Implicit Patterns in LLM-Based Binary Analysis

This paper studies how large language models (LLMs) analyze computer code vulnerabilities across multiple reasoning steps, revealing that the models implicitly follow four recurring patterns: early pruning (quickly dismissing dead ends), path-dependent lock-in (getting stuck on initial choices), targeted backtracking (strategically reconsidering decisions), and knowledge-guided prioritization (focusing on relevant areas). By analyzing nearly 100,000 reasoning steps across 521 programs, the researchers show that LLMs organize their exploration through these implicit token-level behaviors rather than explicit rules, providing insights into how to build more reliable AI-powered security analysis tools.