Syed Md Mukit Rashid, Abdullah Al Ishtiaq, Kai Tu, Yilu Dong, Tianwei Wu, Ali Ranjbar, Tianchang Yang, Najrin Sultana, Shagufta Mehnaz, Syed Rafiul Hussain. Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers). 2026.

The Booth multiplier provides high-performance signed multiplication by encoding and decreasing partial products (PPs) generated using the radix-4 Booth algorithm. Although the radix-8 produces fewer PPs than the radix-4 and needs fewer adders to accumulate PPs, it is not fast because the odd multiples of the multiplicand are generated in a complex unit, and attaining a high performance is challenging. This work alleviates this issue using approximate designs. An approximate 4:2 compressor is proposed in which the inputs are encoded by the generation and propagation method for the reduction of faulty rows in the truth table. The compressor, radix-8 Booth encoder, and PP generation (PPG) are used to attain a signed$16\times 16$-bit, approximate multiplier, and synthesized targeting a 90 nm complementary metal oxide semiconductor (CMOS) technology. The multiplier is efficiently implemented on field programmable gate arrays (FPGAs) to perform the Sobel operator for edge detection. The occupied area, dynamic power dissipation, and power-delay-product (PDP)$\times $mean relative error distance (MRED) of the presented multiplier are superior to the lookup table (LUT)-based multipliers of an FPGA. The Sobel edge detection algorithm implemented on the FPGA detects 99.15% of edges with 33.33% energy savings, while the structural similarity index measure (SSIM) and peak signal-to-noise ratio (PSNR) are 0.88 and 32.92dB, respectively.

Baseband firmware plays a critical role in cellular communication, yet its proprietary, closed-source nature and complex, stateful processing logic make systematic security testing challenging. Existing methods often fail to account for the interdependencies between baseband tasks and the statefulness of input processing logic, limiting their scope and effectiveness. We present Loris, a stateful fuzz testing frame-work designed to explore and analyze baseband firmware implementations effectively. We employ iterative symbolic analysis to progressively identify state variables and the predicates over them that define different protocol states, while alleviating the state explosion problem. It enables Loris to perform targeted exploration and fuzzing of program regions with high potential for vulnerabilities. We evaluated Loris across 5 commercial devices from two major vendors, covering both 4G Long-Term Evolution (LTE) and 5G New Radio (NR), demonstrating its broad applicability. Our testing revealed 7 new vulnerabilities exploitable by over-the-air attackers, potentially leading to baseband crashes, remote code execution, and denial of service.