Gemini Drift: The patch-analysis work that became SCJ.

The question

When a patch fixes one function, where else might the same missing safeguard remain?

From a patch to a structural search

Two functions can share a dangerous pattern even when their names or source text differ. Gemini Drift combines a function’s structural representation, the operations it reaches, and the safety conditions introduced by a patch. The unit of investigation is a candidate sibling function, not simply a matching text fragment.

The paper combines patch-similarity scoring, positive–unlabeled learning and call-graph risk propagation. Positive–unlabeled learning separates known examples from code whose status has not yet been established; it does not assume every unlabeled function is safe.

Check the safeguard, then produce evidence

SAVES, the proposed semantic micro-slicing checker, tests bounded pieces of a candidate against patch-intended conditions such as bounds, message-length checks, watchdog timing and table validation. Its verdicts include match, partial, mismatch and inconclusive. A time limit or ambiguous mapping remains an inconclusive result.

The output is a review-ready evidence pack. Candidate ranking, a bounded semantic check, and confirmation of a vulnerability are separate stages. The PDF describes a retrospective cFS 6.7-to-6.8 study design and targets; these are not presented here as independently established detection performance.

The connection to SCJ

According to Davis, Gemini Drift became SCJ. The later SCJ record develops source-code investigation around function-level representations, reachability and combinations of guard patterns. This establishes a research lineage without treating the later implementation or its evidence as identical to the 2025 paper.

The NASA setting applies to Gemini Drift. The catalog retains IBM as the setting of the later SCJ security research, following the author’s attribution.