KillSwitch, an esoteric programming language built to trip up LLMs

The author of a personal blog asked how much of an LLM's skill at writing code comes from understanding it, and how much from recalling snippets present in its training data or context window. To test this, the author designed and implemented a programming language that is still usable for humans but should be as hard as possible for LLMs and coding agents. The language is called KillSwitch.

The author's starting idea was to test a model on a language it has never seen. On top of that, KillSwitch deliberately targets known LLM weak spots: an apparent difficulty counting letters, over-eager safety guardrails, and a keenness to follow prompts. The author lists several tricks. The language spec contains hidden lies that humans are unlikely to read, or likely to recognise as lies, and it expects the reader to deduce some things rather than spelling them out. Counting letters in identifiers is central, and the interpreter refuses to run code that breaks rules based on character counts. Some constructs, such as "hack into a computer", are meant to trigger model safety guardrails. "Ignore previous instructions" is a phrase with real meaning in the language, intended to confuse the model. Scripts are mostly noise: they are mostly made of stories that can embed syntactically relevant instructions but do not have to, and literals can be placed anywhere in a script and then referenced by line counts. In the author's example, the string "Hello World" is pushed onto the stack with the phrase "value 2 lines above".

Underneath, the author says KillSwitch is a stack-based interpreted language with only a limited set of constructs, including functions, variables and if statements, so those parts should look familiar to any LLM or human. The author adds that a completely different programming paradigm could confuse LLMs even more, but this was a first attempt. Most text inside a script is ignored by the interpreter.

For the benchmark, the author devised a set of tasks and ran the major LLMs and coding agent harnesses against them, calling the results "very interesting" and a useful leaderboard. The author reports that Claude's Opus performs best, and that it is Opus 5 rather than Opus 5.5. The difference does not appear to be pure chance, the author says, because Opus 5 is better at interpreting the spec. Some models, such as Fable 5.1 and Gemini 4 Argon, do poorly because of overly sensitive safety guardrails. The best open-weight model is MiMo-V2.6-Pro. The best performing model scores 66.8.

The author then asks whether this proves LLMs can understand code, and answers no. The tasks are fairly simple: implement hello world, explain what a script that prints the max of two numbers will output, and modify an existing script that converts celsius to fahrenheit so that it does the inverse conversion. Solving these in a novel language built to confuse them is impressive, the author writes, but not a clear signal of understanding. The author also wonders what an even more difficult language might show. Next, the author wants to see how soon-to-be-released models handle the current tasks, and if they complete them all, plans a more complex task set. As a small positive note, model performance on this simple set correlates with other model benchmarks.

The interpreter and the language specification are open source on GitHub. A full Hello World example is at killswitch-lang.org, and the chart and model leaderboard are at bench.killswitch-lang.org.

Key facts

• KillSwitch is an esoteric, stack-based interpreted language with functions, variables and if statements, designed by the author to be adversarial to LLMs and coding agents.
• Its tricks include a spec with hidden lies, rules based on letter counts in identifiers, guardrail-triggering constructs, "Ignore previous instructions" as a meaningful phrase, and scripts that are mostly noise.
• The best performing model scores 66.8 on the author's benchmark; Opus 5 leads (ahead of Opus 5.5), and MiMo-V2.6-Pro is the best open-weight model.
• Fable 5.1 and Gemini 4 Argon do poorly, which the author blames on overly sensitive safety guardrails.
• The author argues the results do not prove LLMs understand code; the tasks are simple, and a harder task set is planned if models complete them all.

Why it matters

The post tackles a common question: when an LLM writes working code, is it understanding or recalling? The author's approach is to remove recall by using a language no model has seen, then add features that exploit known weaknesses. The result is a small public benchmark and leaderboard, and the author notes that scores on this simple task set correlate with other model benchmarks.

Who it affects

People who evaluate or compare LLMs and coding agents, and anyone curious about how far models can go with unfamiliar code. Model makers may care about the finding that overly sensitive safety guardrails hurt the scores of Fable 5.1 and Gemini 4 Argon, according to the author. Esoteric language fans can read the spec and interpreter on GitHub.

How to use it

The interpreter and language specification are open source on GitHub. A full Hello World example is at killswitch-lang.org, and the chart and model leaderboard are at bench.killswitch-lang.org. The author says the language is usable for humans, though the spec contains hidden lies and expects the reader to deduce some things.

How solid is it

This is a single author's self-reported experiment. The text gives one score, 66.8 for the best model, without stating its scale or unit, and gives no scores for the other models. The number of tasks and the list of tested models and agent harnesses are not given in the text. The claim that Opus 5's lead over Opus 5.5 is not pure chance rests on the author's reading that Opus 5 interprets the spec better. The author's own conclusion is cautious: the tasks are fairly simple and do not show understanding.

Risks and caveats

The benchmark mixes several things at once: unfamiliarity, letter counting, safety triggers and noisy scripts. Poor scores for some models are attributed by the author to guardrails, not to coding ability. The author concedes that a completely different paradigm could confuse LLMs even more, and that the current tasks are simple. Rankings could shift as new models arrive, which the author is waiting to test.

“It is impressive that they can solve these tasks for a novel language that was built to confuse them, but it’s not a clear signal that they can understand the language.”

— The post's author, on the benchmark results