Patch2Vuln: LLM Agent Reconstructs Vulnerability Semantics from Binary Patches Alone

arXiv·high signal

A local, resumable pipeline that extracts old/new ELF pairs from Linux binary packages, diffs them, and uses an LLM agent restricted to binary-derived evidence to reconstruct the security meaning of distribution updates. Addresses the critical window between patch release and widespread adoption where both defenders and attackers race to understand what was fixed. Practical for security teams monitoring package updates without source access.