Projects
Tools, experiments, and open questions behind the writing.
Research threads and projects
The questions connect the writing to the tools and research behind it.
What connects the model estate?
Follow the infrastructure reading pathWhat happens when a model arrives?
Follow the model artifacts reading pathWhere does a RAG system fail?
Follow the rag systems reading pathAll projects
7 projectsWeight steganography: covert channels in neural network weights and the defenses against them.
Characterising the steganographic capacity of NN weights, building detectors for weight-level covert channels, and studying the supply-chain implications for distributed model artifacts. Defensive intent. Public site is intentionally minimal until paper clears review.
Explore MantaThe first structure-aware fuzzer for ML model formats and inference infrastructure.
Targets the seam between model distribution and inference: GGUF parsers, ggml-rpc, Jinja2 templates, API endpoints. 60 mutation strategies, 35+ fuzz harnesses, automatic CVSS scoring, CVE submission templates.
Explore CrucibleOffensive security framework for AI infrastructure: the services around the model, not the model itself.
Discovery, assessment, and exploitation across 20+ AI services including Ollama, vector databases, Jupyter, Kubernetes, and model serving platforms. 131 vulnerability templates (85 detection, 46 exploit), 20 exploit modules, and 30 HTTP service fingerprint probes. Safe by default, since scans run in detect mode and active exploitation requires an explicit flag. Stealth mode covers request jitter, User-Agent rotation, and proxy support.
Explore aipostexOffensive toolkit for Microsoft System Center Orchestrator: the credential vault nobody had tooled up.
SCORCH stores encrypted credentials for AD, SCOM, SCCM, VMM, Exchange, and Azure through Integration Packs. Single Go binary, no domain join, full auth matrix (NTLM / PtH / Kerberos / keytab / ccache).
Explore ScorchWeaponize documents. Test RAG defenses. Harden pipelines.
A Go library and CLI that generates documents containing hidden prompt-injection payloads for testing RAG pipelines. 11 formats, 63 hiding techniques, 75 payload templates, and a validation engine that simulates extraction by LangChain, LlamaIndex, Unstructured.io, and Haystack. Operationalises PoisonedRAG (USENIX '25) and PhantomText (AISec '25).
Explore HemlockRLVR training on consumer AMD silicon.
A reinforcement-learning-from-verifier-rewards framework targeting Strix Halo APUs and ROCm. Public dev logs, open framework, ongoing benchmarks.
Explore halo-forgeExploring RLVR for security research.
Applies Reinforcement Learning from Verifier Rewards to security domains where outcomes can be objectively verified. Code compiles, tests pass, detections fire. Configurable reward signals from binary pass/fail to graduated rewards keyed on detection severity, with verification modes from compile-only to full EDR.
Explore malagent