Source-linked AI summary
Stage-Supervised Latent Reasoning for Single-Shot JavaScript Deobfuscation
Rong Feng, Suman Saha
TL;DR
JavaScript obfuscation makes analysis and security review harder, while current LLM deobfuscation often treats recovery as one-step translation rather than modeling practical stages. This paper trains Coconut with deterministic-tool intermediate rewrites but generates the cleaned program in one inference shot. Preliminary results show stronger syntactic validity and semantic correctness than the supplied comparison models, with larger-scale validation still needed.
Problem
LLM-based deobfuscation is commonly framed as one-step translation and largely ignores intermediate stages in practical pipelines, while obfuscation makes JavaScript analysis harder.
Source: §1 · p. 1, §2.2 · p. 3Method
The framework uses deterministic deobfuscation-tool intermediate outputs as multi-stage supervision for Coconut training, while generating the final cleaned program in one shot at inference.
Source: §1 · p. 2Results
50% syntactic validity versus 15% for direct fine-tuning and 25% for zero-shot, plus 80% semantic correctness among valid outputs versus 0% and 40%, respectively.
Source: §1 · p. 2, §4.3 · p. 5Takeaways & Limitations
The preliminary findings indicate that stage-level supervision is a promising direction for improving LLM-based JavaScript deobfuscation.
Source: §6 · p. 6The findings are preliminary, based on a small test set and partially manual semantic evaluation; larger-scale validation is needed.
Source: §4.2 · p. 5, §4.3 · p. 6
Abstract
from arXiv · showhide
JavaScript obfuscation is widely used to protect code, but it also makes program analysis and security review substantially harder. Existing LLM-based deobfuscation methods usually treat the task as one-step translation, ignoring the staged structure of practical deobfuscation pipelines. This WIP paper proposes a stage-aware latent reasoning framework that converts intermediate outputs from a deterministic deobfuscation tool into supervision for Coconut-based training. The model learns from multi-stage rewrites during training but generates the final cleaned program in a single shot at inference time. Preliminary results on JsDeObsBench show that the Coconut-based model improves syntactic validity to 50%, compared with 15% for direct fine-tuning and 25% for a zero-shot baseline, and reaches 80% semantic correctness among valid outputs, indicating better semantic faithfulness than either comparison model in deobfuscation.
1 Introduction
JavaScript obfuscation complicates analysis because real programs often combine transformations that require staged simplification. This work uses deterministic-tool intermediate outputs to supervise Coconut-based latent reasoning during training, while the model generates cleaned code in one shot at inference.
1 Introduction
- Real-world JavaScript obfuscation combines transformations such as string encoding, control-flow flattening, dead-code injection, and self-defending constructs, making recovery a staged process.Obfuscation also makes program comprehension, security auditing, vulnerability analysis, and maintenance harder.Source: §1 · p. 1
- LLM deobfuscation is commonly framed as one-step translation [2], while deterministic tools can struggle with unseen patterns and combinations.The paper identifies deterministic intermediate states as a resource largely ignored by existing LLM-based methods.Source: §1 · pp. 1–2
- The framework turns deterministic-tool intermediate outputs into multi-stage Coconut supervision, then asks the model to produce cleaned code in a single inference shot.Coconut represents reasoning in continuous latent space rather than generating explicit intermediate text [3].Source: §1 · p. 2
- 50% syntactic validity and 80% semantic correctness among valid outputs were achieved by the Coconut model, exceeding direct fine-tuning and zero-shot results on both measures.Syntactic validity was 50% versus 15% for direct fine-tuning and 25% for zero-shot; semantic correctness was 80% versus 0% and 40%, respectively.Source: §1 · p. 2
2 Related Work
Prior deobfuscation work spans rule-based analysis and learned methods, but both face challenges with complex obfuscation and reliable code recovery. This paper explores deterministic intermediate transformations as supervision for latent reasoning.
2 Related Work
- The paper positions its approach between rule-based analysis and learned methods by using deterministic intermediate transformations as structured supervision.These transformations are neither treated as final outputs nor discarded as auxiliary artifacts.Source: §2 · p. 2
2.1 Code Obfuscation and Deobfuscation
- Traditional analysis methods can lose effectiveness when multiple obfuscation transformations are composed or control structure becomes highly irregular.Common transformations such as control-flow flattening and opaque predicates distort structure while preserving behavior.Source: §2.1 · p. 2
2.2 Large Language Models for Code Analysis
- Off-the-shelf LLMs can produce plausible JavaScript that fails to compile or preserve semantics [2], and direct-translation framing omits practical pipeline stages [2].The paper addresses this gap by treating deterministic pipeline intermediate states as structured supervision.Source: §2.2 · pp. 2–3
2.3 Chain-of-Thought and Latent Reasoning
- Natural-language chain-of-thought produces explicit intermediate text [7], whereas Coconut feeds hidden states back as embeddings for continuous latent reasoning [3].The paper applies this latent reasoning approach to staged program transformation and deobfuscation.Source: §2.3 · p. 3
3 Approach
The approach uses deterministic Webcrack rewrites as stage-level supervision for a Coconut-based model. Training exposes the transformation trajectory, while inference supplies only the obfuscated program and requires direct generation of the final cleaned program.
3 Approach
- The framework captures Webcrack intermediate states and uses transition diffs to supervise Coconut, which generates the final cleaned program directly at inference.Encoding each transition from Pi to Pi+1 as a labeled diff avoids storing redundant full-program snapshots.Source: §3 · p. 3, Figure 1 · p. 3
3.1 Dataset and Stage Extraction
- The dataset is sampled from 1,302 JsDeObsBench programs: 300 smallest programs are retained, 100 are sampled, and split into 60 training, 20 validation, and 20 test examples.P1 is the obfuscated input; P2–P5 progressively inline decoder aliases and wrappers, resolve strings, and perform final cleanup while preserving behavior.Source: §3.1 · p. 4
3.2 Training Formulation and Latent Supervision
- Each Coconut example pairs an obfuscated P1 prompt with ordered P1-to-P5 transformation steps and a final P5 answer.The steps provide stage-specific transformation and code-change supervision; Coconut learns the trajectory in latent space while producing only the final output.Source: §3.2 · p. 4
3.3 Model Variants and Inference
- All variants use Llama 3.2-3B; the comparison includes zero-shot, input-output-only No-CoT fine-tuning, and Coconut stage-supervised fine-tuning.At inference, each receives only P1 and generates P5; Coconut inserts fixed latent thought tokens before output decoding.Source: §3.3 · p. 5
4 Experimental Results
In a preliminary evaluation, Coconut performs best on syntactic validity and semantic correctness among valid outputs. The evaluation uses 20 programs and combines execution-based semantic comparison with manual inspection, so larger-scale validation remains needed.
4 Experimental Results
- The preliminary evaluation asks whether stage-aware latent reasoning improves syntactic validity and semantic preservation over direct fine-tuning and a zero-shot baseline..Source: §4 · p. 5
4.1 Experimental Setup
- Both fine-tuned models use the same AdamW settings, learning rate, weight decay, batch size, and gradient accumulation, with training on two A100 GPUs.The shared optimization setup is intended to isolate training-objective differences.Source: §4.1 · p. 5
4.2 Evaluation Methodology
- Syntactic validity requires parsing; semantic correctness compares execution outputs with ground-truth P5 on test inputs.Semantic correctness is measured only for programs that parse.Source: §4.2 · p. 5
- The study evaluates only 20 programs and uses manual inspection alongside automated execution comparison for semantic correctness.The authors identify a fully automated semantic-evaluation pipeline as necessary for a larger-scale study.Source: §4.2 · p. 5, §4.3 · p. 6
4.3 Results and Discussion
- 50% syntactic validity and 80% semantic correctness among valid outputs were achieved by Coconut, versus 15% and 0% for No-CoT and 25% and 40% for the base model, respectively.Semantic evaluation applies only to syntactically valid outputs.Source: §4.3 · p. 5, Table 1 · p. 6
5 Future Work
The authors plan to strengthen empirical evidence through broader evaluation, stronger baselines, and additional correctness checks. They also plan to study malicious JavaScript and longer-term generalization challenges.
5 Future Work
- The next evaluation will use a broader benchmark with diverse JavaScript obfuscation patterns, structural and task-level metrics, and stronger baselines.Planned baselines include direct one-shot deobfuscation and deterministic tool-only pipelines.Source: §5 · p. 6
- Planned checks include execution-based comparison and differential testing, alongside syntax checks, to assess semantic preservation.The authors also plan ablations of stage supervision, latent reasoning, and the number of training stages.Source: §5 · p. 6
- The authors plan to study analysis of obfuscated malicious JavaScript, while cross-tool generalization and scaling to long inputs remain longer-term goals.Their stated immediate focus is stronger evidence of correctness, robustness, and security relevance.Source: §5 · p. 6
6 Conclusion
The paper concludes that stage-level supervision is a promising direction for LLM-based JavaScript deobfuscation. Its preliminary results favor the Coconut-based model, while broader evaluation and ablations remain future work.
6 Conclusion
- The approach trains a latent-reasoning model on intermediate transformation stages from a deterministic deobfuscation pipeline.Training exposes the model to the process structure while inference remains single-shot.Source: §6 · p. 6
- Preliminary results favor the Coconut-based model over direct fine-tuning and a zero-shot baseline on syntactic validity and semantic faithfulness.The paper identifies broader benchmark results, stronger semantic validation, and ablations as future work.Source: §6 · p. 6