How LLMs Derive Program Meaning from Source Code
Determine how large language models derive program meaning from source code.
References
LLMs achieve strong results on code tasks, but how they derive program meaning remains unclear.
The competing ``naming from operations alone'' reading (\S\ref{sec:floormethod}) remains open and needs a fourth condition we did not run.
Evaluations revealed that current LLMs struggle significantly across all three of these tasks. Because PLSemanticsBench presented a set of complex evaluations where models needed to articulate intermediate steps and output long execution traces, the models' uniformly low performance leaves an open question regarding exactly where their capability threshold is.
These methods demonstrate the potential of LLMs for mobile-specific program analysis, but their reliability and interpretability in security-critical settings remain open questions that warrant further investigation.