Intel / article

Statistical Analysis of Executability and Program Equivalence in Decompilation for IoT Vulnerability Detection

Source: arxiv.org
Author: Minami Yoda, Jialong Li, Yasuyuki Tahara, Yuichi Sei, Yutaka Matsuno
Date: Published Aug 10, 2026

Context

Readable decompiled code is useful for investigating device firmware only if it preserves the original program's behavior. The authors of this study warn that language models can reconstruct plausible code while changing details such as boundary checks and error handling, precisely the details that can matter to vulnerability analysis. Research abstract

They assessed 19,625 reconstructions of 318 OpenWrt programs using nine measures of structural, behavioral and semantic similarity. Reconstructions that successfully compiled again had higher overall scores than those that failed. That makes recompilation a useful quality signal in this dataset, while leaving preservation of security-relevant behavior as a separate question. The reported result is a statistical relationship between measures, not proof of program equivalence. Study design and findings

Terms in this piece · Glossary

eval — A repeatable test for AI quality — a set of tasks plus scoring — used the way software teams use test suites, because model output is too variable to judge by eyeballing.
LLM — A large language model — the neural network behind tools like Claude and ChatGPT, trained on huge amounts of text to predict what comes next.

Read the source arxiv.org