AI Frontier · Sep 8, 2026

Covering September 1 to 8. Four of today's papers each dismantle a different metric used to trust automated security tooling: recompilability and re-executability for LLM decompilers, SHAP attribution for malware classifiers, CodeQL's alert list, and attack success rate in safety evaluation. The most uncomfortable result is the one Decompile-Diverge measures — a function can pass every shipped test and still lose a disclosed vulnerability from the recompiled code without a trace.

Research

The cleaner the recompilation, the less behavior survives — and disclosed vulnerabilities vanish without a trace

Traditional decompilers (Ghidra, Hex-Rays) expose whatever they cannot resolve as visible placeholders and often emit pseudocode that will not compile or execute. LLM-based decompilers produce clean, idiomatic C, so they are now judged almost entirely on two things: whether the output recompiles and whether it re-executes — that is, whether it builds and passes its shipped input/output tests. The authors show these metrics reward the wrong path. A function can pass every shipped test and still diverge from the original on other legitimate inputs, and a disclosed vulnerability can disappear from the recompiled code with no visible trace of the crash. Neither failure is caught by existing suites. Their Decompile-Diverge oracle relies on no fixed or hand-crafted tests: for each function it synthesizes a driver, grows a fuzzing corpus from the reference, and reruns the decompiled code on the same inputs to compare behavior. Across eight systems in nine configurations, candidates passing every shipped test still diverged from the original on 4.9% of the input corpus overall, and as much as 13% for a single system. The evaluation also covers 300 real GitHub library functions and 287 CVE-grounded functions.

Sources: arXiv

SHAP explains a feature-coalition game, not malware behavior

SHAP is the standard tool for explaining machine-learning malware detectors, backed by formal properties such as local accuracy, missingness and consistency. The authors argue those guarantees are insufficient for reliable malware interpretation: the game itself is fixed only after the analyst selects the feature players, the missing-feature rule, the background distribution and the simplified input mapping. And in static PE feature spaces, groups like byte histograms, byte-entropy, strings, headers, sections, imports and data-directories are not independent signals — they are jointly shaped by file structure, packing, compiler behavior and family conventions. They prove three consequences: conditional SHAP dilutes a model's feature credit by a factor of 1/m across m−1 redundant features; it attributes importance to features the model never uses; and it can reverse the sign of an unused feature's attribution when the data distribution changes. Interventional SHAP, meanwhile, queries off-manifold coalitions no real executable would exhibit. Experiments on EMBER-2018, EMBER-2024 and BODMAS with fixed LightGBM and XGBoost detectors confirm the effects. Their conclusion is not that SHAP is useless but that it is a limited diagnostic, requiring an explicitly stated data distribution and domain validation.

Sources: arXiv

A third of CodeQL's Java false positives share one cause; query-level fixes remove 80% of them — at the cost of a true positive

Running CodeQL's Java security query suite on 167 CVE instances from 110 projects, taking the ten queries with the highest false positive rates, and manually reviewing 500 sampled false positive paths and locations yields a source-level taxonomy: missed path constraint or sanitization 36.6%, benign execution context 29.4%, missing trust boundary modeling 27.6%, imprecise concurrency modeling 5%, imprecise sink modeling 1.4%. Query-level refinements built from these patterns remove 81.8% of the reviewed false positives. Across the full selected-query dataset they remove 15.8% of reported paths and locations while retaining 7 of 8 true positives — meaning one was lost. The authors name the generalization gap themselves: fixed refinements often depend on project-specific context. They then test whether agentic coding tools can adapt the patterns to new projects, and two tools succeed on 56% and 62% of tasks.

Sources: arXiv

Turning the fixing commits of 19,325 high-severity CVEs into executable detection rules

Public vulnerability databases record weakness types, affected components and related patches, and fixing commits give the exact code changes that removed the flaw — but these records are documented for human inspection, not automated reuse, so the same unsafe conditions may still exist elsewhere with no advisory attached. BUGSTONE-E2E mines 19,325 high-severity CVEs from 2022 to 2026, identifies 2,710 fixing commits, and constructs 1,033 detection rules across 56 CWE families, organized by CWE and language and carrying scan anchors, fix semantics and CVE provenance. Detection runs as a funnel: Tree-sitter enumerates call sites matching rule anchors, lightweight heuristics drop benign sites with no LLM calls at all, LLM-based agents inspect what remains under the rule, and the system then re-triages survivors, builds runtime verifications, and generates scope-checked patches validated by two-sided differential tests. The abstract is cut off at the packaging step; hit rate and false positive rate for these rules on real codebases are not given.

Sources: arXiv

TIER: models with similar attack success rates can have completely different behavior distributions

Current LLM safety benchmarks largely rely on binary metrics, which say nothing about how a model responds to prompts of varying threat implicitness. TIER covers four risk domains and four threat levels, from explicit harmful requests through sophisticated jailbreaks, scoring responses on a six-label behavior scale judged by two independent LLMs. Across six open-weight models: safety behaviors evolve gradually across threat levels rather than shifting directly from refusal to compliance; contextual prompts yield the most diverse behaviors; jailbreaks reveal the largest robustness gaps. The consequence for evaluation practice is that models with similar attack success rates can exhibit distinct response distributions, and a binary metric erases that layer entirely. The sample is six open-weight models, and the judges are themselves models.

Sources: arXiv

Banning personal AI accounts leaves modeled residual risk close to doing nothing

Employees using their own ChatGPT, Gemini and Claude accounts for work is what the authors call BYOAI — a distinct form of Shadow AI where employee-authenticated personal accounts sit entirely outside enterprise identity and security controls. Existing frameworks were designed for organization-managed AI tools and do not cover it. A systematic review of 30 records (24 research studies, 6 framework documents) produces a risk taxonomy and a framework-engagement profile: the most prominent categories are data exposure and compliance, and framework engagement is inconsistent. They then build a parameterized governance model coupling a five-level maturity ladder to a technical control architecture through a chain in which control-layer coverage drives security outcomes, measuring how much each maturity level reduces residual risk. The finding that matters operationally: under the specified parameterization, prohibition-based solutions land at residual risk levels close to baseline, while layered control-based solutions substantially reduce modeled exfiltration risk and increase enforceable coverage. This is a parameterized model over a 30-record corpus, not a field measurement.

Sources: arXiv

Lab announcements

OpenAI: ChatGPT Astra begins rolling out to the $20 Plus subscription (September 7)

No word on when free users get access.

Sources: Bleeping Computer

OpenAI: healthcare organizations can connect EHR and other industry data sources to ChatGPT (September 1)

Sources: OpenAI