Energy-Efficient Multi-LLM Reasoning for Binary-Free Zero-Day Detection in IoT Firmware

TL;DR

This work tackles IoT firmware security in settings where binaries are encrypted or inaccessible by proposing a binary-free, architecture-agnostic framework that estimates conceptual zero-day risk using high-level descriptors. It introduces a tri-LLM architecture (configuration: LLaMA 3-8B, structure: DeepSeek, fusion: GPT-4o) augmented with divergence, entropy, and energy-aware metrics to enhance interpretability and practicality. Theoretical foundations link semantic divergence and misalignment to increasing risk, while simulation-based evaluations show exposure perturbations elevating predicted risk and GPT-4o delivering strongest cross-layer insights. The approach offers a scalable, descriptor-centric complement to traditional binary-focused methods, with potential for integration into IoT security pipelines and supply-chain risk assessment.

Abstract

Securing Internet of Things (IoT) firmware remains difficult due to proprietary binaries, stripped symbols, heterogeneous architectures, and limited access to executable code. Existing analysis methods, such as static analysis, symbolic execution, and fuzzing, depend on binary visibility and functional emulation, making them unreliable when firmware is encrypted or inaccessible. To address this limitation, we propose a binary-free, architecture-agnostic solution that estimates the likelihood of conceptual zero-day vulnerabilities using only high-level descriptors. The approach integrates a tri-LLM reasoning architecture combining a LLaMA-based configuration interpreter, a DeepSeek-based structural abstraction analyzer, and a GPT-4o semantic fusion model. The solution also incorporates LLM computational signatures, including latency patterns, uncertainty markers, and reasoning depth indicators, as well as an energy-aware symbolic load model, to enhance interpretability and operational feasibility. In addition, we formally derive the mathematical foundations of the reasoning pipeline, establishing monotonicity, divergence, and energy-risk coupling properties that theoretically justify the model's behavior. Simulation-based evaluation reveals that high exposure conditions increase the predicted zero-day likelihood by 20 to 35 percent across models, with GPT-4o demonstrating the strongest cross-layer correlations and the highest sensitivity. Energy and divergence metrics significantly predict elevated risk (p < 0.01), reinforcing the effectiveness of the proposed reasoning framework.

Figures (10)

• Figure 1: Conceptual architecture of the tri-layer zero-day estimation pipeline.
• Figure 2: Conceptual architecture of the tri-LLM reasoning pipeline.
• Figure 3: Impact of medium and high exposure levels on predicted risk scores across LLaMA 3-8B, DeepSeek v1, and GPT-4o.
• Figure 4: Comparison of LLaMA 3 8B, DeepSeek v1, and GPT-4o across core security metrics.
• Figure 5: Showing additional security metrics across LLM models.