SoK: AI-Augmented Binary Reversing

A new systematization-of-knowledge paper surveys a decade of AI-augmented binary reversing, analyzing 144 research papers published since 2015 and organizing them into 22 distinct inference-task domains, according to a preprint posted to arXiv on June 16, 2026 [1][2]. The study, titled "SoK: AI-Augmented Binary Reversing," introduces a unified taxonomy that spans both conventional and AI-augmented reversing pipelines [1][2]. Binary reversing — the process of deconstructing compiled software to understand its structure and function — underpins vulnerability discovery, malware investigation, and firmware auditing [1][2]. The authors note that the task remains inherently difficult because semantic information is irreversibly lost during compilation [1][2]. The field of AI-assisted reverse engineering has seen substantial advancements since the mid-2010s, leveraging machine learning strategies to augment and automate analysis [3]. The new taxonomy connects traditional analysis techniques, binary-derived artifacts, representation strategies, learning paradigms, and downstream inference tasks, while clarifying the emerging roles of large language models and agentic AI systems [1][2]. By establishing a common vocabulary and structured framework, the paper provides a holistic view of the field's evolution over the past decade [1][2]. The analysis reveals common structures underlying approaches that previously appeared disparate [1][2]. It also highlights persistent technical challenges and evaluation gaps that have accompanied the rapid adoption of machine learning, large language models, and agentic AI in this domain [1][2]. The authors identify promising opportunities for future research and argue that their insights provide a foundation for building the next generation of reliable and scalable AI-augmented binary reversing systems [1][2]. The preprint was posted on arXiv, an open-access repository of electronic preprints that, as of late 2024, receives approximately 24,000 new articles per month [10]. The paper appears under the Computer Science > Cryptography and Security category [1].