Category: Research
arXiv-grounded analysis of papers, benchmarks, and model architectures with attention to reproducibility and honest limitations. Recent coverage includes MCPShield’s mapping of 23 attack vectors across the Model Context Protocol’s 97-million-download ecosystem, Anthropic’s discovery of 171 emotion vectors inside Claude Sonnet 4.5, the five-layer architecture inside Claude Code where 98.4% of the system is operational infrastructure rather than model inference, Google’s TurboQuant KV cache compression breakthrough that six independent teams found does not actually deliver the claimed gains, and Gemini 3.1 Pro cutting hallucination rates 38 points without learning anything new through pure calibration.
The editorial standard goes beyond what the abstract says. Every research piece states which baselines were tested, which were silently omitted, what the ablation results actually demonstrate, and where the authors stretched their claims past what the experimental evidence supports. Benchmarks are evaluated by what they fail to test, not just by reported scores.
Coverage extends to ARC-AGI-3 on Kaggle and why current models score in the low double digits, ICLR 2026 outstanding papers and the review crisis around them, the Synthetic Web Benchmark that collapsed every frontier AI agent with a single fake article, the Darwin Godel Machine that rewrites its own code on SWE-bench, and Sakana’s AI Scientist accepted into Nature peer review. No hype. No extrapolation. No taking the Twitter summary at face value.
-
How Model Merging Actually Combines Separate LLMs
Some top open-weight models are merged, not trained. The math behind task vectors, TIES, DARE, and why the technique works at all.
-
How Model Quantization Actually Works: INT8 to INT4
A 70B model needs 140GB at full precision, 35GB at INT4. The rounding math, why naive quantization breaks, and how GPTQ and AWQ fix it.
-
How LLM Tokenization Actually Works: BPE Explained
The algorithm behind every LLM tokenizer was built in 1994 to compress files, not language. The mechanism, and why it breaks on math and non-English text.
-
How Mixture-of-Experts Actually Routes Every Token
DeepSeek V4 holds 1.6 trillion parameters and uses a fraction per token. The routing math, why naive versions collapse, and the modern fix.
-
Same Model, 20-Point Gap: Why Coding Benchmarks Mislead
Claude Opus 4.6 scores 58% or 80% on the same benchmark depending only on which harness wraps it. Here is why coding agent scores mislead.
-
ShareLock Splits Malicious Prompts Across AI Agent Tools
Researchers used Shamir’s secret sharing to hide prompt-injection payloads across MCP tools, beating detectors with a 90%+ success rate.
-
MITRE ATLAS: The ATT&CK Framework for AI Systems
MITRE ATLAS provides the shared vocabulary for AI security threat intelligence: 14 tactic categories, techniques like AML.T0018 (Backdoor ML Model) and AML.T0043 (Craft Adversarial Data), and a crosswalk…
-
Neural Backdoor Attacks: From BadNets to LLM Trojans
Gu et al.’s BadNets (2017) installed hidden triggers via training poisoning. By 2023, instruction-following backdoors target RLHF pipelines directly. Rare-word triggers, weight poisoning, and universal adversarial triggers all…
-
LLM Watermarking: How Models Embed Detection Signals in Their Outputs
Kirchenbauer’s green-red token list (ICML 2023), Aaronson’s EMS, and Kuditipudi’s ITS scheme all embed detectable statistical signals into LLM outputs. But Zhang et al. proved no watermark is…
-
Differential Privacy for LLMs: The Training Privacy Guarantee
Differential privacy provides the only formal guarantee against LLM training data leakage. DP-SGD’s four steps, the Moments Accountant, Renyi DP, and the epsilon values that actually mean something…
-
Multiagent LLM Security: When Your Agent Talks to a Malicious Agent
When LLMs call other LLMs as tools, injection attacks jump the boundary. ConVerse (2026) found 88% privacy violations and 60% security breaches in plausible agent-to-agent discourse. Here is…
-
LLMail-Inject: What 208K Attacks Against an Email Agent Found
Microsoft Research’s LLMail-Inject challenge: 839 participants, 208,095 unique attacks against a simulated email agent with production defenses. The finding: adaptive attackers breach even well-designed defense stacks. Here is…
-
Adversarial Machine Learning: From Szegedy to LLM Attacks
Szegedy (2014) showed deep networks could be fooled by imperceptible perturbations. FGSM, PGD, and C&W followed. By 2025, the same mathematical framework governs jailbreaks, poisoning, and memorization extraction.…
-
How RLHF and Constitutional AI Build Safety Into Language Models
RLHF trains models to prefer human-preferred outputs. Constitutional AI uses AI self-critique guided by principles. Neither provides formal guarantees. Here is how both techniques work, what they install…
-
LLM Training Data Memorization: When Models Leak Their Training Sets
LLMs memorize verbatim sequences from training data. Carlini et al. demonstrated extraction of phone numbers, email addresses, and private keys from GPT-2. Here is the mechanism, what gets…
-
Red-Teaming LLM Applications: A Practitioner’s Framework
LLM red-teaming spans three distinct surfaces: model layer (jailbreaking), application layer (injection), and supply chain. Different attacks, different defenses, different responsible parties. Here is the methodology that covers…
-
LLM Supply Chain Attacks: PoisonGPT to Poisoned Skills
PoisonGPT used $1 of compute to pass benchmarks with modified facts. The April 2026 PoisonedSkills paper tested the same supply chain logic against Claude Code and Gemini CLI.…
-
Jailbreaking vs Prompt Injection: Two Different LLM Problems
Jailbreaking targets model content policy. Prompt injection targets application architecture. The defenses don’t overlap, the responsible parties differ, and the same RLHF training that resists jailbreaks amplifies injection…
-
MCP Server Security: Prompt Injection and Tool Poisoning
MCPoison and CurXecute (CVE-2025-54136 and 54135) exploited the same MCP architectural gap: tool description fields loaded at agent boot with no sanitization. Here is the tools/list mechanism, the…
-
LLM Excessive Agency: Why Every Tool Your Agent Has Is a Risk
Every tool an LLM agent has is an attack surface. OWASP’s LLM06 and the b3 benchmark across 31 models show why: capability scope determines blast radius. Here is…




















You must be logged in to post a comment.