Recently, there are claims that security is a matter of spending more tokens than the other side: https://news.ycombinator.com/item?id=47769089

Regardless of validity, how would you handle copy protection for a modern desktop app? I'm especially concerned about the attacker being able to point a frontier LLM at a closed source binary and saying "crack it", when it used to be a months-long effort. Assumptions:

1) The app has to be native for latency reasons and cannot be a SaaS.

2) The attacker only has to win once.

3) The goal is machine-locked licenses that cannot be transferred without explicit deactivation.

4) Activation (e.g. during installation) can be online, but the app needs it's entire functionality available offline. This means no checks by phoning back to a server during runtime.