NeuroDeX: Unlocking Diverse Support in Decompiling Deep Neural Network Executables

2025-09-08

AI Summary

To address reverse-engineering threats against DNN executables deployed on edge devices, this paper proposes the first decompilation framework integrating large language model (LLM)-driven semantic reasoning with dynamic analysis. The method unifies operator identification, attribute recovery, and high-level model reconstruction across non-quantized and quantized models, diverse hardware architectures, and compiler optimization scenarios, leveraging symbolic execution and operator-level feature matching. Crucially, it pioneers the incorporation of LLMs into DNN binary reverse engineering, substantially enhancing semantic understanding and cross-model generalizability. Evaluation on 96 real-world DNN executable samples demonstrates near-perfect structural recovery for non-quantized models and achieves an average Top-1 accuracy of 72% for functionally equivalent reconstructions of quantized models—significantly outperforming state-of-the-art tools.

Technology Category

• Machine Learning: Learning on the Edge & Model Compression
• Natural Language Processing: (Large) Language Models
• Knowledge Representation and Reasoning: Computational Complexity of Reasoning

Application Category

• Graph Algorithms and Modeling for the Web: Foundation models and LLMs for Web-related graphs
• Semantics and Knowledge: Data modeling to support human-machine intelligence, including LLMs agents, intelligent system behavior, explanations, and user-friendly interactions
• Search and Retrieval-Augmented AI: Large language models for search

Abstract

On-device deep learning models have extensive real world demands. Deep learning compilers efficiently compile models into executables for deployment on edge devices, but these executables may face the threat of reverse engineering. Previous studies have attempted to decompile DNN executables, but they face challenges in handling compilation optimizations and analyzing quantized compiled models. In this paper, we present NeuroDeX to unlock diverse support in decompiling DNN executables. NeuroDeX leverages the semantic understanding capabilities of LLMs along with dynamic analysis to accurately and efficiently perform operator type recognition, operator attribute recovery and model reconstruction. NeuroDeX can recover DNN executables into high-level models towards compilation optimizations, different architectures and quantized compiled models. We conduct experiments on 96 DNN executables across 12 common DNN models. Extensive experimental results demonstrate that NeuroDeX can decompile non-quantized executables into nearly identical high-level models. NeuroDeX can recover functionally similar high-level models for quantized executables, achieving an average top-1 accuracy of 72%. NeuroDeX offers a more comprehensive and effective solution compared to previous DNN executables decompilers.

Problem

• Decompiling DNN executables despite compilation optimizations
• Recovering high-level models from quantized compiled executables
• Handling diverse architectures in reverse engineering neural networks

Innovation

• Uses LLMs and dynamic analysis for decompilation
• Handles compilation optimizations and quantized models
• Recovers operator types and reconstructs models accurately