Cross-modal Retrieval Models for Stripped Binary Analysis

2025-12-11

AI Summary

To address the challenge of accurately retrieving stripped binary functions under natural language queries, this paper proposes BinSeek—the first two-stage cross-modal retrieval framework. Methodologically, the first stage employs BinSeekEmbedding to align semantic representations between binary instruction sequences and natural language queries; the second stage introduces a context-aware BinSeek-Reranker for refined ranking, coupled with an LLM-driven synthetic data generation and annotation pipeline to establish the first domain-specific benchmark for this task. Key contributions include: (1) the first binary–text cross-modal embedding paradigm integrated with context-enhanced re-ranking; and (2) the open-sourcing of the first LLM-based synthetic data generation framework and benchmark. Experiments demonstrate significant improvements: +31.42% in Recall@3 and +27.17% in MRR@3, outperforming both same-scale models and general-purpose LMs with 16× more parameters.

Technology Category

• Natural Language Processing: Code Generation / Program Synthesis from Natural Language
• Search and Optimization: Learning to Search
• Machine Learning: Large Multimodal Models (LMMs)

Application Category

• Search and Retrieval-Augmented AI: Web evaluation methodologies and metrics
• Semantics and Knowledge: Methods to enhance, augment, integrate or synergize semantic models such as knowledge graphs and LLMs
• User Modeling, Personalization and Recommendation: Fairness-aware retrieval and ranking

Abstract

LLM-agent based binary code analysis has demonstrated significant potential across a wide range of software security scenarios, including vulnerability detection, malware analysis, etc. In agent workflow, however, retrieving the positive from thousands of stripped binary functions based on user query remains under-studied and challenging, as the absence of symbolic information distinguishes it from source code retrieval. In this paper, we introduce, BinSeek, the first two-stage cross-modal retrieval framework for stripped binary code analysis. It consists of two models: BinSeekEmbedding is trained on large-scale dataset to learn the semantic relevance of the binary code and the natural language description, furthermore, BinSeek-Reranker learns to carefully judge the relevance of the candidate code to the description with context augmentation. To this end, we built an LLM-based data synthesis pipeline to automate training construction, also deriving a domain benchmark for future research. Our evaluation results show that BinSeek achieved the state-of-the-art performance, surpassing the the same scale models by 31.42% in Rec@3 and 27.17% in MRR@3, as well as leading the advanced general-purpose models that have 16 times larger parameters.

Problem

• Develops a cross-modal retrieval framework for stripped binary code analysis
• Addresses retrieving relevant binary functions from thousands without symbolic information
• Introduces a two-stage model to match binary code with natural language queries

Innovation

• Two-stage cross-modal retrieval framework for binaries
• Embedding model learns semantic code-description relevance
• Reranker model judges relevance with context augmentation