SPDAgent: Leveraging LLM Agents for Context-Aware Binary Security Patch Detection Via Pseudocode Diff Analysis

Security Patch Detection (SPD) is critical for protecting systems against vulnerabilities, yet vendors often release security patches silently without CVE assignments, making detection crucial for security maintenance. Existing binary-level SPD methods face key challenges: limited context analysis focusing only on local modifications, coarse-grained basic block representations, and poor scalability on real-world executables. We present SPDAgent, a context-aware framework for binary-level SPD that combines optimized pseudocode diffing with LLM-powered analysis. First, we propose an Iterative Maximal Unique Match based Pseudocode Diff algorithm (IMP-Diff) that progressively eliminates variable renaming noise, reducing diff size by an average of 30%. Second, we develop an LLM-driven multi-agent architecture comprising a pattern-based pre-filter and an iterative analysis loop, where agents dynamically retrieve inter-procedural dependencies on demand for comprehensive vulnerability assessment. To evaluate SPDAgent, we construct SPD-BIN, the first binary-level dataset with 6,250 executable pairs from 625 commits across 15 projects. Experiments show SPDAgent achieves 73.44% accuracy and 0.75 F1 score, outperforming existing methods while reducing false negatives to 18.73%. On real-world cross-version binaries, it achieves 84.48% recall across 58 CVEs, demonstrating practical applicability for detecting security patches in production software.