Search papers, labs, and topics across Lattice.
FORGE reframes LLM-based binary analysis as a feedback-driven execution process, using a reasoning-action-observation loop to enable incremental exploration and evidence construction. To manage long-horizon reasoning instability, they introduce a Dynamic Forest of Agents (FoA) that decomposes execution and coordinates parallel exploration. Evaluated on 3,457 real-world firmware binaries, FORGE identified 1,274 vulnerabilities with 72.3% precision, outperforming prior one-pass approaches and covering a broader range of vulnerability types.
LLMs can find more real-world firmware vulnerabilities (and with higher precision) when structured as a feedback-driven system that interleaves reasoning and tool interaction, rather than a one-pass static analysis.
Binary analysis increasingly relies on large language models (LLMs) to perform semantic reasoning over complex program behaviors. However, existing approaches largely adopt a one-pass execution paradigm, where reasoning operates over a fixed program representation constructed by static analysis tools. This formulation limits the ability to adapt exploration based on intermediate results and makes it difficult to sustain long-horizon, multi-path analysis under constrained context. We present FORGE, a system that rethinks LLM-based analysis as a feedback-driven execution process. FORGE interleaves reasoning and tool interaction through a reasoning-action-observation loop, enabling incremental exploration and evidence construction. To address the instability of long-horizon reasoning, we introduce a Dynamic Forest of Agents (FoA), a decomposed execution model that dynamically coordinates parallel exploration while bounding per-agent context. We evaluate FORGE on 3,457 real-world firmware binaries. FORGE identifies 1,274 vulnerabilities across 591 unique binaries, achieving 72.3% precision while covering a broader range of vulnerability types than prior approaches. These results demonstrate that structuring LLM-based analysis as a decomposed, feedback-driven execution system enables both scalable reasoning and high-quality outcomes in long-horizon tasks.
