AwesomeREA.org

2026 · Conference paper

CASCADE: LLM-powered JavaScript Deobfuscator at Google

Shan Jiang; Pranoy Kovuri; David Tao; Zhixun Tan

Uses Gemini to locate the prelude functions that Obfuscator.IO inserts for string obfuscation, then applies constant-propagation and inlining passes in the JSIR compiler IR to restore string literals and API names deterministically.

Scope and limitations

The method addresses Obfuscator.IO string obfuscation; control-flow flattening, other obfuscators and an agent-based design are future work. Evaluation obfuscates 3,000 programs from the ETH 150k JavaScript dataset with four Obfuscator.IO presets and measures prelude detection, recovered literals and run time, not functional equivalence. Production deployment and scan volume are author-reported, and production pre-filtering uses a proprietary YARA rule.

Why it fits this collection

Shows how an LLM can be confined to locating obfuscation helpers while a compiler IR performs the rewrites, a practical pattern for website deobfuscation.

Publication and review details

Venue
ICSE-SEIP 2026
Status
Conference paper
Publication / posting date
April 12, 2026
Date source
ACM-deposited Crossref print-publication date, which matches the ICSE 2026 start date; the online-publication date is recorded separately in metadata notes.
First arXiv submission
July 23, 2025
arXiv
2507.17691
Reviewed arXiv version
v2
DOI
10.1145/3786583.3786873

ACM-deposited Crossref metadata records print publication on 2026-04-12 and online publication on 2026-07-11, pages 292–302. The publisher title writes 'LLM-powered'; the arXiv record capitalizes 'Powered'. The reviewed text is arXiv v2, which carries the ICSE-SEIP '26 header. The paper says its prompt templates and JSIR are open-sourced at google/jsir. At the pinned commit that Apache-2.0 repository contains JSIR with prelude-extraction and dynamic constant-propagation code, but no prompt-template, Gemini pipeline or evaluation-set files were found; the paper prints its prelude-detection prompt in Figure 5 and lists an open-source CASCADE release as future work.

Sources reviewed

Source review only; experiments were not rerun for this collection. Cite the original authors using the linked paper or BibTeX.

Primary sources

  1. https://doi.org/10.1145/3786583.3786873
  2. https://api.crossref.org/works/10.1145/3786583.3786873
  3. https://arxiv.org/abs/2507.17691
  4. https://github.com/google/jsir/blob/3ef1529ee4ecaa97f2891125b8d01ba2d0a75c3e/README.md
  5. https://github.com/google/jsir/blob/3ef1529ee4ecaa97f2891125b8d01ba2d0a75c3e/LICENSE
  6. https://github.com/google/jsir/blob/3ef1529ee4ecaa97f2891125b8d01ba2d0a75c3e/maldoca/js/ast/transforms/extract_prelude/pass.h
  7. https://github.com/google/jsir/blob/3ef1529ee4ecaa97f2891125b8d01ba2d0a75c3e/maldoca/js/ir/analyses/dynamic_constant_propagation/dynamic_prelude.h