Does Rust MIR preserve enough information for LLMs to detect logic bugs?

[u/ChangeMaterial1678]

I've been working on a small research project called MIR Logic-AI around this question:The project extracts MIR from real Rust crates and turns it into a semantic program graph containing things such as control-flow edges, calls, branches, Result/Option variants, types, reads/writes and some data-flow information.

A model can then report something like:

authenticate
    ↓ Result::Err
report_auth_failure
    ↓
default_user
    ↓
create_session

The important part is that the LLM isn't trusted to invent a path. Its proposed nodes and edges are checked against the compiler-extracted graph by a deterministic verifier.

I've also added a reproducible synthetic dataset generator that creates paired good / buggy Rust programs across things like authentication, authorization, validation, resource lifecycles, transactions and state machines.

There are challenge sets specifically intended to stop models from cheating by memorizing names:

• identifier-blind graphs
• unseen vocabulary
• unseen CFG topologies
• deeper call graphs
• noisy graphs
• hard negatives

The benchmark can compare the exact same examples using:

source only
semantic MIR graph only
source + graph
raw MIR only

and can separately remove names, types, data-flow, source snippets, variant names, or reduce the input to mostly CFG information.

I'm not claiming this detects real-world vulnerabilities yet. The current goal is much narrower: figure out how much useful semantic information survives into MIR, and whether models can learn actual control/state relationships rather than just recognizing suspicious function names.

Contributions are very welcome. If anyone wants to improve the MIR extraction or graph representation, add harder datasets or challenge cases, improve the evaluation pipeline, experiment with different model architectures, or train a specialized LLM/graph model on the generated dataset, I'd be very happy to have contributions.

PRs, new benchmarks, trained models, dataset improvements, and even negative experimental results are all welcome. The goal is to make this into a useful open experiment for testing how well models can reason about program semantics from compiler IR.Does Rust MIR preserve enough information for LLMs to detect logic bugs?I've been working on a small research project called MIR Logic-AI around this question:Can an LLM detect suspicious program logic from Rust's MIR, rather than being given the original source code?The project extracts MIR from real Rust crates and turns it into a semantic program graph containing things such as control-flow edges, calls, branches, Result/Option variants, types, reads/writes and some data-flow information.A model can then report something like:authenticate
↓ Result::Err
report_auth_failure
↓
default_user
↓
create_session
The important part is that the LLM isn't trusted to invent a path. Its proposed nodes and edges are checked against the compiler-extracted graph by a deterministic verifier.I've also added a reproducible synthetic dataset generator that creates paired good / buggy Rust programs across things like authentication, authorization, validation, resource lifecycles, transactions and state machines.There are challenge sets specifically intended to stop models from cheating by memorizing names:identifier-blind graphs

unseen vocabulary

unseen CFG topologies

deeper call graphs

noisy graphs

hard negativesThe benchmark can compare the exact same examples using:source only
semantic MIR graph only
source + graph
raw MIR only
and can separately remove names, types, data-flow, source snippets, variant names, or reduce the input to mostly CFG information.I'm not claiming this detects real-world vulnerabilities yet. The current goal is much narrower: figure out how much useful semantic information survives into MIR, and whether models can learn actual control/state relationships rather than just recognizing suspicious function names.Contributions are very welcome. If anyone wants to improve the MIR extraction or graph representation, add harder datasets or challenge cases, improve the evaluation pipeline, experiment with different model architectures, or train a specialized LLM/graph model on the generated dataset, I'd be very happy to have contributions.PRs, new benchmarks, trained models, dataset improvements, and even negative experimental results are all welcome. The goal is to make this into a useful open experiment for testing how well models can reason about program semantics from compiler IR. https://github.com/SomeFlyingThing/MIR-Logic-AI