Auditing What Program Images Hide and Preserve

Abstract

Reusing a reversible program image for masked code prediction requires hiding the target while preserving the available context. Recovery payloads and integrity metadata may still depend on the target, and removing them can also discard needed context. We propose a task-specific audit with two obligations. It tests invariance to hidden completions and preservation of the fields promised to a consumer. A paired test harness applies established noninterference and metamorphic-testing principles to the carrier-to-view adapter before training. In a bounded study of one pinned CodeImage deployment, fixed redactions expose a reference-class marker that leaves 36 differing pixels after the main panels, recovery regions, and digest stamp are hidden. A separate pair shows an information-loss failure in which views become identical although an allowed operator differs. Exact preservation of designated non-target marks does not prevent this collision. These emerging results motivate construction of views from permitted partial records and evaluation of both obligations. No learned generator or model-accuracy gain is claimed.