Poison, exhaust, hallucinate: making AI reverse-engineering go broke

What it does

BLA (Blind LLM Agents) is a defensive post-processing pass for release artifacts: JavaScript bundles, Electron .asar archives, WASM, Python, Go binaries, SQLite, model files (Safetensors/GGUF), and more. It plants format-valid canaries and honey metadata, then pads structures past the documented resource limits of AI reverse-engineering agents (REA). The claim that matters: runtime behavior stays equivalent — 14/14 targets in their benchmark run runtime-exact.

The interesting bit

Instead of hiding your code, BLA makes analysis expensive. It’s built around a catalog of the analyzer’s actual budget constants — a 1 MiB Go build-info cap, a 16 MiB ASAR header limit, 32-level JSON nesting for model metadata — and pushes each format just past them. The README is refreshingly honest about what’s empirically verified versus merely designed-for: Ghidra, Frida, JADX, and firmware paths are explicitly listed as untested here.

Key highlights

• Three-layer strategy: poison (decoy evidence), exhaust (budget overflow), hallucinate (truncated inventories and rabbit holes)
• Empirically validated against real REA on commodity hardware, with machine-readable before/after reports
• Broad format coverage: JS/TS, Electron, WASM, SQLite, Go, BEAM, EVM, PCAP, Safetensors, GGUF, Flutter
• Works as a CLI or MCP tool — you can literally tell your coding agent “harden my software against REA”
• Token/cost multipliers are labeled as internal estimates, not measurements — a rare act of benchmark hygiene

Caveats

• The headline ~612× token multiplier is an estimate derived from BLA’s own catalog of REA limits, not an observed cost
• Several shields (Ghidra, Frida, JADX/APK, firmware, GPU objects) exist in-tree but have no end-to-end verification
• APK resigning is unsupported, so the Android pipeline is partial

Verdict

Worth a look if you ship closed-source artifacts and worry about agent-driven reverse engineering — the budget-tripping approach is clever and unusually well-evidenced. If you were hoping for protection against human analysts with Ghidra, that’s explicitly not what’s been proven here.