Research on Binary Decompilation Optimization Based on Fine-Tuned Large Language Models for Vulnerability Detection

The proliferation of binary vulnerabilities in the software supply chain has become a critical security challenge. Existing vulnerability detection approaches—including dynamic analysis, static analysis, and decompilation-assisted analysis—all suffer from limitations such as insufficient coverage, high false-positive and false-negative rates, or poor compatibility. Although decompilation technology can serve as a bridge connecting binary-code and source-code vulnerability detection tools, current schemes suffer from inadequate semantic restoration quality and lack of tool compatibility. To address these issues, this paper proposes LLMVulDecompiler, a binary decompilation model based on fine-tuned large language models designed to generate high-precision decompiled code that integrates directly with source-code static analysis tools. We construct a dedicated training and evaluation dataset that covers multiple compiler optimization levels (e.g., O0–O3) and a diverse set of program functionalities. We adopt a two-stage fine-tuning strategy that involves first building foundational decompilation capabilities, then enhancing vulnerability-specific features. Additionally, we design a low-cost inference pipeline and establish multi-dimensional evaluation criteria, including restoration similarity, compilation success rate, and functional correctness. Experimental results show that the model significantly outperforms baseline models in terms of average edit distance, compilation success rate, and black-box test pass rate on the HumanEval-C benchmark. In tests on 12 real-world CVE (Common Vulnerabilities and Exposures) instances, the approach achieved a detection accuracy of 91.7%, with substantially reduced false-positive and false-negative rates. This study demonstrates the effectiveness of specialized fine-tuning of large language models for binary decompilation and vulnerability detection, offering a new pathway for binary security analysis.