When LLM Decompilers Recompile More and Preserve Less: Decompile-Diverge Finds Hidden Behavioral Divergence

Overview

Area: Machine Learning Authors: Chang Liu, Edward Raff, Kristopher Micinski Published: 2026-09-04 arXiv: 2609.05370

Summary

Decompilation recovers high-level source from compiled machine code and underpins security tasks such as vulnerability detection and malware analysis. Traditional decompilers like Ghidra and Hex-Rays emit pseudocode with visible placeholders that often will not compile or execute. LLM-based decompilers, by contrast, produce clean, idiomatic C and are now judged almost entirely by two metrics: recompilability and re-executability—whether the output builds and passes shipped input/output tests.

This paper shows these metrics can reward the wrong path:

• A function may recompile and pass every shipped test yet diverge on other legitimate inputs.
• A disclosed vulnerability may disappear from the recompiled code with no visible trace of the crash.

Neither failure is captured by existing test suites.

Decompile-Diverge

To close this evaluation gap, the authors propose Decompile-Diverge, a behavioral-comparison oracle that requires no fixed or hand-written tests:

1. Synthesize a driver for each function. 2. Grow a fuzzing corpus from the reference implementation. 3. Re-run the decompiled code on the same inputs to detect behavioral changes.

Findings

• Across eight systems in nine configurations, candidates that passed all shipped tests still diverged from the original implementation on the generated corpus: 4.9% overall, up to 13% on a single system.
• On 300 real GitHub library functions and 287 CVE-related functions, recompilability and behavioral fidelity separate: the strongest refined LLM raised Ghidra's build rate from 75% to 90%, while its match rate dropped from 74% to 62%.
• Up to one in ten disclosed vulnerabilities exhibited crash absence in the refined LLM's output.
• Source-level analysis attributes the divergence to introduced fields, types, callees, and guards, which replace the visible unknowns that traditional tools leave behind.

Original Abstract (excerpt)

> Decompilation recovers high-level source from compiled machine code and serves as a foundation for security tasks such as vulnerability detection and malware analysis. Traditional decompilers like Ghidra and Hex-Rays expose whatever they cannot resolve as visible placeholders and often emit pseudocode that will not compile or execute; LLM-based decompilers produce clean, idiomatic C and are now judged almost entirely by recompilability and re-executability: whether the output builds and passes its shipped input/output tests. We show that these metrics can reward the wrong path...

*Auto-collected on 2026-09-09*