Latent reasoning improves single-shot JavaScript code deobfuscation accuracy
Stage-Supervised Latent Reasoning for Single-Shot JavaScript Deobfuscation
Software Engineering
Summary
JavaScript code can be purposely scrambled to hide what it does, which makes it harder to study or fix. The authors propose a method that learns from step-by-step cleaning examples but produces a fully clean version in one try. Their approach uses intermediate hints from existing tools to train a model that better understands how to undo the scrambling. Tests show it creates more syntactically correct and semantically faithful versions of code than simpler methods.
What this means in practice
- •For software security teams: Improve analysis and review of obfuscated JavaScript by generating cleaner code for security audits and vulnerability detection.
- •For malware analysts: Assist in quickly recovering original JavaScript code from obfuscated malware samples to understand malicious behaviors.
Authors
Rong Feng, Suman Saha
Abstract
JavaScript obfuscation is widely used to protect code, but it also makes program analysis and security review substantially harder. Existing LLM-based deobfuscation methods usually treat the task as one-step translation, ignoring the staged structure of practical deobfuscation pipelines. This WIP paper proposes a stage-aware latent reasoning framework that converts intermediate outputs from a deterministic deobfuscation tool into supervision for Coconut-based training. The model learns from multi-stage rewrites during training but generates the final cleaned program in a single shot at inference time. Preliminary results on JsDeObsBench show that the Coconut-based model improves syntactic validity to 50%, compared with 15% for direct fine-tuning and 25% for a zero-shot baseline, and reaches 80% semantic correctness among valid outputs, indicating better semantic faithfulness than either comparison model in deobfuscation.