Student's Open-Source Tool Poisons AI Reverse Engineers, Spiking Token Costs 2800x

Sun Yat-sen University junior Timo Zhang has released BLA (Blind LLM Agents) , an open-source countermeasure against AI-powered reverse-engineering tools such as REA . REA lets an LLM agent navigate packed or minified code by calling analysis tools — reading files, following call graphs, and using artifacts like Source Map files to jump straight to relevant modules. BLA exploits this reliance on external clues by planting poisoned artifacts that look legitimate but lead the agent down fabricated paths.

Core Mechanism: Poison, Exhaust, Hallucinate

Zhang summarizes the approach in three steps:

Poison – Insert plausible-looking but false clues (e.g., a source map that points to a non-existent hardware-security-module call).

Exhaust – The agent follows the fake trail, consuming context window and token budget across multiple tool calls.

Hallucinate – The agent incorporates the unverified information into its final report, producing fabricated call chains.

Even if the agent eventually detects the deception, the tokens spent verifying the false lead are already gone.

Concrete Example: JavaScript Source Map Poisoning

In a demonstrated case, a normal client-side script appears to call a hardware security enclave with a convincing authentication flow. An agent that trusts the poisoned source map will chase the imaginary authentication module, map its supposed callers, and emit a report describing calls that never exist in the real program.

Experimental Evaluation

The author ran two sets of tests against REA:

1. Functional Obstruction (13 public samples)

7 samples: analyzer errored or refused during the tested step.

2 samples: returned partial results.

1 sample: errored only on a specific query.

3 samples: no observable analysis hindrance.

One highlight: an Electron ASAR archive grew from 607 bytes to 16.93 MiB after hardening, exceeding REA's default read limit and causing an immediate tool error.

2. Token Cost Modeling (14 samples)

Estimated token consumption for the hardened reverse-engineering task ranged from 300× to 2800× the original cost. The variance stems from two distinct outcomes: early tool errors (captured directly in the obstruction test) versus agents that pursue false leads for many rounds before stopping.

Usage

BLA provides a CLI and an MCP interface. Recommended runtime: Node.js 22.23.4+ or Node.js 24+.

node -v
npx bla-agents benchmark
npx bla-agents harden .

The benchmark command runs the 14 official samples, reporting token multipliers, cost estimates, and result consistency. The harden command audits, hardens, and verifies a build artifact in the current directory. Token and cost figures are internal estimates; users should cross-reference with the published tables.

Related Work by the Same Author

Zhang also maintains mu (μ) , a tiny model running on a Raspberry Pi designed to reduce token usage for coding agents — a complementary project that saves budget for friendly agents while BLA burns budget for hostile ones.