When LLM Decompilers Recompile More and Preserve Less
Researchers show LLM decompiler outputs can recompile yet diverge behaviorally, proposing the Decompile-Diverge fuzzing oracle to catch hidden changes.
The paper demonstrates that LLM-based decompilers can produce code that recompiles and passes all shipped tests yet diverges on other legitimate inputs—4.9% overall and up to 13% for one system—and can make disclosed vulnerabilities vanish without a visible crash. Across 300 real GitHub functions and 287 CVE-grounded functions, a refinement LLM lifted Ghidra's build rate from 75% to 90% while Matched rate fell from 74% to 62%, with up to one tenth of vulnerabilities showing Crash Absence. Decompile-Diverge detects these gaps by synthesizing drivers, growing fuzzing corpora from the reference, and rerunning decompiled code on identical inputs.
- Recompilability metrics miss behavioral divergence and disappearing vulnerabilities
- Decompile-Diverge oracle uses fuzzing corpora grown from reference functions
- Divergence traced to introduced fields, types, callees, and guards replacing unknowns
- Evaluated across eight systems in nine configurations on LLM decompilation corpora
- Products
- Decompile-Diverge
From the original article
1 min read at arxiv.orgDecompilation recovers high-level source from compiled machine code and serves as a foundation for security tasks such as vulnerability detection and malware analysis.
By Chang Liu · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.