Implicit Patterns in LLM-Based Binary Analysis
Qiang Li, XiangRui Zhang, Haining Wang
This paper studies how large language models (LLMs) analyze computer code vulnerabilities across multiple reasoning steps, revealing that the models implicitly follow four recurring patterns: early pruning (quickly dismissing dead ends), path-dependent lock-in (getting stuck on initial choices), targeted backtracking (strategically reconsidering decisions), and knowledge-guided prioritization (focusing on relevant areas). By analyzing nearly 100,000 reasoning steps across 521 programs, the researchers show that LLMs organize their exploration through these implicit token-level behaviors rather than explicit rules, providing insights into how to build more reliable AI-powered security analysis tools.
LLM agentsbinary analysisreasoning patternsvulnerability detection