Decompiling Binary Code with Large Language Models [pdf] (aclanthology.org)

Researchers released LLM4Decompile, a new open-source family of LLMs (1.3B–33B parameters) specifically fine-tuned to decompile binary executables into readable, re-executable high‑level code. Using an End2end-Decompile pipeline (compile → disassemble → decompile) and optimizations including data augmentation, cleaning, and two‑stage training on ~15 billion tokens, the LLM4Decompile-End models directly decompile binaries and substantially outperformed Ghidra and GPT‑4o on standard benchmarks. For example, the 6.7B End model achieved 45.4% re‑executability on HumanEval and 18.0% on ExeBench, with overall re‑executability gains of over 100% relative to baseline tools. A complementary LLM4Decompile‑Ref variant refines Ghidra output and, with targeted fine‑tuning, yields an additional 16.2% re‑executability improvement over the End models. This work is significant because it demonstrates that large, purpose‑trained LLMs can materially improve decompilation quality — producing more readable source-like code and higher rates of runnable reconstructions — which matters for security analysis, vulnerability research, and legacy code recovery. Key technical implications include: (1) scale and curated binary-specific training corpora are critical for decompilation performance; (2) combining traditional tools (Ghidra) with LLM refinement raises the performance ceiling; and (3) robustness limits remain: neither LLM4Decompile nor Ghidra reliably handles common code obfuscation, tempering immediate misuse concerns but highlighting an area for future research.