# Poisoned Identifiers Survive LLM Deobfuscation: A Case Study on Claude Opus 4.6

arXiv: https://arxiv.org/abs/2604.04289 · HTML: https://mlsanity.com/paper/2604.04289/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 8 of its 20 references that are in the map.
- First posted on arXiv 5 Apr 2026.

## Builds on (most cited first, 8 of 8)

- [SWE-bench: Can Language Models Resolve Real-World GitHub Issues?](https://mlsanity.com/paper/2310.06770/) (2023)
- [Adversarial Examples for Models of Code](https://mlsanity.com/paper/1910.07517/) (2019)
- [JsDeObsBench: Measuring and Benchmarking LLMs for JavaScript Deobfuscation](https://mlsanity.com/paper/2506.20170/) (2025)
- [The Code Barrier: What LLMs Actually Understand?](https://mlsanity.com/paper/2504.10557/) (2025)
- [CASCADE: LLM-Powered JavaScript Deobfuscator at Google](https://mlsanity.com/paper/2507.17691/) (2025)
- ["Digital Camouflage": The LLVM Challenge in LLM-Based Malware Detection](https://mlsanity.com/paper/2509.16671/) (2025)
- [A Systematic Study of Code Obfuscation Against LLM-based Vulnerability Detection](https://mlsanity.com/paper/2512.16538/) (2025)
- [From Obfuscated to Obvious: A Comprehensive JavaScript Deobfuscation Tool for Security Analysis](https://mlsanity.com/paper/2512.14070/) (2025)

## Abstract (arXiv)

When an LLM deobfuscates JavaScript, can poisoned identifier names in the string table survive into the model's reconstructed code, even when the model demonstrably understands the correct semantics? Using Claude Opus 4.6 across 192 inference runs on two code archetypes (force-directed graph simulation, A* pathfinding; 50 conditions, N=3-6), we found three consistent patterns: (1) Poisoned names persisted in every baseline run on both artifacts (physics: 8/8; pathfinding: 5/5). Matched controls showed this extends to terms with zero semantic fit when the string table does not form a coherent alternative domain. (2) Persistence coexisted with correct semantic commentary: in 15/17 runs the model wrote wrong variable names while correctly describing the actual operation in comments. (3) Task framing changed persistence: explicit verification prompts had no effect (12/12 across 4 variants), but reframing from "deobfuscate this" to "write a fresh implementation" reduced propagation from 100% to 0-20% on physics and to 0% on pathfinding, while preserving the checked algorithmic structure. Matched-control experiments showed zero-fit terms persist at the same rate when the replacement table lacks a coherent alternative-domain signal. Per-term variation in earlier domain-gradient experiments is confounded with domain-level coherence and recoverability. These observations are from two archetypes on one model family (Opus 4.6 primary; Haiku 4.5 spot-check). Broader generalization is needed