Compilation Context as a Security Variable: A Cross-Language Classification Framework

Abstract

The compilation context of a program — the flags, format settings, feature selections, and diagnostic instrumentation used at build time — is not necessarily represented by the source file itself. Changing these elements, without modifying a single line of source, can change what the program does, what code it contains, what its test suite exercises, and what failures become visible. This paper presents a methodology for detecting, reproducing, and classifying compilation context divergences, developed through empirical analysis of legacy COBOL systems, Rust cryptographic libraries, and C system programs. Three primary case studies demonstrate compilation-context divergence across interpretation, coverage, and observability dimensions. An adjacent case study illustrates the extensibility of the experimental protocol to deployment and package-management context. A three-tier classification framework — CONFIRMADO, PROBABLE, and OBSERVADO — is proposed to distinguish actionable security findings from intentional design decisions and unresolved observations. Version 2.0.0 — 2026-08-23 Changes from v1.0.0: - Added Case 4.4: Behavioral Divergence — C Optimization Flags and Undefined Behavior (CONFIRMADO). Demonstrates that clang -O0 and clang -O2 produce different observable outputs from the same source due to UB-based compiler assumptions.- Added Section 5: Framework Extensibility, with two subsections: - 5.1 Supply Chain Context — Dependency Build Flag Injection (CONFIRMADO): CFLAGS injected into a dependency build disables input validation in the final consumer binary without modifying any source file. - 5.2 Deployment Context — Package Management and Installer Environment (OBSERVADO): Tailscale cases on FreeBSD and Parrot OS, previously documented as an adjacent case study.- Section 3: Reinforced the centrality of the intentional/unintentional distinction as the core methodological question.- Section 6: Added projection toward context-sensitive dynamic analysis and compiler-flag-aware fuzzing as future work directions.- Section 7: Clarified the relationship between cfg-shield and the C PoC experiments; noted dedicated C static-analysis tool currently in design phase.- References: Added [13] (C compiler divergence PoC) and [14] (supply chain CFLAGS injection PoC).