When LLM Decompilers Recompile More and Preserve Less

• URL: http://arxiv.org/abs/2609.05370v1
• Date: Fri, 04 Sep 2026 17:16:18 GMT
• Title: When LLM Decompilers Recompile More and Preserve Less
• Abstract summary: We show that a function may and pass every shipped test yet diverge on other legitimate inputs.<n>We propose De-Diverge, a behavioral comparison oracle not relying on fixed or hand-crafted tests.
• Score: 35.2873296518414
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Decompilation recovers high-level source from compiled machine code and serves as a foundation for security tasks such as vulnerability detection and malware analysis. Traditional decompilers like Ghidra and Hex-Rays expose whatever they cannot resolve as visible placeholders and often emit pseudocode that will not compile or execute; LLM-based decompilers produce clean, idiomatic C and are now judged almost entirely by recompilability and re-executability: whether the output builds and passes its shipped input/output tests. We show that these metrics can reward the wrong path: a function may recompile and pass every shipped test yet diverge on other legitimate inputs, and a disclosed vulnerability may disappear from the recompiled code with no visible trace of the crash. Neither failure is caught by existing suites. To address this gap, we propose Decompile-Diverge, a behavioral comparison oracle not relying on fixed or hand-crafted tests: for each function it synthesizes a driver, grows a fuzzing corpus from the reference, and reruns the decompiled code on the same inputs to detect changes in the function's behavior. Across eight systems in nine configurations on established LLM decompilation corpora, candidates that pass every shipped test still diverge from the original on our input corpus: 4.9% overall, and as many as 13% for a single system. On 300 real GitHub library functions and 287 CVE-grounded functions, recompilability and behavioral agreement can come apart: the strongest refinement LLM lifts Ghidra's build rate from 75% to 90%, while its Matched rate falls from 74% to 62%; on disclosed vulnerabilities, up to one tenth exhibit Crash Absence in its output. Source-level analysis traces this divergence to introduced fields, types, callees, and guards that replace the visible unknowns traditional tools leave behind.

Related papers

• Recompilation Is Not Enough: Test-Guided Decompiled-C Repair [4.193403311740078]
  Decompiled C often becomes recompilable only after repair, but recompilation alone does not establish test-observed behavior.<n>We present a few-step workflow for repairing decompiled C using compiler feedback and related official tests.
  arXiv  Detail & Related papers  (2026-09-07T08:24:53Z)
• Multi-View Decompilation for LLM-Based Malware Classification [2.6107088019301252]
  We provide a benchmark of benign utilities and malicious programs spanning a range of threat behaviors.<n>We find that providing both decompiler views improves malicious-class F1, mainly by increasing recall on malicious samples.
  arXiv  Detail & Related papers  (2026-06-18T16:15:30Z)
• Correct Code, Vulnerable Dependencies: A Large Scale Measurement Study of LLM-Specified Library Versions [52.50730821321986]
  We present the first large-scale measurement study of version-level risk in large language models (LLMs)<n>We evaluate 10 LLMs on PinTrace, a curated benchmark of 1,000 Stack Overflow programming tasks.<n>Our findings reveal LLM version selection as a first-class, previously overlooked risk surface in LLM-based development.
  arXiv  Detail & Related papers  (2026-05-07T13:52:59Z)
• Constraint-Guided Multi-Agent Decompilation for Executable Binary Recovery [47.704311990064554]
  Decompilation is essential for security analysis, malware reverse engineering, and legacy software maintenance.<n>We present a multi-agent framework that transforms decompiled code into re-executable source through Multi-level Constraint-Guided Decompilation (MCGD)<n>Our framework achieves 84-97% re-executability, improving baseline decompiler output by 28-89 percentage points.
  arXiv  Detail & Related papers  (2026-04-27T01:28:11Z)
• PCodeTrans: Translate Decompiled Pseudocode to Compilable and Executable Equivalent [8.576619291429969]
  PCodeTrans bridges the gap between decompilation, recompilation, and rigorous function-level dynamic validation.<n>It achieves 100% function-level compilability on unstripped binaries alongside 99.55% and 99.89% test-validated behavioral consistency.
  arXiv  Detail & Related papers  (2026-03-16T05:54:24Z)
• Verifiable Provenance of Software Artifacts with Zero-Knowledge Compilation [5.939983212292006]
  We propose a novel approach to verifiable provenance based on compiling software with zero-knowledge virtual machines (zkVMs)<n>By executing a compiler within a zkVM, our system produces both the compiled output and a cryptographic proof attesting that the compilation was performed on the claimed source code with the claimed compiler.<n>Our results show that zk-compilation is applicable to real-world software and provides strong security guarantees.
  arXiv  Detail & Related papers  (2026-02-12T12:36:36Z)
• Context-Guided Decompilation: A Step Towards Re-executability [50.71992919223209]
  Binary decompilation plays an important role in software security analysis, reverse engineering and malware understanding.<n>Recent advances in large language models (LLMs) have enabled neural decompilation, but the generated code is typically only semantically plausible.<n>We propose ICL4Decomp, a hybrid decompilation framework that leverages in-context learning (ICL) to guide LLMs toward generating re-executable source code.
  arXiv  Detail & Related papers  (2025-11-03T17:21:39Z)
• D-LiFT: Improving LLM-based Decompiler Backend via Code Quality-driven Fine-tuning [49.16469288280772]
  Decompilers reconstruct human-readable source code from binaries.<n>Despite recent advances, their outputs often suffer from syntactic and semantic errors and remain difficult to read.<n>With the advent of large language models (LLMs), researchers began to explore the potential of LLMs to refine decompiler output.<n>We present D-LIFT, an enhanced decompiler-LLM pipeline with fine-tuned reinforcement learning.
  arXiv  Detail & Related papers  (2025-06-11T19:09:08Z)
• ReF Decompile: Relabeling and Function Call Enhanced Decompile [50.86228893636785]
  The goal of decompilation is to convert compiled low-level code (e.g., assembly code) back into high-level programming languages.<n>This task supports various reverse engineering applications, such as vulnerability identification, malware analysis, and legacy software migration.
  arXiv  Detail & Related papers  (2025-02-17T12:38:57Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.