When Causality Breaks: Structural Pruning and Overconfidence in Adversarial Reverse Engineering

Reverse engineering of binary code is traditionally framed as a pattern recognition problem. In this work, we propose a paradigm shift by modeling programs as causal systems, where semantics emerge from execution dynamics. We introduce a Causal Reverse Engineering (CRE) framework that represents execution traces as Causal Interaction Graphs, processed by a Graph Neural Network (GNN) to infer program intent.

While highly effective on clean binaries (100% accuracy), we demonstrate that adversarial control-flow obfuscation induces a catastrophic "structural collapse" (accuracy drops to 16.7%). We propose Structural Causal Pruning as a mitigation, restoring accuracy to 66.7%. Crucially, we identify and formalize the phenomenon of Causal Overconfidence through the Causal Overconfidence Index (COI), highlighting a critical risk in security-oriented AI models.

Repository Content This Zenodo deposit contains the full research artifact, including:

• Technical Paper (PDF): Full description of the methodology and results.

• Source Code (Notebook): Implementation of the CRE framework, GNN training, and pruning heuristics.

• Data & Plots: CSV summaries of the experiments and performance visualizations.