Edit Readme for clarity and style

#3
Files changed (1) hide show
  1. README.md +27 -47
README.md CHANGED
@@ -9,14 +9,14 @@ tags:
9
  ---
10
 
11
  # Model Description
12
- ASMTransformers is a project to train and use a machine learning model to compare assembly (arm, amd, risc-v, i386) functions to a database of known functions,
13
- to aid in the process of reverse engineering.
14
 
15
  # Status
16
  Not actively maintained after publishing
17
 
18
  # Relevant links
19
- * [Github repo ASMtransformers](https://github.com/NetherlandsForensicInstitute/asmtransformers)
20
 
21
  # Version
22
  2026-08-06
@@ -30,20 +30,15 @@ nor has it been tested on other downstream tasks.
30
 
31
  # Architecture description
32
 
33
- This model has been trained similarly to [Wang et al.](https://arxiv.org/pdf/2205.12713). We did diverge somewhat from Wang et al. their approach, since our BERT model is trained multilingual.
34
- We also experimented with different training parameters during the Masked Language Modelling (MLM). For example, we set the
35
- --mlm-prob parameter to 0.4 in accordance to [Wettig et al., 2023](https://aclanthology.org/2023.eacl-main.217.pdf). We have done some experiments with different mlm-probs
36
- (namely 0.15, 0.3 and 0.4) and found that 0.4 yielded the best results.
37
 
38
- One remarkable aspect of [Wang et al.](https://arxiv.org/pdf/2205.12713)'s paper, was that they came up with the concept of "Jump target prediction". As part of the
39
- MLM procedure, the model also has to predict jump targets: whenever there is a jump in the code, the model shouldn't only predict it to be a
40
- jump instruction, but it should also predict to which line of code it's supposed to jump. The idea is that this leads to better understanding of the long-term relations
41
- in the code, and as Wang et al yielded good results, we have adopted it.
42
 
43
- Finetuning happens based on triplet loss: given three functions, of which two are similar (see also [Data](https://huggingface.co/NetherlandsForensicInstitute/Multilingual-ASMBERT/blob/main/README.md#data)) and one is deviant, the model has to pick which two functions
44
- are similar to each other. We used [Batched Semi Hard Triplet Loss](https://sbert.net/docs/package_reference/sentence_transformer/losses.html#batchsemihardtripletloss) to
45
- ensure that the training task is not too easy.
46
 
 
 
47
 
48
  **Estimated training time:**
49
 
@@ -70,8 +65,6 @@ finetuning: 4 hours on 1 NVIDIA H200
70
  ]
71
  ```
72
 
73
- **Pretraining parameters used:**
74
-
75
  ```
76
  {
77
  "architectures": [
@@ -99,7 +92,7 @@ finetuning: 4 hours on 1 NVIDIA H200
99
  }
100
  ```
101
 
102
- **Preraining parameters used:**
103
 
104
  ```
105
  {
@@ -113,21 +106,20 @@ finetuning: 4 hours on 1 NVIDIA H200
113
  }
114
  ```
115
 
116
-
117
  # Output
118
- The model outputs embeddings of size 768 that can be compared using cosine similarity
119
 
120
  # Data
121
- The dataset is built on the official [Debian Repository](https://wiki.debian.org/DebianRepository). To obtain multiple families of
122
- assembly, we used `apt` to cross-build the same source package to multiple architectures. The idea is that this gives us
123
- the same functions for all four architectures. For all four architectures, these functions are compiled with different optimisation:
124
- O0, O1, O2, O3, Os and manually selected set with advanced instructions further referenced here as Oc for Optimised-Custom.
125
- This results in a maximum of 24 (6 optimisation * 4 architectures) different functions
126
- which are semantically similar. (i.e. they represent the same functionality but are written differently)
127
- In practise, it was much easier to obtain amd64 functions than riscv64 functions. Thus, not all functions have 24 semantically similar functions.
128
 
129
- The dataset is split into a train, test and an evaluation set. This in done on source package, so all binaries and functions belonging to one source package are part of
130
- either the train or the test set, not both.
 
 
 
131
 
132
  **Total amount of functions per architecture**
133
 
@@ -170,27 +162,15 @@ either the train or the test set, not both.
170
  ----------------------------
171
 
172
  # Preprocessing
173
- Several preprocessing steps have been taken: CFGs are processed to become a flat token list suitable for a tokenizer or
174
- vocabulary builder. This procedure differs slightly between architectures, the processes can be inspected
175
- [here](https://github.com/NetherlandsForensicInstitute/asmtransformers/tree/main/asmtransformers/asmtransformers/preprocessors).
176
-
177
- Some operands have been normalized,
178
- to reduce token explosion caused by raw numeric values. These numerical values are expressed as powers of two, such that
179
- 4096 would be 2 ** 12, so `#0x2^c`, so would 6000, but 9000 would be `#0x2^d`. As a consequence, small numbers are distinguishable
180
- in the vocabulary list, but bigger numbers get one batched representation.
181
-
182
- Finally, jump tokens are normalised to be relative `JUMP_ADDR_*` tokens. (* being the line number of the jump adress in the given
183
- function, rather than in the full CFG)
184
-
185
-
186
 
187
  # Performance
188
- Performance was measured in two ways: Mean Reciprocal Rank (MRR) and Accuracy@1. These metrics are useful for this problem
189
- since we compare a given embedded function to a database of embedded functions, and then rank the database by cosine similarity.
190
- Mean Reciprocal rank shows the mean rank (1 the positive example in the database being ranked first, 0.5 when the positive example
191
- is ranked second, 0.25 when the positive example is ranked fourth, etc). I.e. an MRR of 0.66 shows that the positive example was
192
- usually ranked first or second. Accuracy@1 shows how many times the positive example ranked first. It is a useful metric,
193
- but it's also very strict, which is why we used it combined with MRR.
194
 
195
  |model|ARM64 mrr|ARM64 acc|AMD64 mrr|AMD64 acc|RISC-V mrr|RISC-V acc|I386 mrr|I386 acc|crosslingual mrr|crosslingual acc|
196
  |-----|---------|---------|---------|---------|----------|----------|--------|--------|----------------|----------------|
 
9
  ---
10
 
11
  # Model Description
12
+ The ASMTransformers model is a machine learning model that calculates embeddings of assembly functions to enable comparison and similarity
13
+ operations. Instruction set architectures (ISAs) ARM, AMD64, RISC-V and i386 assembly are supported. The aim is to aid in the process of reverse engineering.
14
 
15
  # Status
16
  Not actively maintained after publishing
17
 
18
  # Relevant links
19
+ * [ASMtransformers on GitHub](https://github.com/NetherlandsForensicInstitute/asmtransformers)
20
 
21
  # Version
22
  2026-08-06
 
30
 
31
  # Architecture description
32
 
33
+ The model is a Bert-base architecture with 12 layers, 12 attention heads and a hidden size of 768. It uses a vocabulary of size 6161 derived from a custom assembler architecture-aware tokenizer.
 
 
 
34
 
35
+ The model is trained in two phases - a masked language modeling (MLM) pretraining phase and a fine-tuning phase for function similarity.
 
 
 
36
 
37
+ The MLM pre-training phase uses a loss function that includes jump target prediction (see [Wang et al.](https://arxiv.org/pdf/2205.12713)).
38
+ This pretraining was perfomed using a masking probability of 0.4 that was determined through ablation experiments. This is in line with the findings of [Wettig et al., 2023](https://aclanthology.org/2023.eacl-main.217.pdf).
 
39
 
40
+ We perform the finetuning phase using [Batched Semi Hard Triplet Loss](https://sbert.net/docs/package_reference/sentence_transformer/losses.html#batchsemihardtripletloss) on batches of size 1024.
41
+ The training set for this phase includes triplets that are formed using versions of the same function compiled for different instruction set architectures.
42
 
43
  **Estimated training time:**
44
 
 
65
  ]
66
  ```
67
 
 
 
68
  ```
69
  {
70
  "architectures": [
 
92
  }
93
  ```
94
 
95
+ **Pre-training parameters used:**
96
 
97
  ```
98
  {
 
106
  }
107
  ```
108
 
 
109
  # Output
110
+ The model outputs embeddings of size 768.
111
 
112
  # Data
113
+ The dataset is derived from the official [Debian Repository](https://wiki.debian.org/DebianRepository). We used the distribution's build and packaging system `apt` to
114
+ cross-compile source packages for multiple ISAs and optimisation levels. We used the standard optimisation levels supported by the distribution's compiler, O0, O1, O2, O3 and Os.
115
+ We also added an optimization level that includes vectorization and cryptographic instructions that we refer to as Optimized-custom, or Oc.
116
+ The binary files from each source package are disassembled using Ghidra and the resulting control-flow graphs (CFGs) are exported.
 
 
 
117
 
118
+ This results in a maximum of 24 (6 optimisation levels and 4 ISAs) potentially CFGs which are semantically identical, i.e. they represent the same functionality.
119
+ However, because not all source packages can be built for all ISAs and because some optimisation levels result in identical code, the actual number is often lower than that.
120
+
121
+ The dataset is split into a train, test and an evaluation set. This in done on source package basis, so all binaries and functions belonging to one source package are part of
122
+ either the training set or the test set, not both.
123
 
124
  **Total amount of functions per architecture**
125
 
 
162
  ----------------------------
163
 
164
  # Preprocessing
165
+ Several preprocessing steps have been taken. CFGs are processed into a flat token list using ISA aware tokenizers.
166
+ Immediate operands and addresses have been normalized to the nearest power-of-two reduce token explosion caused by raw numeric values.
167
+ Finally, target addresses of jumps, conditional branches or call instructions are normalised to fucntion-relative `JUMP_ADDR_*` tokens.
 
 
 
 
 
 
 
 
 
 
168
 
169
  # Performance
170
+ We report two performance metrics: Mean Reciprocal Rank (MRR) and Accuracy@1.
171
+
172
+ These metrics are suitable for evaluating tasks where a single example is retrieved from a large collection.
173
+ Accuracy@1 shows how many times the positive example ranked first. It is a useful metric, but it's also very strict, which is why we used it combined with MRR.
 
 
174
 
175
  |model|ARM64 mrr|ARM64 acc|AMD64 mrr|AMD64 acc|RISC-V mrr|RISC-V acc|I386 mrr|I386 acc|crosslingual mrr|crosslingual acc|
176
  |-----|---------|---------|---------|---------|----------|----------|--------|--------|----------------|----------------|