# CASCADE: LLM-Powered JavaScript Deobfuscator at Google

arXiv: https://arxiv.org/abs/2507.17691 · HTML: https://mlsanity.com/paper/2507.17691/

## Key facts

- Cited by 5 papers in the map (data through 14 Oct 2026).
- Builds on 13 of its 55 references that are in the map.
- First posted on arXiv 23 Jul 2025.

## Builds on (most cited first, 13 of 13)

- [Are Emergent Abilities of Large Language Models a Mirage?](https://mlsanity.com/paper/2304.15004/) (2023)
- [StarCoder 2 and The Stack v2: The Next Generation](https://mlsanity.com/paper/2402.19173/) (2024)
- [Using an LLM to Help With Code Understanding](https://mlsanity.com/paper/2307.08177/) (2023)
- [How well do Large Language Models perform in Arithmetic tasks?](https://mlsanity.com/paper/2304.02015/) (2023)
- [Code Translation with Compiler Representations](https://mlsanity.com/paper/2207.03578/) (2022)
- [CCTEST: Testing and Repairing Code Completion Systems](https://mlsanity.com/paper/2208.08289/) (2022)
- [Language Models Do Hard Arithmetic Tasks Easily and Hardly Do Easy Arithmetic Tasks](https://mlsanity.com/paper/2406.02356/) (2024)
- [LLM-Powered Test Case Generation for Detecting Bugs in Plausible Programs](https://mlsanity.com/paper/2404.10304/) (2024)
- [On the Effectiveness of Large Language Models in Writing Alloy Formulas](https://mlsanity.com/paper/2502.15441/) (2025)
- [JsDeObsBench: Measuring and Benchmarking LLMs for JavaScript Deobfuscation](https://mlsanity.com/paper/2506.20170/) (2025)
- [Generating executable oracles to check conformance of client code to requirements of JDK Javadocs using LLMs](https://mlsanity.com/paper/2411.01789/) (2024)
- [FV8: A Forced Execution JavaScript Engine for Detecting Evasive Techniques](https://mlsanity.com/paper/2405.13175/) (2024)
- [Optimizing Away JavaScript Obfuscation](https://mlsanity.com/paper/2009.09170/) (2020)

## Built on by (most cited first, 5 of 5)

- [OBsmith: LLM-Powered JavaScript Obfuscator Testing](https://mlsanity.com/paper/2510.10066/) (2025)
- [Semantic Voting: Execution-Grounded Consensus for LLM Code Generation](https://mlsanity.com/paper/2605.08680/) (2026)
- [APRIL: API Synthesis with Automatic Prompt Optimization and Reinforcement Learning](https://mlsanity.com/paper/2509.25196/) (2025)
- [Poisoned Identifiers Survive LLM Deobfuscation: A Case Study on Claude Opus 4.6](https://mlsanity.com/paper/2604.04289/) (2026)
- [Sketch-and-Verify: Structured Inference-Time Scaling via Program Sketching](https://mlsanity.com/paper/2605.08658/) (2026)

## Abstract (arXiv)

Software obfuscation, particularly prevalent in JavaScript, hinders code comprehension and analysis, posing significant challenges to software testing, static analysis, and malware detection. This paper introduces CASCADE, a novel hybrid approach that integrates the advanced coding capabilities of Gemini with the deterministic transformation capabilities of a compiler Intermediate Representation (IR), specifically JavaScript IR (JSIR). By employing Gemini to identify critical prelude functions, the foundational components underlying the most prevalent obfuscation techniques, and leveraging JSIR for subsequent code transformations, CASCADE effectively recovers semantic elements like original strings and API names, and reveals original program behaviors. This method overcomes limitations of existing static and dynamic deobfuscation techniques, eliminating hundreds to thousands of hardcoded rules while achieving reliability and flexibility. CASCADE is already deployed in Google's production environment, demonstrating substantial improvements in JavaScript deobfuscation efficiency and reducing reverse engineering efforts.