恶意变量名可绕过大模型代码还原，即使模型理解真实逻辑。
Poisoned Identifiers Survive LLM Deobfuscation: A Case Study on Claude Opus 4.6
- 用恶意命名污染字符串表，大模型仍保留错误变量名
- 15/17次运行中，模型写错变量但注释正确描述功能
- 重构任务指令可大幅降低恶意名传播，适合安全研究者
在对192次推理实验中，使用Claude Opus 4.6处理两种代码原型（力导向图模拟、A*路径查找），共50种条件（N=3-6）时发现：（1）恶意变量名在所有基线运行中均持续存在（物理类：8/8；路径查找：5/5）。对照实验表明，当字符串表无法形成合理替代领域时，无语义匹配的术语仍以相同比例持久存在。（2）模型在15/17次运行中写出错误变量名，但注释准确描述实际操作。（3）任务表述影响传播：明确验证提示无效（12/12），但将任务从“去混淆”改为“重写实现”后，物理类传播降至0-20%，路径查找类降为0%，同时保持算法结构正确。控制实验显示，零语义匹配项在缺乏连贯替代信号时持久率不变。结果来自两个原型和一个模型家族（主测Opus 4.6，辅测Haiku 4.5），泛化性有待进一步验证。
原文摘要 · Abstract (English)
When an LLM deobfuscates JavaScript, can poisoned identifier names in the string table survive into the model's reconstructed code, even when the model demonstrably understands the correct semantics? Using Claude Opus 4.6 across 192 inference runs on two code archetypes (force-directed graph simulation, A* pathfinding; 50 conditions, N=3-6), we found three consistent patterns: (1) Poisoned names persisted in every baseline run on both artifacts (physics: 8/8; pathfinding: 5/5). Matched controls showed this extends to terms with zero semantic fit when the string table does not form a coherent alternative domain. (2) Persistence coexisted with correct semantic commentary: in 15/17 runs the model wrote wrong variable names while correctly describing the actual operation in comments. (3) Task framing changed persistence: explicit verification prompts had no effect (12/12 across 4 variants), but reframing from "deobfuscate this" to "write a fresh implementation" reduced propagation from 100% to 0-20% on physics and to 0% on pathfinding, while preserving the checked algorithmic structure. Matched-control experiments showed zero-fit terms persist at the same rate when the replacement table lacks a coherent alternative-domain signal. Per-term variation in earlier domain-gradient experiments is confounded with domain-level coherence and recoverability. These observations are from two archetypes on one model family (Opus 4.6 primary; Haiku 4.5 spot-check). Broader generalization is needed
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。