tagged · 2 articles

obfuscation

2026

Bigger didn't break it. Knowing did.
Obfuscation dropped this decompiler's recovery from 18.8% of clean functions (28/149) to 0.0-0.9% of the functions each transform fired on (0/97, 0/63, 1/106) — gcc-lenient scorer, native 4096-token window, paired and placebo-controlled. Tripling its parameters bought no monotonic gain in the largest obfuscated cell: three points at n = 151, intervals overlapping. Fine-tuning it on the same transform family bought 12-16% back, and the headline moved from hardening to brittleness — against one modest 6.7B attacker, where every number is a floor.
Jul 30, 2026
2026

Nobody published the denominator
AI-for-security benchmarks that score models on compiled code can report a number nobody can recompute. Of 37 papers reporting an obfuscation-strength number, exactly 1 conditions it on whether the transform actually fired — and that one is a disassembly paper, which scores nothing on re-executability. Our own do-nothing control passes the metric.
Jul 30, 2026