arxiv.orgpaperVulDec: Vulnerability Detection in Binaries via Neural Decompilation
VulDec is an arXiv paper (October 2026) presenting a dataset of real-world Assembly-C function pairs with CWE labels across multiple architectures, plus an end-to-end framework that uses neural decompilation for binary vulnerability detection. Tuned LLM decompilers reach about 56% Edit Similarity and 43% BLEU-4. Tuned LLM detectors reach macro F1 of 0.61 on a realistic test set with a 3% vulnerability rate.
What it is
VulDec (arXiv 2610.33716v1, 24 October 2026, cs.CR) is a dataset and a pipeline for finding vulnerabilities in compiled binaries. The authors are from the University of Naples Federico II, Gran Sasso Science Institute and UNC Charlotte. The dataset has more than 59,000 vulnerable and non-vulnerable C-assembly function pairs taken from 7,000 real-world commits. The assembly comes from official Debian packages. The dataset is hosted on Figshare.
How it works
The dataset builds on DiverseVul (Chen et al. 2023), which has about 19,000 vulnerable and over 330,000 non-vulnerable C/C++ functions across 150 CWE categories. DiverseVul is not directly compilable. VulDec therefore compiles the Debian packages for several architectures, uses objdump to produce assembly, and aligns each assembly function with its source function and CWE label. The page does not list the architectures or describe the alignment step in the text that was retrieved.
The detection pipeline has three stages: disassemble the binary, run an LLM neural decompiler to produce C-like code, then run an LLM classifier on that code. The authors train the decompiler and the detector on the same data distribution. Their stated reason is to reduce distribution shift between training and inference.
Preconditions / Affected
The pipeline works on function-level assembly. The authors argue that neural decompilers, unlike traditional ones such as Ghidra, IDA Pro and RetDec, can handle partial code fragments and isolated functions.
Caveats
The reported results are an Edit Similarity of about 56%, a BLEU-4 of about 43% and a macro F1 of 0.61. The F1 is on an in-distribution test set with a 3% vulnerability rate, so it does not measure generalization to other projects or distributions. The authors themselves say neural decompilers can emit incorrect or non-canonical code and are a complement to traditional decompilers, not a replacement. The retrieved text stops during dataset construction. It does not include the per-architecture results, the models used, the compiler settings or the threats-to-validity section.
Organisations named here
- VulDec
Technologies named here
- Binary executables across multiple architectures
- Tuned LLM-based vulnerability detectors
- LLM
Techniques named here
- Neural decompilation
Related in Malware & RE
huntress.comwriteupReverse Engineering the Six Stages of MacSync Stealer and RAT
huntress.comwriteupPost-DEF CON Phishing Uses Malicious Google Doc to Deliver Malware
huntress.comwriteupClickFix Removes Your Background but Leaves the Malware
