I wonder if another approach would be to map the language syntax onto some banned/censored LLM topic(s) such that programs end up as "readable" instructions for topics the LLM refuses to read and/or write, like producing napalm, nukes, bioweapons, etc. Doesn't have to be factually correct instructions, the terminology itself is enough to shortcircuit most LLMs.

(Inspired by recent malware including bioweapon instructions in the source code as a way to shut down LLM-based analysis.)

Security by obscurity is not security at all.

You're attempting to use a few little gotchas against LLMs that only make sense if you're looking at it one dimensionally as a standard execution flow. AI is not limited by that. Give it a problem too weird going forward and it will divine all your rules by working backwards. Decompile it, rip it apart, and it will follow all those hard rules hidden in the application.

You are trying to hide something digitally from a purely digital creation. This is not a recipe for success.

Wouldn't an LLM just write a python script to convert an intermediate language without the triggering phrases and letter counting.

Wonder how this could be used for communication and captchas? Could be a really expandable approach to determining "probability of bot" for a lot of internal use cases in companies that might involve requesting access to specific resources only meant for humans.

Interesting, reminds me of the Stroop test where people have to say what color a word is written in, except the word is "red" and the color is blue.

I wonder if a sufficiently smart LLM would recognize the difficulty and build a preprocessor that would let it mostly work in a normal syntax.

Where's the human baseline for the benchmarks?

Also, you said:

> The best performing model scores a 66.8. So does this prove LLMs can “understand” the code? I would argue that the answer to this is “no”.

How did you reach that conclusion?

I guess my question is whether it increases the difficulty more for LLMs or humans.

Now that it has a nice webpage the describes the obfuscation technics, it is basically cracked at this point to next-gen models.

May I ask what the motivation behind KilllSwitch is? Out of curiosity, I decided to test your claims and asked Claude to build a program in Go and Claude Skill that is able to decompile (from) and compile (to) KS programs along with a Claude Skill that doesn't trip it up. It all works™ -- All your example programs.

So, whilst I _think_ you've built a very clever interpreter, I don't think you can get around the fact that someone (like me) could just build around the noise you've created anyway.

Right?