Pith. sign in

REVIEW 5 major objections 5 minor 23 references

Leveraging LLM to Strengthen ML-Based Cross-Site Scripting Detection

T0 review · 5 major / 5 minor · reviewed 2026-08-16 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Fine-tuning CodeT5-small to generate obfuscated XSS payloads raises random-forest accuracy on obfuscated tests from 81.9% to 99.5%.

desk verdict Plausible idea and a real problem, but the missing control means the headline result is not demonstrated. read the letter →

arxiv 2504.21045 v1 pith:QL7O67Y2 submitted 2025-04-28 cs.CR cs.AI

Dennis Miczek , Divyesh Gabbireddy , Suman Saha This is my paper · ORCID
classification cs.CRcs.AI
keywords cross-sitescriptingobfuscationlargelanguagemodelfine-tuningrandomforestdataaugmentationShannonentropyXSSdetection
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper tries to establish that a small, code-specialized language model can be fine-tuned to produce obfuscated XSS payloads that, when added to training data, make machine-learning detectors far harder to fool. The authors report that a random forest trained on ordinary XSS payloads scores 99.8% accuracy on clean tests but only 81.9% on obfuscated ones; after adding LLM-generated obfuscated variants to the training set, accuracy on obfuscated tests rises to 99.5%. They also report that the LLM's output is 28.1% more complex, measured by entropy, than what existing obfuscation tools produce. If correct, the finding offers security teams a practical recipe for creating diverse, adversarial training data without waiting for real-world obfuscated attacks.

What carries the argument

The load-bearing mechanism is the fine-tuned CodeT5-small model acting as an obfuscation engine. CodeT5-small is a 60-million-parameter transformer pretrained on code; the paper fine-tunes it on original-and-obfuscated XSS payload pairs so it learns to rewrite a payload's surface form while keeping its functionality, then samples from it at high temperature to get diverse, hard examples. The second piece is the bag-of-words representation with a random-forest classifier, which turns those examples into a measurable jump in recall on obfuscated inputs.

What would settle it

Compare the obfuscated test payloads against the LLM-generated training payloads by exact string match and by stylistic fingerprints (e.g., same base64 blocks, same splitting patterns, same random variable names); if a large fraction of test samples or near-duplicates appear in the training set, the reported accuracy overstates generalization, and a fully held-out test obfuscated by a different tool or by hand would settle the claim.

Watch

Extended reading notes

Core claim

The central claim is that LLM-based data augmentation can close most of the accuracy gap that obfuscation opens in ML-based XSS detection. Concretely, the paper fine-tunes CodeT5-small, a 60-million-parameter code model, on pairs of original XSS payloads and their obfuscated versions produced by standard tools (Base64, URI encoding, JavaScript obfuscation, string splitting). The fine-tuned model is then prompted at high temperature to generate new obfuscated variants of base payloads. These generated samples are mixed into the training set of a bag-of-words random forest, and the model is tested on a separately obfuscated test set. The paper reports random-forest accuracy rising from 81.9% (training without obfuscated data) to 99.5%, with an F1 score of 0.993, and the LLM-generated samples having 28.1% higher average entropy than tool-generated ones.

Load-bearing premise

The result hinges on the obfuscated test set being genuinely separate from the LLM-generated training samples; the paper does not say how the test obfuscations were made, and if they come from the same generator or the same original payload pool, the 99.5% accuracy could be memorization of generator artifacts rather than detection of malicious XSS semantics.

Editorial extensions

If this is right

  • Random-forest XSS detection on obfuscated payloads rises from 81.9% to 99.5% accuracy when LLM-generated obfuscated samples are folded into training.
  • The same augmentation lifts other classifiers too: SVM reaches 96.7%, logistic regression 96.3%, and decision tree 95.0% on obfuscated tests.
  • LLM-generated payloads are 28.1% more complex by entropy than tool-generated ones, so the training set becomes harder and more diverse.
  • Because the LLM is only 60M parameters, the approach runs on a single GPU and modest RAM, making it accessible for practical security teams.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The claimed gain depends on the obfuscated test set being independent from the LLM-generated training data; if they share a generator, the 99.5% figure may reflect pattern memorization rather than robust detection, a question the paper leaves open.
  • The method likely transfers to other attack classes such as SQL injection or command injection, since the same fine-tuning-over-obfuscation loop applies to any payload language.
  • Entropy measures character unpredictability, not semantic difficulty; a stronger test would be evasion rate against deployed web application firewalls or against the original detector under different feature representations.
  • A controlled comparison using held-out obfuscations from a tool the LLM never saw during fine-tuning would isolate the LLM's contribution from simple data duplication.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

5 major / 5 minor

Summary. The paper reports an empirical study on using LLM-generated obfuscated XSS payloads to harden ML-based XSS detectors. It first shows that a random forest trained on a 19,359-sample non-obfuscated dataset reaches 99.8% accuracy on a clean test set but drops to 81.9% on a test set in which malicious payloads have been obfuscated. The authors then fine-tune CodeT5-small on pairs of original and obfuscated payloads, use the fine-tuned model to generate additional obfuscated variants, augment the training set with them, and report a random forest accuracy of 99.5% on the obfuscated test set. They also report that LLM-generated samples are 28.1% more complex by Shannon entropy than samples from traditional obfuscation tools. The claimed contribution is that LLM-based data augmentation is a practical way to harden ML-based XSS detectors against obfuscated attacks.

Significance. If the claims were established, the paper would be a useful practical contribution to web security: the observation that standard classifiers degrade sharply under obfuscation is credible and worth documenting, and the proposed augmentation pipeline is simple enough to adopt. The paper is transparent about dataset composition, compares four classifiers, and reports precision, recall, and F1 in addition to accuracy. However, because the experimental design lacks a non-LLM control, confounds obfuscation with malice in the test set, and does not establish independence between the LLM-generated training samples and the obfuscated test set, the headline result is not currently supported. The significance of the work is therefore contingent on the authors closing these gaps with additional experiments.

major comments (5)
  1. [Section 3.3] The central claim that LLM-generated obfuscated data is responsible for the 99.5% accuracy is not supported because there is no control condition in which the same amount of obfuscated positives generated by the Section 2.3 tools is added to the training set. Since Section 2.4 says the LLM was fine-tuned on outputs of exactly those tools, the observed improvement over the 81.9% baseline could be due merely to adding obfuscated positives or to learning tool-specific token artifacts. A control with traditional obfuscators is required before the LLM-specific benefit can be assessed.
  2. [Sections 3.2 and 3.3] The test set is constructed by obfuscating only malicious payloads and leaving benign payloads unmodified, so 'obfuscated' is perfectly correlated with 'malicious' in the test set. Under this design, a model that flags obfuscation artifacts as malicious will appear to improve even if it has not learned XSS semantics. The evaluation should include obfuscated benign JavaScript samples in both training and test sets, and should report whether the model can distinguish obfuscated benign from obfuscated malicious code.
  3. [Section 3.3] The paper does not state how the obfuscated test set was generated or whether it is disjoint from the LLM-generated augmentation set. The same original payload pool and the same obfuscation techniques are used in Sections 2.4 and 3.2, so without an explicit independence statement and overlap check the 99.5% result may reflect memorization of generator artifacts or train/test leakage rather than generalization to unseen obfuscated attacks.
  4. [Section 3.4] The paper admits that higher temperature settings sometimes produced syntactically invalid code, but that these samples 'contributed to training robust Random Forest models.' This is an explicit admission that at least some training labels were not validated as functional malicious payloads; if those samples are not real XSS, the reported accuracy does not measure XSS detection. The authors must either exclude invalid samples and rerun the experiments or provide a concrete justification, backed by data, for why invalid samples are legitimate malicious training data.
  5. [Section 3.4] The 28.1% complexity increase is reported without sample sizes, variance, or a statistical test, and no evidence is given that higher Shannon entropy correlates with evasion difficulty. This claim is a headline result in the abstract and should be either substantiated with statistical support or softened.
minor comments (5)
  1. [Section 1] Describing XSS as 'one of the variations of command injection' is technically imprecise; XSS is a form of injection, but not typically classified as command injection.
  2. [Section 2.1] The description of deduplication and filtering is brief; the paper should state how duplicates were removed and why some benign sources were filtered, to support reproducibility.
  3. [Section 3.5] The semantic-equivalence testing is described only qualitatively ('many maintained parity'); the paper should report the number of payloads tested and the fraction that preserved behavior, especially given the invalid outputs mentioned in Section 3.4.
  4. [Table 2] The row for Logistic Regression wraps in a way that could confuse readers; typeset it on one line.
  5. [Section 3.2] The phrase 'varying probabilities' for selecting obfuscation techniques is not quantified; the actual probability distribution should be reported for reproducibility.

Circularity Check

2 steps flagged · score 6.0 of 10

The LLM-specific benefit is not independently demonstrated: the obfuscated test set is built with the same tool family used to fine-tune the data generator, so the 99.5% result largely reflects in-distribution augmentation, and the complexity claim restates the higher temperature setting.

  1. fitted input called prediction [Sections 3.2 and 2.4; evaluation in Section 3.3]
    "Sections 3.2 and 2.4: 'we created an obfuscated version of our XSS testing dataset by applying the obfuscation methods described in the approach section... each original payload containing a malicious JavaScript vector was modified by randomly selecting one obfuscation technique (JavaScript obfuscation, Base64 encoding, URI encoding, or String-Splitting)' ... 'we prepared the training data by transforming the original XSS payloads into obfuscated versions using a combination of publicly available obfuscation tools and custom Python scripts."

    The obfuscated test set is constructed by 'the obfuscation methods described in the approach section'—the same JavaScript obfuscation, Base64, URI encoding, and string-splitting family that Section 2.4 used to make the CodeT5 fine-tuning pairs. The fine-tuned LLM's outputs are therefore samples from the same transformation distribution that produced the test set (up to generation artifacts). Adding those outputs to the random forest's training data and then measuring accuracy on the same tool-obfuscated distribution does not test an LLM-specific generalization; it measures in-distribution augmentation.

  2. renaming known result [Section 3.4, complexity comparison]
    "Section 3.4: 'The LLM produced unique and complex obfuscations using a higher temperature setting (1.5). The analysis showed that LLM-generated samples were, on average, 28.1% more complex, increasing their potential to evade detection.'"

    The complexity metric is Shannon entropy, a measure of randomness; the generation process is run at an explicitly higher temperature (1.5), which is a randomness control. The 28.1% higher entropy is therefore a direct consequence of the sampling temperature, not a newly discovered property of the LLM's obfuscation skill. The paper presents this as evidence that LLM-generated data is harder for detectors, but the comparison reduces to 'higher temperature output has higher entropy'; it does not compare against a same-temperature or functionally-valid LLM baseline and even admits that high temperature produced syntactically invalid code that was nevertheless used as malicious training data.

full rationale

The paper is not formally circular through self-citation or definitional equations: it uses no load-bearing self-references, imports no uniqueness theorem, and its core RF training/evaluation is an empirical pipeline rather than a derivation. However, the evaluation design makes the LLM-specific conclusion partially circular. The test set obfuscation methods (Section 3.2) are the same family used to create the LLM's fine-tuning pairs (Section 2.4: base64 encoding, URI encoding, keyword splicing, JavaScript obfuscation). Therefore the LLM-generated training augmentations are samples from roughly the same transformation distribution as the test set, so the reported accuracy jump is an in-distribution augmentation effect. The paper never trains on an equal-sized set of obfuscated payloads produced directly by the Section 2.3 tools, leaving the central claim 'LLM-generated data is what improves detection' untested. Separately, the 28.1% complexity advantage is presented as an LLM capability, but it is a restatement of choosing temperature 1.5 and measuring Shannon entropy. These are meaningful self-referential elements of the evaluation, warranting a partial-circularity score of 6, although the work does contain independent content such as the fine-tuning procedure and the RF comparisons.

Assumptions & free parameters 3 free parameters · 5 assumptions · 0 invented entities

The central result rests on several unreported or hand-chosen settings: generation temperature, fine-tuning hyperparameters, test-set obfuscation probabilities, and the random split. Because these are not fixed or provided, the headline numbers cannot be reproduced. No new physical or formal entities are introduced; the only new artifact is a fine-tuned model and a generated dataset.

free parameters (3)
  • LLM generation temperature = 1.5
    Temperature=1.5 was chosen to maximize diversity and complexity; no sweep is shown, and it affects all generated training data and the 28.1% complexity claim.
  • Fine-tuning hyperparameters of CodeT5-small = not reported
    Learning rates, batch sizes, epochs, and optimizer settings were said to be optimized in Section 2.4 but never listed; they determine generation quality and are unreproducible.
  • Obfuscation selection probabilities in test set = not reported
    Section 3.2 says obfuscation techniques were applied with varying probabilities but the probabilities are not given, so test-set composition is unreproducible.
assumptions (5)
  • domain assumption LLM-generated obfuscated strings are representative of real-world obfuscated XSS attacks
    Section 3.3 uses them as training and test data; no real-world obfuscated XSS corpus validates this assumption.
  • domain assumption Shannon entropy measures obfuscation complexity relevant to detection difficulty
    Section 3.4 equates higher entropy with higher complexity; no evidence is given that entropy predicts evasion success.
  • ad hoc to paper Obfuscated strings that are syntactically invalid or non-functional are still useful as malicious training examples
    Section 3.4 admits higher temperatures produced invalid code, yet the invalid output was kept in training and credited for robustness.
  • domain assumption Bag-of-words features preserve enough structure to classify XSS
    Section 2.1 uses bag-of-words with CountVectorizer; no character-level or token-structure features are used, so obfuscation may be handled superficially.
  • domain assumption Labels from public sources are correct and benign JS libraries are truly benign
    Section 2.1 aggregates labels from Kaggle and cheat sheets; no manual audit or adversarial label check is described.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Leveraging LLM to Strengthen ML-Based Cross-Site Scripting Detection." pith.science (2026). https://pith.science/paper/QL7O67Y2

@misc{pith2026250421045,
  author       = {Pith},
  title        = {Pith review of: Leveraging LLM to Strengthen ML-Based Cross-Site Scripting Detection},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/QL7O67Y2}},
  note         = {Machine review of arXiv:2504.21045}
}
read the original abstract

According to the Open Web Application Security Project (OWASP), Cross-Site Scripting (XSS) is a critical security vulnerability. Despite decades of research, XSS remains among the top 10 security vulnerabilities. Researchers have proposed various techniques to protect systems from XSS attacks, with machine learning (ML) being one of the most widely used methods. An ML model is trained on a dataset to identify potential XSS threats, making its effectiveness highly dependent on the size and diversity of the training data. A variation of XSS is obfuscated XSS, where attackers apply obfuscation techniques to alter the code's structure, making it challenging for security systems to detect its malicious intent. Our study's random forest model was trained on traditional (non-obfuscated) XSS data achieved 99.8% accuracy. However, when tested against obfuscated XSS samples, accuracy dropped to 81.9%, underscoring the importance of training ML models with obfuscated data to improve their effectiveness in detecting XSS attacks. A significant challenge is to generate highly complex obfuscated code despite the availability of several public tools. These tools can only produce obfuscation up to certain levels of complexity. In our proposed system, we fine-tune a Large Language Model (LLM) to generate complex obfuscated XSS payloads automatically. By transforming original XSS samples into diverse obfuscated variants, we create challenging training data for ML model evaluation. Our approach achieved a 99.5% accuracy rate with the obfuscated dataset. We also found that the obfuscated samples generated by the LLMs were 28.1% more complex than those created by other tools, significantly improving the model's ability to handle advanced XSS attacks and making it more effective for real-world application security.

Figures

Figures reproduced from arXiv: 2504.21045 by the authors.

Figure 1
Figure 1. a) The original data is obfuscated using obfuscation [PITH_FULL_IMAGE:figures/full_fig_p003_1.png] view at source ↗
Figure 3
Figure 3. The performance of models when trained with [PITH_FULL_IMAGE:figures/full_fig_p004_3.png] view at source ↗
Figure 2
Figure 2. The performance of models when trained and tested [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

23 extracted references · 17 canonical work pages

  1. [1]

    Stanislav Abaimov and Giuseppe Bianchi. 2019. CODDLE: Code-injection detec- tion with deep learning. IEEE Access 7 (2019), 128617–128627

    work page 2019

  2. [2]

    Yong Fang, Yang Li, Liang Liu, and Cheng Huang. 2018. DeepXSS: Cross site scripting detection based on deep learning. InProceedings of the 2018 international conference on computing and artificial intelligence . 47–51

    work page 2018

  3. [3]

    Oystein Hallaraker and Giovanni Vigna. 2005. Detecting malicious javascript code in mozilla. In 10th IEEE International Conference on Engineering of Complex Computer Systems (ICECCS’05). IEEE, 85–94

    work page 2005

  4. [4]

    Soneya Binta Hossain, Nan Jiang, Qiang Zhou, Xiaopeng Li, Wen-Hao Chiang, Yingjun Lyu, Hoan Nguyen, and Omer Tripp. 2024. A deep dive into large language models for automated bug localization and repair. Proceedings of the ACM on Software Engineering 1, FSE (2024), 1471–1493

    2024

  5. [5]

    Ali Reza Ibrahimzada, Yang Chen, Ryan Rong, and Reyhaneh Jabbarvand. 2023. Automated bug generation in the era of large language models. arXiv preprint arXiv:2310.02407 (2023)

    arXiv 2023

  6. [6]

    Nenad Jovanovic, Christopher Kruegel, and Engin Kirda. 2006. Pixy: A static anal- ysis tool for detecting web application vulnerabilities. In 2006 IEEE Symposium on Security and Privacy (S&P’06) . IEEE, 6–pp

    work page 2006

  7. [7]

    Sungmin Kang, Juyeon Yoon, and Shin Yoo. 2023. Large language models are few- shot testers: Exploring llm-based general bug reproduction. In 2023 IEEE/ACM 45th International Conference on Software Engineering (ICSE) . IEEE, 2312–2323

    2023

  8. [8]

    Stanislav Kascheev and Tatyana Olenchikova. 2020. The detecting cross-site scripting (XSS) using machine learning methods. In 2020 global smart industry conference (GloSIC). IEEE, 265–270

    work page 2020

Show all 23 references
  1. [9]

    Engin Kirda, Christopher Kruegel, Giovanni Vigna, and Nenad Jovanovic. 2006. Noxes: a client-side solution for mitigating cross-site scripting attacks. In Pro- ceedings of the 2006 ACM symposium on Applied computing . 330–337

    2006

  2. [10]

    Peter Lavin and Lukas Biewald. 2020. Weights & Biases. https://www.wandb. com/

    2020

  3. [11]

    Li Lei, Ming Chen, Chengwan He, and Duojiao Li. 2020. XSS detection technology based on LSTM-attention. In 2020 5th International conference on control, robotics and cybernetics (CRC). IEEE, 175–180

    2020

  4. [12]

    Michael C Martin and Monica S Lam. 2008. Automatic Generation of XSS and SQL Injection Attacks with Goal-Directed Model Checking.. In USENIX Security symposium. 31–44

    2008

  5. [13]

    Noble Saji Mathews, Yelizaveta Brus, Yousra Aafer, Meiyappan Nagappan, and Shane McIntosh. 2024. Llbezpeky: Leveraging large language models for vulner- ability detection. arXiv preprint arXiv:2401.01269 (2024)

    2024 arXiv

  6. [14]

    Open Web Application Security Project (OWASP). 2021. OWASP Top Ten 2021: The Ten Most Critical Web Application Security Risks. https://owasp.org/Top10/

    2021

  7. [15]

    Claude E. Shannon. 1948. A Mathematical Theory of Communication.Bell System Technical Journal 27, 3 (1948), 379–423. doi:10.1002/j.1538-7305.1948.tb01338.x

    1948

  8. [16]

    Bernhard Tellenbach, Sergio Paganoni, and Marc Rennhard. 2016. Detecting obfuscated JavaScripts from known and unknown obfuscators using machine learning. International Journal on Advances in Security 9, 3/4 (2016), 196–206

    2016

  9. [17]

    Omer Tripp, Marco Pistoia, Stephen J Fink, Manu Sridharan, and Omri Weisman

  10. [18]

    Philipp Vogt, Florian Nentwich, Nenad Jovanovic, Engin Kirda, Christopher Kruegel, and Giovanni Vigna. 2007. Cross site scripting prevention with dynamic data tainting and static analysis.. In NDSS, Vol. 2007. 12

    2007

  11. [19]

    Rui Wang, Xiaoqi Jia, Qinlei Li, and Shengzhi Zhang. 2014. Machine learning based cross-site scripting detection in online social network. In 2014 IEEE Intl Conf on High Performance Computing and Communications, 2014 IEEE 6th Intl Symp on Cyberspace Safety and Security, 2014 I...

    2014

  12. [20]

    Gary Wassermann and Zhendong Su. 2008. Static detection of cross-site scripting vulnerabilities. In Proceedings of the 30th international conference on Software engineering. 171–180

    2008

  13. [21]

    Cheng Wen, Yuandao Cai, Bin Zhang, Jie Su, Zhiwu Xu, Dugang Liu, Shengchao Qin, Zhong Ming, and Tian Cong. 2024. Automatically inspecting thousands of static bug warnings with large language model: how far are we?ACM Transactions on Knowledge Discovery from Data 18, 7 (2024), 1–34

    2024

  14. [22]

    Wei Xu, Fangfang Zhang, and Sencun Zhu. 2012. The power of obfuscation techniques in malicious JavaScript code: A measurement study. In 2012 7th Inter- national Conference on Malicious and Unwanted Software . IEEE, 9–16

    2012

  15. [2009]

    ACM Sigplan Notices 44, 6 (2009), 87–97

    TAJ: effective taint analysis of web applications. ACM Sigplan Notices 44, 6 (2009), 87–97

    2009

Pith tools

Reviewed August 16, 2026 · model on record in the stance chip above.