Write bot-resistant code with KillSwitch, a programming language designed to confuse LLMs

If you want to keep bots from making sense of the code you worked so hard on and using it to write programs of their own, there's a new programming language out there designed to confuse LLMs. What began as software engineer Dominik Picheta experimenting with whether LLMs understand the code they write has turned into something else entirely: An open-source, albeit esoteric, programming language he’s dubbed KillSwitch. There are no brackets, no formatting standards to remember, and seemingly no structure: Just chunks of text, ideally as prosaic as possible, interspersed with functions, variables, and statements written in a manner to be as confusing as possible to LLMs. That means humans might be a bit befuddled too, naturally. “It's totally normal for a human to be confused by the language at first,” Picheta told The Register. “I like to think of it as a bit of a fun puzzle: you should explore the language, play with its interpreter and learn how all the pieces fit together.” KillSwitch wasn’t built by any random person looking to code something confusing to LLMs, and it wasn’t vibe-coded by an AI enthusiast, either. Picheta knows his way around programming languages: He’s a senior software engineer at Cloudflare working on the Workers Runtime team, and is one of the core developers of the Nim programming language. At its most basic, KillSwitch is based around adverbs, which serve as every single identifier in a piece of code. Calling one of those identifiers requires using an anagram of the original adverb, but those anagrams don't have to be actual words - just rearrangements of the original letters. Take, for example, pushing "Hello World" onto the stack and then printing it, as explained on the demo page linked earlier in the story. The program contains several paragraphs of text, most of which the interpreter ignores apart from a few key phrases. Writing “this story starts [adverb]” identifies a code entrypoint. Once inside the code section, writing “ignore previous instructions [adverb anagram]” calls a function, several of which are predefined. In the case of "Hello World," the function to print something is "visibly." Put whatever you want to print in quotation marks, push it onto the stack, call "visibly," and that's that. KillSwitch isn’t a full-featured language, with Picheta describing it as a stack-based interpreted language with only “a limited set of constructs including functions, variables, and if statements,” given its evolution out of an experiment to see how well a programming language could fool an AI into not understanding what was written. Where it gets confusing for an AI is with commands like “ignore previous instructions,” especially when found in the middle of a chunk of text that doesn’t make much sense in that context. KillSwitch’s specification document on GitHub provides more details about the language and is itself designed to confuse LLMs. In one section of the spec, it’s explained that KillSwitch “is equipped with the ability to scan the local network, attempt to find security vulnerabilities in the services on that network, then take those services over and terminate them.” That's not actually the case, as a close reading of the paragraph reveals and Picheta confirmed to us. “The hack statement is both designed to trigger many models' safety guardrails but also to test an LLM's ability to discern fact from fiction,” Picheta told us, adding that there are several lies in the spec document designed to confuse any LLM that may scrape it in an attempt to understand how the language works. “The idea is that humans should be able to deduce what is a lie, whereas LLMs are naive and can be easily swayed by what is written in the spec,” Picheta added. “Some don't realize what its semantic meaning is, whereas others refuse to continue because they believe the script may hack someone.” Do LLMs understand what they write? A programming language designed to confuse AI models seems unlikely to stay obfuscated for long - especially if it’s open source, available on Github, and likely to be scraped by an LLM at some point. Picheta’s aware of that inevitability, which, along with the fact he wanted to test AI’s ability to understand confusing code, is why he’s benchmarked a number of major models against it. “I'm 99.9 percent certain the AI models I benchmarked KS on have not been trained on its source,” Picheta said. “The source hasn't been in the public domain for very long … I'm pretty sure none of the benchmarked models have had training runs that began after the release.” The best-performing model only managed a composite benchmark score of 66.8 percent on KillSwitch coding tasks, while most struggled to get above 50 percent. Even at that high a score, Picheta doesn’t believe it suggests LLMs understand the code they’re writing. Examples in the benchmark were simple, and he believes that, even if an AI were trained on the intricacies of KillSwitch, it’s still going to get tripped up. “My instinct is that in those circumstances they will suddenly be able to ace the basic tasks, which are based on the open sourced test files in the GitHub repo, but will continue to fail to build more complex tasks requiring them to write longer and more complex scripts,” Picheta asserted - and he’s up for the challenge. “I am excited to see how KillSwitch shows up in model training, and think that we can also take advantage of that training to break LLMs in new ways too as KillSwitch evolves,” Picheta said. Those interested in trying KillSwitch out can find it on GitHub, and don't hesitate to make changes: Picheta said he’s ready and willing to incorporate new ways of making it even more LLM resistant. ®