正文 · AI 翻译
Poisoning → Exhausting the budget → Inducing misjudgment
By Yu Yang, reporting from Aofeisi
QbitAI | WeChat public account QbitAI
By Yu Yang, reporting from Aofeisi
QbitAI | WeChat public account QbitAI
Someone has finally moved to counter REA.
REA, which uses AI to reverse engineer everything, racked up more than 100,000 GitHub stars in just one week, prompting many developers to declare, “Software is dead.”
If there were an award for the hottest open-source project of 2026, REA would naturally be on the shortlist. It would also be on the shortlist for the most dangerous open-source project of 2026.
So an undergraduate at Sun Yat-sen University took action.
The project is called BLA—it makes AI reverse-engineering agents “blind.”
Its three-step trap is: poisoning → exhausting the budget → inducing misjudgment.
With these tactics combined, reverse engineering software protected by BLA sends AI token consumption soaring by 300–2,800 times.
BLA currently has more than 3,900 stars and 476 forks.
Setting traps for AI sends token bills soaring
Like REA, BLA is a suite of MCP services and CLI tools.
REA’s reverse-engineering process usually follows this logic:
An analyzer first extracts modules, functions and call relationships from a file. A coding agent then uses those results to decide where to look and how to interpret a feature.
BLA aims to defeat this process layer by layer. Put simply, it feeds the analyzer junk while pushing it past its processing limits.
BLA places convincingly formatted fake credentials in files, leading the agent to waste tokens on clues that are actually worthless.
A typical example is a decoy Source Map.
After a webpage’s JavaScript is bundled and minified, its code is often squeezed into just a few lines. A Source Map can tell a debugger which file and position in the original project a line corresponds to, and sometimes includes the source code itself. For reverse-engineering tools, it is a ready-made guide.
BLA generates a validly formatted map containing fictional source-code paths and snippets. For example, it can make ordinary client-side code appear to call a hardware security enclave, complete with a remote attestation interface and comments. If an agent treats this content as evidence, it may keep investigating a call chain that does not exist.
Similar decoys include fake credentials, fake diagnostic messages and code branches that look like authorization logic.
This step is more direct: it deliberately triggers hard-coded quota limits inside the analyzer, causing the tool to return an error.
Take the .asar packages commonly used by Electron. Their headers contain an index listing the files in the package. BLA’s strongest protection setting adds about 4,000 decoy file entries. Each file has very little content but a long path, so most of the added size is concentrated in the index.
Tests showed that applying BLA protection to a 607-byte package increased its size to 16.93 MiB. The header exceeded REA’s default limit, causing a read error.
That default limit can be raised, however, and this step also makes the package larger.
As for the results, the project’s author conducted tests and made estimates.
A comparison of 13 items before and after BLA protection showed that 7 produced errors or were rejected at the tested step, 2 returned partial results, 1 produced an error only for a specific query, and the remaining 3 showed no observed blockage of REA’s analysis.
For cost estimates, the author said internal tests showed that the reverse-engineering AI consumed about 300–2,800 times as many tokens after protection. Estimates based on 14 examples in the GitHub repository put total token consumption after protection at about 639.5 times the previous level and total cost at about 304.4 times the previous level.
A project by a Sun Yat-sen University undergraduate
BLA’s main author, TImo Zhang, is a third-year software engineering student at Sun Yat-sen University.
He is currently interning at ByteDance.
Besides BLA, he has another project with more than 500 stars, “mu (μ),” a small Raspberry Pi-based model designed to reduce coding agents’ token consumption.
Timo Zhang is also a contributor to the LobeHub project.
And he also appears enthusiastic about campus life at Sun Yat-sen University.
Project link:
https://github.com/qybaihe/bla/