VulDec: Vulnerability Detection in Binaries via Neural Decompilation

Francesco Crescenzo Grasso; Pietro Liguori; Roberto Natella; Domenico Cotroneo

cs.CROct 24, 2026

VulDec: Vulnerability Detection in Binaries via Neural Decompilation

Authors: Francesco Crescenzo Grasso, Pietro Liguori, Roberto Natella, Domenico Cotroneo

Organizations: DIETI, Universit`a degli Studi di Napoli Federico II, Via Claudio 21, Naples, 80125, Campania, Italy. · Computer Science, Gran Sasso Science Institute, Viale Francesco Crispi 7, L’Aquila, 67100, Abruzzo, Italy. · Department of Computer Science, University of North Carolina at Charlotte, 9201 University City Blvd, Charlotte, 28223, North Carolina, USA.

Abstract

Automated vulnerability detection in binary executables is challenging due to the lack of source code and the limited semantic information available at the assembly level. Despite significant progress in machine-learning-based code analysis, the field still lacks methodologies and large, high-quality datasets that provide vulnerable code jointly at assembly- and source-level with precise vulnerability labels. To address this gap, we introduce VulDec, consisting of (i) a new large-scale, carefully curated dataset aligning real-world Assembly-C function pairs with detailed CWE annotations across multiple architectures, and (ii) the first end-to-end framework that leverages neural decompilation for binary vulnerability detection. Tuned LLM-based neural decompilers trained on our dataset achieve strong source-level recovery across architectures (Edit Similarity of approximately 56%, BLEU-4 of approximately 43%), while our tuned LLM-based detectors reach a macro F1-score of 0.61 on an in-distribution realistic test set (3% vulnerability rate). Our findings provide evidence that neural decompilation offers a powerful alternative to conventional low-level binary representations, facilitating robust binary vulnerability detection.

Figures & tables

Figure 1: Illustrative example of the VulDec pipeline applied to a binary from OpenSSL

Figure 2: Automated compilation, cross-architecture assembly generation and source-level alignment

Figure 3: VulDec workflow: binary-level function analysis and vulnerability discovery

Figure 4: VulDec training and testing workflow: neural decompilation and vulnerability detection. Note: integrated data sources (Section 4 ) are used to enhance detection diversity

Dataset	ARM	x86	Dataset	ARM	x86
# functions	$28,426$	$31,340$	# projects	$24$	$24$
# vulnerable func.	$1,879$	$1,949$	# CWE Types	80	74
% vulnerable rate	$6.6\%$	$6.2\%$	LOC (median) C/C++	$18$	$18$
# common func.	$23,163$	-	LOC (median) ASM	$56$	$49$

Table 1: VulDec statistics on projects, CWEs, functions, and code metrics

Model	# parameters	ISA	Edit Similarity	BLEU-4	ROUGE-L
Qwen2.5-Coder	3.0B	x86	55.83	40.50	56.45
		ARM	56.60	43.42	55.96
CodeT5+	220M	x86	55.55	42.45	37.34
		ARM	56.12	44.41	38.10
DeepSeek-Coder	1.3B	x86	49.18	29.76	45.97
		ARM	47.17	27.51	44.21

Table 2: Automatic evaluation of the neural decompilation task. Results are reported for x86 and ARM architectures

Framework	Model	ES	Re-executability
Ghidra	Base	6.19	15.24
Tan et al. (2024)	LLM4Decompile-End-6.7B	12.93	36.71
	Ghidra + LLM4Decompile-Ref-6.7B	13.42	47.56
	Ghidra + LLM4Decompile-Ref-22B	13.58	59.76
	Ghidra + LLM4Decompile-Ref-33B	13.63	43.90
VulDec Decompiler	Qwen2.5-Coder-3B	32.82	34.34

Table 3: Human-Eval BenchMark (-opt 02) on VulDec x86 Decompiler

Strategy	Vul-Prec	Vul-Recall	Vul-F1	F1-score (macro avg)
Raw	0.463	0.097	0.160	0.571
Raw + CW	0.532	0.115	0.189	0.586
US 50-50	0.070	0.707	0.128	0.466
US 70-30	0.127	0.427	0.196	0.567
US 80-20	0.167	0.336	0.223	0.591
US 80-20 + CW	0.171	0.415	0.243	0.599

Table 4: Class-imbalance mitigation strategies using CodeBERT on validation set (

3\%

vulnerability prevalence). CW: Class Weighting; US: Under-Sampling

In-distribution Test Set
Model	Vul-P	Vul-R	Vul-F1	Acc	Prec	Recall	F1
DiverseVul ∗	–	–	–	0.923	0.518	0.433	0.472
FlawFinder	0.055	0.130	0.077	0.898	0.512	0.527	0.511
CodeT5 (base)	0.150	0.309	0.202	0.920	0.563	0.625	0.580
CodeParrot	0.164	0.276	0.206	0.930	0.569	0.614	0.584
DeepSeek-Coder	0.180	0.260	0.213	0.937	0.577	0.610	0.590

Table 5: Vulnerability prediction performance on an imbalanced in-distribution test set (

3\%

vulnerable samples). Reported metrics refer to the vulnerable class and overall macro performance

Figure 5: Architectural overview of the end-to-end evaluation via cross-combination pipelines evaluating rule-based and neural stages for decompilation and detection

Out-of-distribution Test Set
Pipeline	ES	BLEU-4	Vul-P	Vul-R	Vul-F1	F1
Ghidra $\rightarrow$ Flawfinder	26.27	9.19	0.00	0.00	0.00	0.49
Ghidra $\rightarrow$ VD-Det	26.27	9.19	0.03	0.04	0.03	0.50
VD-Dec $\rightarrow$ Flawfinder	36.83	19.36	0.04	0.07	0.05	0.51
VD-Dec $\rightarrow$ VD-Det	36.83	19.36	0.14	0.28	0.19	0.57

Table 6: End-to-end evaluation on an imbalanced out-of-distribution test set (3% vulnerability prevalence). The columns report cross-combinations of rule-based and neural tools for both decompilation and vulnerability detection

Figure 6: Correlation analysis between Edit Similarity (Decompilation Fidelity) and downstream classification performance (Accuracy and F1-Score). The density curve (left) highlights the sample distribution across the test set, while the trend lines (right) illustrates the performance metrics values as structural translation quality increases

Group	Distr %	Prec	Rec	Acc	F1
Uncategorized	48.47	0.58	0.68	0.91	0.60
Memory Management and Concurrency	32.30	0.58	0.72	0.92	0.61
Validation and Authorization Issues	6.66	0.60	0.72	0.92	0.63
Taint Propagation Issues	7.89	0.59	0.67	0.94	0.62
Data Protection Issues	4.19	0.53	0.57	0.91	0.54
Insecure Configuration Issues	0.48	0.49	0.42	0.83	0.45

Table 7: Performance of vulnerability prediction across vulnerability groups reported in Appendix 13 and ID test set distribution

Appendix figures & tables6 assets

Supplementary material from the paper’s appendix.

Appendix

Project	Version	ARM #functions	x86 #functions
linux	5.4.0	18,965	19,979
qemu	4.2.0	580	2,451
openssl	1.1.1f	1,303	1,311
vim	8.1.2269	857	843
mysql-server	8.0.40	147	145
samba	4.15.13	458	492

Appendix

Table 9: Project versions and number of functions per architecture

Category	Feature	x86 $\rightarrow$ C	ARM $\rightarrow$ C	C $\rightarrow$ target
Split	Total Examples	15,624	12,300	213,661
	Train	14,061	11,070	192,295 ∗
	Dev	781	615	10,683
	Test	782	615	10,683
Assembly	Min Tokens	9	8	–
	Max Tokens	512	512	–

Appendix

Table 10: Unified statistics for neural decompilation (x86/ARM) and vulnerability detection preprocessed datasets

Parameter	Neural Decompilation	Vulnerability Detection
Optimizer	AdamW	AdamW
Learning Rate	$5\times 10^{-5}$	$2\times 10^{-5}$
Epsilon (AdamW)	$1\times 10^{-8}$	$1\times 10^{-8}$
Weight Decay	0	0.01
Gradient Clipping	max_grad_norm = 1.0	–
Scheduler	1000 warm-up steps	Linear decay

Appendix

Table 11: Training configuration for neural decompilation and vulnerability detection

Architecture (Model)	Strategy	Vul-Prec	Vul-Recall	Vul-F1	F1-score
Encoder Only SLM (CodeBERT)	US 50-50	0.070	0.707	0.128	0.466
	US 70-30	0.127	0.427	0.196	0.567
	US 80-20	0.167	0.336	0.223	0.581
	US 80-20 + CW	0.171	0.415	0.243	0.591
Encoder-Decoder SLM (PLBART)	US 50-50	0.072	0.725	0.131	0.469
	US 70-30	0.131	0.450	0.203	0.572

Appendix

Table 12: Class-imbalance mitigation strategies extended to all model architectures on validation set (3% vulnerability prevalence). CW: Class Weighting; US: Under-Sampling; SLM: Small Language Model; LLM: Large Language Model

Macro-Category	Included CWEs
Taint Propagation Issues	CWE-20, CWE-74, CWE-77, CWE-79, CWE-89, CWE-116
Insecure Configuration Issues	CWE-16, CWE-611, CWE-276, CWE-732, CWE-933
Data Protection Issues	CWE-200, CWE-201, CWE-312, CWE-319, CWE-522
Validation and Authorization Issues	CWE-703, CWE-285, CWE-862, CWE-863, CWE-306, CWE-807
Memory Management and Concurrency	CWE-119, CWE-120, CWE-125, CWE-416, CWE-476, CWE-362, CWE-401
Uncategorized (Remaining CWEs)	This category aggregates all safe and vulnerable functions for which the CWE column is empty.

Appendix

Table 13: Mapping between macrocategories and associated CWE identifiers

Ground Truth	VulDec Decompiled
store_tabletJitterDelay( struct device *dev,	store_tabletJitterDelay( struct device *dev,
struct device_attribute attr, const char buf,	struct device_attribute attr, const char buf,
size_t count)	size_t count)
{	{
struct aiptek *aiptek = dev_get_drvdata(dev);	struct aiptek *aiptek = dev_get_drvdata(dev);
int err, j ;	int err, delay ;

Appendix

Table 14: Qualitative analysis of VulDec neural decompilation outputs across different performance tiers sorted by Edit Similarity (ES)

Software Vulnerability Detection

Software vulnerability detection identifies insecure code, pinpoints weaknesses, and helps developers validate or prevent exploitable bugs.

See all 143 papers

VulTriage: Triple-Path Context Augmentation for LLM-Based Vulnerability Detection
May 10, 2026Wenxin Tang, Xiang Zhang, Junliang Liu +11Software Vulnerability Detection Static Code Analysis
Tsinghua University · Henan University · Dalian Maritime University +8
VulValidate: Auditing Function-Level Vulnerability Labels with Executable Evidence
Oct 4, 2026Leizhen Zhang, Sheng ChenSoftware Vulnerability Detection
University of Louisiana at Lafayette, USA
When LLM Decompilers Recompile More and Preserve Less
Sep 4, 2026Chang Liu, Edward Raff, Kristopher MicinskiSoftware Reverse Engineering Differential Testing
Syracuse University · CrowdStrike

May 10, 2026J/K move · Enter open · S save

VulTriage: Triple-Path Context Augmentation for LLM-Based Vulnerability Detection

Wenxin Tang, Xiang Zhang, Junliang Liu, Jingyu Xiao+10

Tsinghua University · Henan University · Dalian Maritime University+8

Software Vulnerability Detection Static Code Analysis LLMs for Cybersecurity

Open paper AskPDF arXiv

Automated vulnerability detection is a fundamental task in software security, yet existing learning-based methods still struggle to capture the structural dependencies, domain-specific vulnerability knowledge, and complex program semantics required for accurate detection. Recent Large Language Models (LLMs) have shown strong code understanding ability, but directly prompting them with raw source code often leads to missed vulnerabilities or false alarms, especially when vulnerable and benign functions differ only in subtle semantic details. To address this, we propose VulTriage, a triple-path context augmentation framework for LLM-based vulnerability detection. VulTriage enhances the LLM input through three complementary paths: a Control Path that extracts and verbalizes AST, CFG, and DFG information to expose control and data dependencies; a Knowledge Path that retrieves relevant CWE-derived vulnerability patterns and examples through hybrid dense--sparse retrieval; and a Semantic Path that summarizes the functional behavior of the code before the final judgment. These contexts are integrated into a unified instruction to guide the LLM toward more reliable vulnerability reasoning. Experiments on the PrimeVul pair test set show that VulTriage achieves state-of-the-art performance, outperforming existing deep learning and LLM-based baselines on key pair-wise and classification metrics. Further ablation studies verify the effectiveness of each path, and additional experiments on the Kotlin dataset demonstrate the generalization ability of VulTriage under low-resource and class-imbalanced settings. Our code is available at https://github.com/vinsontang1/VulTriage

Abstract

Software Vulnerability Detection

Explore similar work

VulTriage: Triple-Path Context Augmentation for LLM-Based Vulnerability Detection

VulValidate: Auditing Function-Level Vulnerability Labels with Executable Evidence

When LLM Decompilers Recompile More and Preserve Less