Semref: LLMs plus dependency analysis to refine recovered software architectures

What happened on 26 July

On 26 July 2026 at 17:51 UTC, v1 of Semantic-Enhanced Automatic Refinement of Architecture Recovery Results Using LLMs was submitted to arXiv, listed as accepted at ICSE 2026. The authors note that designed and implemented architectures often diverge and that automatic recovery tools are not accurate enough, leaving architects to refine results by hand. Semref combines an LLM's semantic understanding with structural dependency analysis to refine the output of existing recovery tools. Evaluated on 9 projects with published ground-truth architectures and the output of 10 state-of-the-art tools, the abstract reports normalized gains of 17.72% to 43.35% across metrics, with a 118.57% relative improvement on MoJoFM.

Relevance to cloning risk, and its limits

This is a software engineering paper meant to help maintainers understand their own systems. Indirectly, it shows that using LLMs to condense large codebases into modules and responsibilities is getting cheaper, and that step is among the most time-consuming in understanding or replicating a product. The limits deserve emphasis: the paper uses projects with source code, and the abstract does not cover decompiled, symbol-stripped or obfuscated input, so it says nothing direct about AI recovery of shipped apps. A sober reading for defenders is that once client code is fully obtained, the semantics carried by names and structure lower the barrier to understanding, so a product's distinctive value should not depend entirely on client code being unreadable.

Checks you can run

First, draw a module map of your product, mark the modules that embody your competitive edge, and check whether they run on the client or the server. Second, inspect the symbols, class names, log strings and debug information left in release artifacts, confirm release builds strip or rename them as intended, and keep mapping files internally for crash analysis. Third, include AI-assisted code comprehension in periodic threat-model reviews, grounded in public, verifiable research rather than assumptions that overstate or understate the risk. Re-run the module-mapping exercise whenever a major feature moves between client and server.

Your checklist

• Map modules and check where core logic runs
• Inspect release artifacts for leftover symbols and debug info
• Review AI-assisted comprehension risk periodically using public research