Security
SoK: Are LLMs Reliable at Source Code Recovery? A Taxonomy and Empirical Evaluation
arXiv cs.SE0 views
arXiv:2610.11556v1 Announce Type: cross Abstract: Effective source recovery is critical to security applications such as malware analysis, vulnerability assessment, and legacy maintenance. Large Language Models (LLMs) are reshaping this field, shifting the paradigm away from rule-based heuristics to probabilistic and high fidelity semantic recovery of source code from assembly or classical decompiler-derived pseudo-C. However, despite rapid progress, the field suffers from fragmentation across numerous approaches as well as their non-unified evaluations, limiting objective comparisons. Further, existing works have limited coverage of embedded, IoT architectures and source languages beyond C/C++. In this work, we present the first Systematization of Knowledge (SoK) focused specifically on LLM-assisted binary-to-source recovery. We provide a granular design-centric taxonomy of LLM-assisted source recovery methods and systematic evaluations using seven key metrics along six evaluation dimensions. We evaluate state-of-the-art methods on 45,000 test samples derived from four standard and five embedded architectures, five optimization levels, and symbol stripping. We ablate the impact of design choices on recovery performance, including input representation, contextual enrichment, model scale, iteration and review roles using controlled in-house recovery pipelines and three off-the-shelf models. Finally, we test same-language and cross-language recovery capability covering four mature and two legacy languages. Our systematization and comprehensive evaluations provide key insights that guide future directions in this field.
Source:https://arxiv.org/abs/2610.11556PreviousRetromorphic Testing of Quantum Compiler PassesNextWhere Do the Tokens Go? Understanding and Reducing Costs in LLM Agents for Vulnerability Discovery
Related posts
[$] Managing the kernel CVE flood
0LWN.net
5 Stars for sale: Inside the underground fake review trade
0Hacker News New
Show HN: Hands-on security exercises for students and instructors
0Hacker News Show
Investors Dish on New Startups & What They'd Back Next
0Dark Reading

NVIDIA Brev security breach may have exposed SSH keys used to access customer VMs — investigation finds unauthorized activity spanning 16 days, but no evidence of misuse
0Tom's Hardware
Testing and rebuilding Node.js snapshot artifacts after CVE-2026-106074
0dev.to Node