XTRIDE: N-gram Type Inference

• XTRIDE is an n-gram-based statistical type inference system that efficiently recovers composite types and function signatures from stripped binaries with high accuracy.
• It leverages contextual token modeling and calibrated confidence scores to overcome limitations of static analysis and conventional machine learning methods.
• Optimized for large-scale reverse engineering, XTRIDE offers sub-millisecond inference and significant speedups while maintaining near state-of-the-art semantic fidelity.

XTRIDE is an n-gram-based statistical type inference system designed for efficient, high-fidelity recovery of composite types (especially C structs) and function signatures from stripped binaries. By leveraging token sequence modeling and probability calibration, XTRIDE addresses critical limitations of prior approaches in runtime performance, confidence quantification, and generalization to real-world struct layouts. The system achieves state-of-the-art accuracy and speed, enabling its practical deployment in large-scale and automated reverse engineering pipelines (Seidel et al., 9 Mar 2026).

1. Motivations and Problem Setting

Recovering type information from stripped binaries is essential for exact decompilation and practical binary reverse engineering. While primitives such as int, char, and float can often be recovered by pattern-based heuristics, composite types (user-defined structs) typically remain opaque when identifiers and debug symbols are removed by compilation. Accurate struct layout (field offsets and widths) and semantic identification are necessary for usable downstream output from decompilers such as IDA Pro and Ghidra.

Static-analysis-based methods (e.g., TIE, OSPREY, Retypd) rely on constraint solving and memory access pattern analysis, enabling shape recovery and partial field name inference; however, these approaches incur significant runtime (hundreds of seconds per binary) and often lack grounding in real-world type names. Machine-learning-based baselines, including Transformer models (DIRTY) and GNNs (TYGR), translate untyped IR to typed code with high hardware overhead (200–8,500 ms per function), and fail to recover unfamiliar struct names. LLM-driven hybrids (HyRES, TypeForge, ReSym) achieve high semantic fidelity but inflate runtimes and lack calibrated probabilistic confidence scores, limiting their integration into automated environments.

STRIDE showed that n-gram token sequence matching offers competitive accuracy at much greater speed. However, it lacks calibrated scores, is biased toward primitives, is under-optimized for dataset utilization and context ablation, and does not systematically address generalization and closed-vocabulary challenges. XTRIDE is architected to close these gaps while preserving high-throughput n-gram inference (Seidel et al., 9 Mar 2026).

2. Core Algorithmic Approach

XTRIDE treats decompiled code as a natural language: tokens extracted from decompiled binaries provide local context for predicting the type of program variables or callsite signatures. The system defines a closed vocabulary $T$ of types, encompassing both primitives and user-defined struct names.

For each variable occurrence, windows of $n$ contiguous tokens before and after (with literals normalized to <NUM>/<STR>, and callsite tokens retained in full) are concatenated and hashed for multiple chosen values of $n$ (e.g., $\{2,4,8,12,48\}$). An n-gram database stores all $(\langle \text{n-gram hash}\rangle, \text{type})$ pairs with occurrence frequencies.

The conditional probability of type $t$ given context $c$ (an n-gram) is modeled as:

$$P(t \mid c) = \frac{C(c, t) + \alpha}{C(c) + \alpha\,|T|}$$

where $C(c, t)$ counts joint occurrences in the training set, $C(c) = \sum_{u \in T} C(c, u)$, and $n$0 is a smoothing hyperparameter (set to $n$1).

For final type prediction, counts across multiple n-gram sizes and contexts are aggregated per candidate type $n$2 via:

$n$3

where $n$4 is a context-size weight (favoring higher $n$5), $n$6 is the context frequency, and $n$7 is the context diversity ($n$8).

Confidence calibration is introduced by normalizing the raw score and employing isotonic regression on held-out data, yielding a well-calibrated probability $n$9 that reflects the empirical correctness rate for that confidence. The system supports abstention—only emitting predictions when $n$0 for user-chosen thresholds $n$1, with tie-break heuristics that prefer user-defined structs in ambiguous cases.

3. Training Regimen and System Optimization

XTRIDE’s training corpus builds upon the DIRT dataset—initially comprising 75,656 binaries and 738,158 functions with DWARF ground truth—augmented to up to 300,000 binaries. Each binary is decompiled (using IDA Pro), tokenized, and processed to extract relevant n-gram contexts.

A validation-guided Pareto sweep determined that four n-gram databases with $n$2 achieved the same 15 GB database footprint as STRIDE’s 16-database setup, but with superior out-of-train accuracy (68.7% versus 65.5%). Separate indices for 32-bit and 64-bit binaries reduce architectural false positives.

XTRIDE leverages aggressive I/O and serialization optimizations: Rust’s rkyv library enables rapid (560 ms cold start) memory-mapped I/O for the 15 GB n-gram DB, supporting thread-safe parallel queries and $n$3 lookup per context.

Key hyperparameters include:

• Smoothing factor $n$4
• Top-$n$5 contexts per variable/query
• Linearly increasing weights $n$6 with $n$7
• Diversity $n$8
• Confidence thresholds $n$9

4. Empirical Evaluation and Comparative Performance

4.1 Type Inference Accuracy and Runtime

On the DIRT evaluation: | System | Overall | In-Train | Out-Train | ms/func | |----------------|---------|-----------|-----------|-----------| | DIRTY [20] | 75.8% | 89.9% | 56.4% | 200–8,500 | | STRIDE (repl) | 85.1% | 98.5% | 65.5% | 8.2 | | XTRIDE | 90.15% | 98.26% | 68.66% | 0.04 |

XTRIDE achieves an overall improvement of +5.09 pp over STRIDE and +14.35 pp over DIRTY, while being 200×–100,000× faster than Transformer-based baselines.

4.2 Struct Recovery in Real Binaries

Field-level layout and full-match rates on representative software (coreutils, wget, grep, gzip, lighttpd, as in HyRES [12]):

System	Id-F1	Layout-F1	Full-Match
HyRES [12]	0.891	0.795	–
TypeForge	0.556	0.555	0.201
XTRIDE	0.329	0.768	0.742
XTRIDE₊	0.807	0.944	0.943

Base XTRIDE (without test-set grounding) achieves layout-F1 = 0.768 and 74.2% full struct matches, outperforming TypeForge and closely approaching the semantic fidelity of HyRES at a fraction of runtime. XTRIDE₊ (16 databases, with in-environment samples) achieves layout-F1 = 0.944 and 94.3% full matches.

4.3 Runtime

Per-binary median runtime comparison shows speedups over static-analysis and LLM-based systems:

Program	HyRES	TypeForge	XTRIDE	XTRIDE₊
wget	719 s	21.4 s	0.13 s	0.31 s
lighttpd	499 s	240.8 s	0.36 s	0.89 s
grep	293 s	63.5 s	0.19 s	0.47 s
gzip	148 s	24.9 s	0.13 s	0.33 s
coreutils	189 s	9.2 s	0.05 s	0.08 s

XTRIDE provides 70×–2,300× speedups over static analysis/LLM hybrids, even when LLM post-passes are included.

4.4 Confidence Thresholding

Adjusting the threshold $\{2,4,8,12,48\}$0 allows control over coverage and error rates:

• $\{2,4,8,12,48\}$1: 100% coverage, 15.3% var-risk, 8.9% struct-risk
• $\{2,4,8,12,48\}$2: 77.0% coverage, 3.6% var-risk, 3.0% struct-risk
• $\{2,4,8,12,48\}$3: 47.8% coverage, 2.4% var-risk, 2.2% struct-risk

This enables deployment trade-offs between automation and reliability.

5. Function Signature Recovery

XTRIDE’s n-gram method generalizes to infer function signatures. By treating the function name as the prediction target at call-sites and aggregating the evidence for each function address, the system constructs likely function signatures (including parameter types).

• On DIRT (stripped): 78.97% of calls to known functions are correctly labeled at $\{2,4,8,12,48\}$4.
• Embedded firmware (STM32 HAL case study): Average precision across three ARM firmware samples is 51.5%, recall 37.4%, F1 43.1%. This level of precision, with modest recall, enables efficient triage of “hook-worthy” HAL/MMIO functions, significantly reducing manual analysis in rehosting and fuzzing workflows.

6. Design Implications, Limitations, and Future Directions

XTRIDE achieves the highest ratio of fully-correct struct layouts to date by leveraging closed-vocabulary prediction: once a struct is correctly recognized, the predicted layout matches ground truth, obviating the need for post-hoc struct name mapping. Training corpus scale and selective diversity in context lengths contribute more to accuracy than simply increasing the number of n-gram databases.

Well-calibrated probability scores support abstentions, which is essential for mitigating error propagation in automated pipelines. The system’s architecture yields sub-millisecond, per-function inference, enabling its deployment in CI/CD and continuous large-scale binary analysis.

Limitations include the inability to infer entirely out-of-vocabulary types, dependence on training–target environment similarity, and degraded performance under bit-level structural changes due to novel compiler optimizations. Structural generalization and open-world coverage are fundamental areas for improvement.

Potential future directions for XTRIDE encompass semi-supervised expansion of the vocabulary using high-confidence unknowns, tighter integration with static constraint solvers for difficult cases, and cross-architecture transfer learning (e.g., x86 to ARM).

7. Position in the Research Landscape

XTRIDE establishes a unique operational point in type-inference system design. By combining n-gram-based token modeling and rigorous calibration, it delivers near-state-of-the-art layout and semantic fidelity with unprecedented scalability. It bypasses the hardware demands and uncalibrated uncertainties of learning-based and hybrid methods, proving especially suitable for partially known binary environments where practical, continuous recovery of composite types and function signatures is required (Seidel et al., 9 Mar 2026).