policies

Within systems security, a CFI filter is the runtime embodiment of a static or dynamic policy over indirect control transfers. LLVM-CFI models a defense as a policy $\Psi$ defined over callsites, targets, and metadata such as function signatures, class hierarchies, sub-hierarchies, vtable entries, or virtual-table roots (Muntean et al., 2019). A reconstructed per-callsite allowed-target set is

$$T_{\Psi}(c_s) = \{\, f \mid (c_s,f) \text{ satisfies the policy } \Psi \,\},$$

and the paper’s primary global metric is

$CTR = \sum_{i=1}^n ctr_i,$

where $ctr_i$ is the number of legitimate calltargets for callsite $i$ (Muntean et al., 2019). The central methodological point is that filter strength is a distribution over callsites, not a single average.

This perspective yields a standard coarse-versus-fine distinction. Coarse filters admit broad equivalence classes such as “all vtables” or weak parameter-count compatibility; fine-grained filters use exact or near-exact function signatures, class sub-hierarchies, vtable sub-hierarchies, and slot-specific dispatch structure (Muntean, 2018). LLVM-CFI ranks Strict src types, Strict sub-hierarchy, and Sub-hierarchy as the strongest of eight static policies on normalized average residual target ratio, whereas Bin types and All vTables are much more permissive (Muntean et al., 2019).

Binary-CFI shows that the effectiveness of a type-based CFI filter depends directly on the fidelity of recovered signature information. It therefore introduces target-set overlap metrics against source-level ground truth: $$RelativeCTR_T ~~(R_T) = \sum_{i=1}^{n} \frac{CT_i\cap CT_i^{'}}{CT_i}$$ and

$1$0

These quantify, respectively, how much of the source-level legal set survives in the binary-derived filter and how much spurious target freedom is introduced by binary recovery errors (Vaidya et al., 2024). The paper’s empirical conclusion is that coarse ABI-visible features such as argument counts and relaxed width classes support comparatively faithful filters, whereas exact type- and pointer-sensitive filters degrade sharply when fed speculative binary analysis.

A recurrent implication is that CFI filters are best understood as approximate admissibility relations. Even when the policy is syntactically fine-grained, residual target multiplicity can remain large enough for control-flow bending, COOP-like reuse, or other policy-compliant attacks (Muntean, 2018).

3. Hardware realizations of CFI filters

Concrete CFI mechanisms differ mainly in how they encode and query the legal target set. CaRE is a microcontroller-oriented example whose policy is particularly clear: all returns in the instrumented main program must match previously observed calls, and indirect calls must target valid function-entry addresses (Nyman et al., 2017). The backward-edge filter is exact because returns are checked against a secure shadow stack in TrustZone-M protected memory; the forward-edge filter is a call-target-table membership test over valid subroutine entries rather than a complete per-callsite CFG relation (Nyman et al., 2017).

Several later systems transform CFI filtering into a hardware-enforced authorization problem. EC-CFI encrypts each function with a different key and dynamically derives the decryption key from the current control-flow state, so execution outside the statically determined call graph becomes a wrong-key fetch rather than a late explicit check (Nasahl et al., 2023). SCRAMBLE-CFI applies the same basic idea to OpenTitan by assigning each function an encryption tweak and making code executable only when the correct tweak is active; its explicit security claim is mitigation of control-flow redirections outside the call graph (CFM1), with hardware overhead of less than $1$1 and runtime overhead of $1$2 for Embench-IoT (Nasahl et al., 2023). These are cryptographic CFI filters: legal edges are the ones for which software installs the matching decryption context.

Branch Landing generalizes forward-edge authorization through Bloom-filter membership. Each indirect source emits a bld instruction carrying a source Section Identifier, and each landing site executes brl, which checks whether the source SID belongs to the Bloom-filter-encoded authorized-source set for that target (Wu et al., 25 Apr 2026). The false-positive model is

$1$3

and the paper’s key claim is fixed-probe latency independent of the number of authorized sources (Wu et al., 25 Apr 2026). This makes the CFI filter a probabilistic set-membership query rather than a fixed-width equality tag.

Standardized landing-pad designs instantiate a coarser but simpler form of the same idea. CVA6-CFI implements the RISC-V Zicfiss and Zicfilp extensions: sspush and sspopchk provide shadow-stack-based backward-edge checking, while lpad acts as a forward-edge landing-pad primitive whose label must match the expected value in x7 after an indirect jump (Manoni et al., 4 Feb 2026). The paper reports only $1$4 area overhead and up to $1$5 performance overhead on the MiBench automotive subset (Manoni et al., 4 Feb 2026).

SPECCFI moves CFI filtering into speculation. For forward edges, the BTB-predicted target is accepted only if decode observes a cfi_lbl with a label matching the one carried by the indirect branch; otherwise an lfence micro-op is inserted (Koruyeh et al., 2019). For backward edges, the paper replaces the conventional RSB with a speculation-aware RSB/SCS hybrid so that return speculation is driven by precise shadow-call-stack state instead of an approximate predictor (Koruyeh et al., 2019). The result is a CFI-informed filter over speculative targets rather than a blanket fence on all indirect speculation.

Camouflage shows a related but pointer-authentication-based formulation for the AArch64 Linux kernel. Here the filter is not a CFG table but a requirement that a return address, function pointer, or control-relevant data pointer carry a valid PAC under the correct key and modifier; otherwise authentication fails and a later dereference or branch faults (Denis-Courmont et al., 2019). This effectively binds control-flow validity to cryptographically authenticated provenance at the storage location where the pointer is consumed.

4. Residual attack surface and the assessment of CFI filters

A major research theme is that filtering does not eliminate attack surface; it reshapes it. “Automated CFI Policy Assessment with Reckon” and “Analyzing Control Flow Integrity with LLVM-CFI” both argue that the decisive object is the residual per-callsite legal target set after policy application, not the mere existence of a CFI mechanism (Muntean, 2018). On the offensive side, “Automated Multi-Architectural Discovery of CFI-Resistant Code Gadgets” treats coarse-grained CFI explicitly as a filter that leaves a residual graph of legal gadget starts and ends, and then searches that graph for semantically useful code-reuse fragments (Wollgast et al., 2020).

The gadget-discovery results are strongest against coarse policies. The framework looks for gadgets whose boundaries align with CFI-permitted target classes such as function entry points (EP) and legitimate call sites (CS), and whose suffixes are RET, indirect call (IC), or indirect jump (IJ) (Wollgast et al., 2020). The key conclusion is that coarse-grained CFI is a weak filter rather than a strong eliminator of gadget targets: CS-RET gadgets are particularly numerous, loop/dispatcher gadgets remain, and even ARM binaries contain CFI-compatible gadgets sufficient for a one-gadget system("/bin/sh") exploit under a CCFIR-like policy (Wollgast et al., 2020).

LLVM-CFI and Reckon systematize that intuition. Both frameworks show that average-only measures obscure the real security picture because a few permissive callsites can dominate exploitability (Muntean et al., 2019). Their results consistently place strict signature- or hierarchy-based policies at the top of the ranking, but they also emphasize that even restrictive policies usually remain one-to-$1$6 mappings rather than one-to-one dispatch relations (Muntean, 2018). This means CFI filters must be evaluated both as set-size reducers and as semantic residual spaces: a small surviving set can still be dangerous if it contains the wrong reusable computation.

Binary-CFI adds a separate caution for binary-only deployments. There, a filter can appear stronger by simple target-count reduction while actually becoming less faithful, because it may exclude legitimate targets and keep spurious ones (Vaidya et al., 2024). The paper’s overall message is that stricter abstract policies do not necessarily produce better realized filters when the analysis substrate is weak.

5. CFI filters in counting complexity and Weisfeiler–Leman lower bounds

In counting complexity, a CFI filter is a quantum graph designed to annihilate undesired homomorphism types while preserving the desired one. “Count on CFI graphs for #P-hardness” formalizes a filter $1$7 by the condition

$1$8

and exploits tensor multiplicativity,

$1$9

to remove unwanted terms from homomorphism expansions (Curticapean, 2023).

The central CFI-based construction is the two-constituent quantum graph

$0$0

built from an untwisted and a singly twisted CFI instance over a connected colorful graph $0$1 (Curticapean, 2023). Its defining property is

$0$2

while graphs that are not surjectively $0$3-colored cannot distinguish the two constituents and therefore cancel out (Curticapean, 2023). The paper’s main algorithmic payoff is that this replaces a $0$4 inclusion–exclusion filter by a CFI-based construction with cost $0$5, which is decisive for bounded-degree hard pattern classes (Curticapean, 2023).

“Compressing CFI Graphs and Lower Bounds for the Weisfeiler–Leman Refinements” uses CFI in a different but related filtering sense. It compresses standard CFI gadgets by an equivalence relation on base vertices, reusing gadgets while preserving the parity obstructions that hinder $0$6-WL (Grohe et al., 2023). The resulting compressed CFI graphs remain hard enough to prove

$0$7

round lower bounds for $0$8-WL, the first super-linear lower bound of that form for all $0$9 (Grohe et al., 2023). A plausible implication is that compression here acts as an information-hiding filter: only parity-consistent, compression-compatible twist motions remain visible, and WL refinement cannot quickly localize the hidden inconsistency.

6. Cryogenic coaxial microwave filters and other non-security usages

In low-temperature experimental physics, “CFI filters” maps directly onto a practical cryogenic filter design intended to suppress broadband electromagnetic noise on wiring into millikelvin devices (Tancredi et al., 2013). The design uses UT-020-SS-SS semi-rigid stainless-steel coax, with a 304 stainless steel jacket and core, PTFE dielectric, outer diameter $k$0 mm, inner diameter of outer conductor $k$1 mm, and inner conductor diameter $k$2 mm (Tancredi et al., 2013). Each filter line uses 1.5 m of coax, and four such lines are wrapped around a hollow copper cylinder of length 30 mm, outer diameter 40 mm, and wall thickness 2 mm, then soldered along their full length for thermalization at the mixing chamber (Tancredi et al., 2013).

The operating principle is a distributed low-pass attenuator. Using the Zorin transmission-line model, the attenuation per unit length is written as

$k$3

with

$k$4

and a skin-effect-dominated $k$5 (Tancredi et al., 2013). For room-temperature stainless steel resistivity $k$6, the paper estimates

$k$7

hence for $k$8 m

$k$9

with the model expected to remain predictive up to approximately 1 THz (Tancredi et al., 2013). Measured $\Psi$0 at 300 K and 77 K agrees extremely well with the model, with fitted resistivities

$\Psi$1

(Tancredi et al., 2013).

The paper also validates the filters functionally using small underdamped Al/AlOx/Al Josephson junctions at about 15 mK. Without the filters, the sample does not display a supercurrent branch at $\Psi$2 V; with the filters, a clear supercurrent branch appears, the transition becomes sharp, and the low-current voltage reaches

$\Psi$3

in agreement with theory (Tancredi et al., 2013). In this literature, then, a CFI filter is an RF-noise suppressor and thermal anchor rather than a control-transfer validator.

Outside both security and cryogenic physics, the acronym becomes unstable. The variable-cutoff-frequency FIR survey explicitly treats cutoff-frequency interpolation only indirectly through interpolation/FRM, fractional-delay/Farrow, SPA, and hybrid methods rather than under a named “CFI filters” category (Dhabu et al., 2018). A current-conveyor-based multifunction biquad, by contrast, is a separate analog-filter topic built from two balanced output current conveyors, four resistors, and two grounded capacitors, realizing LP, HP, BP, and elliptical-notch responses at a single output node (Kumar et al., 2010). These usages underscore that “CFI filters” has no universal meaning outside a clearly specified disciplinary context.