ML Security PapersNeuroDeX: Unlocking Diverse Support in Decompiling Deep Neural Network Executables
Yilin Li 1,2, Guozhu Meng 1,2, Mingyang Sun 1,2, Yanzhong Wang 1,2, Kun Sun 1,2, Hailong Chang 1,2, Yuekang Li 3
Published on arXiv
2509.06402
Model Theft
OWASP ML Top 10 — ML05
Key Finding
NeuroDeX recovers non-quantized DNN executables into nearly identical high-level models and achieves 72% average top-1 accuracy when decompiling quantized executables, outperforming prior DNN decompilers.
NeuroDeX
Novel technique introduced
On-device deep learning models have extensive real world demands. Deep learning compilers efficiently compile models into executables for deployment on edge devices, but these executables may face the threat of reverse engineering. Previous studies have attempted to decompile DNN executables, but they face challenges in handling compilation optimizations and analyzing quantized compiled models. In this paper, we present NeuroDeX to unlock diverse support in decompiling DNN executables. NeuroDeX leverages the semantic understanding capabilities of LLMs along with dynamic analysis to accurately and efficiently perform operator type recognition, operator attribute recovery and model reconstruction. NeuroDeX can recover DNN executables into high-level models towards compilation optimizations, different architectures and quantized compiled models. We conduct experiments on 96 DNN executables across 12 common DNN models. Extensive experimental results demonstrate that NeuroDeX can decompile non-quantized executables into nearly identical high-level models. NeuroDeX can recover functionally similar high-level models for quantized executables, achieving an average top-1 accuracy of 72%. NeuroDeX offers a more comprehensive and effective solution compared to previous DNN executables decompilers.
Key Contributions
- NeuroDeX pipeline combining LLM-based semantic understanding with dynamic analysis for DNN executable decompilation, covering operator type recognition, attribute recovery, and model reconstruction
- Support for quantized compiled models and compilation-optimized executables, extending beyond prior decompilers' capabilities
- Evaluation on 96 DNN executables across 12 architectures, achieving near-identical recovery for non-quantized models and 72% top-1 accuracy for quantized models
🛡️ Threat Analysis
NeuroDeX's explicit goal is model stealing — recovering the high-level model (architecture, operator attributes, weights) from a compiled binary executable deployed on edge devices. The paper's own IEEEkeywords list 'model stealing' as a core topic, and the system reconstructs functionally equivalent models, constituting IP theft of the model itself.