Compile–Trace–Filter Framework

• CTF is a framework that defines compiler correctness by relating source and target traces through configurable trace relations and filters.
• It addresses semantic mismatches such as undefined behavior, resource exhaustion, and side channels with precise filtering mechanisms.
• CTF enables systematic property preservation between source and target domains, thus supporting secure compilation through trace mapping.

The Compile–Trace–Filter (CTF) framework provides a generalized and parametric approach to compiler correctness and secure compilation for settings in which the set of traces produced by the source language and the target language differ in structure or granularity. Instead of requiring trace equality, as in classical trace-inclusion definitions, CTF makes explicit how a compiler can remain correct by relating source and target traces through an arbitrary trace relation, and by using an associated filter to connect target traces back to source trace semantics. This methodology accommodates a range of semantic mismatches, including undefined behavior, resource exhaustion, differing trace alphabets, and (computational) side-channels (Abate et al., 2019).

1. Core Components of the CTF Framework

CTF analysis is anchored in the following core elements:

• Source and Target Traces: A source language is associated with a set of traces $\mathit{Trace}_S$, and the compiled target language with traces $\mathit{Trace}_T$.
• Trace Relation $R$: A relation $$R \subseteq \mathit{Trace}_S \times \mathit{Trace}_T$$ links possible source executions with corresponding target executions, potentially permitting translations that introduce or filter events (e.g., markers for undefined behavior).
• Compiler and Semantics: The compiler $$\downarrow : \mathit{Program}_S \to \mathit{Program}_T$$ is equipped with operational semantics for both languages, $\langle P \rangle_S \Downarrow s$ for the source and $\langle P \rangle_T \Downarrow t$ for the target, where $s \in \mathit{Trace}_S$, $t \in \mathit{Trace}_T$.
• Filter $F$: For each target trace $t$, the filter $F$ returns all source traces $s$ such that $(s, t) \in R$.

The CTF pipeline is therefore: $$P_{src} \xrightarrow{\downarrow} P_{tgt} \xrightarrow{F} \text{source trace candidates}$$.

2. Generalized Compiler Correctness via Trace Relations

Classical compiler correctness is often defined by trace inclusion: every trace of the compiled program must be a trace of the original program, which presumes that the trace sets of source and target are identical. The CTF framework generalizes this through:

Definition 1 (Trace-Relating Filter Relation):

A CTF relation is any $$R \subseteq \mathit{Trace}_S \times \mathit{Trace}_T$$.

Definition 2 (CTF-Correctness):

The compiler $\downarrow$ is $R$-correct if for all source programs $P$ and for every $t \in \mathit{Trace}_T$,

$$\langle \downarrow P \rangle_T \Downarrow t \implies \exists s \in \mathit{Trace}_S. (s, t) \in R \wedge \langle P \rangle_S \Downarrow s$$

This asserts that every target trace for a compiled program corresponds, under $R$, to a source trace for the original program.

3. Property Preservation and Transformation

CTF theory provides systematic tools for lifting properties between source and target trace domains using $R$:

• Existential Image $\tau$:

Given a property $\Pi_S \subseteq \mathit{Trace}_S$, the corresponding set of target traces is

$$\tau(\Pi_S) = \{\, t \in \mathit{Trace}_T \mid \exists s \in \Pi_S .\, (s, t) \in R \,\}$$

This captures the set of traces that "come from" some source trace satisfying $\Pi_S$.

• Universal Image $\sigma$:

For a target property $\Pi_T \subseteq \mathit{Trace}_T$,

$$\sigma(\Pi_T) = \{\, s \in \mathit{Trace}_S \mid \forall t .\, (s, t) \in R \Rightarrow t \in \Pi_T \,\}$$

This is the set of source traces all whose $R$-related target traces lie in $\Pi_T$.

These two maps are adjoint: $\tau \dashv \sigma$, forming a Galois connection with respect to set inclusion.

The filter $F(t) = \{s \mid (s, t)\in R\}$ can be viewed as the pointwise preimage of $\tau$.

4. Handling Semantic Mismatches via CTF

CTF is designed to account explicitly for differences between trace alphabets. For example:

• Undefined Behavior (UB): Let $UB \in \mathit{Evt}$ be a special undefined-behavior event. Define

$$(s, t) \in R_{UB} \Longleftrightarrow t = s \ \text{or}\ \exists m.\ s = m \cdot UB \wedge m \leq t$$

The filter $F_{UB}(t)$ removes everything after the first $UB$ event in the source, so any arbitrary continuation after UB in the target is "dropped."

• Resource Exhaustion: For $EXH \notin \mathit{Evt}_S$,

$$(s, t) \in R_{EXH} \Longleftrightarrow s = t \ \text{or}\ \exists m.\ m \leq s \wedge t = m \cdot EXH$$

Here, $F_{EXH}$ returns the maximal source prefix corresponding to an out-of-memory target trace.

• Side Channels: If $$\mathit{Trace}_T = (\mathit{Trace}_S \times \mathbb{N})$$, $R_{time}$ can specify $(s, (s', \tau)) \in R_{time} \iff s = s'$, and $F_{time}$ simply projects away the timing information $\tau$.

CTF thereby provides a rigorous mechanism for formally relating and filtering semantic artifacts that arise during compilation.

5. Concrete Example: Filtering Side-Channel Metadata

Consider a simple source language with input-output semantics. Suppose a source program $$P = \text{input}(x); \text{if}\ x>0\ \text{then}\ \text{output}(1)\ \text{else}\ \text{output}(0)$$ produces traces $s_1 = [(i,0), (o,0)]$ and $s_2 = [(i,1), (o,1)]$.

Suppose the compiler emits an extra secret-tag event $secret\_ok$ before each output:

• $$\downarrow P \Downarrow t_1 = [(i,0), (secret\_ok), (o,0)]$$
• $$\downarrow P \Downarrow t_2 = [(i,1), (secret\_ok), (o,1)]$$

Define $R_{secret}$ such that $(s, t) \in R_{secret}$ iff $t$ with all $secret\_ok$ events deleted equals $s$. The filter $F(t_i) = \{s_i\}$ projects away the secret-ok tags, enabling property transfer even in the presence of such metadata.

6. Central Theorems and Robustness

The main theorems underpinning CTF establish the equivalence between $R$-correctness and property preservation:

Theorem 4 (CTF-Correctness $\Leftrightarrow$ Property Preservation):

Let $$R \subseteq \mathit{Trace}_S \times \mathit{Trace}_T$$ with Galois connection $(\tau, \sigma)$. The following are equivalent:

• a) CTF-correctness relative to $R$
• b) Source-to-target trace-property preservation ($$\forall \Pi_S.\ \forall P.\ P \models \Pi_S \implies \downarrow P \models \tau(\Pi_S)$$)
• c) Target-to-source trace-property reflection ($$\forall \Pi_T.\ \forall P.\ P \models \sigma(\Pi_T) \implies \downarrow P \models \Pi_T$$)

Moreover, corollaries transfer safety properties through safety-closure and image operators. CTF robustly generalizes to secure compilation in the presence of adversarial linking contexts.

7. Algorithmic Realization of the CTF Filter

Given a relation on events $$R_{evt} \subseteq \mathit{Evt}_S \times \mathit{Evt}_T$$, the filter $F$ operates by searching for all source traces $s$ such that, proceeding eventwise along a target trace $t_T$, the pair $(s, t_T[0..n]) \in R_{eventwise}$ for all $n$. In many cases a deterministic event-filter $$f_{evt} : \mathit{Evt}_T \to (\mathit{Evt}_S + \bot)$$ suffices, so that $s = \text{map-while-just}(f_{evt})(t_T)$ computes the source projection by dropping any $T$-event mapped to $\bot$ and mapping the rest to the appropriate $S$-event (Abate et al., 2019).

Summary Table: CTF Key Concepts

Component	Role	Example
Trace Relation $R$	Relate source and target traces	$R_{UB}, R_{EXH}, R_{secret}$
Filter $F$	Recovers source traces from a target trace	Removes UB suffixes, OOM markers, or secret tags
Existential Image $\tau$	Lifts source properties to target trace properties	Allows secret tags without breaking output property
Universal Image $\sigma$	Reflects target properties to source preconditions	Dually computes sufficient source properties

The CTF framework, as introduced by Abate et al., systematizes reasoning about trace-relating compiler correctness, clarifies property preservation under trace transformations, and provides robust abstractions for secure compilation in the presence of observable semantic mismatches (Abate et al., 2019).