揭示大模型分析二进制时隐含的探索规律，提升漏洞检测可靠性。
Implicit Patterns in LLM-Based Binary Analysis
- 通过分析99,563步推理，发现四种隐式探索模式。
- 模式表现为早期剪枝、路径锁定、定向回溯与知识引导优先。
- 为构建更稳定可靠的智能漏洞分析系统提供依据。
基于大模型的二进制漏洞分析正采用迭代多轮方式，由模型自主决策。然而，受限于上下文长度和底层令牌行为，其在数百步推理中的探索机制尚不清晰。本研究首次开展大规模、逐级追踪分析，揭示多轮推理中存在结构化的令牌级隐式模式。通过对521个二进制文件、共99,563次推理步骤的分析，识别出四种主导模式：早期剪枝、路径依赖锁定、目标导向回溯与知识引导优先。这些隐式模式构成了大模型推理的抽象表征——不依赖显式控制流或预设启发式规则，而是通过隐性决策调节路径选择、承诺与修正。分析表明，这些模式形成具有明确时间角色与可度量特征的稳定结构体系。研究成果首次系统刻画了大模型驱动的二进制分析过程，为构建更可靠分析系统奠定基础。
原文摘要 · Abstract (English)
Binary vulnerability analysis is increasingly performed by LLM-based agents in an iterative, multi-pass manner, with the model as the core decision-maker. However, how such systems organize exploration over hundreds of reasoning steps remains poorly understood, due to limited context windows and implicit token-level behaviors. We present the first large-scale, trace-level study showing that multi-pass LLM reasoning gives rise to structured, token-level implicit patterns. Analyzing 521 binaries with 99,563 reasoning steps, we identify four dominant patterns: early pruning, path-dependent lock-in, targeted backtracking, and knowledge-guided prioritization that emerge implicitly from reasoning traces. These token-level implicit patterns serve as an abstraction of LLM reasoning: instead of explicit control-flow or predefined heuristics, exploration is organized through implicit decisions regulating path selection, commitment, and revision. Our analysis shows these patterns form a stable, structured system with distinct temporal roles and measurable characteristics. Our results provide the first systematic characterization of LLM-driven binary analysis and a foundation for more reliable analysis systems.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。