Learning Exact NVIDIA SASS Encoders with $\mathbb{F}_2$ Linear Algebra

Jiading Gai

cs.LGAug 20, 2026

Learning Exact NVIDIA SASS Encoders with $\mathbb{F}_2$ Linear Algebra

Authors: Jiading Gai

Organizations: Independent Researcher.

Abstract

NVIDIA provides a SASS disassembler but no public SASS assembler for recent data-center GPUs, limiting controlled machine-code rewriting. We present F2Asm, which learns exact 128-bit SASS encoders from paired disassembly and original CUBIN instruction words. To our knowledge, F2Asm is the first system to learn SASS instruction encoders as vector-valued affine maps over $\mathbb{F}_2$ and the first open-source NVIDIA SASS assembler to support Rubin SM107. F2Asm uses Gaussian elimination over $\mathbb{F}_2$ to incrementally build a compact basis, detect inconsistencies, and reject inputs outside the learned span. F2Asm separates target-specific control bits, relocation rules, and CUBIN metadata from its learning algorithm. We train encoders for Hopper SM90/SM90a, Blackwell SM100, and Rubin SM107 using 3,225 CUBINs from pinned NVIDIA and third-party production libraries, CUDA 13.3 packages, and CUDA 13.4 Developer Preview archives. In round-trip tests, F2Asm reassembles each CUBIN's disassembled SASS, and all compared executable text sections match the originals exactly. Joint training with F2Asm yields one shared encoder for five Blackwell SM targets and another for three Rubin SM targets, providing strong evidence of a common SASS encoding scheme for instructions shared within each family. Continual training extends the Rubin encoder to all 17,159 previously unsupported cuTile and GROMACS queries with 1,504 additional basis rows, matching the derived lower bound.

Figures & tables

Target	GPU architecture	Corpus sources (CUBINs)	Total	Raw rows	Exact-context basis rows	Exact contexts	Skips a
SM90/90a	Hopper	NVIDIA TensorRT-LLM (1,108); NVIDIA Transformer Engine (60); vLLM (239); FlashAttention (72); SGLang (60); xFormers (8); bitsandbytes (3); rVLLM (1)	1,551	169.87M	440,308	60,412	200
SM100	Blackwell	NVIDIA cuBLAS (378); cuDNN (283); cuSOLVER (194); NPP (182); cuSPARSE (100); nvJPEG (10); cuRAND (7); cuSPARSELt (3)	1,157	25.09M	385,141	59,894	0
SM107	Rubin	NVIDIA cuSOLVER (203); NPP (197); cuSPARSE (100); nvJPEG (10); cuRAND (7)	517	17.98M	238,190	37,277	13,524
Total			3,225	212,937,948	1,063,639	157,583	13,724

Table 1: Training corpora and exact-context evidence compaction.

Target	$(f,m)$ groups	Affine maps	Final basis rows
SM90/90a	2,865	2,936	50,099
SM100	3,669	3,673	60,159
SM107	2,896	2,896	44,882
Total	9,430	9,505	155,140

Table 2: Final encoding-repository structure. Each

(f,m)

group stores one shared affine map, or one per operand signature when sharing fails; basis rows are summed across maps.

Target	Forms	CUBINs	Sections	Text MiB	P/F/E
SM90/90a	389	1,551	87,141	2,592.0	1,551/0/0
SM100	326	1,157	30,491	382.8	1,157/0/0
SM107	279	517	32,676	274.5	517/0/0

Table 3: Round-trip results for the 3,225-CUBIN release corpus. All executable text sections matched their originals byte-for-byte. P/F/E denotes passed/failed/errors.

Partition	CUBINs	Instructions	Unique queries	Text sections	P/F/E
Training	14,970	71,927,724	4,412,203	59,921	14,970/0/0
Held-out	3,608	12,788,800	740,247	9,017	3,608/0/0

Table 5: Rubin development-corpus partition and round-trip results for the trained encoder. P/F/E denotes passed/failed/error CUBINs.

Source	Obs.	Queries	Forms	Maps	$\sum_{g}\delta_{g}$
cuTile	3,702	3,421	21	33	104
GROMACS	53,134	13,738	63	173	1,400
Combined	56,836	17,159	75	206	1,504

Table 7: Unsupported Rubin queries before adaptation and the minimum number of additional independent instruction observations required to support them. Obs. denotes unsupported instruction observations.

Appendix figures & tables2 assets

Supplementary material from the paper’s appendix.

Appendix

Target(s)	Architecture	Status	Opcodes	Forms
sm_90/90a	Hopper	Supported	140	389
sm_100/100f/100a sm_103/103a	Blackwell	Supported	153	388
sm_107/107f/107a	Rubin	Supported	153	369

Appendix

Table 8: Exact target support in the evaluated implementation.

$k$	Active features in $r_{k}$	$z_{k}$ (128-bit hexadecimal)
259	$v_{1}[2]\oplus v_{2}[2]\oplus v_{4}[2]$	00000000000000040000000004040000
199	$v_{3}[6]$	00000000000000000000004000000000
196	$v_{3}[3]$	00000000000000000000000800000000
135	$v_{2}[6]$	00000000000000000000000040000000
3	$1\oplus v_{0}[0]\oplus v_{0}[1]\oplus v_{0}[2]$	0400000000041800000000000000723c

Appendix

Table 9: Five of the encoding map’s 16 stored basis pairs used for this HMMA example. Here

v_{i}[b]

denotes bit

b

of parsed value

v_{i}

; each

z_{k}

is shown as a 128-bit hexadecimal word.

Explore similar work

GPU-Accelerated Synthesis of Mixed-Boolean Arithmetic: Beyond Caching
May 7, 2026Gabriel Bathie, Baptiste Mouillon, Nathanaël FijalkowSynthesis Synthesizer
CNRS, LaBRI, University of Bordeaux, France
FuseFSS: Efficient Secure LLM Inference with Function Secret Sharing
Jun 8, 2026Yuhan Ma, Yong Li, Stefan SchmidLLM Inference Optimization Fixed-Point Iteration
Huawei Heisenberg Research Center, Huawei Technologies Düsseldorf GmbH, Düsseldorf, Germany · Technische Univer-sität Berlin, Berlin, Germany
ARGUS: Agentic GPU Optimization Guided by Data-Flow Invariants
Apr 16, 2026Haohui Mai, Xiaoyan Guo, Xiangyun Ding +7Graphics Processing Unit Kernels Agentic Optimization
UC Riverside5 · UCAS4 · Tsinghua University2 +2

May 7, 2026, cs.PLJ/K move · Enter open · S save

GPU-Accelerated Synthesis of Mixed-Boolean Arithmetic: Beyond Caching

Gabriel Bathie, Baptiste Mouillon, Nathanaël Fijalkow

CNRS, LaBRI, University of Bordeaux, France

Synthesis Synthesizer Obfuscation Cache

Open paper AskPDF arXiv

Synthesizing Mixed-Boolean Arithmetic (MBA) expressions from input-output examples is central to program deobfuscation and also useful for compiler optimization, reverse engineering, and cryptanalysis. Existing MBA synthesizers are typically CPU-based and scale poorly on large specifications or complex targets. Recent GPU-accelerated synthesis methods achieve large speedups in qualitative settings, but they depend on caching observationally equivalent candidates; this strategy breaks down for MBA because candidate outputs are quantitative bitvectors and the behavioral space is enormous. We present SIMBA (Synthesis of Mixed-Boolean Arithmetic), a GPU-accelerated MBA synthesizer built around cache-free bottom-up enumeration. SIMBA avoids language caches entirely and uses a GPU-oriented enumeration design that keeps work local and highly parallel. In experiments, SIMBA is substantially faster than prior MBA synthesis tools, handles larger specifications, and reaches expression sizes that existing methods fail to solve. These results establish cache-free GPU synthesis as a practical and scalable approach for quantitative domains, and identify it as a strong alternative to cache-centric designs.

Abstract

Explore similar work

GPU-Accelerated Synthesis of Mixed-Boolean Arithmetic: Beyond Caching

FuseFSS: Efficient Secure LLM Inference with Function Secret Sharing

ARGUS: Agentic GPU Optimization Guided by Data-Flow Invariants