arXiv AI
Jun 19
Multi-View Decompilation for LLM-Based Malware Classification
arXiv:2606. 20436v1 Announce Type: cross Abstract: Malware analysts often inspect compiled binaries through decompiled pseudo-C, when source code is unavailable.
Echo: Learning-based Matching Decompilation using Trusted Back Translation
Echo is a matching decompilation system that uses trusted back‑translation to guide an iterative search for source code whose recompiled assembly exactly matches a target binary. It generates candidate programs and compilation configurations with a domain‑specific model, compiles them, measures assembly similarity, and refines mismatches through rule‑based, neural, and reasoning‑based techniques. In evaluations on function‑level benchmarks and the Mirai malware binary, Echo achieves 2.43× more exact matches than the strongest baseline and outperforms GPT‑5.6 and Codex by 2.75× and 7.4× on Mirai, respectively.
Related stories
arXiv AI
Jul 13
REFORGE: A Method for Benchmarking LLMs' Reverse Engineering Capabilities in Decompiled Binary Function Naming
arXiv:2607. 07738v1 Announce Type: cross Abstract: Large language models (LLMs) are increasingly applied to reverse-engineering tasks, and recent threat-intelligence reporting shows them operating inside live offensive-security workflows.
arXiv AI
Jul 13
Practical Source Code Recovery from Binary Functions Using Anchor-Based Retrieval and LLM Reasoning
arXiv:2607. 09452v1 Announce Type: cross Abstract: We present a practical pipeline for recovering source code from stripped binary functions by combining reverse engineering, anchor-based source code retrieval, and large language model reasoning.
arXiv AI
Sep 7
When LLM Decompilers Recompile More and Preserve Less
The paper examines how large‑language‑model (LLM) decompilers, which produce clean, idiomatic C code, are currently evaluated mainly on recompilability and passing shipped tests. It shows that these metrics can mask significant behavioral differences: a decompiled function may recompile and pass all tests yet diverge on other inputs or lose disclosed vulnerabilities. To address this, the authors propose Decompile‑Diverge, a behavioral oracle that synthesizes drivers, fuzzes inputs, and compares the decompiled code’s behavior to the original, revealing divergences in up to 13% of cases and exposing gaps in current evaluation suites.
arXiv AI
Jul 13
Beyond Embeddings: Interpretable Feature Extraction for Binary Code Similarity
arXiv:2509. 23449v2 Announce Type: replace Abstract: Binary code similarity detection is a core task in reverse engineering.
arXiv AI
Aug 13
Instruction Alignment for Binary Code Representation Learning
arXiv:2608. 11766v1 Announce Type: cross Abstract: Binary code representation learning is a fundamental problem in software security and reverse engineering.
arXiv AI
Jun 3
Large Byte Model: Teaching Language Models About Compiled Code
arXiv:2606. 02834v1 Announce Type: cross Abstract: Malware analysis starts with the raw bytes of an executable program, and tools to "lift" these to higher-level representations, such as assembly, are expensive and subject to error.
arXiv AI
Jul 16
Generative Compilation: On-the-Fly Compiler Feedback as AI Generates Code
arXiv:2607. 13921v1 Announce Type: cross Abstract: Languages with rich static semantics, such as Rust, provide stronger guarantees for AI-generated code, but their strictness makes generation more difficult.
arXiv AI
2d ago
Are AI Coders Snitches? An Empirical Study of Pretraining Data Detection on Code Large Language Models
The paper investigates whether code large language models (CodeLLMs) inadvertently reproduce proprietary or sensitive code by evaluating seven state‑of‑the‑art training data detection (TDD) methods on eight CodeLLMs. It introduces CodeSnitch, a benchmark of 9,000 function‑level code samples across three languages, each labeled as included or excluded from training data, and applies mutation strategies based on the Type‑1 to Type‑4 code clone taxonomy to test TDD robustness. The study offers a systematic assessment of current TDD techniques for code and suggests directions for developing more effective detection methods.
arXiv AI
Aug 13
The Next Challenge for Agentic Cybersecurity: A Realistic, Contamination-Free Reverse Engineering Benchmark
arXiv:2608. 11469v1 Announce Type: cross Abstract: AI agents are rapidly improving in cybersecurity capabilities when the source code is available for analysis, yet much of the software most consequential to cybersecurity, including malware, firmware, and proprietary applications, is available only as binaries.
arXiv AI
Sep 10
SCRIPTIOC-BENCH: A Benchmark for Recognizing Actionable Threat Intelligence from Script-Based Malware using LLMs
SCRIPTIOC-BENCH is a benchmark designed to evaluate how well large language models can statically extract indicators of compromise (IOCs) from script-based malware. It contains 634 manually verified JavaScript, PowerShell, and VBScript samples and covers four IOC types—URLs, domains, IP addresses, and filesystem artifacts—while distinguishing between directly exposed and encoded indicators. Experiments show that even the best models achieve only 65.4 F1, and a false‑positive taxonomy is introduced to analyze error patterns, with two mitigations (deterministic string utilities and task‑specific adaptation) improving precision and shifting errors toward sample‑grounded mismatches.
arXiv AI
Jul 10
Beware What You Autocomplete: Forensic Attribution of Backdoored Code Completions
arXiv:2607. 08011v1 Announce Type: cross Abstract: Large language models have enabled powerful code completion systems that assist developers by predicting subsequent lines of code.