Minimally Invasive Alterations (MIA)

• Minimally Invasive Alterations (MIA) are interventions that modify only the minimal necessary region while preserving overall system invariants across domains.
• In ARM binary patching and surface-code error correction, MIA techniques localize changes to maintain control flow, ABI, and operational schedules with quantifiable metrics.
• MIA is applied in multi-robot navigation and clinical robotics to ensure safety and efficiency by constraining perturbations while achieving effective functional corrections.

Minimally Invasive Alterations (MIA) is a label used in several recent technical literatures for interventions that are deliberately local, structure-preserving, and constraint-aware. In ARM binary patching, MIA denotes patching only what is necessary to remove a known vulnerability while preserving the rest of the binary’s behavior, layout, and interfaces. In surface-code quantum error correction, it denotes local reductions or splits of syndrome-extraction circuits around dead components while keeping the native operation set and global schedule unchanged. In decentralized multi-robot control, it denotes minimal perturbation of an agent’s speed profile while avoiding spatial detours. In a clinical robotics usage, it denotes local tissue alteration and instrument delivery in narrow lumens without the conventional “push” approach (Jänich et al., 16 Oct 2025, Mishmash et al., 6 Aug 2025, Gouru et al., 2024, Jeon et al., 26 Feb 2025).

1. Conceptual scope

MIA is not a single algorithm or domain-specific standard. The cited literature uses the same phrase for a recurring design logic: intervene only where a defect, conflict, or obstruction appears, and preserve the surrounding system as far as possible. The preserved object differs by domain: a binary’s ABI and layout, a surface code’s schedule and gate set, a robot’s desired path, or a minimally invasive clinical access route.

Domain	Local alteration	Preserved structure
ARM binary patching	Reassemble only the smallest region that differs between vulnerable and fixed functions	Behavior, layout, interfaces, ABI, GOT-relative positioning
Surface code	Reduce or split only the n-gons touching dead components	Native operation set, global four-step schedule, rest of the code
Multi-robot navigation	Modulate speed to yield or pass	Desired spatial path, decentralized execution
Luminal medical robotics	Perform local electrocauterization and deliver instruments in situ	Avoids conventional pushing through sharp angles

This suggests that MIA is best understood as a locality principle with explicit invariants. The intervention is not merely small in size; it is constrained so that global semantics, scheduling assumptions, or physical access patterns remain stable. The literature also makes clear that “minimally invasive” does not mean “zero change.” In all four settings, a nontrivial alteration is still performed, but it is confined to the smallest well-delimited region or degree of freedom judged necessary (Jänich et al., 16 Oct 2025, Mishmash et al., 6 Aug 2025, Gouru et al., 2024, Jeon et al., 26 Feb 2025).

2. Binary-level MIA in ARM firmware patching

In "Match & Mend: Minimally Invasive Local Reassembly for Patching N-day Vulnerabilities in ARM Binaries" (Jänich et al., 16 Oct 2025), MIA is defined as patching only what is necessary to remove a known vulnerability while preserving the rest of the binary’s behavior, layout, and interfaces. The target setting is low-cost IoT devices running Linux/ARMv7 with outdated open-source libraries and poor update hygiene, under the assumption that the vulnerable library version is identifiable, public patched source code is available, the affected function can be identified, and firmware update or installation is feasible.

The central mechanism is minimally invasive local reassembly. The system takes a vulnerable ARM32 ELF library from firmware, a self-compiled patched version of the library from public source, and the affected function name. If symbols exist, the function is resolved by name; if stripped, angr’s BinDiff-like matching is used. angr then constructs an interprocedural CFG with CFGFast, and for the affected functions a precise intraprocedural CFG with CFGEmulated plus a DDG. Basic blocks are compared across vulnerable and fixed versions. A “perfect match” is defined as identical opcode and operand sequences modulo absolute addresses. The patch window extends from the first non-matching basic block to the last non-matching basic block, inclusive, with matched blocks inside that interval retained when necessary to preserve control-flow continuity.

The MIA invariants are explicit. Outside the patched region, control-flow edges, including indirect fall-through, remain unchanged. ABI compatibility is preserved at function boundaries, including the function signature, calling convention, and caller-callee relationships. Critical runtime structures such as the GOT remain at the same relative load distance. PC-relative code and data references are retargeted so that their semantics remain equivalent after relocation, with Thumb PC semantics observed. These design choices are formalized through cost functions that minimize rewritten instructions, binary growth, and graph perturbation:

$$J_{\mathrm{ins}} = |I_{\mathrm{patched}}|,\qquad J_{\mathrm{size}} = \Delta \mathrm{size},\qquad J_{\mathrm{cfg}} = |E_{\mathrm{altered}}|,$$

with combined objective

$$J = \alpha \cdot |I_{\mathrm{patched}}| + \beta \cdot \Delta \mathrm{size} + \gamma \cdot |E_{\mathrm{altered}}|.$$

The mend phase operationalizes these invariants. Patch space is created by extending the first executable load segment without changing runtime relative distances to the GOT, or by adding a new .patch section. A branch is inserted at the start of the function’s patch window to redirect control to the new patch region while preserving the original function identity and entry point. The algorithm uses AdjustReference(), ReplaceDest(), Reassemble(), BackwardSlice(), Solve(), WriteData(), and LoadDataFrom() to manage ARM/Thumb instruction-size changes, literal pools, matched and unmatched control destinations, matched and unmatched data references, and alignment.

The evaluation is correspondingly local and operational. On MAGMA ARM builds, 36 vulnerabilities across LibPNG, LibTIFF, LibXML2, and OpenSSL were compiled under O1/O2/O3, producing 108 vulnerable binaries; 90 of 108 were patched successfully, with success rate $S_{\mathrm{MAGMA}} = 90/108 \approx 0.83$. For the 39 cases with PoV inputs, 29 passed, giving $S_{\mathrm{PoV}} = 29/39 \approx 0.74$. Average patching time was approximately 14 minutes per binary. On 30 KARONTE firmware images, 131 vulnerable library instances were targeted and 126 were successfully patched, with $S_{\mathrm{firmware}} = 126/131 \approx 0.962$. Patch sizes were typically 5–46 KiB versus library sizes 65–850 KiB, with one outlier due to debug info. Reported failures arose from mismatched function identification, backward-slicing limitations on stack data flow, or angr failing to build an interprocedural CFG (Jänich et al., 16 Oct 2025).

3. Surface-code MIA and superstabilizer construction

In "Excising dead components in the surface code using minimally invasive alterations: A performance study" (Mishmash et al., 6 Aug 2025), MIA is a superstabilizer-based strategy for excising dead components from the surface code by locally reducing or splitting standard n-gon syndrome-extraction circuits while keeping the rest of the code unchanged. Dead components include defective data qubits, auxiliary qubits, and non-functioning couplers. The scheme is studied for the pairwise-measurement-based “3aux” surface code under circuit-level noise and is explicitly designed to satisfy three criteria: it uses the same native operation set as the defect-free parent protocol, maximizes salvaging of functional components, and maintains a consistent global operating schedule.

The code is represented as a tiling of local n-gon circuits: bulk 4-gons measure 4-qubit plaquette stabilizers and boundary 2-gons measure 2-qubit boundary stabilizers. When a data qubit is dead, the affected 4-gon is reduced to a 3-gon measuring the same Pauli type over the remaining data qubits. When necessary, 1-gons are introduced through direct mid-circuit readout of a data qubit to heal adjacent checks in subsequent rounds. When an auxiliary qubit or a connection is dead, the 4-gon circuit is split into smaller circuits, such as two 3-gons, that measure local gauge operators whose products infer the original plaquette’s superstabilizer. The same reduction and splitting logic is applied at boundaries; the paper emphasizes that the code heals naturally in time without ad hoc boundary deformation.

The stabilizer description is correspondingly local. For plaquette $p$ with neighborhood $N(p)$, the original stabilizers are

$$Z_p = \bigotimes_{i \in N(p)} Z_i,\qquad X_p = \bigotimes_{i \in N(p)} X_i.$$

Under MIA with one dead data qubit $j \in N(p)$, the reduced check becomes

$$\widetilde{Z}_p = \bigotimes_{i \in N(p)\setminus\{j\}} Z_i,$$

and similarly for $$J = \alpha \cdot |I_{\mathrm{patched}}| + \beta \cdot \Delta \mathrm{size} + \gamma \cdot |E_{\mathrm{altered}}|.$$0-type checks. With a dead auxiliary in a bulk 3aux 4-gon, the local generators are replaced by gauge-like checks $$J = \alpha \cdot |I_{\mathrm{patched}}| + \beta \cdot \Delta \mathrm{size} + \gamma \cdot |E_{\mathrm{altered}}|.$$1 whose product reconstructs the corresponding superstabilizer, schematically

$$J = \alpha \cdot |I_{\mathrm{patched}}| + \beta \cdot \Delta \mathrm{size} + \gamma \cdot |E_{\mathrm{altered}}|.$$2

Away from defects, the modified stabilizer set satisfies $$J = \alpha \cdot |I_{\mathrm{patched}}| + \beta \cdot \Delta \mathrm{size} + \gamma \cdot |E_{\mathrm{altered}}|.$$3.

A second contribution concerns automatic detector-basis construction directly from circuits. Measurement outcomes $$J = \alpha \cdot |I_{\mathrm{patched}}| + \beta \cdot \Delta \mathrm{size} + \gamma \cdot |E_{\mathrm{altered}}|.$$4 are assembled into binary checks

$$J = \alpha \cdot |I_{\mathrm{patched}}| + \beta \cdot \Delta \mathrm{size} + \gamma \cdot |E_{\mathrm{altered}}|.$$5

The pipeline computes the outcome code of a prior/noisy/posterior circuit triple using the outcome-complete simulation algorithm of Ref. [Kliuchnikov 2023], forms the check matrix $$J = \alpha \cdot |I_{\mathrm{patched}}| + \beta \cdot \Delta \mathrm{size} + \gamma \cdot |E_{\mathrm{altered}}|.$$6 and logical-effect matrix $$J = \alpha \cdot |I_{\mathrm{patched}}| + \beta \cdot \Delta \mathrm{size} + \gamma \cdot |E_{\mathrm{altered}}|.$$7, then seeks a graph-like basis through graph realization using the Bixby–Wagner algorithm, followed by hyperedge splitting and decoding with PyMatching. A weighted hypergraph union-find decoder is also studied for runtime and performance trade-offs.

The performance study emphasizes how “minimal invasiveness” affects effective distance and logical error rate. For $$J = \alpha \cdot |I_{\mathrm{patched}}| + \beta \cdot \Delta \mathrm{size} + \gamma \cdot |E_{\mathrm{altered}}|.$$8 with one dead qubit, MIA and Auger coincide for a dead data qubit, but for a dead A/C auxiliary MIA reduces distance by 1 for only one logical observable while Auger reduces distance by 2 for both, and for a dead B auxiliary MIA keeps distance unchanged while Auger reduces distance by 2 for both. Under many-dead-qubit sampling with independent failure probabilities $$J = \alpha \cdot |I_{\mathrm{patched}}| + \beta \cdot \Delta \mathrm{size} + \gamma \cdot |E_{\mathrm{altered}}|.$$9, MIA produced tight interquartile bands and medians near the defect-free curves even at $S_{\mathrm{MAGMA}} = 90/108 \approx 0.83$0, whereas Auger degraded rapidly. For $S_{\mathrm{MAGMA}} = 90/108 \approx 0.83$1, MIA formed a logical qubit in all 504 tested configurations; for $S_{\mathrm{MAGMA}} = 90/108 \approx 0.83$2, in all 509 tested configurations. At $S_{\mathrm{MAGMA}} = 90/108 \approx 0.83$3 and $S_{\mathrm{MAGMA}} = 90/108 \approx 0.83$4, the reported scatter plots show up to four-to-five orders of magnitude reduction in logical error rate relative to Auger in configurations where Auger is not error-correcting. The paper also reports that weighted hypergraph union-find can improve median $S_{\mathrm{MAGMA}} = 90/108 \approx 0.83$5 by a factor of two to three, with up to approximately $S_{\mathrm{MAGMA}} = 90/108 \approx 0.83$6 improvement in the top of the 95% band, at roughly 20% runtime increase in the deep sub-threshold regime (Mishmash et al., 6 Aug 2025).

4. MIA as minimally perturbative control in constrained multi-robot navigation

In "LiveNet: Robust, Minimally Invasive Multi-Robot Control for Safe and Live Navigation in Constrained Environments" (Gouru et al., 2024), MIA denotes minimal alteration of an agent’s speed profile in congested spaces such as doorways, narrow halls, and corridor intersections. The preserved object is the desired spatial path. The paper explicitly contrasts this with highly invasive trajectory changes and formalizes minimal invasiveness through near-zero spatial deviation from the preferred trajectory and minimal velocity perturbations.

Each agent has a preferred trajectory $S_{\mathrm{MAGMA}} = 90/108 \approx 0.83$7 and control sequence $S_{\mathrm{MAGMA}} = 90/108 \approx 0.83$8 that it would follow in isolation. In a Social Mini-Game, preferred spatiotemporal trajectories intersect, so the realized trajectories $S_{\mathrm{MAGMA}} = 90/108 \approx 0.83$9 must be minimally perturbed under safety and liveness constraints. The paper states the quantitative conditions as

$S_{\mathrm{PoV}} = 29/39 \approx 0.74$0

Experimentally, invasiveness is measured by $S_{\mathrm{PoV}} = 29/39 \approx 0.74$1 as average change in velocity and $S_{\mathrm{PoV}} = 29/39 \approx 0.74$2 as average spatial deviation.

The safety and liveness mechanism is a unified CBF formulation embedded in a neural-network-driven QP. Safety uses a distance barrier

$S_{\mathrm{PoV}} = 29/39 \approx 0.74$3

with a higher-order CBF inequality because the system has higher relative degree with respect to control. Liveness is expressed as time ordering at a potential collision point $S_{\mathrm{PoV}} = 29/39 \approx 0.74$4, with

$S_{\mathrm{PoV}} = 29/39 \approx 0.74$5

where $S_{\mathrm{PoV}} = 29/39 \approx 0.74$6 if the ego agent is faster and should pass, and $S_{\mathrm{PoV}} = 29/39 \approx 0.74$7 if it is slower and should yield. Safety and liveness are enforced jointly by solving a QP over $S_{\mathrm{PoV}} = 29/39 \approx 0.74$8 that minimizes deviation from a learned reference control $S_{\mathrm{PoV}} = 29/39 \approx 0.74$9 while satisfying both barrier inequalities and box constraints on the inputs.

The architectural point is that minimal invasiveness is realized primarily through acceleration modulation rather than heading change. The network has a shared feedforward backbone with three heads: one predicts $S_{\mathrm{firmware}} = 126/131 \approx 0.962$0, one predicts obstacle HOCBF penalties $S_{\mathrm{firmware}} = 126/131 \approx 0.962$1, and one predicts the liveness penalty $S_{\mathrm{firmware}} = 126/131 \approx 0.962$2. These are passed to a differentiable QP layer based on OptNet. The training data come from a tuned receding-horizon MPC that implements the barrier functions across perturbed doorway and intersection scenarios.

The reported results make the term operational. In the doorway setting over 50 runs, LiveNet achieved 0 collisions, 0 deadlocks, makespan 13.8 s, $S_{\mathrm{firmware}} = 126/131 \approx 0.962$3 m/s, $S_{\mathrm{firmware}} = 126/131 \approx 0.962$4 m, and cycle time 7.5 s. SMG-CBF also achieved 0 collisions and 0 deadlocks, but with $S_{\mathrm{firmware}} = 126/131 \approx 0.962$5 m/s and cycle time 81.1 s. In the intersection setting, LiveNet achieved 0 collisions, 0 deadlocks, makespan 11.6 s, $S_{\mathrm{firmware}} = 126/131 \approx 0.962$6 m/s, $S_{\mathrm{firmware}} = 126/131 \approx 0.962$7 m, and cycle time 9.3 s, whereas SMG-CBF reported 12.2 s makespan and 157.0 s cycle time. MPC-CBF reached safety but deadlocked, while MACBF, PIC, and BarrierNet collided. Across 28 perturbed doorway variants, LiveNet solved 25 without collision or deadlock, compared with 16 for SMG-CBF with fixed parameters (Gouru et al., 2024).

5. MIA-enabled intervention in luminal medical robotics

In "A convoy of magnetic millirobots transports endoscopic instruments for minimally-invasive surgery" (Jeon et al., 26 Feb 2025), the paper itself centers on TrainBot, a convoy of magnetic crawling millirobots for transporting endoscopic instruments. The supplied technical synthesis casts this as enabling MIA in a clinical sense: local tissue alteration and instrument delivery within constrained lumens without the conventional “push” approach. The target anatomy is the intestine and bile duct, and the main demonstration is electrocauterization to relieve biliary obstruction.

TrainBot consists of millimeter-scale units actuated by a rotating external magnetic field. Each unit measures $S_{\mathrm{firmware}} = 126/131 \approx 0.962$8 and uses two cylindrical NdFeB permanent magnets and molybdenum feet with four sharp spikes. Up to three units are spaced along a common wire or catheter and convoy it forward via simultaneous actuation; they are not mechanically linked, and spacing is maintained by stoppers on the instrument. The feet were optimized over spike angles $S_{\mathrm{firmware}} = 126/131 \approx 0.962$9. On a 3.4 wt% gelatin hydrogel phantom, measured propulsive force increased from 0.27 mN without feet to 0.93 mN with $p$0, a $p$1 increase. The convoy then amplified maximal propulsive force sublinearly: two units gave $p$2 the single-unit maximal force, and three units gave $p$3.

The actuation platform is human-scale. A permanent magnet setup provides an accessible volume of $p$4 and a central working space of approximately $p$5. The paper models the field by the ideal dipole expression

$p$6

with moments computed by

$p$7

The reported central static flux density is approximately 4.7 mT and the rotating field maximum approximately 3.6 mT in the crawling demonstration, with field gradients below 0.06 T/m in the central working zone during a full cycle. Measured velocity scales linearly over 0.17–1.7 Hz, reaching 0.4–4.2 mm/s.

The clinical demonstration used a 3-unit convoy to transport an electrical wire of outer diameter 0.35 mm, length 250 mm, and mass 70 mg through ex vivo porcine bile duct tissue. A piece of chicken breast sutured inside the duct mimicked biliary stenosis. The convoy delivered the electrocautery wire through the duodenoscope tool channel to the obstruction, oriented the electrode, and progressively created a patent opening large enough to pass a soft catheter for drainage or drug delivery. The paper reports qualitative success but does not report quantitative tunnel diameter, flow rates, thermal dosimetry, or histology.

The MIA interpretation here is procedural rather than formal. The alteration is localized to the obstructing tissue, while access is maintained through narrow lumens using small-scale mobile actuators rather than forceful advancement of larger tools. The authors also note limitations directly relevant to this interpretation: demonstrations are ex vivo; local closed-loop control and per-robot addressability are not implemented; NdFeB and mu-metal are not biocompatible without coating; and quantitative thermal safety data are not reported (Jeon et al., 26 Feb 2025).

6. Shared invariants, evaluation strategies, and limits

Across these uses, MIA consistently couples a local intervention with a preserved global invariant. In binary patching, the invariant is unchanged control-flow edges outside the patched region, preserved ABI compatibility, and preserved relative positioning of runtime structures such as the GOT (Jänich et al., 16 Oct 2025). In the surface code, the invariant is the same native operation set and the same pipelined four-step schedule, with damaged and undamaged stabilizers effectively measured every round (Mishmash et al., 6 Aug 2025). In LiveNet, the invariant is the desired spatial path and decentralized execution without inter-agent communication (Gouru et al., 2024). In the TrainBot setting, the invariant is minimally invasive access through narrow lumens while reducing reliance on pushing flexible instruments through sharp anatomical junctions (Jeon et al., 26 Feb 2025).

The evaluation regimes also reveal what each field means by “minimal.” Binary patching makes minimality explicit through rewritten-instruction count, added footprint, and altered control-flow edges. LiveNet measures it empirically through $p$8 and $p$9. Surface-code MIA does not reduce to a single scalar cost, but its performance study evaluates the consequence of local reductions and splits on logical distance, logical error rate, detector graphicness, and decoder runtime. The TrainBot work evaluates minimality indirectly through traction, convoy force amplification, accessible workspace, and the ability to accomplish electrocautery and catheter delivery in ex vivo ducts.

A recurrent misconception is that MIA implies no loss or no trade-off. The cited work does not support that reading. In Match & Mend, matched basic blocks may still be included within the patch window to preserve continuity, and failures arise from function-identification mismatches or slicing limitations. In the surface code, MIA can still reduce distance by one in specific dead-component cases, even though it generally outperforms Auger. In LiveNet, minimal invasiveness is not identical to zero deviation: the doorway results report $N(p)$0 m rather than exact zero. In the TrainBot study, the minimally invasive interpretation is constrained by ex vivo validation and the absence of thermal dosimetry or histology.

A plausible implication is that MIA is most effective when the defective or contested region is already localized and the system exposes a mechanism for local recompilation, reassembly, re-scheduling, or actuation. That condition is explicit in all four settings: an affected function identified from CVE sources, dead components identified during bring-up or computation, nearby agents sensed in a constrained interaction, or an obstruction localized within a bile duct. Under those conditions, the literature treats minimal invasiveness not as a rhetorical adjective but as an engineering discipline: preserve global semantics, alter only the necessary local structure, and quantify the residual perturbation (Jänich et al., 16 Oct 2025, Mishmash et al., 6 Aug 2025, Gouru et al., 2024, Jeon et al., 26 Feb 2025).