---
title: 'CFI Filters: Cross-Domain Interpretations'
url: https://www.emergentmind.com/topics/cfi-filters
type: topic
---

# CFI Filters: Cross-Domain Interpretations

“CFI filters” is not a single standardized term across the research literature. In low-temperature experimental physics, the phrase maps naturally onto **cryogenic coaxial microwave filters**: distributed, dissipative low-pass filters made from lossy semi-rigid coax and mounted at the mixing chamber to suppress broadband electromagnetic noise in millikelvin experiments [1308.6716]. In computer security, “CFI” usually denotes **Control-Flow Integrity**, and a “CFI filter” is the mechanism that restricts the legal destination set of indirect branches, returns, or speculative control transfers [1910.01485]. In counting complexity and Weisfeiler–Leman lower bounds, “CFI” refers to **Cai–Fürer–Immerman** constructions, and “filters” are quantum-graph devices that isolate desired homomorphism types or preserve parity obstructions under compression [2305.04767]. The term is therefore best understood as a domain-dependent shorthand whose meaning is fixed by the surrounding literature.

## 1. Terminological scope

The computer-security literature treats a CFI filter primarily as a **target-restriction policy**. LLVM-CFI describes a policy as a matching relation \(M\) over callsites, targets, and policy metadata, and operationally reduces analysis to the residual allowed-target set at each indirect callsite [1910.01485]. Reckon adopts the same viewpoint: static CFI defenses are evaluated by the legitimate target sets that remain after filtering, rather than by a binary protected/unprotected distinction [1812.08496]. SPECCFI extends this idea into speculation, using CFI metadata as a runtime filter over speculative branch targets rather than only over architecturally committed control flow [1906.01345].

The low-temperature physics literature uses the phrase very differently. The cryogenic coaxial microwave filter work explicitly states that if one refers to “CFI filters,” that design maps naturally onto the category of cryogenic coaxial microwave filters for dilution-refrigerator wiring [1308.6716]. Here the “filter” is an RF component, not a control-transfer validator.

The graph-theoretic literature uses “CFI” in the Cai–Fürer–Immerman sense. “Count on CFI graphs for #P-hardness” formalizes filters by quantum graphs whose homomorphism counts are \(1\) on desired pattern types and \(0\) on undesired ones, while “Compressing CFI Graphs and Lower Bounds for the Weisfeiler–Leman Refinements” uses compressed CFI constructions as information-hiding barriers for \(k\)-WL [2305.04767].

A further source of ambiguity is that some signal-processing and analog-filter papers use nearby acronymic territory without standardizing “CFI filters” as a named class. The survey on variable cutoff frequency FIR filters explicitly states that “CFI filters” is not used as a named category there; if “CFI” is interpreted as cutoff-frequency interpolation, the relevant techniques are discussed instead under interpolation / frequency-response masking, fractional-delay / Farrow-based tuning, spectral parameter approximation, and hybrid structures [1804.02891].

## 2. Control-Flow Integrity filters as target-restriction policies

Within systems security, a CFI filter is the runtime embodiment of a static or dynamic policy over indirect control transfers. LLVM-CFI models a defense as a policy \(\Psi\) defined over callsites, targets, and metadata such as function signatures, class hierarchies, sub-hierarchies, vtable entries, or virtual-table roots [1910.01485]. A reconstructed per-callsite allowed-target set is
\[
T_{\Psi}(c_s) = \{\, f \mid (c_s,f) \text{ satisfies the policy } \Psi \,\},
\]
and the paper’s primary global metric is
\[
CTR = \sum_{i=1}^n ctr_i,
\]
where \(ctr_i\) is the number of legitimate calltargets for callsite \(i\) [1910.01485]. The central methodological point is that filter strength is a distribution over callsites, not a single average.

This perspective yields a standard coarse-versus-fine distinction. Coarse filters admit broad equivalence classes such as “all vtables” or weak parameter-count compatibility; fine-grained filters use exact or near-exact function signatures, class sub-hierarchies, vtable sub-hierarchies, and slot-specific dispatch structure [1812.08496]. LLVM-CFI ranks **Strict src types**, **Strict sub-hierarchy**, and **Sub-hierarchy** as the strongest of eight static policies on normalized average residual target ratio, whereas **Bin types** and **All vTables** are much more permissive [1910.01485].

Binary-CFI shows that the effectiveness of a type-based CFI filter depends directly on the fidelity of recovered signature information. It therefore introduces target-set overlap metrics against source-level ground truth:
\[
RelativeCTR_T ~~(R_T)  = \sum_{i=1}^{n} \frac{CT_i\cap CT_i^{'}}{CT_i}
\]
and
\[
RelativeCTR_F ~~(R_F) = \sum_{i=1}^{n} \frac{CT_i^{'}\setminus CT_i}{CT_i^{'}}.
\]
These quantify, respectively, how much of the source-level legal set survives in the binary-derived filter and how much spurious target freedom is introduced by binary recovery errors [2401.07148]. The paper’s empirical conclusion is that coarse ABI-visible features such as argument counts and relaxed width classes support comparatively faithful filters, whereas exact type- and pointer-sensitive filters degrade sharply when fed speculative binary analysis.

A recurrent implication is that CFI filters are best understood as **approximate admissibility relations**. Even when the policy is syntactically fine-grained, residual target multiplicity can remain large enough for control-flow bending, COOP-like reuse, or other policy-compliant attacks [1812.08496].

## 3. Hardware realizations of CFI filters

Concrete CFI mechanisms differ mainly in how they encode and query the legal target set. CaRE is a microcontroller-oriented example whose policy is particularly clear: all returns in the instrumented main program must match previously observed calls, and indirect calls must target valid function-entry addresses [1706.05715]. The backward-edge filter is exact because returns are checked against a secure shadow stack in TrustZone-M protected memory; the forward-edge filter is a call-target-table membership test over valid subroutine entries rather than a complete per-callsite CFG relation [1706.05715].

Several later systems transform CFI filtering into a hardware-enforced authorization problem. EC-CFI encrypts each function with a different key and dynamically derives the decryption key from the current control-flow state, so execution outside the statically determined call graph becomes a wrong-key fetch rather than a late explicit check [2301.13760]. SCRAMBLE-CFI applies the same basic idea to OpenTitan by assigning each function an encryption tweak and making code executable only when the correct tweak is active; its explicit security claim is mitigation of control-flow redirections outside the call graph (CFM1), with hardware overhead of less than \(3.97\%\) and runtime overhead of \(7.02\%\) for Embench-IoT [2303.03711]. These are cryptographic CFI filters: legal edges are the ones for which software installs the matching decryption context.

Branch Landing generalizes forward-edge authorization through Bloom-filter membership. Each indirect source emits a `bld` instruction carrying a source Section Identifier, and each landing site executes `brl`, which checks whether the source SID belongs to the Bloom-filter-encoded authorized-source set for that target [2604.23331]. The false-positive model is
\[
p_{\text{fp}} \approx \bigl(1 - e^{-kn/m}\bigr)^{k},
\]
and the paper’s key claim is fixed-probe latency independent of the number of authorized sources [2604.23331]. This makes the CFI filter a probabilistic set-membership query rather than a fixed-width equality tag.

Standardized landing-pad designs instantiate a coarser but simpler form of the same idea. CVA6-CFI implements the RISC-V Zicfiss and Zicfilp extensions: `sspush` and `sspopchk` provide shadow-stack-based backward-edge checking, while `lpad` acts as a forward-edge landing-pad primitive whose label must match the expected value in `x7` after an indirect jump [2602.04991]. The paper reports only \(1.0\%\) area overhead and up to \(15.6\%\) performance overhead on the MiBench automotive subset [2602.04991].

SPECCFI moves CFI filtering into speculation. For forward edges, the BTB-predicted target is accepted only if decode observes a `cfi_lbl` with a label matching the one carried by the indirect branch; otherwise an `lfence` micro-op is inserted [1906.01345]. For backward edges, the paper replaces the conventional RSB with a speculation-aware RSB/SCS hybrid so that return speculation is driven by precise shadow-call-stack state instead of an approximate predictor [1906.01345]. The result is a CFI-informed filter over speculative targets rather than a blanket fence on all indirect speculation.

Camouflage shows a related but pointer-authentication-based formulation for the AArch64 Linux kernel. Here the filter is not a CFG table but a requirement that a return address, function pointer, or control-relevant data pointer carry a valid PAC under the correct key and modifier; otherwise authentication fails and a later dereference or branch faults [1912.04145]. This effectively binds control-flow validity to cryptographically authenticated provenance at the storage location where the pointer is consumed.

## 4. Residual attack surface and the assessment of CFI filters

A major research theme is that filtering does not eliminate attack surface; it reshapes it. “Automated CFI Policy Assessment with Reckon” and “Analyzing Control Flow Integrity with LLVM-CFI” both argue that the decisive object is the residual per-callsite legal target set after policy application, not the mere existence of a CFI mechanism [1812.08496]. On the offensive side, “Automated Multi-Architectural Discovery of CFI-Resistant Code Gadgets” treats coarse-grained CFI explicitly as a filter that leaves a residual graph of legal gadget starts and ends, and then searches that graph for semantically useful code-reuse fragments [2007.04116].

The gadget-discovery results are strongest against coarse policies. The framework looks for gadgets whose boundaries align with CFI-permitted target classes such as function entry points (`EP`) and legitimate call sites (`CS`), and whose suffixes are `RET`, indirect call (`IC`), or indirect jump (`IJ`) [2007.04116]. The key conclusion is that coarse-grained CFI is a weak filter rather than a strong eliminator of gadget targets: `CS-RET` gadgets are particularly numerous, loop/dispatcher gadgets remain, and even ARM binaries contain CFI-compatible gadgets sufficient for a one-gadget `system("/bin/sh")` exploit under a CCFIR-like policy [2007.04116].

LLVM-CFI and Reckon systematize that intuition. Both frameworks show that average-only measures obscure the real security picture because a few permissive callsites can dominate exploitability [1910.01485]. Their results consistently place strict signature- or hierarchy-based policies at the top of the ranking, but they also emphasize that even restrictive policies usually remain one-to-\(N\) mappings rather than one-to-one dispatch relations [1812.08496]. This means CFI filters must be evaluated both as **set-size reducers** and as **semantic residual spaces**: a small surviving set can still be dangerous if it contains the wrong reusable computation.

Binary-CFI adds a separate caution for binary-only deployments. There, a filter can appear stronger by simple target-count reduction while actually becoming less faithful, because it may exclude legitimate targets and keep spurious ones [2401.07148]. The paper’s overall message is that stricter abstract policies do not necessarily produce better realized filters when the analysis substrate is weak.

## 5. CFI filters in counting complexity and Weisfeiler–Leman lower bounds

In counting complexity, a CFI filter is a **quantum graph** designed to annihilate undesired homomorphism types while preserving the desired one. “Count on CFI graphs for #P-hardness” formalizes a filter \(\mathbf F\) by the condition
\[
\hom(H,\mathbf F)=
\begin{cases}
1 & H\in \mathcal G,\\
0 & H\in \mathcal F\setminus \mathcal G,
\end{cases}
\]
and exploits tensor multiplicativity,
\[
\hom(F,\mathbf G\otimes \mathbf X)=\hom(F,\mathbf G)\cdot \hom(F,\mathbf X),
\]
to remove unwanted terms from homomorphism expansions [2305.04767].

The central CFI-based construction is the two-constituent quantum graph
\[
\mathbf{X}(S)= \frac{\Gamma(S,\chi_\emptyset)-\Gamma(S,\chi_{e^*})}{2^{|E(S)|-|V(S)|+1}},
\]
built from an untwisted and a singly twisted CFI instance over a connected colorful graph \(S\) [2305.04767]. Its defining property is
\[
\hom(S,\mathbf{X}(S))=1,
\]
while graphs that are not surjectively \(S\)-colored cannot distinguish the two constituents and therefore cancel out [2305.04767]. The paper’s main algorithmic payoff is that this replaces a \(2^{|E(S)|}\) inclusion–exclusion filter by a CFI-based construction with cost \(4^{\Delta(S)}\mathrm{poly}(n,s)\), which is decisive for bounded-degree hard pattern classes [2305.04767].

“Compressing CFI Graphs and Lower Bounds for the Weisfeiler–Leman Refinements” uses CFI in a different but related filtering sense. It compresses standard CFI gadgets by an equivalence relation on base vertices, reusing gadgets while preserving the parity obstructions that hinder \(k\)-WL [2308.11970]. The resulting compressed CFI graphs remain hard enough to prove
\[
\Omega(n^{k/2})
\]
round lower bounds for \(k\)-WL, the first super-linear lower bound of that form for all \(k\) [2308.11970]. A plausible implication is that compression here acts as an information-hiding filter: only parity-consistent, compression-compatible twist motions remain visible, and WL refinement cannot quickly localize the hidden inconsistency.

## 6. Cryogenic coaxial microwave filters and other non-security usages

In low-temperature experimental physics, “CFI filters” maps directly onto a practical cryogenic filter design intended to suppress broadband electromagnetic noise on wiring into millikelvin devices [1308.6716]. The design uses **UT-020-SS-SS** semi-rigid stainless-steel coax, with a **304 stainless steel** jacket and core, **PTFE** dielectric, outer diameter \(0.508\) mm, inner diameter of outer conductor \(0.381\) mm, and inner conductor diameter \(0.114\) mm [1308.6716]. Each filter line uses **1.5 m** of coax, and **four** such lines are wrapped around a hollow copper cylinder of length **30 mm**, outer diameter **40 mm**, and wall thickness **2 mm**, then soldered along their full length for thermalization at the mixing chamber [1308.6716].

The operating principle is a distributed low-pass attenuator. Using the Zorin transmission-line model, the attenuation per unit length is written as
\[
\mathcal{A}(\omega)=20 \Re\gamma(\omega)/\ln(10),
\qquad
\gamma(\omega)=\sqrt{i\omega c (r+i\omega l)},
\]
with
\[
c=2\pi\epsilon\epsilon_{0}/\ln(d_{2}/d_{1}),
\qquad
l=\mu\mu_{0}\ln(d_{2}/d_{1})/(2\pi)
\]
and a skin-effect-dominated \(r\) [1308.6716]. For room-temperature stainless steel resistivity \(\rho_{300K}=7.19\times10^{-7}\,\Omega\,\text{m}\), the paper estimates
\[
\mathcal{A}(1\,\text{GHz})\simeq -17~\text{dB/m},
\]
hence for \(1.5\) m
\[
A(1\,\text{GHz}) \simeq -25~\text{dB},
\]
with the model expected to remain predictive up to approximately **1 THz** [1308.6716]. Measured \(S_{21}\) at **300 K** and **77 K** agrees extremely well with the model, with fitted resistivities
\[
\rho_{300K}=\left(7.22\pm0.12\right)\times10^{-7}\,\Omega\,\text{m},
\qquad
\rho_{77K}=\left(5.27\pm0.04\right)\times10^{-7}\,\Omega\,\text{m}
\]
[1308.6716].

The paper also validates the filters functionally using small underdamped Al/AlOx/Al Josephson junctions at about **15 mK**. Without the filters, the sample does **not display a supercurrent branch at \(0\) V**; with the filters, a clear **supercurrent branch** appears, the transition becomes sharp, and the low-current voltage reaches
\[
2\Delta/e \simeq 0.365~\text{mV},
\]
in agreement with theory [1308.6716]. In this literature, then, a CFI filter is an RF-noise suppressor and thermal anchor rather than a control-transfer validator.

Outside both security and cryogenic physics, the acronym becomes unstable. The variable-cutoff-frequency FIR survey explicitly treats cutoff-frequency interpolation only indirectly through interpolation/FRM, fractional-delay/Farrow, SPA, and hybrid methods rather than under a named “CFI filters” category [1804.02891]. A current-conveyor-based multifunction biquad, by contrast, is a separate analog-filter topic built from **two balanced output current conveyors**, **four resistors**, and **two grounded capacitors**, realizing LP, HP, BP, and elliptical-notch responses at a single output node [1003.1491]. These usages underscore that “CFI filters” has no universal meaning outside a clearly specified disciplinary context.

Source: https://www.emergentmind.com/topics/cfi-filters