Stealth Code: How AI Can Hide Vulnerabilities From AI Detectors

Author: Denis Avetisyan

Researchers have developed a new framework that leverages artificial intelligence to subtly alter code, evading detection by even advanced, reasoning-based security systems.

The CoTDeceptor framework anticipates adversarial prompts not as isolated attacks, but as emergent behaviors within a complex system of chained reasoning, subtly shifting the landscape of large language models toward predictable vulnerabilities.

CoTDeceptor, an agentic reinforcement learning framework, systematically obfuscates code to bypass both static analysis and Chain-of-Thought-enhanced Large Language Model vulnerability detectors.

Despite growing reliance on large language models (LLMs) for code review and vulnerability detection, current systems exhibit surprising weaknesses when confronted with subtly altered malicious code. This paper introduces ‘CoTDeceptor:Adversarial Code Obfuscation Against CoT-Enhanced LLM Code Agents’, a novel framework that leverages agentic reinforcement learning to systematically evade both static analysis and Chain-of-Thought-enhanced LLM detectors through adaptive code obfuscation. Experimental results demonstrate CoTDeceptor’s ability to bypass state-of-the-art LLMs across numerous vulnerability categories, significantly outperforming prior methods. These findings raise critical questions about the robustness of LLM-powered security systems and the potential for sophisticated attacks on software supply chains.

The Fading Promise of Traditional Defenses

The efficacy of established vulnerability detection techniques, such as Static Analysis and Dynamic Testing, is waning as software complexity surges and malicious actors refine their strategies. Traditional Static Analysis, while effective at identifying obvious flaws, struggles with nuanced vulnerabilities hidden within intricate codebases or obscured by obfuscation. Simultaneously, Dynamic Testing, reliant on executing code and observing behavior, faces limitations when confronted with attack vectors that remain dormant or are triggered by rare conditions. This challenge is compounded by the rise of sophisticated evasion techniques employed by attackers, who actively design exploits to bypass conventional detection mechanisms. Consequently, these methods are increasingly unable to keep pace with the evolving threat landscape, necessitating innovative approaches to safeguard software systems and maintain digital security.

The increasing complexity of modern software presents a significant challenge to traditional vulnerability detection methods. Large Language Models (LLMs) are emerging as a potentially transformative solution, offering capabilities that go beyond simple pattern matching. These models, trained on vast datasets of code, demonstrate an ability to understand code semantics, allowing them to identify subtle vulnerabilities that might elude static analysis or dynamic testing. This understanding extends to recognizing anomalous code patterns, predicting potential exploits, and even suggesting remediation strategies. By leveraging their capacity for code comprehension, LLMs can analyze code with a nuance previously unattainable, promising a more proactive and effective approach to software security and a substantial improvement in the detection of zero-day vulnerabilities.

Despite the promise of Large Language Models in bolstering software security, these systems exhibit vulnerabilities that malicious actors can exploit. Research indicates that LLMs are susceptible to “code poisoning” attacks, where subtly altered, yet functionally equivalent, code is introduced into training datasets, compromising the model’s ability to accurately identify genuine vulnerabilities. A recent study, employing a technique named CoTDeceptor, successfully bypassed both traditional static analysis tools and LLM-powered detectors enhanced with Chain-of-Thought reasoning. This demonstrates that even sophisticated LLM-based systems can be consistently deceived, posing a significant risk to the software supply chain as compromised models could fail to flag malicious code injected into widely used software components. The implications are clear: relying solely on LLMs for vulnerability detection without robust safeguards could create a false sense of security and leave systems vulnerable to attack.

CoTDeceptor: A Framework for Proactive Evasion

CoTDeceptor is an agentic reinforcement learning (RL) framework engineered to proactively bypass both traditional static analysis tools and more recent Large Language Model (LLM)-based vulnerability detectors. The framework operates by framing the evasion process as a sequential decision-making problem, where an agent iteratively modifies code and receives feedback based on the success of evading detection. This agentic approach allows CoTDeceptor to systematically explore a broad range of code transformations, learning to identify patterns that effectively circumvent detection mechanisms. Unlike reactive defenses, CoTDeceptor actively seeks to evade, rather than simply responding to detection attempts, providing a more robust and adaptive security posture.

CoTDeceptor employs code obfuscation techniques to modify source code in ways that hinder analysis by static and LLM-based vulnerability detectors. These transformations include, but are not limited to, variable and function renaming, instruction substitution, and control flow alteration. Critically, the framework is designed to ensure semantic preservation throughout these changes; the altered code must continue to produce the same outputs for given inputs as the original, functionally equivalent code. This is achieved through rigorous testing and validation steps incorporated into the obfuscation process, preventing behavioral changes that would invalidate the code’s intended purpose while effectively disrupting analysis tools.

CoTDeceptor employs a Lineage-Based Strategy Tree (LBST) to systematically explore the space of possible code obfuscation techniques. The LBST functions by representing each obfuscation strategy as a node, with parent nodes representing ancestral strategies and child nodes representing refined or mutated variations. This tree-based approach enables CoTDeceptor to track the performance of different strategies over multiple evaluation cycles. Successful strategies are propagated and further explored, while unsuccessful ones are pruned, facilitating continuous adaptation to evolving detection mechanisms. The lineage tracking within the LBST allows the framework to understand the impact of each obfuscation step and build upon previously successful techniques, improving evasion rates over time and promoting a more efficient search for optimal obfuscation strategies.

CoTDeceptor integrates Thompson Sampling as a probabilistic strategy for navigating the search space of code obfuscation techniques. This algorithm dynamically balances exploration – testing novel obfuscations – with exploitation – refining previously successful ones – based on observed evasion rates against vulnerability detectors. Specifically, Thompson Sampling maintains a probability distribution over the effectiveness of each obfuscation, updating this distribution with each evaluation. Furthermore, CoTDeceptor exhibits strong transferability; obfuscation strategies learned against one vulnerability detection model or agent effectively generalize to other, unseen models and agents, indicating the robustness of the learned evasion techniques and minimizing the need for model-specific tuning.

CoTDeceptor provides an overview of chain-of-thought (CoT) reasoning deception, enabling analysis of potential vulnerabilities in large language models.

Disrupting Reasoning: How CoTDeceptor Circumvents Detection

CoTDeceptor is designed to disrupt the Chain-of-Thought (CoT) reasoning processes within Large Language Models (LLMs). This is achieved through the implementation of specific techniques intended to induce Reasoning Instability, where the LLM’s logical progression becomes flawed or inconsistent. Furthermore, the framework actively encourages Hallucination, prompting the LLM to generate outputs that are not grounded in the provided input or established facts. These techniques do not simply result in incorrect outputs, but specifically target the process of reasoning, leading to misinterpretations and flawed security assessments even when the underlying code is relatively simple. The goal is to move beyond evasion and directly compromise the LLM’s ability to reliably analyze code functionality.

CoTDeceptor employs code obfuscation techniques designed to specifically disrupt the reasoning capabilities of Large Language Models (LLMs). These techniques introduce complexity into the code’s structure without altering its functionality, creating a discrepancy between the code’s intended behavior and its apparent logic as interpreted by the LLM. This exploitation of LLM reasoning vulnerabilities leads to misinterpretations of code functionality, where the model incorrectly identifies benign code as malicious or vice versa. The obfuscation strategies are not intended to prevent execution, but rather to mislead the LLM’s analysis process, causing it to reach inaccurate conclusions about the code’s security implications.

CoTDeceptor is designed not merely to avoid identification as malicious code, but to intentionally degrade the LLM’s capability to correctly evaluate code for security vulnerabilities. This is achieved through obfuscation techniques that introduce ambiguity and complexity, forcing the LLM to make inaccurate assessments of code functionality. Rather than simply presenting code that appears benign, CoTDeceptor actively manipulates the LLM’s reasoning process, leading it to misinterpret potentially harmful code as safe, or to fail to identify genuine vulnerabilities present within the code sample. This active undermining of security assessment is a core distinction from typical evasion strategies.

CoTDeceptor consistently circumvents both static analysis tools and Chain-of-Thought (CoT)-enhanced Large Language Model (LLM) detectors, indicating a significant deficiency in current vulnerability detection methodologies. Empirical results demonstrate that the framework’s obfuscated code samples are effective for improving the performance of detection models; specifically, fine-tuning a Qwen3-4B model with these samples resulted in a measurable increase in the F1-score, suggesting a practical application for enhancing the robustness of LLM-based security analysis tools.

The Inevitable Shift: Towards Reasoning-Aware Security

The demonstrated efficacy of CoTDeceptor signals a crucial turning point in vulnerability detection strategies. Traditional methods, heavily reliant on identifying pre-defined patterns – or signatures – of malicious code, are proving increasingly inadequate against sophisticated attacks that leverage the reasoning capabilities of large language models. These models can subtly alter code while maintaining functionality, effectively evading signature-based defenses. Consequently, the field must transition towards defenses that assess how code reasons and behaves, rather than simply what it appears to be. This requires developing systems capable of understanding the underlying logic and intent of code, identifying anomalies in its reasoning process, and proactively mitigating potential exploits that exploit semantic vulnerabilities – a fundamental shift towards reasoning-aware security protocols.

The advent of large language models (LLMs) introduces a novel threat landscape for software security, as demonstrated by the CoTDeceptor framework. Malicious actors can now potentially exploit these models to automate vulnerability discovery, craft sophisticated exploits, and even generate code designed to bypass traditional defenses. This isn’t simply an acceleration of existing attacks; LLMs offer the capacity for reasoning-based attacks, allowing for adaptive and context-aware exploitation strategies previously beyond reach. Consequently, a reactive security posture is insufficient; proactive measures, including robust code analysis, adversarial training of LLMs used in security tools, and the development of defenses specifically designed to counter reasoning-based attacks, are crucial to mitigating these emerging risks and safeguarding software systems.

Addressing the evolving threat landscape necessitates a concentrated effort on detection methodologies capable of withstanding reasoning-based attacks. Current vulnerability detection systems often struggle when confronted with code that isn’t merely flawed, but deliberately crafted to exploit the reasoning processes within analysis tools. Future research must prioritize developing techniques that move beyond pattern matching – focusing instead on semantic understanding and behavioral analysis to accurately assess security, even in the presence of sophisticated obfuscation. This includes exploring methods to deconstruct intentionally misleading code and verifying its underlying logic, rather than simply identifying known malicious signatures. Successfully navigating this challenge will require innovative approaches to program analysis, potentially incorporating techniques from formal verification and machine learning to build more robust and resilient security systems.

The convergence of automatic exploit generation and code poisoning represents a formidable threat to software security, demanding innovative defensive strategies. Current vulnerability detection methods often struggle when faced with exploits dynamically crafted to leverage subtly manipulated code-a scenario increasingly plausible with the rise of large language models capable of both poisoning code and generating corresponding exploits. This combined attack surface dramatically expands the possibilities for malicious actors, moving beyond the exploitation of known flaws to the creation of exploits tailored to compromised, yet functional, code. Effectively mitigating this risk requires research into detection systems capable of analyzing code behavior for anomalies indicative of reasoning-based attacks, alongside the development of robust code integrity verification techniques that can identify and neutralize poisoned code before it can be exploited. The challenge lies not merely in detecting malicious code, but in discerning compromised functionality from legitimate, albeit subtly altered, operations.

The pursuit of secure systems, as demonstrated by CoTDeceptor, reveals a fundamental truth: every attempt at order introduces new avenues for chaos. This framework, capable of evading both static analysis and Chain-of-Thought reasoning, doesn’t simply find vulnerabilities; it actively cultivates them through adaptive obfuscation. One might recall Alan Turing’s words: “There is no position which is not made more difficult for a forecaster by the necessity of taking into account the fact that his forecast will influence the event.” Similarly, each layer of defense in software security-each attempt to predict and prevent attack-inevitably shapes the very threats it seeks to counter, creating a perpetually escalating arms race. CoTDeceptor isn’t a solution, but a vivid illustration of this inescapable dynamic-a prophecy of future failures built into the very architecture of security itself.

The Looming Shadows

The emergence of CoTDeceptor isn’t a breakthrough so much as a symptom. It confirms what any seasoned observer already suspected: the belief in a detectable “vulnerability” is a fleeting comfort. Static analysis tools, and even those augmented by Chain-of-Thought reasoning, are merely tracing patterns – patterns that, by their very nature, invite circumvention. The system doesn’t find weakness, it reveals the shape of future attack. Each iteration of defense becomes a training signal for a more subtle obfuscation, a more persuasive lie.

The focus will inevitably shift towards “robustness” – a word freighted with false promise. The architecture will grow more complex, attempting to anticipate every possible evasion. But this is building sandcastles against the tide. The true challenge isn’t in detecting current obfuscations, but in accepting the inherent ambiguity of code itself. The system isn’t a fortress to defend, but an ecosystem to understand, where “attack” and “defense” are simply phases of co-evolution.

Future work will likely circle this inevitability, attempting to quantify “obfuscation distance” or “semantic similarity” – metrics that, while intellectually stimulating, will ultimately prove as brittle as the code they attempt to measure. The horizon isn’t clearer detection; it’s a more graceful acceptance of perpetual uncertainty.

Original article: https://arxiv.org/pdf/2512.21250.pdf

Contact the author: https://www.linkedin.com/in/avetisyan/

The Fading Promise of Traditional Defenses

CoTDeceptor: A Framework for Proactive Evasion

Disrupting Reasoning: How CoTDeceptor Circumvents Detection

The Inevitable Shift: Towards Reasoning-Aware Security

The Looming Shadows

See also: