Arduino Leak Detection

(Will Be Inserted By The Editor)

LeakGuard: Detecting Memory Leaks Accurately and Scalably

Received: Date / Accepted: Date

Abstract Memory leaks are prevalent in various real-world software projects, thereby leading to serious attacks like denial-of-service. Though prior methods for detecting memory leaks made sig- nificant advance, they often suffer from low accuracy and weak scalability for testing large and com- plex programs. In this paper we present LeakGuard, a memory leak detection tool which provides satisfactory balance of accuracy and scalability. For accuracy, LeakGuard analyzes the behaviors of library and developer-defined memory allocation and deallocation functions in a path-sensitive manner and generates function summaries for them in a bottom-up approach. Additionally, we develop a pointer escape analysis technique to model the transfer of pointer ownership. For scala- bility, LeakGuard examines each function of interest independently by using its function summary and under-constrained symbolic execution technique, which effectively mitigates path explosion problem. Our extensive evaluation on 18 real-world software projects and standard benchmark datasets demonstrates that LeakGuard achieves significant advancements in multiple aspects: it exhibits superior MAD function identification capability compared to Goshawk, outperforms five state-of-the-art methods in defect detection accuracy, and successfully identifies 129 previously undetected memory leak bugs, all of which have been independently verified and confirmed by the respective development teams.

Keywords Memory Leaks, Under-Constrained Symbolic Execution, Pointer Escape Analysis

2

Hongliang Liang et al.

1 Introduction

Memory leaks refer to situations where a memory regions dynamically allocated by functions such as malloc, calloc, or the new operator, is not properly released after their use. These unused memory regions cannot be reclaimed by the operating system, leading to depletion of system resources.

Memory leak bugs in programs can be maliciously exploited by attackers, potentially resulting in denial-of-service attacks. Research shows that many small or uncommon memory leak defects can also lead to similar consequences (Cantrill, 2003). As of July 2024, there are over 1,700 CVEs (Common Vulnerabilities and Exposures) related to memory leaks. Memory leaks have become a significant factor compromising the security of computer systems.

Except for the standard functions like malloc or free, in real-world programs, developers often write their own MAD functions that manage multiple memory objects by invoking standard functions directly or indirectly. The identification of memory allocation/deallocation (MAD for short) functions is crucial in memory leak detection. Prior studies make significant advances in detecting memory leaks though they are limited in either accuracy or scalability. For example, K- MELD (Emamdoost et al., 2021) assumes that developers often check the success of MAD functions, and has demonstrated its effectiveness on the Linux Kernel. SinkFinder (Bian et al., 2020) identifies potential bugs or issues by focusing only on the data flow between specific pairs of functions.

MiROK (Wang et al., 2023) mines abstract resource operation knowledge (Abs-RAR pairs) from Java code using rule-based and learning-based strategies, and then instantiates them into concrete RAR pairs to build a comprehensive pool for enhanced resource leak detection. MLEE (Wang, 2021) assumes that memory leak bugs often occur in early-exit (E-E) paths of a program. It detects memory leak bugs by cross-checking the differences in memory freeing operations between E-E paths and normal paths in Linux kernel. Unfortunately, these assumptions are not always true in real-world software projects and hence limited their scalability.

In contrast, NLP-EYE (Wang et al., 2019) employs data flow analysis and function summary to accurately model customized MAD functions. Based on NLP-EYE, Goshawk (Lyu et al., 2022) can detect Use-After-Free (UAF) and Double-Free (DF) vulnerabilities in large-scale software.

Goshawk generates summaries for MAD functions in a path-insensitive manner. Initially, it uses an AI model to filter functions related to memory allocation/deallocation based on function names and parameter lists. Then, it applies a path-insensitive data flow analysis method to identify memory management functions and generate summaries, including information about the memory objects allocated/deallocated by these functions. However, this approach may overlook some genuine MAD functions during the AI filtering stage. Moreover, due to the path-insensitive nature of the data flow analysis, it fails to effectively address pointer aliasing issues, leading to a higher rate of false positives in the generated function summaries. Moreover, it does not consider the path conditions of memory object allocation/deallocation, leading to a higher false positive rate in practical detection.

SMOKE (Fan et al., 2019) uses path-sensitive analysis to detect memory leak bugs, and then confirms the results via an SMT solver. However, its modeling of library functions is not precise, and it suffers from inaccurate pointer analysis, thereby resulting in over 40% false-negative (Aslanyan et al., 2022).

To mitigate the above issues, we present LeakGuard, a memory leak detection tool which pro- vides satisfactory balance of accuracy and scalability. Specifically, we first use a path-sensitive approach to accurately identify MAD functions in the program and the memory objects managed by them, and then generate function summaries for these functions. Then we filter out the caller functions of the MAD functions for later symbolic execution. Finally we perform path-sensitive analysis on these caller functions via under-constrained symbolic execution (Ramos and Engler, 2015) to detect memory leak bugs. Additionally, we develop a pointer escape analysis technique to model the transfer of pointer ownership. In extensive experiments conducted on 18 real-world software projects, including OpenSSL, MySQL, and the Linux Kernel, LeakGuard demonstrated superior capability in generating MAD function summaries compared to Goshawk and outper- formed five state-of-the-art methods—Clang Static Analyzer (CSA), Infer, CppCheck, SMOKE, and SVF—in defect detection. Moreover, it identified 129 previously unknown memory leak bugs, all of which have been confirmed by the respective developers.

3

...

11

...

32

static int asn1 item ex new(ASN1 VALUE ∗∗pval, const

33

...

36

...

39

...

}

Fig. 1 A memory leak in OpenSSL found by LeakGuard Our contributions are summarized as follows. – We first identify MAD functions in a bottom-up manner based on the function call graph and generate function summaries for each of them, thereby enhancing the accuracy. Next we analyze the caller functions of each MAD function by using under-constrained symbolic execution, which facilitates the scalability .

– We propose a pointer escape analysis strategy for memory leak, which identify three pointer escape scenarios as follows. A pointer pointing to a dynamic memory object is 1) returned by a function; 2) assigned to function parameters; or 3) assigned to a global variable or a member of a global structures. Accordingly we achieve effective results by employing data flow analysis technique.

– We implemented the aforementioned techniques in LeakGuard and evaluated its effectiveness on 18 real-world software projects, including OpenSSL, MySQL, and the Linux Kernel. Exper- imental results demonstrate that LeakGuard surpasses the state-of-the-art method Goshawk in identifying MAD functions and outperforms five advanced memory leak detection tools—Clang Static Analyzer, Infer, CppCheck, SMOKE, and SVF—in defect detection. Furthermore, Leak- Guard detected 129 previously unknown memory leak vulnerabilities, all of which have been confirmed by the respective developers.

– We build a benchmark that contains 129 real memory leak bugs in real-world open-source software projects. We make our tool and benchmark publicly available to facilitate future re- searches.

2 Motivation

In this section, we describe the limitations of prior methods to detect memory leak by using a motivating example. Figure 1 shows a code snippet in OpenSSL. In the make addressPrefix function, a pointer vari- able aor points to a memory region returned by the function IPAddressOrRange new (Line 4). In fact, the functions IPAddressOrRange new, ASN1 item new, ASN1 item ex new, and asn1 item ex new will be called in order before the desired memory is allocated by the library function calloc (Line 37). However, if the condition at Line 6 which has nothing to do with aor is true, the make addressPrefix function returns directly and thus results in a memory leak bug.

4

Hongliang Liang et al. Unfortunately, three state-of-the-art static analysis tools, CSA, Infer, and CppCheck, failed to detect this bug. Firstly, these industrial-grade analysis tools prioritize efficiency. To address the path explosion problem and complete large-scale project analysis within time limits, they restrict path depth and node count during analysis and may use path-insensitive techniques. As a result, some deep-seated bugs, such as this memory leak, are overlooked.

Secondly, all three tools model memory allocation/deallocation (MAD) based on standard li- brary functions. In the example code, the memory leak occurs in the make addressPrefix function, while the calloc library function is four levels away in the call chain. This call chain involves com- plex program semantics like loops and switches. The imprecise MAD behavior modeling in these tools thus decreases the analysis accuracy.

Actually this bug was found by LeakGuard and confirmed by OpenSSL developers.

3.1 Formalization Of Memory Leak

Below we formally describe the functions regarding memory and pointer operations in Linear Temporal Logic (LTL), considering the ownership and reference count of a memory region. The formula explanation of atomic propositions and operators is as follows.

– allocate(p): Allocates memory at address p. – free(p): Frees the memory pointed to by p. – owns(X, p): Entity X (e.g., caller, global variable) owns the memory at p.

– transfer ownership(X, p): Transfers ownership of the memory at p to entity X. – shared(p, n): The reference count of the memory at p is n. – F(ϕ) (Eventually): ϕ will hold at some future time.

– G(ϕ) (Globally): ϕ holds for all future time. 3.1.1 Allocation Return with Ownership & RefCount (AROR) The function returns a dynamically allocated pointer, transferring ownership to the caller and ini- tializing the reference count to 1. The reference count is initialized to 1 on allocation. Each copy of p increments the reference count (+1), and each release decrements it (-1). Memory is freed when the reference count reaches 0. Its LTL formula is defined as: ∃p·F (allocate(p) ∧shared(p, 1) ∧F (return(p) ∧transfer ownership(caller, p)))

∧G (Free(P) ↔Shared(P, 0))

3.1.2 Inner Allocation Return with Ownership & RefCount (IAROR) The function returns a pointer containing an inner structure allocation. The parent pointer owns the memory, and reference counts manage cascade deallocation. Deallocating the parent pointer p decrements the reference count of the inner pointer q (-1). Memory for q is freed when its reference

Count Reaches 0. Its Ltl Formula Is Defined As:

∃p, q·F (allocate(q) ∧shared(q, 1) ∧F (return(p) ∧(q = p + offset) ∧owns(p, q)))

5

3.1.3 Deallocation of Argument with Ownership & RefCount (DAOR) The function takes ownership of an argument pointer and directly releases its memory, resetting the reference count to 0. The function resets the reference count of p to 0 and frees it. The caller relinquishes ownership of p. Its LTL formula is defined as: ∀p · G (call(f) ∧arg(p) →F (shared(p, 0) ∧free(p) ∧¬owns(caller, p))) 3.1.4 Deallocation of Argument Offset with Ownership & RefCount (DAOOR) The function releases memory at an offset of the argument pointer while retaining ownership of the parent pointer. Only the offset pointer’s reference count is decremented (-1). The parent pointer p retains its ownership and reference count. Its LTL formula is defined as:

∀P· G (Call(F) ∧Arg(P) ∧Shared(P + Offset, N) →

F (free(p + offset) ∧shared(p + offset, n −1) ∧owns(caller, p))) 3.1.5 Allocation in Global with Ownership & RefCount (AGOR) The function stores allocated memory in a global variable, managed via reference counting. The global variable increments the reference count (+1) when holding p. Memory is freed when the global reference count reaches 0. Its LTL formula is defined as: ∃p·F (allocate(p) ∧shared(p, 1) ∧F (store(global, p) ∧owns(global, p)))∧G (free(p) ↔shared(p, 0)) 3.1.6 Deallocation of Global with Ownership & RefCount (DAGOR) The function releases memory held by a global variable and resets its reference count to 0. Its LTL

Formula Is Defined As:

∀p · G (owns(global, p) →F (free(p) ∧shared(p, 0)))

3.1.7 Argument Copy With Refcount (Acr)

The function copies a pointer to an argument or a global, updating reference counts. The source pointer p increments its reference count (+1). Its LTL formula is defined as: ∀p, q · G (copy(p, q) →F (shared(p, n) ∧shared(p, n + 1))) By applying the above formulas, our approach can 1) reduce false positives as ownership rules eliminate irrelevant deallocation checks, 2) support for complex patterns because shared memory, nested structures, and global ownership are handled rigorously.

3.2 Overview

LeakGuard aims to detect memory leak in a scalable and accurate way. Its workflow consists of four phases, as shown in Figure 2. Phase 1: Preprocessing the software project under test. Real-world software projects usually consist of lots of code files and build files which contain rules and commands to build the whole project. e.g., CMake/Make files. When building the project, LeakGuard records the compilation process into a compilation database for later use. thereby supporting for analyzing lots of open- source software projects.

6

Hongliang Liang et al.

Fig. 2 Overview Of Leakguard

Phase 2: Modeling MAD Functions. In real-world programs, an MAD function may be a stan- dard library function or a customized (i.e., developer-defined) one that allocates/deallocates mem- ory. A library MAD function directly performs MAD operations, whereas a custom MAD function may invoke a or multiple library MAD functions. Stand MAD functions are a prior and eas- ily identified. We regard standard library MAD functions as predefined domain knowledge and encapsulate them within the tool as function summaries. To detect custom MAD functions, we implement an iterative process that starts by querying the call graph to identify all callers of known MAD functions. Subsequently, we employ path-sensitive data flow analysis to pinpoint MAD func- tions within these caller functions and refine their corresponding function summaries. This cycle continues iteratively until no additional summaries are incorporated.

Phase 3: Identifying Caller Functions of MAD functions. Based on the fact that a program doesn’t expose memory leak if it has no MAD operations, the necessary condition for a memory leak bug is a call at least to an MAD function. In other words, memory leak bugs can only occur in functions that call an MAD functions. In this step, we filter out all caller functions of the identified MAD functions by traversing the program call graph.

Phase 4: Detecting Memory Leaks. In this step, we perform path-sensitive analysis on these caller functions to detect memory leaks through under-constrained symbolic execution

(Ramos

and Engler, 2015). Specifically, LeakGuard tracks the dynamic allocation and release of memory objects and uses a memory leak checker to detect related defects, and verifies the feasibility of bug-triggering paths via an SMT solver, thus ensuring detection accuracy. Moreover, we developed a pointer escape analysis mechanism based on data flow analysis, which can effectively track the escape behavior of dynamic memory and hence reduce false positives. In this way, LeakGuard effectively avoids the exploration of unnecessary paths and alleviate the path explosion problem, thereby ensuring its scalability.

3.3 Modeling Mad Functions

Goshawk (Lyu et al., 2022) abstracts the memory management behavior of MAD functions through function summaries and incorporates these summaries to model memory management behavior dur- ing symbolic execution, thereby effectively simplifying the path exploration process. Goshawk has successfully applied the aforementioned methodology to the detection of Use-After-Free (UAF) and Double-Free (DF) vulnerabilities, achieving promising results. Compared to the aforemen- tioned two types of defects, memory leak defects are more significantly impacted by inaccuracies in function summarization. For instance, when a function is mistakenly identified as a memory allocation function, this misclassification does not generate any false positives for UAF or DF defects. However, in the case of memory leak detection, each invocation of the erroneously classi- fied function in the program will result in a corresponding false positive report of a memory leak.

This heightened sensitivity to summarization inaccuracies underscores the critical need for precise function characterization in memory leak detection methodologies. During the function summary generation phase, Goshawk first uses natural language processing to filter potential MAD func- tions based on function names and parameter information. It then employs a path-insensitive data flow analysis method to identify MAD functions within these functions. However, this method has certain limitations. Specifically, during the natural language processing phase, it may miss LeakGuard: Detecting Memory Leaks Accurately and Scalably

7

actual MAD functions. Additionally, the path-insensitive data flow analysis struggles to accurately model pointer assignment behaviors and has limited capabilities in pointer alias analysis. As a result, false positives and false negatives often occur when identifying memory objects managed by MAD functions. Furthermore, in real-world application scenarios, most memory allocation and deallocation operations are closely related to runtime parameters, whereas Goshawk currently sim- plifies these memory management operations by assuming they are executed unconditionally. This oversimplification further reduces the accuracy of the analysis.

In light of the aforementioned considerations, the current function summarization methodolo- gies prove inadequate for meeting the requirements of memory leak detection. Effective identifica- tion of memory leak defects necessitates precise function summaries that accurately capture and represent memory management behaviors.

We propose a bottom-up path-sensitive data flow analysis based on the function call graph to generate function summaries and obtain the complete set of memory objects managed by these functions. The process of generating MAD function summaries is iterative. It begins with predefined MAD seed functions, which are stored in the system as prior knowledge. These seed functions are typically standard library functions used for memory allocation and deallocation. We traverse the call graph to identify the callers of these known MAD functions and perform path-sensitive data flow analysis on them. This analysis helps determine whether the callers qualify as MAD functions, and their function summaries are updated accordingly. The process continues iteratively until all MAD functions are identified.

In each iteration of the process, we determine whether the callers of the existing MAD functions are also MAD functions. To optimize analysis time and reduce redundant computations, we do not analyze all the callers of the already identified MAD functions. Instead, we focus on the callers of MAD functions that were newly identified in the previous iteration or those whose allocated or deallocated memory objects have increased. This targeted approach effectively streamlines the data flow analysis by concentrating on the most relevant functions.

In the process of generating memory allocation function summaries, we model the memory allocation behavior in the target function based on the currently identified memory allocation functions. At the same time, we track the propagation of dynamic memory throughout the pro- gram using path-sensitive symbolic execution techniques. When dynamic memory is returned as a function return value or passed as a function parameter out of the target function along any execution path, the current function is identified as a MAD function. We then record its name and the allocated memory objects and incorporate this information into the function summary.

In the process of generating memory deallocation function summaries, we adopt a path-sensitive approach to track each parameter within the target function. If, along any execution path, a parameter is passed to a known deallocation function recorded in the function summary, the target function is identified as a memory deallocation function. Subsequently, we record the name of the target function and the index of the memory object released within its parameters, and write this information into the function summary.

Our data flow analysis is both path-sensitive and field-sensitive, which means our tool can accu- rately distinguish memory allocation across different program paths while precisely identifying the nested relationships among members within structures. Customized MAD functions and standard library MAD functions are not independent; instead, the memory management functionality of customized MAD functions is typically realized through the invocation of standard library MAD functions. In some cases, developers design customized MAD functions to maintain high cohesion by consolidating multiple memory allocation/deallocation operations with similar functionality into a single function. This design approach contributes to the widespread presence of customized MAD functions within the program. Notably, our tool can effectively handle nested MAD functions, in other words, a memory object managed by an outer MAD function contains those managed by all callee MAD functions.

Once a function is identified as an MAD function through data flow analysis, we store its name, characteristics, and the complete set of allocated/deallocated objects in the form of a func- tion summary. The function summary mainly include the function’s name, its properties, and the

8

Hongliang Liang et al.

2

static int dec alloc(DecoderPriv ∗∗pdec, Scheduler ∗sch, int send end ts){

4

...

11

...

Fig. 3 Code Snippet From Ffmpeg Project

set of objects it operates on. For instance, as shown in Figure 3, dec alloc is a custom MAD function in FFmpeg project, where a variable dp points to a memory region allocated by the function av mallocz. Subsequently, its two members dp->frame and dp->pkt point to memory regions allocated by the functions av frame alloc and av packet alloc, respectively. Finally, dp is assigned as the value of the function parameter pdec. In this way, the memory allocated by the dec alloc function can be passed to its caller functions. Accordingly, the function sum- mary generated by LeakGuard is {"name": "dec_alloc", "function_type": "Allocator", " ret_objects": [], "para_objects": ["pdec", "pdec->frame", "pdec->pkt"]}.

3.4 Identifying Caller Functions Of Mad Functions

All MAD functions, including both standard and custom functions, have now been identified. Based on the fact that a function exhibiting memory leaks must call at least one allocation-type function, we can assume that a function that does not call any MAD functions will not exhibit memory leaks. In other words, we can safely exclude these functions. Therefore, at this stage, we first generate the call graph for the target program. Subsequently, based on the function call graph and MAD function summaries, we filter out the set of functions that do not need to be explored by the under-constrained symbolic execution engine.

The under-constrained symbolic execution technique allows us to freely choose entry points without starting exploration from the main function, which lays the foundation for excluding cer- tain functions from exploration. Equally important as the under-constrained symbolic execution technique is the MAD function summarization technique. It abstracts memory allocation/deallo- cation behavior at a higher function level, helping us identify developer-defined MAD functions, which in turn allows us to exclude functions that do not perform memory allocation/deallocation, thereby reducing the exploration space for symbolic execution.

3.5 Detecting Memory Leaks

To check whether a caller function identified above contains memory leak, LeakGuard performs path-sensitive analysis on it via under-constraint symbolic execution (Ramos and Engler, 2015). Under-constrained symbolic execution allows exploration starting from specific functions, perform- ing symbolic execution and constraint solving even in the absence of complete constraint collection.

This approach effectively balances the accuracy and scalability of the detection. Based on under- constrained symbolic execution, LeakGuard directly executes a caller function of interest within the program, effectively skipping the costly path prefix from main to this function, which reduces the LeakGuard: Detecting Memory Leaks Accurately and Scalably

If

(!ossl quic wire peek frame ack num ranges(pkt, &total ranges)

8

|| (ack ranges = OPENSSL zalloc(sizeof(ack ranges) ∗(size t)total ranges)) == NULL)

If

(!ossl quic wire decode frame ack(pkt, 0, &ack, NULL))

14

...

Fig. 4 Code Snippet From Openssl Project

number and length of execution paths that must be explored. Additionally, LeakGuard leverages the ability of under-constrained symbolic execution to limit the exploration depth of function call chains, ensuring that only a manageable number of layers are analyzed for each function call. The combination of entry-point optimization and depth control significantly improves analysis efficiency while maintaining high coverage of code regions where memory leaks may occur.

Figure 5 shows a code snippet in OpenSSL, which contains a real memory leak bug. In the frame ack function, a pointer variable ack ranges points to a memory region allocated by an MAD function OPENSSL zalloc (Line 8), which is deallocated at by the OPENSSL free (Line 15).

However, frame ack function will exit if the condition at the line 12 is evaluated to be true, without releasing the memory region pointed to by ack ranges. Based on the path-sensitive analysis, Leak- Guard detected this bug and reported the trigger condition: the ossl quic wire peek frame ack num ranges function returns zero and the ossl quic wire peek frame ack num ranges function also returns zero. OPENSSL zalloc is a customed MAD function, which internally invokes standard library MAD functions to perform dynamic memory allocation. When LeakGuard encounters the OPENSSL zalloc function at the outermost layer, it can model the behavior of this function by reading the summary generated during the MAD summary generation phase, without the need to delve into the function itself. This method effectively reduces the complexity of data flow explo- ration and addresses the issue of standard library MAD functions being deeply embedded within the call chain, which prevents them from being explored and modeled.

Moreover, we establish a set of rules to identify memory leak bugs as follows: (1) When a pointer variable that points to a dynamically allocated memory region goes out of scope and ceases to exist, the memory region it points to has not been released. (2) The dynamically allocated memory region pointed to by the pointer variable in Rule 1 has not been passed outside the scope by being added to a global list, assigned to an external parameter, or returned as a return value.

When a pointer variable exits its scope but the memory object it points to is not deallocated, the first rule holds while this does not necessarily indicate a memory leak. This is because the memory object may have been reassigned to another variable before the pointer’s scope ended.

Specifically, ownership of the memory could have been transferred to a variable outside the scope prior to the pointer’s destruction. According to the second rule, a memory leak is only considered if the allocated memory has not been reassigned outside the scope. This reassignment, known as pointer escape, can occur in three scenarios: (1) the memory is returned as a return value, (2) the memory is assigned to a function parameter or a global variable, or (3) the memory is added to a global data structure like a list. For the first two scenarios, we analyze the pointer’s data flow to determine if it is returned or reassigned. In the third scenario, based on our observation that developers of real-world software often abstract such operations into independent functions with names including terms like add, insert or create and take as an argument the pointer to the

10

Hongliang Liang et al. global structure, we analyze these functions independently to accurately model their behavior and identify potential pointer escapes.

The key to implementing the aforementioned rules is modeling MAD functions, as detailed in Section 3.3. LeakGuard models the behavior of MAD functions by reading the summaries generated during the MAD function modeling phase. In the MAD function summary generation phase, path- sensitive analysis is employed, which accurately models pointer assignment operations, thereby enhancing the accuracy of the generated summaries. However, the generated function summaries do not include conditional information related to memory management operations, as many of these operations depend on complex runtime parameters. Including such conditions in the summaries would significantly increase their complexity.

In real-world programs, many custom MAD functions do not perform memory allocation or deallocation unconditionally. Instead, these operations are often determined by runtime parameters. For instance, a MAD allocation function may allocate multiple memory objects, and developers can control which specific objects are allocated by passing allocation flags as arguments to the function.

This approach is commonly employed when integrating multiple similar yet not entirely identical memory allocation requirements into a single MAD function, thereby enhancing code reusability and modularity. During the memory leak detection process, the symbolic execution engine relies on function summaries to model memory management behaviors. Failure to incorporate path- sensitive information during the modeling of memory objects can lead to false positives in the detection results.

Based on the above analysis, it is crucial to account for the conditions under which memory management operations occur during the symbolic execution phase. If all memory management behaviors in an MAD function are unconditional, the symbolic execution engine will model these behaviors directly at the outermost layer based on the function summary. However, if some memory management operations in the summary are conditional, the engine will increase the exploration depth of the function call, collecting path constraints for each sub-MAD function invoked within the function. When the engine encounters an MAD function inside the function, it will recursively perform the above checks until path constraint collection is complete. Notably, the engine only performs deep exploration of the MAD function call chain. For other function calls within the MAD function that are not related to the invocation of sub-MAD functions, the engine does not increase the exploration depth. This feature is enabled by the under-constrained symbolic execution technique used by the engine, which allows flexible setting of exploration depth and enables the engine to utilize existing constraints to solve path feasibility when constraints are insufficient. In this way, the engine can collect the path constraints for each memory management operation without triggering path explosion issues, thereby accurately modeling memory management behaviors.

Specifically, during the MAD function modeling phase, we systematically record whether dy- namic memory allocations or deallocations within the function are unconditional. When the sym- bolic execution engine encounters an MAD function where all memory objects are unconditionally allocated or deallocated, it directly models the corresponding memory management behaviors based on the function summary. However, if the MAD function summary indicates that certain memory management behaviors depend on runtime parameters, the engine will increase the exploration depth for both the function and its sub-MAD functions. It then performs constraint solving on the feasibility of memory management behaviors based on relevant path constraints, thereby elim- inating infeasible memory management operations under the current path. This approach enables precise modeling of memory objects.

Previous methods, such as (Shi et al., 2018; Fan et al., 2019; Emamdoost et al., 2021), typically stop tracking the data flow of a pointer once it is added to a global data structure and assume that such paths are not potential sources of memory leaks. Unlike these approaches, LeakGuard offers a more precise modeling of the memory state of global variables, thereby improving the detection of memory leaks involving global data structures.

Authors:

Peder EZ Larson 1, 2,* , Jenna ML Bernard1, James A Bankson 3, Nikolaj Bøgh 4, Robert A Bok1, Albert P. Chen 5, Charles H Cunningham 6,7, Jeremy Gordon1, Jan-Bernd Hövener 8, Christoffer Laustsen 4, Dirk Mayer 9,10, Mary A McLean11 12, Franz Schilling13, James Slater1, Jean-Luc Vanderheyden5, 14, Cornelius von Morze 15, Daniel B Vigneron1, 2, Duan Xu1, 2, and the HP 13C

94143, Usa.

Denmark. 5 GE Healthcare, Menlo Park, California, USA. 6 Physical Sciences, Sunnybrook Research Institute, Toronto, Ontario, Canada.

8 Section Biomedical Imaging, Molecular Imaging North Competence Center (MOIN CC), Medicine, Baltimore, MD, USA. Cambridge, United Kingdom.

14Jlvmi Consulting Llc, Dousman, Wi, Usa

#See Acknowledgements for a list of all HP 13C MRI Consensus Group Members This work was supported by the ISMRM Hyperpolarized Media MR Study Group, the ISMRM Hyperpolarization Methods & Equipment Study Group, and the Hyperpolarized MRI Technology Resource Center (NIH/NIBIB grant P41EB013598).

Abstract

MRI with hyperpolarized (HP) 13C agents, also known as HP 13C MRI, can measure processes such as localized metabolism that is altered in numerous cancers, liver, heart, kidney diseases, and more. It has been translated into human studies during the past 10 years, with recent rapid growth in studies largely based on increasing availability of hyperpolarized agent preparation methods suitable for use in humans. This paper aims to capture the current successful practices for HP MRI human studies with [1-13C]pyruvate - by far the most commonly used agent, which sits at a key metabolic junction in glycolysis. The paper is divided into four major topic areas: (1) HP 13C-pyruvate preparation, (2) MRI system setup and calibrations, (3) data acquisition and image reconstruction, and (4) data analysis and quantification. In each area, we identified the key components for a successful study, summarized both published studies and current practices, and discuss evidence gaps, strengths, and limitations. This paper is the output of the “HP 13C MRI Consensus Group” as well as the ISMRM Hyperpolarized Media MR and Hyperpolarized Methods & Equipment study groups. It further aims to provide a comprehensive reference for future consensus building as the field continues to advance human studies with this metabolic imaging modality.

Keywords: Hyperpolarized MRI, metabolic imaging, carbon-13, pyruvate, dissolution dynamic

Introduction

MRI with hyperpolarized 13C agents, also known as hyperpolarized (HP) 13C MRI, has shown great potential as a novel imaging modality, particularly for its ability to probe metabolic processes in real time. The first human studies with HP [1-13C]pyruvate were performed in 2011 in prostate cancer patients (1).

Since then, there have been over 60 papers published with imaging results of human subjects from 13 different sites, with applications including prostate cancer, brain tumors, breast cancer, kidney cancer, pancreatic cancer, metastatic disease, liver disease, ischemic heart disease, diabetes and cardiomyopathies. The vast majority of these studies used [1-13C]pyruvate (1–63), where [2-13C]pyruvate (64) and 13C-urea (56) have been demonstrated too.

As clinical HP 13C MRI advances, there is a growing need to build consensus for best practices, which are critical for comparing data across sites, performing multi-site trials,deploying methods to new sites, partnering with vendors, and potentially for obtaining broader regulatory approvals.

In March 2022, we initiated an effort to build consensus within the HP 13C MRI community with this opportunity in mind, and it was greeted with strong enthusiasm. The “HP 13C MRI Consensus Group”, containing over 55 members from 27 sites, identified the area of greatest need and opportunity for consensus building to be HP [1-13C]pyruvate human

●

Pyruvate is the most mature and widely used HP agent and has the most significant translational evidence emphasizing the potential clinical impact.

●

Clinical trials, particularly multi-site trials, have the strongest need for consensus methods to ensure that data can be combined across sites. This work is a Position Paper for which the goal is to describe current successful practices and study methods for HP [1-13C]pyruvate human studies along with justification to support those practices. This is divided into four major topic areas: (1) HP 13C-pyruvate preparation, (2) MRI system setup and calibrations, (3) data acquisition and image reconstruction, and (4) data analysis and quantification (Fig. 1). The current successful practices and study methods include a literature review of published peer-reviewed journal papers showing human HP [1-13C]pyruvate study data, up to September 2022 (1–63), as well as new unpublished information from surveys of HP 13C study sites. Based on this information, we also highlight the evidence gaps, strengths, and limitations of current practices which are summarized at the end of each section.

Figure 1: Illustration of the HP 13C MRI human study process, including the 4 major areas covered in this paper: Hyperpolarized 13C-pyruvate preparation, MRI system setup and calibration, Acquisition and Reconstruction, and Data Analysis and Quantification.

Figure 2: Anatomical targets of HP [1-13C]pyruvate MRI human studies published up to September 2022.

Hyperpolarized 13C-Pyruvate Preparation

This section covers the processes for creating the HP agent, 13C pyruvate, and will include many aspects and considerations that are needed to safely and effectively prepare doses for metabolic imaging studies in human subjects. These include material, personnel, equipment and facility, fluid path preparation, quality control, and release.

It is helpful to understand that the specifications of a dose of 13C pyruvate suitable for in vivo MR HP metabolic imaging were shaped in part by early preclinical studies performed by GE HealthCare summarized in Ref. (65). In short, the safety of the two novel drug components, 13C pyruvate and the electron paramagnetic agent (EPA) AH111501, were demonstrated in those studies. The more precise formulation of the dose suitable for human use was then determined from clinical studies (66) that included two Phase 1 clinical trials in young and elderly healthy volunteers without hyperpolarization of the 13C nuclei and another Phase 1/2a dose escalation and imaging feasibility study with HP 13C pyruvate in 31 prostate cancer patients at the With the exception of the first HP 13C imaging clinical trial, which utilized a prototype device in a cleanroom (1), all HP 13C studies performed in humans to date have utilized the SPINlab polarizer (manufactured by GE HealthCare). Consequently all doses of the HP 13C pyruvate delivered by SPINlab have been produced using the “SPINlab Pharmacy Kit” that serves as the container-closure system for the various drug components (13C pyruvic acid and EPA mixture, dissolution medium, and neutralization and dilution medium) during sample polarization, dissolution and quality control (QC) processes. Thus many aspects of the HP sample preparation considerations discussed below are related to the SPINlab instrument and the consumables designed to be used with it (67).

General Considerations

While more than 860 patients or healthy subjects having been injected with HP 13C pyruvate as of January 2022 without reports of any serious adverse events (68), HP 13C pyruvate injection remains an investigational MR contrast agent and can only be administered by those with Investigational New Drug (IND) exemption from the Food and Drug Administration (FDA) in the USA, a Clinical Trial Application (CTA) in Canada, approval from National Research Ethics Committee Services in the UK, or approval from the relevant local regulatory body. Thus, methods and processes involved to produce a dose should have patient safety as the first priority. Since utilizing dissolution dynamic nuclear polarization (dissolution-DNP) for human use is still a relatively new development, there are no existing published regulatory guidelines specifically for this method.

There are two major production styles that determine how various sites approach the agent preparation. In the US, the most common approach is to rely on a sterilizing filter (“Terminal Sterilization”) to ensure sterility of the final product, akin to PET tracer production, where a starting molecule with a radioisotope is processed using various other ingredients to make the final, desired and injectable contrast agent within a necessarily short amount of time (69). For these sites, sterilization of the components and accessories upstream of this filter are not required, although many of them were manufactured and tested following Good Manufacturing Practice (GMP) or Good Laboratory Practice (GLP) requirements. The filling process is usually performed under an ISO 5 laminar flow hood, but a clean room or an isolator is not required.

This approach is typically accompanied by testing the integrity of the sterilizing filter prior to release of the dose for injection. Typically, post release endotoxin and sterility tests are performed using an aliquot reserved from each released dose.

In the UK and EU, the most common approach is to more-closely follow sterile pharmaceutical compounding guidelines (70), where all components and ingredients are required to be sterile or manufactured under GMP guidelines and are assembled and filled within a clean room environment or an isolator system (“Sterile Preparation”). Typically a batch of Pharmacy Kits for HP 13C pyruvate injection are prepared together. The sterility of the final dose is also ensured by batch validation testing, in addition to the sterility of the ingredients and the sterile compounding process. The endotoxin and sterility testing are performed for the process validation but are not performed for each injected dose.

Some institutions fill and assemble the Pharmacy Kit required for a specific study on the same day or the day prior to polarization, dissolution, and patient administration, but others have also demonstrated the feasibility of preparing a batch of kits, keeping them in a -20ºC freezer and using them over a period of a few months.

Beyond the obvious requirements that the process and the facility has to ultimately produce a dose that is safe to inject into a human, regulatory authorities will also focus on the question “Are you in control of your processes?”. To be in control of your process requires an in-depth and broad understanding of all processes involved in pre, post, and during the production process.

Personnel

It is typical and may be required to have licensed personnel involved in the production process depending on local regulations.Typically a pharmacist, radiopharmacist or other similarly qualified person (QP), in charge of the facility where the Pharmacy Kit filling and preparation is taking place, is responsible for the overall process and the release of the injectable dose.

Qualified cleanroom technicians are often involved in the Pharmacy Kit filling under the supervision of the pharmacist or QP. As is required for pharmaceutical compounding or PET tracer production, training requirements and training records for all personnel need to be maintained and available for audit by the FDA or equivalent.

Equipment And Facility

The facility and all equipment need to have standard operating procedures (SOPs) that describe how equipment is used, maintained, and calibrated to comply with relevant legislation. Currently, almost all the filling of the Pharmacy Kit takes place within a compounding laminar flow hood or isolator (typically ISO 5). At some sites, the filling is conducted within a cleanroom, while at others, it is conducted in a dedicated non-cleanroom space, reflecting differences in cleanroom approach and specifications between regulators worldwide (71). Some equipment or facilities, such as the compounding hood or cleanroom, may require external certified laboratories for testing.

Material Handling

Material handling guidelines (69,70) require SOPs detailing a system to track all of the materials involved in the HP production process for a particular patient dose, similar to current good manufacturing practice (cGMP) requirements for material handling for drug compounding. This includes acceptance standards, storage conditions, amount used in the patient dose for each ingredient and materials used in the assembly of the fluid path and Pharmacy Kit. Currently some users choose to open and inspect and sometimes modify the Pharmacy Kits upon arrival, but some users keep them in the sealed packaging until they are required for dose preparation.

Pharmacy Kit Filling And Assembling

As required by an IND or its equivalent, the preparation of the doses of HP 13C agent are detailed in the Chemistry, Manufacturing, and Control (CMC) section of an applicable regulatory submission; an example of this has been made available (72). It describes the processes of filling the Pharmacy Kit with the different components that make up the final drug product, and of assembling the final kit for either storage or immediate use in the polarizer. Special attention should be given to the laser welding process in order to satisfy installation qualification (IQ) and operational qualification (OQ). Typically, the final developed process is validated by process qualification (PQ) runs, during which 3 or more Pharmacy Kits are filled and used and the final HP 13C products are tested for endotoxin and sterility and to confirm that they meet the dose specifications for injections (usually including pyruvate concentration, residual EPA concentration, pH, liquid state polarization level and dose temperature). The data from 3 consecutive PQ runs are submitted as part of the IND submission (or its equivalent), and are often also reviewed by the Institutional Review Board (IRB) where the studies are conducted.

Quality Control And Dose Release

The quality control (QC) and dose release can be separated into two aspects: one is the QC and release of the filled Pharmacy Kit, and second is the QC and release of the HP 13C agent for injection, after polarization and dissolution. For institutions filling a batch of kits and storing them to use over a period of time, typically the batch can be released based on initial validation, environmental monitoring data from the day of kit production, and if filters are used during preparation of any of the components, filter integrity testing. But in some cases one or more kits are used for validation before the batch of kits are released for future use. For institutions that fill only the kits required for specific studies shortly before the experiment, the filled kits often do not go through separate release tests before they are used.

The quality control of the HP 13C pyruvate solution post dissolution is primarily performed to ensure that the agent meets the dose specifications (Table 1) before it is administered to the subject. These specifications target both safety (pH, residual EPA, temperature) and efficacy (pyruvate concentration, polarization, volume). Typically, the pyruvate concentration, residual EPA concentration, pH, dose temperature, dose volume, and liquid state polarization are measured by the QC accessory associated with the SPINlab polarizer. Some users perform a secondary measurement for one of the parameters, such as pH, using a different instrument or pH paper. For sites that do not go through a separate release testing process for batch filled kits, the integrity of the sterilization assurance filter, a part of the Pharmacy Kit, is typically tested as a part of the dose release. It is also common for these users to preserve an aliquot of the final HP 13C pyruvate solution for post-release endotoxin and sterility testing. This testing cannot be completed fast enough to test an individual dose prior to injection, but this is why other processes such as PQ runs and validation testing are done to minimize the chance a subject could be injected with a contaminated dose.

The Final Dose Release And Injection

should be done under the supervision of a licensed professional, based on local regulations.

Some Key Challenges

Many of the challenges associated with HP 13C pyruvate preparation can be attributed to the conditions required for the dissolution-DNP method of high magnetic field (~3-7 T) and very low temperature (~1 K) during polarization, with pressurized and superheated water necessary for the rapid dissolution event. These extreme conditions are quite challenging for the design of the container-closure and fluid path system. In particular, the cryogenic temperature in the polarizer requires special attention to any moisture or ambient (moist) air introduced into that portion of the fluid path, which can form an ice block at ~1 K. This ice can lead to flow restriction during the dissolution event and reduce the strength of the laser welded bond between the cryovial and its cap. This can ultimately produce failures in the dissolution step, including variations in final pyruvate concentration and pH that may fail to meet QC release criteria as well as fluid path ruptures that provide no available dose and result in polarizer down-time.

The polarization of the HP 13C pyruvate sample decays quickly over the span of a few minutes after dissolution, and thus the process of dissolution, QC for release, and injection should be completed as fast as possible to preserve the high polarization level achieved. Any delays in the preparation process, such as transportation time or equipment malfunction, can significantly reduce the final polarization and result in lower quality imaging data.

Current Practices

A summary of data collected from all sites performing clinical trials with HP 13C-pyruvate is shown in Fig. 3 and Table 1, including the specification of the final dose and how the quality control and release of the final dose are performed. There is a split in the Production Style, described in the General Considerations section above, with 8/13 sites using Sterile Preparation versus 5/13 using Terminal Sterilization. While many of the dose specifications show notable differences in acceptable ranges, all of these variations listed in tables have been successfully and safely been used to perform HP 13C pyruvate studies in humans. Their differences depend on the institutions’ preferences, resources and their particular regulatory situation. There is high similarity in pyruvate ranges, temperature ranges, EPA limits, and volume limits. There is modest variability in pH ranges and large variability in the endotoxin test limit. There is a 3-fold difference in acceptable polarization levels, which are measured to ensure a futile dose is not injected since the polarization is directly proportional to SNR. This reflects the decision by several sites to believe that useful data can be still be obtained with suboptimal polarizations.

Figure 3: Hyperpolarized agent preparation methods reported by sites currently performing HP

In House

Table 1: HP 13C-pyruvate preparation parameters, methods, and dose specifications used for quality control testing and release as well as validation. These were obtained from a survey of all sites performing clinical trials with HP [1-13C]pyruvate. The parameters used for product release are noted in bold text, otherwise these parameters are measured for batch validation or other QC measurements. The endotoxin and sterility testing are performed during process validation of the batch and/or post-injection, and largely depends on the agent production approach.

Summary

The overall safety record of HP 13C-pyruvate has been very strong, and the SPINlab hyperpolarizer has proven to provide high polarizations at human sized doses while meeting numerous QC and release criteria. A weakness remains the failure modes of the SPINlab Phamacy Kits (e.g. ice blocks, path ruptures), which are placed under extreme requirements particularly during dissolution. The preparation process still requires a high degree of expertise.

Therefore, there is a significant need to improve the reliability, robustness, and ease of operation for generating HP 13C-pyruvate doses for human studies. Furthermore, there is a divide between manufacturing and sterile compounding style preparation as well as other site-specific practices, resulting in variations in SOPs and justification required to relevant regulatory bodies. There have also been no comparisons between these approaches. It is also unclear what release criteria and QC parameters are truly required to ensure patient safety.

However, all of the reported methods are acceptable and approved by the appropriate regulatory authorities, and have led to the rapid expansion of successful human studies in recent years.

Mri System Setup And Calibrations

This section covers the MRI system setup, including the imaging system, RF coils, phantoms, and prescan calibration methods.

Imaging System

The main prerequisite for a given MRI scanner to be capable of supporting studies with HP 13C is its “broadband” capability to transmit and receive radiofrequency (RF) signal at the frequency of 13C, which is around 4 times lower than 1H. This does not come as a default on clinical MR devices. The transmit power of the broadband amplifier should also be sufficient to support the intended flip angle and RF pulse shape with the employed transmission RF coil(s) for 13C. Most studies to date use relatively low flip angles (< 90 degrees) for HP 13C in order to preserve polarization for time-resolved imaging. The capability to receive 13C signal on multiple channels is also desirable to increase SNR, as discussed further in the “RF coils” section.

The choice of magnetic field strength is primarily dependent on the metabolites’ frequency separation due to chemical shift dispersion and 1H imaging. High field strengths do not enhance hyperpolarized 13C signal as they do for 1H because the signal strength in a HP experiment relies on manipulating the population of quantum energy states outside of the MRI scanner.

However, the injected HP 13C-pyruvate and its metabolic products have greater frequency separation at higher fields, and it may thus be easier to separate and quantify these resonances at higher fields. This comes at the cost of a reduction in the achievable T2* and often reduced T1. As the initial polarization is independent of the imaging field strength it has been proposed that the increased T2* at 1.5T can potentially be exploited to increase SNR by adapting the acquisition bandwidth or reduce off-resonance imaging effects in cases when the decay of the transverse magnetization is dominated by T2* (73). In practice, 3T has been used in all published human 13C-pyruvate studies surveyed (Supporting Table S1), and comprises the majority of scanners currently in use for human studies (Table 3). A field strength of 3T is well-suited for 1H MRI anatomical reference and correlative imaging.

Stronger and more rapidly slewing magnetic field gradients support more rapid spatial encoding, particularly for metabolite-specific single-shot imaging using echo-planar imaging (EPI) or spiral imaging (See “Acquisition and Reconstruction”). Although the spatial resolution acquired for HP 13C imaging is typically much coarser than for 1H MRI, the factor of ~4 in gyromagnetic ratio leads to the same reduction factor in performance of the gradient system, so 13C experiments are potentially more limited by gradient hardware performance. To date, all human studies have used the commercially-available integrated gradient systems provided in clinical MRI scanners.

Optimization of scanner design has understandably focused on minimization of artifacts in 1H MRI, where devices such as room lights, the gradient amplifiers, and the motors driving the patient bed are checked to ensure that they do not produce RF interference at the 1H frequency, but artifacts may arise at other frequencies. Eddy current compensation is also not always appropriately adjusted for nuclei at other frequencies (74). In order to optimize for 13C, many sites have performed checks on phantoms for RF interference, gradient artifacts, and eddy currents (74), including the use of post-hoc gradient impulse response function characterisation and correction, and some vendors have fixed these issues as well.

Rf Coils

For HP 13C imaging studies in humans, RF coils for both 1H and 13C nuclei are needed, with 1H MRI providing an anatomical reference for registration and optional additional multiparametric MRI readouts. At the Larmor frequency of 13C nuclei, the relative contributions from coil noise compared to sample noise increase compared to 1H (73,75), although sample noise still is likely the dominant contributor for human-sized coils at 32.1MHz - the resonance frequency of 13C nuclei at 3T.

The key requirement for human 13C-pyruvate RF coils are that the coil geometry and sensitive volume must cover the volume of interest in the subject. Table 2 and Figure 4 shows coil configurations that have been used and optimized for applications in different anatomic regions.

Volume resonators are most commonly used for transmit, as they surround the subject to

Provide B1 Transmit Across The Fov (B1

+). While 1H relies on a large birdcage (“body”) coil built into the scanner, 13C transmit coils must be placed inside the bore. This takes up valuable space within the magnet, and also has led to the use of designs with relatively inhomogeneous

B1

+. Many human studies have used Helmholz pair resonators for transmit, including the “clamshell coil”, which has a notably inhomogeneous B1

+ Profile But Has Been Used Because Of

relatively easy integration into the scanner bore. B1

+ Variation Results In Variations In The Flip

angles that control the use of the hyperpolarized magnetization and creates errors in common HP metrics (9,76). The exception are head coils, where birdcage designs with highly

Homogeneous B1

+ can be placed around the head while easily fitting inside the bore. As with 1H MRI, higher SNR can typically be achieved by smaller receive coil elements, such as surface coils or phased arrays, and the majority of 13C receive coils used have layouts similar to 1H phased arrays.

RF coil quality control is important to ensure proper functioning of the coils to provide consistent imaging quality, especially with limited natural abundance 13C signal in vivo. It typically involves 1) a physical integrity check of the coil cables and connectors and 2) phantom SNR tests to check the coil’s performance and to monitor it over time (see Phantoms below). An useful reference for RF coil quality control is outlined in the MRI accreditation program of the American College of Radiology (77) and can be adapted for 13C coils.

Notably, configurations for brain and prostate studies used dual-tuned 1H/13C coil designs, which greatly simplify workflow and registration of 1H and 13C images, as no switching of coils is needed.

(1)

Table 2: RF coil configurations reported for human HP [1-13C]pyruvate studies.

Tx = Transmit

coil, RX = receive coil. The commonly used “clamshell” TX coil is a Helmholz pair design. For 1H RF configurations, all used the Body coil for TX unless otherwise noted, and “repositioned” indicates the 13C coil was removed for 1H imaging. One representative reference is listed for each configuration. The RF coil configurations reported in the reviewed papers are shown in Supporting Table S1.

Figure 4: Examples of RF coil configurations used for human HP [1-13C]pyruvate brain studies. (A,B) 13C Clamshell TX (Helmholz pair) and 2× 4-channel paddle RX arrays. (C) 13C Birdcage volume TX and 32-channel RX array (RX array slides into TX coil). (D) 13C Birdcage volume TX and 24-channel RX array, combined with a 1H 8-channel RX array. Image reproduced with permission from Ref (16).

Phantoms

Since hyperpolarized magnetization is non-renewable, phantoms containing 13C nuclei are important to: 1) test the multi-nuclear capabilities of the imaging system, including all parts of the signal excitation and receive chain; 2) perform calibration measurements before a scan with hyperpolarized nuclei; and 3) perform necessary pre-scan adjustments (see “Prescan Calibration” section). The phantoms currently in use are listed in Table 3. Their composition must provide sufficient 13C signal, with additional considerations of conductivity, stability, chemical shift(s) present, potential for dynamic imaging, and cost. The phantom geometries are typically either compact, in order to be used alongside the subject during a HP scan, or large enough to mimic the inner volume of a RF coil for system testing.

One popular compact design contains enriched 13C-urea at high concentration, typically 8 M, which provides a single resonance, placed inside a small container ~1 mL. The most common recipe mixes 13C-urea in a 90% water/10% glycerol solution, with glycerol used to increase the urea solubility and doping with a Gd-based contrast agent to shorten T1 which increases the potential SNR per unit time. For example, when Dotarem is added at a 3:1000 volume ratio the 13C-urea T1 is around 500 ms and T2 is around 100 ms. However, when testing pulse sequences influenced by T1 and T2, doping should be used carefully. This phantom is suitable for frequency calibration, transmit gain calibration, sequence testing, and as a fiducial marker when placed next to a patient. However, enriched 13C-urea has a relatively high cost compared to natural abundance compounds.

For larger volumes (>100 ml), the phantoms most often used contain undiluted ethylene glycol, glycerol, or dimethyl silicone. These compounds have sufficiently high carbon concentrations to provide sufficient 13C signal even with the 1.1% natural abundance of 13C. These larger phantoms matching the inner volume of an RF coil are useful for coil testing, including transmit

+) And Receive (B1

-) coil profile mapping, as well as to mimic acquisitions using in vivo FOV requirements. In this case, size and conductivity should match the expected subject size in order to mimic coil loading and get a realistic estimation of B1+. Large-volume natural abundance urea phantoms have also been used by some sites, but suffer from higher conductivity compared to biological tissues. Typically, it is easier to increase the conductivity and hence coil loading of the non-conductive phantom by adding NaCl to match physiological loading (16,78).

Dynamic phantoms that aim to mimic metabolite kinetics have also been developed (79–81), and have the potential to more closely mimic the HP experiment, but so far these are not widely used.

Prescan Calibration

Prior to performing an MRI acquisition, the so-called prescan procedure is used to set the shim parameters to maximize B0 homogeneity over the field of view (FOV) or a specific region of interest (ROI), the scanner center frequency (CF), the RF transmit gain, and the receiver gain.

While this calibration procedure is usually automated for 1H, the lack of sufficient natural abundance 13C signal prevents use of automated methods. (Although natural abundance 13C lipid signal has been detected, there are so far no reports on using this signal for prescan.) Table 3 shows current practices across sites.

Maximizing B0 homogeneity is independent of the nucleus and is therefore performed prior to 13C imaging using the 1H water signal and existing shimming tools, such as by a standard automated process (“Auto Shimming”) or using high order shimming routines. Similarly, the 13C CF can be calculated from the 1H CF using a predetermined scaling factor that depends on the target chemical shift (82). Another common approach used is to have a small, high-concentration 13C phantom, e.g. 8M 13C-urea, integrated in the RF coil or placed next to the scan subject (1). The reference frequency can also be based on real-time measurements after the HP injection but prior to imaging (83). Both the CF and B0 shimming are critical when using spectrally-selective RF pulses, as inmetabolite-specific imaging methods, where the desired excitation bandwidths are typically very narrow and frequency offsets can lead to a failure mode that is only apparent after injection.

The calibration of the RF transmit power is typically performed on a small, high-concentration 13C phantom placed near the region of interest during the scan or on a large 13C phantom of similar size and coil loading as the subject, prior to the subject scan. Reference power is often done by sweeping the power in a pulse-acquire sequence (53,62), or the Bloch-Siegert method (52,84). When using a small phantom, the location of the phantom, B1

+ Inhomogeneity As Well

as any shielding effects, e.g., when the phantom is integrated into a coil (1), may degrade the accuracy. Other methods include real-time Bloch-Siegert method measurements after the HP injection (83), and using the stronger natural abundance 23Na signal that is close enough to the 13C resonance frequency to be detected by 13C coils (82).

The receiver gain is predetermined, either systematically based on independent phantom measurements and assuming the dose and polarization of the HP compound is known prior to injection, or based on past HP imaging studies.

Power [Kw]

Phantom(s) - during study Phantom(s) - before study 13C Frequency

8

13C-bicarbonate doped with dimethyl silicone, various

Maximum Values

Table 3: Summary of the imaging systems, phantoms, and prescan procedures used at sites currently performing HP 13C-pyruvate human studies. These were obtained from a survey of all sites performing clinical trials with HP [1-13C]pyruvate. *Previously performed studies with a Siemens 3T Tim Trio. The imaging systems, phantoms, and prescan procedures reported in the reviewed papers are shown in Supporting Table S1.

Summary

Commercially available 3T MRI systems are by far the most commonly used for human HP 13C-pyruvate studies, although a systematic investigation of the impact of B0 has only recently been investigated (73). The multi-nuclear RF transmit and receive chain has proven sufficient for current acquisition strategies, although many sites have observed artifacts due to RF interference, gradient interference, and residual eddy currents when operating at the 13C frequency. A variety of 13C RF coils, tailored for numerous anatomical targets, have been successfully demonstrated, with the main limitation that most transmit coils take up a lot of additional space inside the bore and provide relatively inhomogeneous B1

+ Profiles. The

phantoms used have converged into generally 2 categories - small phantoms containing 13C-enriched compounds that can be used during the study and human-sized phantoms containing compounds with high carbon concentrations but without 13C enrichment that are used to test and calibrate the coils. There are no standardized compositions or geometry, and dynamic phantoms that recapitulate in vivo kinetics would be desirable but are still an emerging area. Prescan calibration procedures were not well defined in most publications, so we surveyed individual sites to determine current practices. Calibration procedures for the B0 field (13C CF and shimming) for most sites take advantage of 1H signal and methods, while methods

For Calibration Of B1

+ is more variable across sites, likely a reflection of remaining challenges in how to perform this calibration. Standardization of both phantoms and calibration procedures would synergistically improve the robustness and reproducibility of HP 13C studies.

Acquisition And Reconstruction

Data acquisition strategies in human HP [1-13C]pyruvate MRI studies must account for multiple chemical shifts, efficiently utilize the non-renewable HP magnetization, and acquire data quickly relative to metabolism and relaxation decay processes. These studies require spectral encoding to separate metabolites, necessitating pulse sequences that efficiently encode up to 5D data (3 spatial + 1 spectral + 1 temporal dimension). RF pulses must efficiently sample without immediately saturating the non-renewable HP magnetization, and sequences must acquire data quickly and be robust to both experimental and physiologic variation (e.g. B1

+ Inhomogeneity,

variation in perfusion) to ensure reproducibility and minimize scan-to-scan variability. This section covers current successful practices for data acquisition in human [1-13C]pyruvate studies, and accompanying 1H imaging, from different anatomic regions, including scan parameters and image reconstruction.

Acquisition And Reconstruction Methods

The acquisition methods used in human [1-13C]pyruvate studies can be classified into 3 categories: 1) MR spectroscopy or MR spectroscopic imaging (“MRS/I”), 2) chemical shift encoding methods, and 3) metabolite-specific imaging (Fig. 5).

Mrs/I Methods Specifically

resolve a spectrum that can be analyzed to extract expected as well as unexpected resonances, making this approach very robust. It was used in many initial studies (1).

Chemical Shift

encoding methods, most commonly the Iterative Decomposition of water and fat with Echo Asymmetry and Least-squares estimation (IDEAL) method, use imaging sequences acquired with multiple TEs and rely on a model-based separation of expected chemical shifts (85).

Metabolite-specific imaging methods use specialized RF pulses that are spatially and spectrally selective to excite individual metabolites which are then typically imaged with fast k-space trajectories such as echo planar imaging (EPI) or spirals (86).

Their Application To Different

organ systems is described below. The image reconstruction methods used in human [1-13C]pyruvate studies have typically been conventional methods (e.g. FFT, non-uniform FFT, or equivalent). The incorporation of accelerated imaging and advanced reconstruction methods including parallel imaging (4,57,87) and compressed sensing (7) has also been applied in human studies for improved spatial resolution, temporal resolution and coverage, but have the potential for additional artifacts as well as SNR losses due to ill-conditioning of the reconstruction (e.g. g-factor).

The Majority Of

published studies do not use accelerated imaging indicating the resolution and coverage achievable without acceleration is currently adequate for successful data collection. Performing coil combination, even with fully sampled data has also been shown to have specific challenges for HP human images: using naive sum-of-squares methods suffer from high noise amplification in the relatively low SNR regime of HP [1-13C]pyruvate (compared to 1H), motivating several HP 13C-specific methods that include data-driven coil sensitivity estimation which have shown obvious improvements over sum-of-squares (11).

More recently denoising techniques have been applied as post-processing of human HP data(41,42,44). The techniques applied are based on spatial-temporal singular value decomposition for unsupervised estimation of signal and noise components. They have shown improvements in apparent SNR in the brain and liver, while care must be taken to choose parameters such as the rank threshold to avoid oversmoothing and overfitting to the estimated signal components.

Prostate Studies

Prostate cancer was the first human application of HP [1-13C]pyruvate (1), and data was acquired with MRS/I methods: 1D dynamic MRS, single-slice 2D dynamic echo-planar spectroscopic imaging (EPSI), and single time point 3D EPSI. Advances in imaging strategies led to the development and application of new acquisition schemes, including undersampled 3D EPSI with compressed-sensing (7), model-based chemical shift encoding methods that use a priori information (47,59), and metabolite-specific EPI (10), all of which can provide volumetric whole-organ coverage and dynamic acquisitions.

The pyruvate bolus arrival in the prostate can vary by ± 10 s between patients, necessitating dynamic imaging to reliably and consistently capture the pyruvate bolus (18). For this reason, all currently ongoing studies acquire dynamic data. While MRS/I, chemical shift encoding, and metabolite-specific imaging can all achieve dynamic imaging, chemical shift encoding and metabolite-specific imaging provide greater dynamic and volumetric coverage (85). For scan prescriptions, the FOV is designed to provide full prostate coverage and typically to match the orientation of the anatomic imaging used for registration. Flip angles used in current studies are constant through time, as quantification with a variable-through-time flip scheme is highly sensitive to bolus timing (8) and errors in the RF transmit (B1 +) field (76).

Heart Studies

Data acquisition methods for 13C imaging in the heart must be designed to meet the demands of significant cardiac motion and blood flow. To cope with the periodic cardiac motion, most human heart studies to date used gating to the diastolic window, the longest cardiac cycle interval, which has reduced motion (2,22,28,30,35,36,38,45,52). The duration of the diastolic window limits the available data sampling time, making cardiac acquisitions the most time-constrained of the HP 13C MRI applications. The most common acquisition approach is metabolite-specific imaging with spiral k-space trajectories (2). Their single-shot imaging capability makes these methods particularly robust to motion effects. Furthermore, spiral k-space trajectories provide rapid k-space coverage and relatively benign flow and motion artifacts. The majority of studies have used 2D multi-slice acquisitions, but 3D encoding has also been used successfully (35).

Brain Studies

For HP 13C MRI of the human brain, the majority of studies have also used 2D (slice selective) acquisitions (10–12,14,16,28,33,40,41,44,51,53,60), with a trend toward volumetric coverage using 2D multi-slice metabolite-specific imaging. 3D metabolite-specific imaging of the whole brain, with phase encoding of the slice direction (34,57), has been shown to provide similar SNR efficiency (88) compared with multislice imaging. A number of studies have employed MRS/I (5,6,29,31–33,50,55) resulting in a spectrum from each voxel, which has the advantage of not requiring a priori information about which peaks to encode. This was important in early brain studies when it was not known which peaks would be detectable. Chemical shift encoding, using a set of images with different echo times and an iterative reconstruction of the individual resonances (i.e. the IDEAL approach (85)), has also been used (12,49,54), with the drawback that coverage in the slice direction was limited due to the time required to acquire multiple echo time images.

Abdomen And Breast Studies

The fundamental approaches to data acquisition and reconstruction in the abdomen and breast are largely similar to the aforementioned applications, but demand attention to particular challenges associated with these anatomic regions, especially relating to respiratory motion.

Although it has been shown that a basic 2D MRSI approach based on phase encoding and FID readout can be successfully applied for HP 13C imaging in breast (15) and kidney (13), major advantages in terms of spatiotemporal resolution and coverage have been realized using tailored approaches based on metabolite-specific imaging (43,62) and chemical shift encoding (43), which have facilitated multi-slice or 3D dynamic acquisitions over large FOVs in the abdomen (4,37,46).

The significant respiratory motion encountered in these regions can directly blur 13C images, and has further favored these rapid acquisition strategies. Motion also degrades B0 homogeneity, which can shift frequency-selective excitation profiles and introduce artifacts into rapid imaging readouts. This makes accurate determination of the acquisition center frequency and shimming essential in these regions which often cover large FOVs. (See “Prescan Calibration” section for more information). In some studies, breath-holding was used to minimize motion effects and enforce frame-to-frame data consistency (42). A pragmatic and reasonably effective approach for dealing with respiratory motion during 13C data acquisition is an initial breath-hold (as long as can be tolerated), followed by free-breathing (46,62).

1H Imaging

Collection of 1H imaging data is essential both for prescribing the 13C acquisition and for interpretation of the resulting 13C data. Multi-planar 1H scouts are acquired prior to 13C acquisition to enable graphical prescription of the 13C imaging region. All human HP 13C-pyruvate imaging studies acquire conventional MRI scans (e.g. T1- and T2-weighted volumes) for anatomic reference, aiming to cover at least the full 13C FOV. Acquiring these anatomic scans as close as possible to the time of 13C imaging (immediately before or after) minimizes potential misregistration between the data sets. Depending on the application, other advanced 1H sequences are also acquired (e.g. diffusion-weighted imaging for cancer imaging).

When contrast-enhanced data is acquired, it is done after 13C imaging, as paramagnetic contrast agents will accelerate 13C relaxation.

Reported Study Parameters

Figures 5 and 6, and Supporting Table S2 shows the reported acquisition study parameters for human HP [1-13C]pyruvate studies published as of September 2022. Figure 5 shows a mixture of MRS/I, metabolite-specific imaging, and chemical shift encoding methods have been successfully used, where spectroscopy-based methods have become less prevalent in recent studies. Figure 6 shows the acquisition timing, including the important start time and interval/temporal resolution, is quite variable across studies.

Figure 5: Acquisition methods used in published HP [1-13C]pyruvate human studies published up to September 2022, classified into: MR spectroscopy and spectroscopy imaging (MRS/I); chemical shift encoding methods, such as IDEAL, that use multiple TEs and model-based reconstructions; and metabolite-specific imaging methods that use spectrally-selective excitation to image a single resonance at a time.

Figure 6: Temporal acquisition characteristics reported in HP [1-13C]pyruvate human studies published up to September 2022. (a) Reported referencing of acquisition start times.

(B)

Acquisition start times reported when using dynamic imaging and when timing was reported relative to the end of the injection. (c) Temporal resolutions. “Not Applicable” indicates dynamic imaging was not used.

Summary

Three general categories of acquisition strategies have been used successfully for human HP 13C-pyruvate studies: MRS/I, model-based chemical shift encoding (e.g. IDEAL) methods, and metabolite-specific imaging methods. These have enabled successful studies in the prostate, heart, brain, abdomen, and breast. Recent studies increasingly have used the imaging-based strategies of metabolite-specific imaging and chemical shift encoding which are the fastest methods, although a heads-to–head comparison between techniques has not been performed.

Metabolite-specific imaging is quite popular because of its speed and compatibility with single-shot imaging, but is sensitive to B0 field variations and thus requires careful calibrations. Nearly all studies surveyed acquired data dynamically, allowing measurement of the bolus and metabolite kinetics. The exact timings and associated flip angles vary quite widely across reported studies, with no consensus yet as to how to choose these parameters. Image reconstruction is typically done directly using Fourier Transform methods, and accelerated imaging strategies are uncommon.

Data Analysis And Quantification

This section covers the analysis of data from human HP [1-13C]pyruvate studies, including modeling and metrics, visualization, as well as considerations for how to store data and metadata. Depending on study design, the analysis may need to give quantitative or semi-quantitative output reflecting a biological process or may just reflect a contrast between different regions of interest for quantitative evaluation.

Metrics

Figure 7: HP [1-13C]pyruvate raw data (A) have typically been quantified using four categories of metrics depending on the acquisition. Data acquired as a single time point are often quantified using normalized metabolite images or metabolite ratios (B). Dynamic data can be quantified using normalized metabolite images or metabolite ratios (B), or with metabolite timings such as time-to-peak (TTP) or pharmacokinetic (PK) models (C). The latter two require the data to be time-resolved. [1-13C]alanine and 13C-bicarbonate are analyzed similarly to [1-13C]lactate but omitted here for display.

Metabolite images are commonly used as summary metrics for HP MRI data, often including some form of normalization as well as summed over time as an area under the time curve (AUC) (17). These are analogous to the visual evaluation that is most used for routine clinical work (89,90). In these metabolite images, we expect that the [1-13C]pyruvate AUC signal is predominantly weighted towards perfusion and uptake, while [1-13C]lactate, [1-13C]alanine and 13C-bicarbonate AUCs represent metabolic conversion. The strength of this approach lies in its simplicity and relatively few underlying assumptions. Limitations to the use of single-metabolite images or AUCs include sensitivity to inhomogeneous coil profiles (57,87,91), the acquisition strategy and acquisition parameters, pyruvate polarization and concentration level, and signal relaxation rates (92). Further, the reader must be careful to interpret all the images in conjunction to better understand the underlying biology; for example, increased [1-13C]lactate in the presence of decreased [1-13C]pyruvate delivery can have a very different meaning compared to increased [1-13C]lactate with increased [1-13C]pyruvate delivery.

In an attempt to address variations in coil sensitivity, polarization level, and pyruvate delivery, AUC images are often computed by normalizing to a specified parameter, such as the maximum pyruvate or average lactate signals, or presented as a ratio such as lactate/pyruvate or divided by “total Carbon” - the sum total of HP 13C signal observed across all metabolites. The AUC ratios between metabolites and pyruvate are proportional to the corresponding forward kinetic rates (81,93), but are not directly comparable to rate constants when magnetization loss rates (e.g. relaxation and losses due to signal excitation) differ between studies. Similarly, the ratios between the produced metabolites (e.g. bicarbonate/lactate) can reflect the balance between downstream metabolic pathways (12,55). Care must be taken to consider how AUC images are calculated and normalized before comparing values between studies.

To further quantify the interpretation, pharmacokinetic (PK) modeling approaches were developed to compute the apparent kinetics of pyruvate-to-metabolite exchange (92,94–99). These yield semi-quantitative to quantitative apparent rate constants, given in s-1. Some models require a vascular input function, while others avoid this requirement (95). PK models can explicitly account for acquisition-specific details such as excitation angle and repetition time, and thus may reduce the effects of these details on quantification. An input-less model, provided in the Hyperpolarized-MRI-Toolbox (https://github.com/LarsonLab/hyperpolarized-mri-toolbox) (100) and thus frequently employed for human data, has been shown to fit well and robustly to prostate and brain data (8,20). PK models are quantitative in nature, arguably provide more relevant biological information (8,20), and appear to be reproducible across sites (51). However, rate constants derived from PK models are still apparent rates, and likely do not reflect a single biological characteristic.

Some additional considerations include whether complex or magnitude data is used, as the noise behaviors will impact the analysis differently. Additionally, cut-off thresholds or other criteria may be used to identify and avoid voxels with insufficient SNR before analysis to improve robustness (20,41).

Regardless of the analysis approach, the underlying biology is not always clearly represented by the data; instead, the metrics may be influenced by perfusion, barrier permeability, intercellular shuttles, enzyme activities, co-substrate concentrations, or combinations thereof, depending on the organ and disease of interest (19,43,94,101–103). This may be addressed by incorporating complementary information. As an example, HP 13C pyruvate data is influenced by perfusion, and thus addition of perfusion MRI could be important for interpretation (98,104,105).

All the methods outlined above have been explored in clinical studies, described in Supporting Table 3 and summarized in Figure 8. As of September 2022, approximately 52% of studies involving human subjects report rate constants derived from a PK model with a few different models reported. A nearly equal fraction (51%) of the studies report AUC ratio values.

Approximately 66% of these studies report metabolite-specific images or AUC values. About 40% report SNR values; this metric is particularly frequent in manuscripts that describe technical developments for clinical HP MRI. Approximately 16% of these studies summarize model-free metrics, and 10% report measurements from a single timepoint. Most studies report a combination of quantities.

Figure 8: Reported metrics used for analysis in HP [1-13C]pyruvate human studies published up to September 2022.

Visualization

A wide variety of approaches have been used for visualizing data from human HP 13C-MRI studies. The challenges and practical considerations are: 1) choosing the appropriate metrics to display, 2) how to encode the parameters (e.g. the colormap), and 3) choosing how to provide anatomical context and other multi-parametric data. The choice of visualization also depends on the goal which could be for diagnostic interpretation, but also quality control, reproducibility among readers and publication.

Metrics

The choice of HP 13C metrics is described in detail above. At this stage in HP 13C development where there is no standardized metric, often a combination of metabolite images and ratios or PK model parameters are shown.

Parameter Encoding

The mapping function chosen should provide an adequate, often quantitative, impression of the parameter mapped. There is a consensus in the visualization field that perceptually uniform maps are best suited to visualize continuous parameters, like the greyscale typically used by radiologists as well as other monochrome (black to blue) and color ranges (fire-type, rainbow-type) (106,107). Multi-color heatmaps have been the most frequently employed method for HP 13C data, while greyscale has infrequently been used but it ensures there is no coloring-based bias as well as facilitating later reuse (Fig. 9a). Among the color schemes employed in the clinical HP 13C literature, fire-type scheme seems to be the most common [similar to “Plasma” or “Inferno” in matplotlib.org]. Next most commonly employed is the rainbow-type scheme [similar to “Rainbow” in matplotlib.org].

Anatomical Context

HP MRI faces the challenge that it does not necessarily depict the anatomical features, similar to PET, and thus requires an anatomical reference. Most often, a grayscale anatomical image is overlaid with a HP colormap (Fig. 9c,d). This approach is very intuitive, but can skew perception as the grey-scale anatomical reference may affect the brightness of the HP data (e.g. signal in the skull). This bias does not occur when showing adjacent maps (Fig. 9a, b). Here, anatomical outlines may help to provide reference (Fig. 9b).

Related Journal Articles & DOI Links

Selected peer-reviewed publications relevant to 12 Lead ECG Acquisition. Click the DOI to access the full paper (may require institutional access).

Why Choose Us?

Bangalore guidance for robotics, Spectre and autonomous systems projects.