arXiv: When LLM Decompilers Recompile More and Preserve Less

A new academic paper, published on arXiv, examines the reliability of large language models when used as decompilers—tools that convert compiled machine code back into human-readable source code. The study finds that these AI decompilers often produce code that is more verbose and structurally different from the original, while also failing to preserve critical semantic details, such as variable types and control flow logic. This raises significant concerns for any organization relying on AI-assisted reverse engineering for security audits, vulnerability research, or legacy system maintenance, as the output may be misleading or incomplete.

The primary impact falls on cybersecurity firms, software development companies, and regulated industries like finance and healthcare that use third-party or open-source components. If these decompiled outputs are used to assess compliance with security standards, such as OWASP or NIST guidelines, or to verify that software patches do not introduce new risks, the inaccuracies could lead to false assurance. Regulators are increasingly scrutinizing AI-generated code for safety and transparency, so any automated toolchain that feeds into compliance reporting must be validated.

Compliance teams should immediately review any internal workflows that incorporate LLM-based decompilation or code analysis. They must document the limitations of these tools, implement human verification checkpoints for critical findings, and update risk assessments to reflect the potential for semantic drift. Additionally, they should monitor the paper’s follow-up research and consider adding a control that flags any AI-generated decompiled code as “unverified” until a qualified engineer manually confirms its accuracy against the original binary.