Paper deep dive
CoDe-R: Refining Decompiler Output with LLMs via Rationale Guidance and Adaptive Inference
Qiang Zhang, Zhongnian Li
Intelligence
Status: succeeded | Model: google/gemini-3.1-flash-lite-preview | Prompt: intel-v1 | Confidence: 96%
Last extracted: 4/15/2026, 1:45:14 AM
Summary
CoDe-R is a lightweight two-stage framework for binary decompilation that addresses semantic loss and logical hallucinations in LLMs. It uses Semantic Cognitive Enhancement (SCE) to inject functional rationales during training and a Dynamic Dual-Path Fallback (DDPF) mechanism during inference to balance semantic recovery and syntactic stability, achieving state-of-the-art re-executability for 1.3B parameter models.
Entities (5)
Relation Signals (4)
CoDe-R → evaluatedon → HumanEval-Decompile
confidence 100% · We evaluate CoDe-R on the challenging HumanEval-Decompile benchmark
CoDe-R → usesbackbone → LLM4Decompile-1.3B
confidence 95% · we implement CoDe-R using the LLM4Decompile-1.3B backbone.
CoDe-R → utilizes → SCE
confidence 95% · The first stage introduces Semantic Cognitive Enhancement (SCE)
CoDe-R → utilizes → DDPF
confidence 95% · The second stage introduces a Dynamic Dual-Path Fallback (DDPF) mechanism
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:Binary decompilation is a critical reverse engineering task aimed at reconstructing high-level source code from stripped executables. Although Large Language Models (LLMs) have recently shown promise, they often suffer from "logical hallucinations" and "semantic misalignment" due to the irreversible semantic loss during compilation, resulting in generated code that fails to re-execute. In this study, we propose Cognitive Decompiler Refinement with Robustness (CoDe-R), a lightweight two-stage code refinement framework. The first stage introduces Semantic Cognitive Enhancement (SCE), a Rationale-Guided Semantic Injection strategy that trains the model to recover high-level algorithmic intent alongside code. The second stage introduces a Dynamic Dual-Path Fallback (DDPF) mechanism during inference, which adaptively balances semantic recovery and syntactic stability via a hybrid verification strategy. Evaluation on the HumanEval-Decompile benchmark demonstrates that CoDe-R (using a 1.3B backbone) establishes a new State-of-the-Art (SOTA) in the lightweight regime. Notably, it is the first 1.3B model to exceed an Average Re-executability Rate of 50.00%, significantly outperforming the baseline and effectively bridging the gap between efficient models and expert-level performance. Our code is available at this https URL.
Tags
Links
- Source: https://arxiv.org/abs/2604.12913v1
- Canonical: https://arxiv.org/abs/2604.12913v1
Trouble viewing inline? Open PDF directly →
Full Text
46,325 characters extracted from source content.
Expand or collapse full text
CoDe-R: Refining Decompiler Output with LLMs via Rationale Guidance and Adaptive Inference Qiang Zhang 1 , Zhongnian Li 1,2,* 1 School of Computer Science and Technology / School of Artificial Intelligence, China University of Mining and Technology, Xuzhou, China 2 Mine Digitization Engineering Research Center of the Ministry of Education, China University of Mining and Technology, Xuzhou, China zqiang, zhongnianli@cumt.edu.cn Abstract—Binary decompilation is a critical reverse engineer- ing task aimed at reconstructing high-level source code from stripped executables. Although Large Language Models (LLMs) have recently shown promise, they often suffer from “logical hallucinations” and “semantic misalignment” due to the irre- versible semantic loss during compilation, resulting in generated code that fails to re-execute. In this study, we propose Cognitive Decompiler Refinement with Robustness (CoDe-R), a lightweight two-stage code refinement framework. The first stage introduces Semantic Cognitive Enhancement (SCE), a Rationale-Guided Semantic Injection strategy that trains the model to recover high-level algorithmic intent alongside code. The second stage introduces a Dynamic Dual-Path Fallback (DDPF) mechanism during inference, which adaptively balances semantic recovery and syntactic stability via a hybrid verification strategy. Evalua- tion on the HumanEval-Decompile benchmark demonstrates that CoDe-R (using a 1.3B backbone) establishes a new State-of-the- Art (SOTA) in the lightweight regime. Notably, it is the first 1.3B model to exceed an Average Re-executability Rate of 50.00%, significantly outperforming the baseline and effectively bridging the gap between efficient models and expert-level performance. Our code is available at https://github.com/Theaoi/CoDe-R. Index Terms—Binary Decompilation, Large Language Models, Code Refinement, Rationale Guidance, Adaptive Inference, Re- executability I. INTRODUCTION Decompilation, the process of reconstructing high-level source code from binary executables, is fundamental to soft- ware security, vulnerability discovery, and legacy system maintenance [1]. While traditional tools like IDA Pro [2] and Ghidra [3] serve as industry standards, they rely on rule-based control flow recovery. Consequently, they often yield pseudo-code cluttered with obscure pointer arithmetic [4] and unstructured jumps. These limitations stem from the irreversible semantic loss during compilation, where high-level syntactic structures and variable semantics are stripped away, making the output difficult for human analysts to comprehend. Recently, Neural Decompilation has emerged as a promising paradigm. General-purpose Large Language Models (LLMs) such as CodeLlama [5] and DeepSeek-Coder [6] have revo- lutionized code generation. To align these foundations with * Corresponding author. long func0(int param_1) long lVar1 = 1; long lVar2 = 1; long lVar3 = 1; // ... do lVar3 = lVar3 * lVar1; lVar2 = lVar2 * lVar3; lVar1 = lVar1 + 1; while (lVar1 != (ulong) (param_1 - 1) + 2); return lVar2; // CoDe-R Output long long func0(int n) long long result = 1; long long factorial = 1; for (int i = 1; i <= n; i++) factorial *= i; result *= factorial; // Correct! return result; /* Function: func0 * Purpose: Computes a factorial-like product * based on input param_1... */ long func0(int param_1) // ... (Ghidra code) ... // Baseline Output long func0(int n) long result = 1; for (long i = 1; i <= n; i++) result *= i; // Missing logic! return result; Ghidra Decompiled Pseudo-Code (Semantics Lost) × √ Direct Refinement Semantic Injection (SCE) Adaptive Inference (DDPF) Existing Path Ours Path Non-Executable Re-Executable Fig. 1. Comparison between existing methods and CoDe-R: While existing methods suffer from semantic loss, CoDe-R employs SCE to inject rationale, guiding the refinement of re-executable code. binary recovery, Tan et al. proposed LLM4Decompile [7], establishing a baseline for assembly-to-C translation. More re- cently, advanced methods have sought to improve performance through structural intermediaries [8], [9] or complex external relabeling pipelines [10]. However, treating decompilation as a direct translation task (P(Code|Assembly)) presents a critical challenge. As illustrated in the “Existing Path” of Fig. 1, models often suffer from Logical Hallucination—generating code that looks syntactically correct but is functionally divergent [11]. This issue is particularly acute in lightweight models (≈1.3B), which are ideal for real-time deployment but lack the deep reasoning capacity to bridge the semantic gap. Existing ap- proaches often fail to distinguish between algorithmic intent and implementation details, leading to Semantic Misalignment where the generated code fails to re-execute [12]. To address this challenge, we propose Cognitive Decompiler Refinement with Robustness (CoDe-R). The name reflects our framework’s goal: to act as an “Coder” that refines the raw output of traditional decompilers. Unlike methods that gener- arXiv:2604.12913v1 [cs.SE] 14 Apr 2026 ate code from scratch, CoDe-R refines the opaque output of traditional decompilers through a cognitive process. In the first stage (Training), we introduce Semantic Cognitive Enhance- ment (SCE). We adopt a Rationale-Guided Semantic Injection approach that explicitly models the intermediate reasoning process. Drawing on methodologies from Chain-of-Thought (CoT) [13], we utilize a strong generator model to synthesize functional rationales—high-level summaries of algorithmic intent. These rationales act as Semantic Anchors, transforming the task from opaque translation into a transparent, rationale- conditional refinement process (P(Code|Input, Rationale)). In the second stage, recognizing that generation involves inherent uncertainty, we propose the Dynamic Dual-Path Fall- back (DDPF) mechanism. Inspired by recent advances in Test- Time Compute [14], DDPF mitigates risk by generating two distinct candidate paths: a semantic-rich path guided by the synthesized rationale and a syntactic-robust path for stabil- ity. Crucially, we employ a hybrid verification strategy that combines compiler constraints with semantic verdicts. This allows the system to adaptively select the optimal trajectory, balancing logical recovery with execution stability. We evaluate CoDe-R on the challenging HumanEval- Decompile benchmark [7]. Demonstrating the efficacy of our approach in resource-constrained scenarios, we implement CoDe-R using the LLM4Decompile-1.3B backbone. Experi- mental results show that our framework significantly outper- forms the baseline across all optimization levels. Specifically, under the O0 setting, CoDe-R achieves a peak Re-executability Rate of 70.73%, an improvement of nearly 5% over the baseline. These results validate that explicitly modeling ”lost” functional intent allows lightweight models to punch above their weight class. In summary, our contributions are as follows: • We propose CoDe-R, a cognitive refinement framework that enables lightweight models to master complex logic. To the best of our knowledge, this is the first work to introduce a Rationale-Guided Semantic Injection strategy in neural decompilation. • We design the Dynamic Dual-Path Fallback (DDPF) mechanism. Leveraging Test-Time Compute concepts, DDPF mitigates generation uncertainty by dynamically selecting optimal trajectories via a hybrid verification strategy. • We achieve an Average Re-executability Rate of 50.00% on HumanEval-Decompile, setting a new State-of-the- Art for lightweight neural decompilation. CoDe-R com- prehensively outperforms the baseline and demonstrates robust generalization across all optimization levels. I. RELATED WORK A. End-to-End Neural Decompilation The paradigm of decompilation has shifted from rule-based tools like IDA Pro [2] and Ghidra [3] to learning-based approaches. Early attempts utilized LSTMs [15] to translate assembly into source code, while Graph Neural Networks (GNNs) [16] have been employed to predict high-level prop- erties, such as procedure names, from stripped binaries. The emergence of LLMs has accelerated this trend. Tan et al. proposed LLM4Decompile [7], establishing the first open- source foundation for assembly-to-C translation. Recent works have focused on enhancing this direct map- ping (P(Code|Assembly)) through structural intermediaries or context augmentation. CodeInverter [17] augments the input with Control Flow Graphs (CFG) to improve structural recovery. To bridge the abstraction gap, Salt4Decompile [8] proposes inferring a Source-level Abstract Logic Tree (SALT) as an intermediate step, while SK2Decompile [9] introduces a “Skeleton-to-Skin” approach, first recovering the syntactic structure and then predicting identifiers. In a parallel direction, ReF Decompile [10] achieves state-of-the-art performance by integrating variable relabeling and function call graph analysis to enhance the model’s understanding of data flow. Similarly, D-LiFT [18] utilizes Reinforcement Learning (RL) to align the decompiler backend with code quality metrics. However, these methods typically rely on explicit structural representations or external static analysis aids. In contrast, CoDe-R prioritizes intrinsic semantic intent. By distilling functional rationales via SCE, we ensure the model captures the algorithmic logic (z) before synthesizing the implementa- tion (y), reducing logical hallucinations without the need for complex intermediate languages or heavy pre-processing tools. B. Refinement and Neuro-Symbolic Approaches A parallel line of research focuses on refining the output of traditional decompilers rather than generating code from scratch. DeGPT [19] leverages LLMs to improve the read- ability of Ghidra-generated pseudo-code by renaming variables and simplifying control structures, while Wong et al. [20] fo- cus on refining decompiled code to restore recompilability. To enhance accuracy in variable renaming, LMPA [21] proposes a neuro-symbolic synergy, using program analysis to propagate context for better prediction. While effective at polishing code, these refinement methods are fundamentally bound by the structural errors of the underlying traditional decompiler. If the initial control flow is broken (common in O3 optimization), refinement models struggle to correct the underlying logic. CoDe-R avoids this dependency by directly reconstructing logic from pseudo-code using a rationale-guided cognitive process. C. Augmented Generation with Rationales Standard LLMs struggle with complex reasoning without explicit guidance. Recent research in Chain-of-Thought (CoT) [13] and Scratchpads [22] demonstrates that providing in- termediate reasoning steps significantly boosts performance on complex tasks. However, applying CoT directly during inference for decompilation is computationally expensive and prone to error propagation due to the verbose nature of assembly code. To harness this reasoning capability without the inference overhead, our SCE module adapts this insight into a Context- If ConditionWhile LoopBitwise OpsDo While Loop Memory Mgmt 0 100 200 300 400 336 288 272 258 113 Execution Failure Count Baseline (a) Top-5 Failure Count Patterns. 502001k5k 0 0.5 1 Token Length (Log Scale) Re-executability Baseline (b) Length Degradation: Performance drops as input scales. Fig. 2.Motivation Analysis (Baseline: LLM4Decompile-Ref-1.3B on HumanEval-Decompile). (a) The model struggles with control flow, indicating superficial learning [12]. (b) Re-executability drops with length [11]. Augmented Generation paradigm. Instead of requiring the model to reason spontaneously at runtime, we perform Of- fline Rationale Generation using a strong generator to create high-quality functional summaries. These summaries are then injected as Semantic Anchors during training. This approach aligns with recent trends in Rationale-Augmented Learning [23], [24], utilizing LLM-generated reasoning to enhance small model training. Unlike refinement-based methods [19] that polish output post-hoc, our method fundamentally alters the generation process by resolving semantic ambiguities at the input level. D. Test-Time Compute and Execution Feedback Recent research suggests that scaling Test-Time Com- pute—allocating more computational resources during infer- ence—can be more effective than scaling model parameters [14]. A prominent direction is Execution-based Verification, where models generate multiple candidates and select the best one based on test case execution. CodeT [25] pioneered this approach by using generated unit tests to verify code consis- tency. Similarly, Self-Refine [26] employs iterative feedback loops to correct errors. The DDPF mechanism of CoDe-R draws inspiration from these strategies but is tailored for the constraints of decompi- lation. Instead of expensive multi-turn iterations, we employ a lightweight dual-path strategy that leverages hybrid feedback: combining the hard constraints of a compiler (re-compilability) with the soft semantic checks of a BLEU-based verifier. This allows CoDe-R to dynamically trade off between semantic fidelity and syntactic robustness without the overhead of full- scale iterative refinement. I. MOTIVATION AND KEY INSIGHTS We analyze the limitations of current neural decompilers to articulate the intuitions driving CoDe-R. A. Insight 1: Decompilation requires semantic guidance Existing methods predominantly adopt a “Direct Mapping” paradigm (P(Y|X)), mapping assembly (X ) directly to source (Y ). However, this is ill-posed due to the irreversible semantic loss in compilation. Compiler optimizations often map distinct source codes to identical assembly [27], leaving X insufficient to uniquely determine Y . Fig. 2(a) shows that errors are not uniformly distributed; the model fails most on semantic-heavy patterns (e.g., control flow), suggesting it captures superficial correlations rather than logic [12], [28]. Furthermore, Fig. 2(b) reveals a per- formance drop as token count increases, aligning with the “Lost-in-the-Middle” phenomenon [11]. To mitigate this, we introduce Functional Rationales as domain-specific “Semantic Landmarks” [29], transforming the target to P(Y|X,Z) to anchor generation on what to do before how. B. Insight 2: The Trade-off between Rationale and Rigidity We observe a tension between two paradigms: Rationale- Guided Generation captures high-level intent but may violate syntax, while Direct Generation ensures robustness but misses logical dependencies. To resolve this, our Dynamic Dual- Path Fallback (DDPF) decouples the objectives. Inspired by Snell et al. [14], we leverage Test-Time Compute to generate candidates from both paradigms and use a hybrid verification strategy to dynamically select the optimal trajectory. IV. PROPOSED METHOD We propose CoDe-R, a cognitive framework designed to optimize decompiler-generated pseudo-code. As illustrated in Fig. 3, our pipeline operates in two main stages: Rationale- Guided Semantic Injection (SCE) during training and Adaptive Inference (DDPF) during inference. A. Stage I: Rationale-Guided Semantic Injection (SCE) Datasets D = (x i ,y i ) consist of pairs where x i is the pseudo-code decompiled from assembly via a decompiler and y i is the ground-truth source code. Direct translation P(y|x) is ill-posed due to the severe semantic loss. To resolve this, we propose an Input Augmentation strategy that introduces an explicit Semantic Anchor. We formulate the refinement task as a Latent Variable Model. We posit that the generation of source code y depends not only on the input pseudo-code x but also on a latent Functional Rationale z (i.e., the high-level algorithmic intent). Let θ denote the learnable parameters of the refinement model M ref . Mathematically, we decompose the generation probability into a two-step conditional chain: P(y|x)≈ P(z|x;M gen )· P(y|x,z;θ).(1) To operationalize the first term, we utilize a Rationale Gen- erator to annotate the dataset. We construct a prompt P gen instructing M gen to analyze the pseudo-code logic and gen- erate a concise Symbolic Rationale z i : z i ∼M gen (x i ,P gen ),(2) Generator Model Generate Symbolic Rationales Build Augmented Dataset (Source + Rationales) Refiner Model Augmented Data Rationale-Guided Instruction Tuning Input Pseudo-Code Path 1: Semantic-Rich (Rationale-Guided) Path 2: Syntactic-Robust (Direct Generation) Dynamic Fallback (Compiler + BLEU) Final Optimal Code Stage I: Rationale-Guided Semantic Injection (SCE Module) Stage I: Adaptive Inference (DDPF Module) Ghidra Pseudo-Code Corpus (decompile-ghidra-100k) Data Augmentation Pipeline Model Fine-tuning Pipeline Inference Pipeline Fig. 3. The overview of CoDe-R. The framework operates in two stages: Stage I employs SCE to train the model via rationale-conditional generation; Stage I utilizes DDPF to dynamically select between semantic-rich and syntactic-robust paths via a hybrid verification strategy. where z i contains high-level intent descriptions. The core of SCE is to train the model M ref to utilize the injected rationale. We employ Instruction Tuning following the standard Alpaca format [30], where the input instruction explicitly includes the generated rationale z. The optimization objective is to maximize the likelihood of the source code given the augmented context: L SCE (θ) =− |y| X t=1 logP(y t |x,z,y <t ;θ),(3) By explicitly conditioning on z, the model treats the rationale as semantic guidance, effectively pruning the search space and reducing generation ambiguity. From an information-theoretic perspective, the rationale acts as an information bottleneck [31] that filters implementation noise while preserving seman- tic intent. B. Stage I: Adaptive Inference with DDPF During inference, we face a dilemma: relying solely on injected rationales can be risky if the generated rationale contains noise (Hallucination Propagation), while ignoring them loses semantic depth. To balance this, we propose the Dynamic Dual-Path Fallback (DDPF) mechanism. As illustrated in the inference stage of Fig. 4, the system maintains two parallel inference trajectories: 1) Path 1: Semantic-Rich Generation: This path restricts the training condition to maximize semantic recovery. First, we reuse the generation prompt P gen to prompt the model to predict a functional rationale on the fly: ˆz =M gen (x,P gen ).(4) Subsequently, the model synthesizes the source code ˆy sem utilizing this predicted rationale as a semantic anchor: ˆy sem =M ref (x, ˆz).(5) This path excels at capturing complex algorithmic logic by grounding the generation in semantic guidance. Input Pseudo- Code (x) Generator Model (M gen ) Refiner Model (M ref ) Refiner Model (M ref ) ˆy sem (Candidate 1) ˆy syn (Candidate 2) Compiler Check (V) Semantic Comparator (S) Final Output (y*) DDPF Decision Module Path 1:Semantic-Rich Path 2:Syntactic-Robust Rationale ˆz Fig. 4. The running workflow of the DDPF mechanism. 2) Path 2: Syntactic-Robust Generation: To ensure robust- ness when rationale generation fails, we reuse the exact same M ref for direct generation, querying it using only the pseudo- code x: ˆy syn =M ref (x,∅).(6) This path forces the model to rely on its internal pattern- matching capabilities, acting as a Syntactic Stabilizer that ensures basic syntactic correctness. 3) Hybrid Verification Strategy:We employ a Re- Compilation Consistency strategy to select the optimal output. Since ground-truth source code is unavailable at inference, we utilize the underlying assembly as the reference. We define the consistency score S(y) as the BLEU similarity between the original binary’s assembly and the re-compiled assembly of the generated code. Let C(y) denote the compiler function that converts source code y back to assembly, and x asm denote the original input assembly. The score is calcu- lated as: S(y) = BLEU(C(y),x asm ).(7) Let V(y) = 1 denote that code y successfully compiles. The final output y ∗ is selected by prioritizing the semantic Instruction: You are an expert in binary reverse engineering. Analyze the provided source code and summarize its high-level functionality. Guidelines: (1) Use multi-line comments only at the very beginning of the function; (2) The comment block must strictly include function name and purpose; Format: Input: Pseudo Code → Output: Annotated Code (x, z) Fig. 5. Simplified Prompt Template for Generator. We query the model to extract high-density semantic anchors (z) using these instructions. For the unabridged prompt incorporating expert reverse-engineering heuristics, please refer to Appendix A. path (ˆy sem ), provided it compiles and maintains higher (or equal) assembly-level consistency than the robust path (ˆy syn ): y ∗ = ( ˆy sem if V(ˆy sem )∧ (¬V(ˆy syn )∨ S(ˆy sem )≥ S(ˆy syn )). ˆy syn otherwise. (8) This mechanism effectively acts as a Semantic Cycle- Consistency Check. By comparing the re-compiled assembly against the original, we verify whether the generated high-level logic (ˆy) faithfully preserves the original control flow and data operations, filtering out candidates that are syntactically valid but semantically divergent. V. EXPERIMENTAL SETUP A. Datasets To rigorously evaluate the effectiveness of semantic in- jection, we utilized two distinct datasets. For training, we adopted the Decompile-Ghidra-100k dataset [7], filtering the original 100,000 pairs down to 86,536 high-quality C/C++ source and pseudo-code pairs. For evaluation, we employed the HumanEval-Decompile benchmark [7], [32], a recognized test set containing 164 samples. To simulate real-world com- pilation diversity, each problem was compiled under four optimization levels (O0, O1, O2, O3), resulting in a total of 656 test samples. To implement our Semantic Cognitive Enhancement (SCE), we utilized the Qwen3 [33] to synthesize Symbolic Rationales (z). The simplified prompting strategy is illustrated in Fig. 5. For training, we strictly filtered out 13,464 samples where the generator failed to yield valid comments or exceeded length limits. This produced a refined corpus of 86,536 high- quality pairs (z i ⊕ x i ,y i ), adhering to [34], where the functional rationale z i is concatenated with pseudo-code x i . Conversely, for the testing set, we retained all 656 samples to ensure a fair, 100% coverage comparison against the baseline. B. Evaluation Metrics We employ three distinct metrics to comprehensively eval- uate performance. The primary metric is the Re-executability Rate (R re-exec ). It measures the percentage of generated code that not only compiles successfully but also achieves the expected functionality: R re-exec = 1 N N X i=1 I(Exec(C i ,T i )),(9) TABLE I COMPARISON OF RE-EXECUTABILITY RATE (%) ON HUMANEVAL-DECOMPILE (FOCUS ON LIGHTWEIGHT METHODS) MethodO0O1O2O3Avg Base Tool Ghidra (Base)33.5416.4615.8513.4119.82 Refinement Methods +Idioms70.73 27.4413.4112.2030.95 +LLM4Decompile-Ref (1.3B)*65.8536.5940.2436.5944.82 +Ours (CoDe-R)70.73 46.3442.0740.8550.00 End to End Method Nova-1.3B [36]37.5321.7122.6818.7525.17 Nova-6.7B [36]48.7830.5830.8527.2334.36 CodeInverter (1.3B) [17]71.3439.6342.0740.2448.32 General-purpose LLMs Qwen-Plus20.127.935.498.5410.52 GPT-4o34.1511.5915.2410.3717.84 DeepSeek-V367.0737.2037.8037.2044.82 * Indicates the baseline model. Bold: Best. Underline: Second Best. where N is the total number of test samples, I(·) is the indicator function which equals 1 if the condition holds and 0 otherwise, C i is the generated code, and T i represents the unit tests. Additionally, we use BLEU-4 [35] to measure textual similarity with the ground truth and the Compile Rate as a baseline indicator of syntactic validity. C. Implementation Details We selected LLM4Decompile-Ref-1.3B [7] as our Refiner Model backbone. The model was fine-tuned using the standard causal language modeling objective, optimized via Hybri- dAdam with a learning rate of 2× 10 −6 and a cosine decay scheduler. We set the micro-batch size to 8 per device and trained for 2 epochs with a maximum sequence length of 2048 tokens. Experiments were conducted on a heterogeneous computing cluster: Refiner Model training was performed on a node with 4× RTX 4090D. For inference, the model runs on a single RTX 4090D, while the Generator’s rationale generation is offloaded to a node equipped with a single H20-NVLink. VI. RESULTS AND DISCUSSION A. Main Results Table I compares CoDe-R against methods across varying parameter scales. CoDe-R achieves the highest average re- executability (50.00%), outperforming the baseline by 5.18%. Compared to the structure-aware CodeInverter [17], CoDe-R shows superior robustness at higher optimization levels (O1- O3), proving the efficacy of semantic injection for complex logic. Crucially, CoDe-R demonstrates exceptional parameter ef- ficiency. It not only doubles the performance of Nova-1.3B (25.17%) but also significantly surpasses the larger Nova- 6.7B (34.36%) [36]. This result highlights that domain-specific cognitive alignment (via SCE and DDPF) is a more effective driver of performance than mere parameter scaling. Further- more, CoDe-R outperforms massive generalist models like DeepSeek-V3 (44.82%) and GPT-4o (17.84%), solidifying its If Condition While Loop Bitwise Ops Do While Loop Memory Mgmt 50 60 54.8 57.6 60.7 58.9 61.4 52.9 56.8 60.5 57.8 59.8 Execution Failure Rate (%) BaselineCoDe-R Fig. 6. Failure Rate Comparison on Top-5 Failure Count Patterns: CoDe-R (Green) consistently reduces failure rates compared to Baseline (Blue). Note the significant drop in if-condition and memory-mgmt. position as the state-of-the-art in lightweight neural decompi- lation refinement. B. Error Pattern Analysis Recall the motivation analysis in Section I (Fig. 2(a)), where we identified that existing methods suffer from severe “Deep Program Semantics” deficits [12]. To verify whether CoDe-R effectively addresses this issue, we conducted a fine- grained comparison on the top-5 failure count patterns. As shown in Fig. 6, CoDe-R consistently reduces failure rates, yet the magnitude of improvement varies non-uniformly, aligning with established program comprehension theories. We observe the most distinct reductions in if condition and memorymanagement. As established in classic reverse engi- neering literature [28], recovering structured control flow and variable abstractions represents the primary “semantic gap.” The substantial gains here confirm that our Symbolic Rationale effectively provides the missing functional intent, enabling the model to reconstruct logic that relies on global understanding rather than local syntax. Conversely, the improvement in bitwise ops is minimal. Bitwise operations often stem from compiler optimizations (e.g., strength reduction) or low-level arithmetic [27], which serve as local implementation details rather than high-level algorithmic intent. Since these patterns rely more on local syntax than global semantics, the baseline model captures them sufficiently, and the high-level rationale offers limited additional guidance. This differential improvement strongly supports our core hy- pothesis: CoDe-R effectively restores the semantic information lost during compilation, thereby significantly enhancing the re- executability of code patterns with high semantic demands. 50100200500 1k2k5k10k 0 0.2 0.4 0.6 0.8 1 Average Token Length (Log Scale) Re-executability Rate BaselineCoDe-R Fig. 7. Re-executability Rate vs. Code Length: CoDe-R (Red) demonstrates superior robustness in the long-context regime (> 1000 tokens) compared to Baseline (Blue), confirming the anchoring effect of rationales. C. Impact of Code Complexity To further validate the efficacy of our SCE module in mitigating the “Lost-in-the-Middle” challenge discussed in Section I, we analyzed the correlation between code length and re-executability. Fig. 7 shows that CoDe-R (Red Line) demonstrates consistent superiority over the Baseline (Blue Line). The underlying mechanism varies across complexity regimes, which we interpret through the lens of Information Theory. In the regime of Short Contexts (< 300 tokens), CoDe-R achieves maximal gains. As noted by Ding et al. [12], short functions are often dominated by a single algorithmic intent; here, our generated rationale (z) provides near-perfect seman- tic coverage, bridging the gap between assembly and source code with high precision. However, as complexity increases to Medium Contexts (400 − 800 tokens), the performance gap narrows slightly. We attribute this to the Information Bottleneck principle [31]: medium-length code often resides in a “complexity valley”, which is complex enough to require specific implementation details yet short enough for the base- line to memorize local patterns. Crucially, the divergence becomes most pronounced in Long Contexts (> 1000 tokens). Consistent with our motivation, the baseline suffers from a catastrophic drop in the long tail due to context drift. In contrast, CoDe-R maintains a significant margin. This confirms that our Symbolic Rationale effectively functions as a “Semantic Landmark” [29], allowing the model to maintain logical coherence even when the local context window is saturated. D. Ablation Study To systematically evaluate the contribution of each design component in CoDe-R, we conducted comprehensive ablation studies. We dissect the framework to analyze four critical aspects: the isolated efficacy of the Semantic Cognitive En- hancement (SCE) module, the architectural necessity of the TABLE I ABLATION STUDY OF COMPONENT CONTRIBUTIONS ConfigurationO0O1O2O3Avg Path 2 Only (Syntactic-Robust)67.6842.0742.6838.4147.71 Path 1 Only (Semantic-Rich)70.7342.6842.6837.2048.32 CoDe-R (DDPF Combined)70.7346.3442.0740.8550.00 TABLE I COMPILABILITY ANALYSIS (PASS@1-COMPILE %) ModelO0O1O2O3Avg Baseline89.6388.4193.2989.6390.24 Path 1 (Semantic)85.3787.8082.9379.8883.99 Path 2 (Robust)90.2487.8090.8589.0289.48 CoDe-R90.2491.4690.2490.8590.70 Dynamic Dual-Path Fallback (DDPF) mechanism, the impact of rationale granularity, and the optimal injection strategy. 1) Effect of SCE Module: The core premise of CoDe-R is that explicitly injecting functional rationales serves as a critical semantic anchor. To isolate this effect, we examine the performance of Path 1 Only, which represents the model operating purely in the Rationale-Guided mode (trained with SCE). To isolate the efficacy of explicit semantic injection, we compare Path 1 Only (Semantic-Rich) directly with Path 2 Only (Syntactic-Robust). As shown in Table I, Path 1 achieves a higher average re-executability (48.32%) compared to Path 2 (47.71%). This result validates the hypothesis of Rationale- Guided Generation: even when the model is capable of direct synthesis, explicitly conditioning the process on the functional summaries (z) further constrains the search space. This proves that the injected rationale serves as a necessary Semantic Anchor, bridging the gap between implicit intent and explicit implementation effectively. 2) Effect of DDPF Mechanism: To validate the dual-path design, we compare CoDe-R against individual paths in Ta- ble I. Results show a complementary relationship: Path 1 excels in structure-preserving scenarios (O0: 70.73%), while Path 2 demonstrates resilience in optimized settings (O3). CoDe-R computes the union of these strategies, achieving the highest average re-executability of 50.00%. To further verify the mechanism, Table I analyzes syntactic validity. While Path 1 suffers from lower compilability (Avg: 83.99%) due to aggressive reasoning, the robust Path 2 (Avg: 89.48%) acts as a Syntactic Stabilizer. DDPF effectively lever- ages this to fix syntax errors, boosting the overall compilability to 90.70%. 3) Effect of Rationale Granularity: To determine our design choice for Rationale Granularity, we compared our Con- cise Rationale strategy (strictly Function Name and Purpose) against a Detailed Rationale strategy (expanded with Inputs, Outputs, and Implicit Operations). As shown in Table IV, TABLE IV IMPACT OF RATIONALE GRANULARITY ON RE-EXECUTABILITY (%) ConfigurationO0O1O2O3Avg Detailed67.0739.6343.9036.5946.80 Concise70.7342.0739.6337.8047.56 TABLE V COMPARISON OF INJECTION STRATEGIES: UTILIZING VS. DISTILLATION (%) Injection StrategyO0O1O2O3Avg Both (Full Distillation)67.6843.9037.2032.9345.43 Source-Only (Utilizing)70.7342.0739.6337.8047.56 the Concise strategy outperforms the Detailed approach on average (47.56% vs. 46.80%). We attribute the performance drop in the Detailed setting to a poor Signal-to-Noise Ratio. A verbose rationale consumes context window and introduces speculative fields prone to hallucination. These hallucinations act as semantic noise, distracting the model rather than guiding it. Thus, prioritizing Semantic Density over volume proves critical for robust refinement. 4) Effect of Injection Strategy: We further investigated whether the model benefits more from utilizing reasoning or learning to reason. We compared a Source-Only strategy , where the rationale z acts solely as input context (P(y|x,z)), against a Full Distillation strategy that forces the model to generate the rationale before the code (P(z,y|x,z)). As summarized in Table V, Source-Only consistently outperforms Distillation, particularly in the O3 setting. This aligns with findings on CoT-augmented distillation [24]: the dual objective in Distillation burdens the model, where imperfect rationale generation propagates errors to the code. By treating the rationale as a fixed Semantic Anchor, we effectively offload the reasoning burden to the Generator, allowing the model to focus entirely on translation. VII. LIMITATIONS Despite the promising performance of CoDe-R, several limitations remain. First, the DDPF mechanism introduces inference overhead, increasing latency compared to single-pass methods. However, this trade-off is highly practical given the substantial 5% gain in re-executability. Second, our evaluation is restricted to C/C++ compiled via GCC. The generalizability of our rationale-guided approach to other compiled languages (such as Rust or Go) and diverse compiler toolchains (e.g., MSVC or Clang) requires further verification. VIII. CONCLUSION This study introduces CoDe-R, a cognitive refinement framework designed to refine decompiler-generated pseudo- code into high-quality source code. By robustly injecting semantics to adaptively enhance context via Semantic Cogni- tive Enhancement (SCE) and applying a Dynamic Dual-Path Fallback (DDPF) mechanism, we addressed both the logical hallucinations and semantic misalignment inherent in exist- ing direct-mapping paradigms. Experimental results on the HumanEval-Decompile benchmark demonstrate that CoDe-R sets a new State-of-the-Art for lightweight models with an average re-executability rate of 50.00%. This validates that explicitly recovering lost semantic information allows efficient models to punch above their weight class. This rationale- guided paradigm could be generalized to other reverse engi- neering tasks, indicating the potential for broader applicability in cognitive code understanding. Future work will focus on reducing the inference latency of the dual-path mechanism through parallel decoding. Addition- ally, we plan to extend CoDe-R to support modern compiled languages such as Rust and Go. ACKNOWLEDGMENT This work was supported by the National Natural Sci- ence Foundation of China (No.62306320, 61976217) and the Natural Science Foundation of Jiangsu Province (No. BK20231063). REFERENCES [1] C. Cifuentes, Reverse compilation techniques.Queensland University of Technology, Brisbane, 1994. [2] Hex-Rays, “Ida pro: a cross-platform multi-processor disassembler and debugger,” https://hex-rays.com/ida-pro/, 2024. [3] “Ghidra,” https://github.com/NationalSecurityAgency/ghidra, 2023. [4] G. Balakrishnan and T. Reps, “Analyzing memory accesses in x86 executables,” in International conference on compiler construction. Springer, 2004, p. 5–23. [5] B. Roziere, J. Gehring, F. Gloeckle, S. Sootla, I. Gat, X. E. Tan, Y. Adi, J. Liu, R. Sauvestre, T. Remez et al., “Code llama: Open foundation models for code,” arXiv preprint arXiv:2308.12950, 2023. [6] D. Guo, Q. Zhu, D. Yang, Z. Xie, K. Dong, W. Zhang, G. Chen, X. Bi, Y. Wu, Y. Li et al., “Deepseek-coder: When the large language model meets programming–the rise of code intelligence,” arXiv preprint arXiv:2401.14196, 2024. [7] H. Tan, Q. Luo, J. Li, and Y. Zhang, “Llm4decompile: Decom- piling binary code with large language models,” arXiv preprint arXiv:2403.05286, 2024. [8] Y. Wang, X. Xu, X. Zhu, X. Gu, and B. Shen, “Salt4decompile: Inferring source-level abstract logic tree for llm-based binary decompilation,” arXiv preprint arXiv:2509.14646, 2025. [9] H. Tan, W. Li, X. Tian, S. Wang, J. Liu, J. Li, and Y. Zhang, “Sk2decompile: Llm-based two-phase binary decompilation from skele- ton to skin,” arXiv preprint arXiv:2509.22114, 2025. [10] Y. Feng, B. Li, X. Shi, Q. Zhu, and W. Che, “Ref decompile: Relabeling and function call enhanced decompile,” arXiv preprint arXiv:2502.12221, 2025. [11] N. F. Liu, K. Lin, J. Hewitt, A. Paranjape, M. Bevilacqua, F. Petroni, and P. Liang, “Lost in the middle: How language models use long contexts,” Transactions of the association for computational linguistics, vol. 12, p. 157–173, 2024. [12] Y. Ding, “Semantic-aware source code modeling,” in Proceedings of the 39th IEEE/ACM International Conference on Automated Software Engineering, 2024, p. 2494–2497. [13] J. Wei, X. Wang, D. Schuurmans, M. Bosma, F. Xia, E. Chi, Q. V. Le, D. Zhou et al., “Chain-of-thought prompting elicits reasoning in large language models,” in Advances in Neural Information Processing Systems, vol. 35, 2022, p. 24 824–24 837. [14] C. Snell, J. Lee, K. Xu, and A. Kumar, “Scaling llm test-time compute optimally can be more effective than scaling model parameters,” arXiv preprint arXiv:2408.03314, 2024. [15] D. S. Katz, J. Ruchti, and E. Schulte, “Using recurrent neural networks for decompilation,” in 2018 IEEE 25th international conference on software analysis, evolution and reengineering (SANER). IEEE, 2018, p. 346–356. [16] Y. David, U. Alon, and E. Yahav, “Neural reverse engineering of stripped binaries using augmented control flow graphs,” Proceedings of the ACM on Programming Languages, vol. 4, no. OOPSLA, p. 1–28, 2020. [17] P. Liu, J. Sun, R. Sun, L. Chen, Z. Yan, P. Zhang, D. Sun, D. Wang, X. Zhang, and D. Li, “The codeinverter suite: Control-flow and data- mapping augmented binary decompilation with llms,” arXiv preprint arXiv:2503.07215, 2025. [18] M. Zou, H. Cai, H. Wu, Z. L. Basque, A. Khan, B. Celik, A. Bianchi, D. Xu et al., “D-lift: Improving llm-based decompiler backend via code quality-driven fine-tuning,” arXiv preprint arXiv:2506.10125, 2025. [19] P. Hu, R. Liang, and K. Chen, “Degpt: Optimizing decompiler output with llm,” in Network and Distributed System Security Symposium, 2024. [20] W. K. Wong, H. Wang, Z. Li, Z. Liu, S. Wang, Q. Tang, S. Nie, and S. Wu, “Refining decompiled c code with large language models,” arXiv preprint arXiv:2310.06530, 2023. [21] X. Xu, Z. Zhang, S. Feng, Y. Ye, Z. Su, N. Jiang, S. Cheng, L. Tan, and X. Zhang, “Lmpa: Improving decompilation by synergy of large lan- guage model and program analysis,” arXiv preprint arXiv:2306.02546, 2023. [22] M. Nye, A. J. Andreassen, G. Gur-Ari, H. Michalewski, J. Austin, D. Bieber, D. Dohan, A. Lewkowycz, M. Bosma, D. Luan et al., “Show your work: Scratchpads for intermediate computation with language models,” arXiv preprint arXiv:2112.00114, 2021. [23] C.-Y. Hsieh, C.-L. Li, C.-K. Yeh, H. Nakhost, Y. Fujii, A. Ratner, R. Kr- ishna, C.-Y. Lee, and T. Pfister, “Distilling step-by-step! outperforming larger language models with less training data and smaller model sizes,” in Findings of the Association for Computational Linguistics: ACL 2023, 2023, p. 8003–8017. [24] S. Wadhwa, S. Amir, and B. C. Wallace, “Investigating mysteries of cot-augmented distillation,” arXiv preprint arXiv:2406.14511, 2024. [25] B. Chen, F. Zhang, A. Nguyen, Z. Da, S. R. Bowman et al., “Codet: Code generation with generated tests,” in ICLR, 2023. [26] A. Madaan, N. Tandon, P. Gupta, S. Hallinan, L. Gao, S. Wiegreffe, U. Alon, N. Dziri, S. Prabhumoye, Y. Yang et al., “Self-refine: Iterative refinement with self-feedback,” in Advances in Neural Information Processing Systems, vol. 36, 2023, p. 46 534–46 594. [27] D. F. Bacon, S. L. Graham, and O. J. Sharp, “Compiler transformations for high-performance computing,” ACM Computing Surveys (CSUR), vol. 26, no. 4, p. 345–420, 1994. [28] K. Yakdan, S. Eschweiler, E. Gerhards-Padilla, and M. Smith, “No more gotos: Decompilation using pattern-independent control-flow structuring and semantic-preserving transformations.” in NDSS, 2015. [29] A. Mohtashami and M. Jaggi, “Landmark attention: Random-access in- finite context length for transformers,” arXiv preprint arXiv:2305.16300, 2023. [30] R. Taori, I. Gulrajani, T. Zhang, Y. Dubois, X. Li, C. Guestrin, P. Liang, and T. B. Hashimoto, “Stanford alpaca: An instruction-following llama model,” 2023. [31] N. Tishby, F. C. Pereira, and W. Bialek, “The information bottleneck method,” arXiv preprint physics/0004057, 2000. [32] M. Chen, J. Tworek, H. Jun, Q. Yuan, H. P. d. O. Pinto, J. Kaplan, H. Edwards, Y. Burda, N. Joseph, G. Brockman et al., “Evaluating large language models trained on code,” arXiv preprint arXiv:2107.03374, 2021. [33] A. Yang, A. Li, B. Yang, B. Zhang, B. Hui, B. Zheng, B. Yu, C. Gao, C. Huang, C. Lv et al., “Qwen3 technical report,” 2025. [34] S. Gunasekar, Y. Zhang, J. Aneja, C. C. T. Mendes, A. Del Giorno, S. Gopi, M. Javaheripi, P. Kauffmann, G. de Rosa, O. Saarikivi et al., “Textbooks are all you need,” arXiv preprint arXiv:2306.11644, 2023. [35] K. Papineni, S. Roukos, T. Ward, and W.-J. Zhu, “Bleu: a method for automatic evaluation of machine translation,” in Proceedings of the 40th annual meeting of the Association for Computational Linguistics, 2002, p. 311–318. [36] N. Jiang, C. Wang, K. Liu, X. Xu, L. Tan, X. Zhang, and P. Babkin, “Nova: Generative language models for assembly code with hierarchical attention and contrastive learning,” arXiv preprint arXiv:2311.13721, 2023. APPENDIX A DETAILED PROMPT FOR RATIONALE GENERATOR The complete prompt template utilized for the Rationale Generator (M gen ) is detailed below. This template integrates expert reverse-engineering heuristics to ensure the extraction of high-fidelity semantic anchors. Instruction: You are an expert C code analyst. Task: Read the following C function and generate a standard multi-line header comment (/ * ... * /) for it. Source Code:code_snippet Requirements: 1) Output ONLY the comment block. Do not output the source code. 2) The comment must start with / * and end with * /. 3) Content: • Function: [Name] • Purpose: [Concise description] CRITICAL LOGIC CHECK (Must Follow): • Loop Analysis: Check how the inner loop initializes. If the inner loop index initializes using the outer loop’s index (e.g., inner = outer or inner = outer + 1), explicitly describe it as comparing ”all pairs” or ”combinations”. STRICTLY FORBID the word ”adjacent” unless the code strictly checks i vs i+1. • Bitwise Magic: If you see a float being cast to int/uint and AND-ed (&) with a constant (like 0x7F) OR a global data label (e.g., DAT_..., PTR_...), treat this as calculating the ”absolute value” (fabs). APPENDIX B QUALITATIVE CASE STUDY To intuitively demonstrate the effectiveness of our Rationale-Guided Semantic Injection (SCE) and validate the expert heuristics embedded in our prompt, we provide a real-world decompilation example from the HumanEval-Decompile benchmark in Table VI. As shown in the original Ghidra pseudo-code, compiler optimizations heavily obscure the semantics: the floating-point absolute value (fabsf) is optimized into an opaque bitwise AND operation with a data label (DAT_001020d0 & ...), and array indexing is reduced to raw byte-level pointer arithmetic. Without high-level guidance, the Baseline model acts as a rigid translator. It blindly copies the undefined memory labels and raw casts, failing to infer the correct types (e.g., treating param_2 as a long rather than a float * ), which leads to uncompilable code. In contrast, guided by the generated rationale (z), CoDe-R successfully recognizes the O(n 2 ) pair-wise combination logic and the bitwise magic for fabsf. It synthesizes clean, idiomatic, and fully re-executable C code that perfectly aligns with the original algorithmic intent. TABLE VI A QUALITATIVE EXAMPLE COMPARING BASELINE AND CODE-R ON A COMPLEX MATH AND LOOP STRUCTURE. 1. Original Ghidra Pseudo-Code (Input x) undefined8 func0(float param_1,long param_2,int param_3) int local_10; int local_c; local_10 = 0; do local_c = local_10; if (param_3 <= local_10) return 0; while (local_c = local_c + 1, local_c < param_3) if ((float)(DAT_001020d0 & (uint)( * (float * )(param_2 + (long)local_10 * 4) - * (float * )(param_2 + (long)local_c * 4))) < param_1) return 1; local_10 = local_10 + 1; while( true ); 2. Generated Symbolic Rationale (Extracted z) / * * Function: func0 * Purpose: Compares pairs of float values from an array pointed to by param_2, * using a nested loop structure. Returns 1 if any pair difference * (absolute value) is less than param_1; otherwise returns 0. * / 3. Baseline Output (Direct Translation - Compilation Fails) bool func0(float param_1, long param_2, int param_3) for (int i = 0; i < param_3; i++) for (int j = i + 1; j < param_3; j++) // Logical & Syntax Error: Fails to restore fabsf and pointer types if ((float)(DAT_001020d0 & (uint)( * (float * )(param_2 + i * 4) - * (float * )(param_2 + j * 4))) < param_1) return true; return false; 4. CoDe-R Output (Rationale-Guided - Successfully Re-executes) bool func0(float * arr, int n, float eps) int i, j; for (i = 0; i < n; i++) for (j = i + 1; j < n; j++) // Success: Perfectly restores fabsf and array indexing semantics if (fabsf(arr[i] - arr[j]) < eps) return true; return false;