{
  "added_at": "2026-10-17",
  "arxiv_id": "2507.17691",
  "arxiv_version_reviewed": "v2",
  "authors": [
    "Shan Jiang",
    "Pranoy Kovuri",
    "David Tao",
    "Zhixun Tan"
  ],
  "bibtex_url": "https://awesomerea.org/papers/citations/paper-cascade.bib",
  "citation": {
    "container_title": "Proceedings of the IEEE/ACM 48th International Conference on Software Engineering: Software Engineering in Practice",
    "pages": "292-302",
    "publisher": "ACM",
    "sources": [
      "https://api.crossref.org/works/10.1145/3786583.3786873"
    ]
  },
  "code_url": "https://github.com/google/jsir",
  "date_basis": "ACM-deposited Crossref print-publication date, which matches the ICSE 2026 start date; the online-publication date is recorded separately in metadata notes.",
  "date_basis_zh": "采用 ACM 在 Crossref 登记的印刷出版日期，与 ICSE 2026 开幕日期一致；在线出版日期在元数据说明中单独记录。",
  "date_precision": "day",
  "description_en": "Uses Gemini to locate the prelude functions that Obfuscator.IO inserts for string obfuscation, then applies constant-propagation and inlining passes in the JSIR compiler IR to restore string literals and API names deterministically.",
  "description_zh": "利用 Gemini 定位 Obfuscator.IO 为字符串混淆插入的前置（prelude）函数，再在 JSIR 编译器中间表示上执行常量传播与内联，以确定性方式还原字符串字面量和 API 名称。",
  "doi": "10.1145/3786583.3786873",
  "entry_url": "https://awesomerea.org/papers/paper-cascade/",
  "entry_url_zh": "https://awesomerea.org/zh/papers/paper-cascade/",
  "evidence_urls": [
    "https://doi.org/10.1145/3786583.3786873",
    "https://api.crossref.org/works/10.1145/3786583.3786873",
    "https://arxiv.org/abs/2507.17691",
    "https://github.com/google/jsir/blob/3ef1529ee4ecaa97f2891125b8d01ba2d0a75c3e/README.md",
    "https://github.com/google/jsir/blob/3ef1529ee4ecaa97f2891125b8d01ba2d0a75c3e/LICENSE",
    "https://github.com/google/jsir/blob/3ef1529ee4ecaa97f2891125b8d01ba2d0a75c3e/maldoca/js/ast/transforms/extract_prelude/pass.h",
    "https://github.com/google/jsir/blob/3ef1529ee4ecaa97f2891125b8d01ba2d0a75c3e/maldoca/js/ir/analyses/dynamic_constant_propagation/dynamic_prelude.h"
  ],
  "first_arxiv_date": "2025-07-23",
  "id": "paper-cascade",
  "json_url": "https://awesomerea.org/papers/paper-cascade/record.json",
  "kind": "research",
  "markdown_url": "https://awesomerea.org/papers/paper-cascade/index.md",
  "markdown_url_zh": "https://awesomerea.org/zh/papers/paper-cascade/index.md",
  "metadata_notes": "ACM-deposited Crossref metadata records print publication on 2026-04-12 and online publication on 2026-07-11, pages 292–302. The publisher title writes 'LLM-powered'; the arXiv record capitalizes 'Powered'. The reviewed text is arXiv v2, which carries the ICSE-SEIP '26 header. The paper says its prompt templates and JSIR are open-sourced at google/jsir. At the pinned commit that Apache-2.0 repository contains JSIR with prelude-extraction and dynamic constant-propagation code, but no prompt-template, Gemini pipeline or evaluation-set files were found; the paper prints its prelude-detection prompt in Figure 5 and lists an open-source CASCADE release as future work.",
  "metadata_notes_zh": "ACM 在 Crossref 登记的元数据记载印刷出版于 2026-04-12，在线出版于 2026-07-11，页码为 292–302。出版方标题写作“LLM-powered”，arXiv 记录则大写为“Powered”。审阅文本为带有 ICSE-SEIP '26 页眉的 arXiv v2。论文称其提示词模板和 JSIR 已在 google/jsir 开源。固定提交中该 Apache-2.0 仓库包含 JSIR 及前置函数提取、动态常量传播等代码，但未发现提示词模板、Gemini 流程或评测集文件；论文在图 5 中给出了前置函数识别提示词，并将开源 CASCADE 本身列为后续工作。",
  "pdf_url": "https://arxiv.org/pdf/2507.17691v2",
  "project_url": null,
  "publication_date": "2026-04-12",
  "publication_status": "conference-paper",
  "record_type": "paper",
  "runtime_tested": false,
  "scope_limitations_en": "The method addresses Obfuscator.IO string obfuscation; control-flow flattening, other obfuscators and an agent-based design are future work. Evaluation obfuscates 3,000 programs from the ETH 150k JavaScript dataset with four Obfuscator.IO presets and measures prelude detection, recovered literals and run time, not functional equivalence. Production deployment and scan volume are author-reported, and production pre-filtering uses a proprietary YARA rule.",
  "scope_limitations_zh": "该方法针对 Obfuscator.IO 的字符串混淆；控制流平坦化、其他混淆器及基于智能体的设计留待后续工作。评测以 Obfuscator.IO 的四种预设配置混淆 ETH 150k JavaScript 数据集中的 3,000 个程序，衡量前置函数识别、还原的字面量数量和运行时间，而非功能等价性。生产部署及扫描规模均为作者自述，生产环境的预筛选依赖一条未公开的 YARA 规则。",
  "targets": [
    "website"
  ],
  "title": "CASCADE: LLM-powered JavaScript Deobfuscator at Google",
  "title_zh": "CASCADE：谷歌基于大语言模型的 JavaScript 反混淆器",
  "url": "https://doi.org/10.1145/3786583.3786873",
  "venue": "ICSE-SEIP 2026",
  "verification": "source-reviewed",
  "verified_at": "2026-10-17",
  "why_fits_en": "Shows how an LLM can be confined to locating obfuscation helpers while a compiler IR performs the rewrites, a practical pattern for website deobfuscation.",
  "why_fits_zh": "展示了将 LLM 限定于定位混淆辅助函数、由编译器中间表示完成改写的做法，可作为网站反混淆的实用模式。",
  "year": 2026
}