Undefined Behavior Exploitation as a Service: Adaptive Optimization for Security-Performance Trade-offs

The papers by Popescu and Lopes (2025) and Shen (2021) present this fascinating conflict: undefined behavior enables optimizations but the performance gains are often minimal while security risks are significant. The current approach is all-or-nothing - either you allow UB exploitation or you don't. What if we could make this granular? My idea is to develop a compiler framework that analyzes each potential UB exploitation opportunity and presents developers with a detailed trade-off analysis. We'd use program analysis to identify UB patterns, then profile the application to see which ones actually matter for performance. The system would estimate the security impact of each UB exploitation and suggest a middle ground. For example, it might find that exploiting signed integer overflow in three specific loops gives 15% performance improvement with minimal security impact, while exploiting pointer aliasing elsewhere gives only 2% improvement but opens major security vulnerabilities. Developers could then make informed decisions rather than accepting blanket compiler policies. This extends Popescu and Lopes's work by moving from "does UB help overall?" to "which specific UB exploitations help and are they worth the risk?" It's particularly relevant for security-sensitive applications where developers need to justify every optimization choice.

References:

1. Exploiting Undefined Behavior in C/C++ Programs for Optimization: A Study on the Performance Impact. Lucian Popescu, Nuno P. Lopes (2025). Proc. ACM Program. Lang..
2. The Impact of Undefined Behavior on Compiler Optimization. Zefan Shen (2021). Esse.