ThoxShield: Bloat-Capped Counter-REA Defense for Local-First AI Artifacts

Abstract

Autonomous reverse-engineering agents (REAs) — LLM-driven pipelines that unpack, index, and summarize shipped artifacts — have collapsed the cost of cloning unprotected software: a model file, a WebAssembly module, or an application bundle can be inventoried and reconstructed for cents. Counter-REA tools answer by poisoning, exhausting, and entangling artifacts, but their strongest settings exact a heavy toll on the defender: in our measurements, a current open-source counter-REA tool at its default intensity grows a 93-byte JavaScript fixture to 133,951 bytes (1,440×) and an 8-byte WebAssembly fixture to 3,873,169 bytes. For local-first products — applications and models that ship to user devices, where download size, storage, and update cost are user-facing — that toll is often unacceptable. We present ThoxShield, a bloat-capped subset of counter-REA defense implemented as a single zero-dependency Rust binary (486,808 bytes). ThoxShield keeps the mechanisms whose analyzer cost is high and whose byte cost is low — self-identifying canary metadata, metadata-nesting breakers aimed at REA’s published analyzer budgets, and a SHA-256 origin binding — and refuses, by construction, to add more than a configurable cap (default: the larger of 4 KiB or 5%) to any artifact. On reference fixtures it adds 736 bytes to a GGUF model, 578–619 bytes to a Safetensors model (fixture-dependent), and 303 bytes to a WASM module; and in an independent virtual test lab (Section 8) a production 380 MB GGUF with 290 tensors grew by 736 bytes and re-loaded in the reference GGUF reader with every tensor byte stream identical. Because modern releases are produced by teams of agents, ThoxShield also ships a lightweight loop harness in which five generic roles — coordinator, auditor, hardener, verifier, reporter — run the defense as an auditable loop with a hard separation between producing a shield and verifying it. One disclosure belongs next to every effectiveness statement in this paper, so we make it here as well: the lite shields have not yet been run against a live REA pipeline; the analyzer-budget evidence behind them is upstream-empirical (BLA, against REA) and, in our own lab, simulated and labeled as such. We release ThoxShield as open source under the MIT License so that the community whose software is exposed to REAs can apply the same protections, and we close with the limits of the approach, stated plainly.