What was done
Liu, Raff and Micinski built Decompile-Diverge, an oracle that reruns decompiled functions on fuzzed inputs, and found tested LLM decompilers diverge from the original binary more often than shipped tests show.
Chang Liu, Edward Raff and Kristopher Micinski studied LLM-based decompilers, which produce clean C but are usually judged by whether the output recompiles and passes its shipped tests. Their paper argues those metrics miss behaviour changes.
How it was done
They built Decompile-Diverge. For each function it synthesises a driver, builds a fuzzing corpus from the reference binary and reruns the decompiled code on the same inputs. They evaluated eight systems in nine configurations, with Ghidra as a traditional baseline.
Results
Candidates that passed every shipped test still diverged from the original on the authors' inputs in 4.9% of cases overall, and up to 13% for one system. On 300 real library functions, the strongest LLM refinement raised Ghidra's build rate from 75% to 90% while its matched rate fell from 74% to 62%. On 287 functions tied to disclosed CVEs, up to a tenth lost the crash in the decompiled version. The authors trace this to invented fields, types and guards. The paper was submitted on 4 September 2026 and gives no code link.