VulDec is a new framework for detecting vulnerabilities in binary executables. It introduces a large, curated dataset that pairs real-world assembly functions with source code and detailed CWE annotations across multiple architectures. Using LLM-based neural decompilers trained on this dataset, the system achieves strong source-level recovery and a macro F1-score of 0.61 on realistic test data, demonstrating that neural decompilation can effectively replace traditional low-level binary representations for vulnerability detection.
arXiv:2512. 10485v2 Announce Type: replace-cross Abstract: Vulnerability detection methods based on deep learning (DL) have shown strong performance on benchmark datasets, yet their real-world effectiveness remains underexplored.
arXiv:2509. 23449v2 Announce Type: replace Abstract: Binary code similarity detection is a core task in reverse engineering.
arXiv:2606. 20502v1 Announce Type: cross Abstract: Whether LLMs scoring well on vulnerability benchmarks genuinely reason about security or merely pattern-match on contaminated data remains unresolved.
arXiv:2607. 04729v1 Announce Type: cross Abstract: LLM agents are increasingly applied to vulnerability analysis, but existing benchmarks have not kept pace.
arXiv:2608. 12246v1 Announce Type: cross Abstract: Evaluating security vulnerability detection tools requires benchmark datasets with vulnerability-inducing commits (VICs) - the commits that first introduce vulnerabilities into codebases.
arXiv:2608. 11766v1 Announce Type: cross Abstract: Binary code representation learning is a fundamental problem in software security and reverse engineering.
The paper introduces CodeScan, a black-box, vulnerability-oriented scanning framework designed to detect data poisoning and backdoor attacks in code generation large language models (LLMs). CodeScan operates by analyzing structural similarities across multiple code generations, normalizing them with abstract syntax tree (AST) techniques, and then applying LLM-based vulnerability analysis to identify recurring insecure patterns. Evaluations on 117 models across three architectures and multiple sizes show over 97% detection accuracy with fewer false positives compared to prior methods.
Evaluating security vulnerability detection tools requires benchmark datasets with vulnerability-inducing commits (VICs) - the commits that first introduce vulnerabilities into codebases. VICs are essential for determining the full range of vulnerable software versions.
Echo is a matching decompilation system that uses trusted back‑translation to guide an iterative search for source code whose recompiled assembly exactly matches a target binary. It generates candidate programs and compilation configurations with a domain‑specific model, compiles them, measures assembly similarity, and refines mismatches through rule‑based, neural, and reasoning‑based techniques. In evaluations on function‑level benchmarks and the Mirai malware binary, Echo achieves 2.43× more exact matches than the strongest baseline and outperforms GPT‑5.6 and Codex by 2.75× and 7.4× on Mirai, respectively.
arXiv:2608.30025v1 Announce Type: new Abstract: Large language models (LLMs) frequently generate source code containing vulnerabilities, yet little work studies the internal mechanisms that distingui...
arXiv:2610.27257v1 Announce Type: cross Abstract: Large language models can detect vulnerable code, yet the form of vulnerability encoding in their representations remains unclear. We analyze 8 code...
arXiv:2606. 15123v1 Announce Type: cross Abstract: We study the task of CVE-conditioned exploit generation, where a model drafts proof-of-concept (PoC) exploits given software vulnerability context.