Test-Time Registers in Computational Systems

• Test-time registers are data structures maintained during system evaluation to store, update, and compare values, forming the basis for models such as register and timed automata.
• They are crucial in runtime verification and synthesis, enabling precise monitoring and security measures through techniques like dynamic register allocation and MAC chaining.
• In modern neural architectures, test-time registers improve feature filtering and interpretability by absorbing artifacts and integrating with symbolic testing, thus enhancing overall system performance.

Test-time registers are an overarching concept referring to data structures, stateful variables, or architectural tokens that are maintained, updated, and utilized during the evaluation phase (“test time”) of computational systems. Their main purpose is to track, store, and compare values—ranging from timestamps and input data to local variables or specialized embeddings—in a way that enables verification, synchronization, or improved downstream processing. Across computational models, test-time registers appear as explicit registers in automata and runtime verification tools, as memory cells in distributed protocols, as register tokens or neurons in neural architectures, and as tracking constructs in symbolic or constraint-based testers. Theoretical and practical research establishes their critical roles in both correctness and efficiency, their influence on decidability and complexity, and their impact on the interpretability and security of modern systems.

1. Theoretical Models: Register Automata, Timed Automata, and Their Correspondence

Test-time registers are foundational in the theory of automata over infinite alphabets, where register automata extend classical finite automata by including registers that store and compare data values from potentially unbounded domains. Timed automata analogously use clocks (resembling “test-time registers” for time) to store the time of last resets and check timing constraints between events.

A tight bi-directional correspondence exists between register automata and timed automata (Figueira et al., 2010). Each clock in a timed automaton can be simulated by a register which remembers the time of the last reset, and conversely, register tests (inequalities and equality) in a register automaton can be mimicked by clock constraints and reset mechanisms in a timed automaton. Formally, for any alternating timed automaton $\mathcal{A}$, it is possible to construct, in exponential time, a register automaton $\mathcal{A}'$ such that, for all timed words $w$,

$$\mathcal{A} \text{ accepts } w \iff \mathcal{A}' \text{ accepts } db(w),$$

where $db(w)$ denotes the “data braid” transformation encoding time as data.

This correspondence preserves key properties, including the mode of computation (alternating, nondeterministic, deterministic), enabling the transfer of decidability and complexity results:

• Emptiness for alternating automata with one clock/register is decidable (but with non-primitive recursive complexity).
• Language inclusion for nondeterministic automata with many clocks (or registers) and an alternating automaton with one is also decidable, albeit with high complexity.

These results establish that “testing” elapsed time or data at test time—via appropriate registers or clocks—is fundamentally equivalent in expressive power and analytical tractability.

2. Practical Constructions: Test-Time Registers in Verification and Synthesis

Test-time registers play a central role in runtime verification and reactive synthesis. In runtime verification, formalisms such as register automata and their extensions (e.g., TOPL automata) allow monitors to track and check complex temporal/data-dependent properties during execution (Grigore et al., 2012). TOPL automata, for instance, are defined as:

$$\mathcal{A} = \langle Q, q_0, s_0, \delta, F \rangle,$$

where a fixed number of registers encode active data identities, allowing transitions with guards and actions that bind, update, or compare the stored values in response to monitored events.

The flexibility to dynamically rebind registers enables the expression and verification of intricate properties, such as resource lifetimes, taint propagation, and object interaction patterns. Test-time registers in this context support tracing the evolution of resources even in systems with unbounded object creation.

In synthesis, bounded register transducers (Khalimov et al., 2018) restrict the number of available registers, enabling the construction of systems from specifications over infinite domains by reducing the problem to Boolean synthesis. This approach uses a “Boolean associate” for every register automaton or transducer, where only equivalence relations between input and register values are tracked symbolically. Guard signals (e.g., $g_{ir}$ indicating “input equals register $r$”) are treated as Booleans, decoupling comparisons from concrete data domains and facilitating scalable synthesis strategies.

3. Security and Efficiency: Architectural Test-Time Registers in CPUs

At the architectural level, test-time registers are realized as CPU registers leveraged for runtime security—most notably in schemes such as RegGuard (Geden et al., 2021). Here, compiler-driven register allocation privileges the most security-critical variables (e.g., return addresses, control flags) so that they reside in dedicated registers instead of memory. The rationale is that CPU registers are not directly addressable by standard memory-based attacks.

RegGuard’s allocation strategy prioritizes variables based on static “security scores.” When registers must be spilled to the stack, cryptographic message authentication codes (MACs) chain frame information:

$$\text{tag}_{i} = \text{MAC}_{sk}(\text{tag}_{i-1} \| \text{args}_{i-1} \| \ldots )$$

This chained integrity-check mechanism ensures that tampering with saved register values is reliably detected, even under powerful adversarial models.

Benchmark experiments confirm that RegGuard’s approach delivers strong protection with runtime overheard in the range of 13%–23% on ARM64 systems, intersecting performance and security by repurposing test-time registers as both operational and protective elements.

4. Register Sets, Expressiveness, and Complexity

Register set automata (RsAs) (Gulčíková et al., 2022) generalize basic register automata by allowing each register to contain not a single data value but a set. The allowed operations are:

• Addition of values to a register,
• Clearing registers,
• Testing (non-)membership of the current input in any register.

A transition in an RsA is defined as $t: (q, a, \mathcal{G}_1, \mathcal{G}_2, up, s),$ in which the update $up$ determines how sets evolve via union operations. These constructs allow RsAs to naturally encode properties like “all values seen so far” or “no value from the initial segment appears later.”

The emptiness problem for RsAs is decidable and complete for the fast-growing complexity class $F_\omega$ (Ackermannian complexity). Despite high worst-case complexity, this determinization (e.g., DRsAs for regex with back-references) offers practical advantages in certain domains, including test-time evaluation tasks where membership and accumulation of observed values is essential.

5. Test-Time Registers in Modern Neural Architectures

Test-time registers now appear prominently in neural architectures, particularly Vision Transformers (ViTs) where tokenized feature representations admit “artifact” or “outlier” tokens with high norms that degrade attention quality and dense prediction. The introduction of register tokens—additional learnable or untrained tokens appended to the input sequence—enables the absorption of these artifacts at test time (Chen et al., 27 May 2025, Jiang et al., 9 Jun 2025).

Recent work demonstrates two major approaches:

• Self-distilled register tokens (Chen et al., 27 May 2025): Through post-hoc self-distillation (PH-Reg), register tokens are integrated into a pre-trained ViT without full retraining. Test-time data augmentation combined with teacher-student alignment produces denoised dense features, with register tokens absorbing unwanted artifact components and improving segmentation and depth tasks.
• Training-free test-time registers (Jiang et al., 9 Jun 2025): By identifying a sparse set of “register neurons” responsible for high-norm activations, activations can be dynamically redirected into an untrained test-time token. The attention computation is thus:

$$\text{Attention}(Q, K, V)_t = \sum_{i \in \mathcal{R}} p_t^i v_i + \sum_{i \notin \mathcal{R}} p_t^i v_i$$

This removes outlier influence from image tokens, achieving cleaner feature maps and attention, often matching or surpassing models retrained with explicit register tokens.

In both cases, test-time registers are not merely storage—they are active participants in the model's feature filtering and interpretation. Extensions to vision-LLMs further improve interpretability and localization in cross-modal tasks without retraining.

6. Symbolic and Constraint-Based Test-Time Register Management

In model-based and symbolic testing, test-time registers can be conceptualized as the data structures used to maintain state and timing constraints during exploration. In timed symbolic transition systems (TIOSTS) (Bannour et al., 2023), symbolic registers (variables) track both timing (via clock variables) and data state across finite symbolic execution trees.

Rules for variable updates—and hence test-time register management—are formalized as:

$$\lambda'(w) = \begin{cases} \lambda_0'(\rho(w)) & w \in A \ 0 & w \in \mathbb{K} \ \lambda_0'(w) & w \in K \setminus \mathbb{K} \end{cases}$$

where $\lambda_0'(w)$ captures input or time advancement using fresh variables. This rigorous symbolic treatment allows test suites to handle all possibilities for register values resulting from time elapse and uninitialized parameters. The resulting test cases are trees labeled with correctness verdicts at their leaves, ensuring coverage and diagnostic ability during runtime verification.

7. Foundational Role in Computability and Distributed Protocols

Test-time registers underpin computability and synchronization in distributed systems. Their necessity is highlighted by impossibility results for consensus in settings lacking read-write registers (Gelashvili et al., 2014). Registers serve as persistent, reliable storage for intermediate and final decisions, enabling correct consensus protocols. Theoretical formulations clarify that, without registers, even systems with other strong primitives (e.g., test-and-set objects) fall short:

$$\text{Consensus}_n \not\subseteq \text{TestAndSet}_{n-1}$$

Initialization states in registers further ground synchronization, supporting linearizable and wait-free progress essential for robust protocol design.

---

Test-time registers thus constitute a unifying concept, extending from automata theory and synthesis to hardware security, dense neural representation filtering, symbolic testing, and distributed computation. Through their generalization—as data-holding, updating, and comparison structures—they promote expressive specification, efficient runtime instrumentation, robust verification, and enhanced model interpretability at all levels of system design and deployment.