LLM4C2Rust: Large Language Models for Automated Memory-Safe Code Transpilation

1. Problem Statement

Legacy software systems written in C and C++ are prone to critical memory-safety vulnerabilities (e.g., buffer overflows, dangling pointers, data races), which account for approximately 70% of reported security issues. While Rust offers a modern alternative with compile-time memory safety guarantees, manually migrating legacy C/C++ code to Rust is prohibitively expensive, time-consuming, and error-prone.

Existing automated transpilation tools face two main limitations:

1. Rule-based approaches: Often produce non-idiomatic Rust code that retains unsafe blocks and low-level C idioms, failing to fully leverage Rust's safety features.
2. Standard Large Language Models (LLMs): While capable of generating idiomatic code, they suffer from hallucinations (producing incorrect or unverifiable code) and lack semantic guarantees regarding memory safety.

The core challenge is to automate the transpilation of C/C++ to memory-safe Rust while ensuring functional equivalence, idiomatic quality, and minimizing hallucinations.

2. Methodology

The authors propose LLM4C2Rust, a novel framework that integrates Large Language Models (LLMs) with a Retrieval-Augmented Generation (RAG) pipeline and a Small Language Model (SLM) to enhance memory safety.

A. Architecture Overview

The framework operates through a multi-stage pipeline:

1. Input Segmentation:

   • Instead of splitting code by function, the system processes C/C++ files character-by-character, tracking braces {}.
   • Code is segmented into balanced blocks (ensuring no function is split) with a minimum length of 500 characters to provide sufficient context while adhering to token limits.
   • A global natural-language summary of the program is attached to each segment to maintain intent.

2. Two-Stage Transpilation:

   • Stage 1 (Initial Transpilation): The LLM converts C/C++ segments into "unsafe" Rust. This stage prioritizes functional equivalence, allowing raw pointers and casts to preserve behavior.
   • Stage 2 (Refinement): The initial Rust code is passed to a second LLM refinement step. The prompt explicitly instructs the model to eliminate Raw Pointer Dereferences (RPDs) and Unsafe Type Casts (UTCs) to improve memory safety.

3. RAG Integration:

   • To mitigate hallucinations, the LLM is augmented with retrieved context from external sources, including the Rust Programming Language book, safety best practices, and compiler error documentation.
   • A similarity search (Cosine Similarity) retrieves relevant code patterns and documentation chunks to guide the generation process.

4. Verification Layer:

   • Self-Reported Metrics: The LLM estimates the number of RPDs and UTCs in its output.
   • Compiler-Verified Ground Truth: The generated Rust code is compiled using rustc. A custom bash script parses compiler error codes (e.g., E0133, E0392 for RPDs; E0604–E0607 for UTCs) and counts unsafe blocks and lines of code (ULoCs) to determine the actual safety status.

B. Models Evaluated

The study tested three OpenAI models:

• GPT-4o and GPT-4-Turbo (Large Language Models).
• o3-mini (Small Language Model).
• All models were configured with temperature = 0 to maximize reproducibility.

3. Key Contributions

1. Novel Framework: Proposed a RAG-assisted framework combining LLMs and SLMs specifically for C/C++-to-Rust transpilation with a focus on memory safety.
2. Hybrid Approach: Demonstrated that integrating retrieval-based context (RAG) with generative models effectively reduces hallucinations and improves the correctness of transpiled code compared to standard LLM prompting.
3. Rigorous Evaluation: Introduced a dual-validation method comparing LLM self-assessments against compiler-verified metrics (RPDs, UTCs, ULoCs) to quantify hallucination rates.
4. Empirical Evidence: Provided experimental data showing that RAG-enhanced pipelines can achieve near-complete elimination of unsafe constructs in specific legacy programs.

4. Experimental Results

The framework was evaluated on seven GNU Coreutils programs (e.g., uniq, cat, tail) originally written in C.

• Performance of GPT-4-Turbo:

  • Achieved the best overall results, successfully eliminating RPDs and UTCs in five out of seven programs (e.g., uniq, cat, head, split, truncate).
  • Showed the highest alignment between self-reported safety improvements and compiler-verified results.
  • Reduced Unsafe Lines of Code (ULoCs) significantly (e.g., split reduced from 114 to 1 ULoC).

• Performance of GPT-4o:

  • Demonstrated strong qualitative reasoning and accurate safety trends, though it occasionally overestimated improvements in larger programs (e.g., tail).
  • Successfully reduced RPDs to zero in several programs.

• Performance of o3-mini (SLM):

  • Produced syntactically correct code but exhibited the highest hallucination rate.
  • Frequently overstated safety improvements (e.g., claiming RPD reductions that the compiler did not verify).
  • Often inserted declarative safety directives (e.g., #![forbid(unsafe_code)]) without actually removing the underlying unsafe logic, leading to compilation failures or residual unsafe blocks.

• Comparison with Baselines:

  • The RAG-enhanced LLM approach significantly outperformed previous state-of-the-art tools like C2SaferRust and LAC2R in reducing RPDs, UTCs, and ULoCs.
  • For example, in the cat program, GPT-4-Turbo achieved a 100% reduction in RPDs, whereas C2SaferRust achieved only 24%.

5. Significance and Conclusion

The paper establishes that RAG-enhanced LLMs are a viable and superior solution for automated memory-safe code transpilation.

• Security Impact: The ability to automatically convert legacy C/C++ code into memory-safe Rust without human intervention addresses a critical industry need, potentially reducing the 70% of vulnerabilities caused by memory safety issues.
• Hallucination Mitigation: The study proves that augmenting LLMs with domain-specific retrieval (RAG) significantly reduces hallucinations, making the generated code more reliable for safety-critical systems.
• Future Directions: The authors plan to scale this approach to larger datasets (e.g., the LAERTES benchmark) and explore differential verification for Rust-to-Rust reconfiguration, aiming to support industrial-scale legacy migration.

In summary, LLM4C2Rust demonstrates that combining the fluency of generative AI with the determinism of static analysis and retrieval context can effectively modernize legacy software, bridging the gap between performance-critical C/C++ systems and the safety guarantees of Rust.