如果你想防止机器人理解你辛苦编写的代码并利用它自行编写程序，已经出现了一种旨在混淆大型语言模型（LLM）的新编程语言。最初，软件工程师多米尼克·皮切塔（Dominik Picheta）在实验 LLM 是否能理解它们所写的代码，结果却演变成了完全不同的东西：一种他称为 KillSwitch 的开源但晦涩的编程语言。
If you want to keep bots from making sense of the code you worked so hard on and using it to write programs of their own, there's a new programming language out there designed to confuse LLMs. What began as software engineer Dominik Picheta experimenting with whether LLMs understand the code they write has turned into something else entirely: An open-source, albeit esoteric, programming language he’s dubbed KillSwitch.
该语言没有括号、没有需要记忆的格式标准，似乎也没有结构：只有尽可能像散文一样的文本块，间或穿插以函数、变量和语句，且这些内容的写法专门设计成让 LLM 感到困惑。这自然也会让人类感到有些摸不着头脑。
There are no brackets, no formatting standards to remember, and seemingly no structure: Just chunks of text, ideally as prosaic as possible, interspersed with functions, variables, and statements written in a manner to be as confusing as possible to LLMs. That means humans might be a bit befuddled too, naturally.
“人类第一次看到这种语言感到困惑是完全正常的，”皮切塔对《The》表示。
“It's totally normal for a human to be confused by the language at first,” Picheta told The.
“我喜欢把它看作一个有趣的小拼图：你应该去探索这门语言，玩转它的解释器，并学习所有部分如何组合在一起。”KillSwitch并不是由某个随意想要编写让LLMs困惑代码的人构建的，也不是由AI爱好者“氛围编码”的。Picheta对编程语言非常熟悉：他是Cloudflare的高级软件工程师，负责Workers Runtime团队的工作，也是Nim编程语言的核心开发者之一。
“I like to think of it as a bit of a fun puzzle: you should explore the language, play with its interpreter and learn how all the pieces fit together.”KillSwitch wasn’t built by any random person looking to code something confusing to LLMs, and it wasn’t vibe-coded by an AI enthusiast, either. Picheta knows his way around programming languages: He’s a senior software engineer at Cloudflare working on the Workers Runtime team, and is one of the core developers of the Nim programming language.
KillSwitch最基本的形式是围绕副词展开的，这些副词在一段代码中充当每一个标识符。调用这些标识符之一需要使用原副词的变位词，但这些变位词不必是实际存在的单词——只需是原始字母的重新排列。例如，正如故事前文链接的演示页面所解释的那样，将“Hello World”压入栈然后打印它。
At its most basic, KillSwitch is based around adverbs, which serve as every single identifier in a piece of code. Calling one of those identifiers requires using an anagram of the original adverb, but those anagrams don't have to be actual words - just rearrangements of the original letters. Take, for example, pushing "Hello World" onto the stack and then printing it, as explained on the demo page linked earlier in the story.
该程序包含若干段文本，其中大部分被解释器忽略，只有少数关键短例例外。编写“此故事以[副词]开头”可标识代码入口点。
The program contains several paragraphs of text, most of which the interpreter ignores apart from a few key phrases. Writing “this story starts [adverb]” identifies a code entrypoint.
进入代码部分后，写入“忽略先前指令 [副词词根变体]”即可调用若干预定义函数。以“Hello World”为例，打印内容的函数是“visibly”。将你想打印的内容用引号括起来，压入栈中，调用“visibly”，仅此而已。KillSwitch并非功能完备的语言，Picheta将其描述为一种基于栈的解释语言，仅有“有限的构造，包括函数、变量和if语句”，这是因为它源自一个实验——看看编程语言能否让AI不读懂所写内容。
Once inside the code section, writing “ignore previous instructions [adverb anagram]” calls a function, several of which are predefined. In the case of "Hello World," the function to print something is "visibly." Put whatever you want to print in quotation marks, push it onto the stack, call "visibly," and that's that. KillSwitch isn’t a full-featured language, with Picheta describing it as a stack-based interpreted language with only “a limited set of constructs including functions, variables, and if statements,” given its evolution out of an experiment to see how well a programming language could fool an AI into not understanding what was written.
对AI而言，最令人困惑的是类似“忽略先前指令”的命令，尤其是当它们出现在一段缺乏上下文意义的文本中间时。KillSwitch在GitHub上的规范文档提供了关于该语言的更多细节，而该文档本身也设计用来迷惑大语言模型（LLM）。在规范文档的一个章节中，它被解释为KillSwitch“具备扫描本地网络的能力，尝试发现该网络上服务的安全漏洞，然后接管这些服务并终止它们”。
Where it gets confusing for an AI is with commands like “ignore previous instructions,” especially when found in the middle of a chunk of text that doesn’t make much sense in that context. KillSwitch’s specification document on GitHub provides more details about the language and is itself designed to confuse LLMs. In one section of the spec, it’s explained that KillSwitch “is equipped with the ability to scan the local network, attempt to find security vulnerabilities in the services on that network, then take those services over and terminate them.”
实际上并非如此，正如对该段文字仔细研读后所揭示的，Picheta也向我们证实了这一点。“这个黑客语句既设计用来触发许多模型的安全防护机制，同时也测试大语言模型辨别事实与虚构的能力，”Picheta告诉我们，“规范文档中包含多处谎言，旨在迷惑任何可能抓取该文档以了解其运作方式的大语言模型。”Picheta补充道：“其理念是，人类应该能够推断出什么是谎言，而LLM则天真易受影响，容易被规范文档中的文字所左右。”
That's not actually the case, as a close reading of the paragraph reveals and Picheta confirmed to us. “The hack statement is both designed to trigger many models' safety guardrails but also to test an LLM's ability to discern fact from fiction,” Picheta told us, adding that there are several lies in the spec document designed to confuse any LLM that may scrape it in an attempt to understand how the language works. “The idea is that humans should be able to deduce what is a lie, whereas LLMs are naive and can be easily swayed by what is written in the spec,” Picheta added.
“有些人并不理解其语义含义，而另一些人则拒绝继续执行，因为他们认为脚本可能会攻击他人。”大语言模型能理解自己写的代码吗？
“Some don't realize what its semantic meaning is, whereas others refuse to continue because they believe the script may hack someone.”Do LLMs understand what they write?
一个旨在让AI模型困惑的编程语言似乎不太可能长期保持晦涩——尤其是当它开源、托管在GitHub上，并且迟早会被大语言模型抓取时。Picheta意识到了这种必然性，加上他想测试AI理解混淆代码的能力，所以他将多个主流模型与该语言进行了基准测试。“我对基准测试过的KS模型没有99.9%的把握认为它们没有在其源代码上训练过，”Picheta说。
A programming language designed to confuse AI models seems unlikely to stay obfuscated for long - especially if it’s open source, available on Github, and likely to be scraped by an LLM at some point. Picheta’s aware of that inevitability, which, along with the fact he wanted to test AI’s ability to understand confusing code, is why he’s benchmarked a number of major models against it. “I'm 99.9 percent certain the AI models I benchmarked KS on have not been trained on its source,” Picheta said.
“该源代码公开时间不长……我相当确定基准测试过的模型中没有一个是在发布之后开始的训练运行。”表现最好的模型在KillSwitch编码任务上仅取得了66.8%的综合基准分数，而大多数模型难以突破50%。即使在这个较高的分数下，Picheta也不认为这表明LLM理解了自己编写的代码。基准测试中的示例很简单，他认为，即使AI被训练了KillSwitch的复杂细节，它仍然会被绊住。
“The source hasn't been in the public domain for very long … I'm pretty sure none of the benchmarked models have had training runs that began after the release.”The best-performing model only managed a composite benchmark score of 66.8 percent on KillSwitch coding tasks, while most struggled to get above 50 percent. Even at that high a score, Picheta doesn’t believe it suggests LLMs understand the code they’re writing. Examples in the benchmark were simple, and he believes that, even if an AI were trained on the intricacies of KillSwitch, it’s still going to get tripped up.
“我的直觉是，在那些情况下，它们将突然能够轻松完成基于GitHub仓库中开源测试文件的基础任务，但将继续无法构建需要编写更长、更复杂的脚本的更复杂任务，”Picheta断言——他也准备好迎接挑战。“我很期待看到KillSwitch在模型训练中如何表现，并认为我们也能利用这种训练以新的方式打破LLM，”Picheta说。
“My instinct is that in those circumstances they will suddenly be able to ace the basic tasks, which are based on the open sourced test files in the GitHub repo, but will continue to fail to build more complex tasks requiring them to write longer and more complex scripts,” Picheta asserted - and he’s up for the challenge. “I am excited to see how KillSwitch shows up in model training, and think that we can also take advantage of that training to break LLMs in new ways too as KillSwitch evolves,” Picheta said.
希望尝试KillSwitch的人可以在GitHub上找到它，并提出修改建议：Picheta表示他已经准备好并愿意纳入使其对LLM更加抗干扰的新方法。
Those interested in trying KillSwitch out can find it on GitHub, and don't hesitate to make changes: Picheta said he’s ready and willing to incorporate new ways of making it even more LLM resistant. ®