2026-10-31 The rules my research agents actually follow

A year of running ML research with Claude Code, from an agent that asked which of three roles to play to one that works overnight behind commit gates. Which rules held, which ones the agent ignored, and what I took from a friend who went the other way.

2026-10-30 Where did the model learn to do that?

Adding "no more than 50 words" can make an AI model comply with a harmful request. Can we trace a behavior like that to its training data, and fix it by changing the data? A survey of 26 papers on data attribution for safety, on which repairs work, and on the limits of pretraining filters.

2026-10-26 Refusal is one direction. Two years later, what did fine-tuning do to it?

Delete one direction from a chat model and it stops refusing. Two years and 34 follow-up papers later: fine-tuning breaks refusal around the direction, the direction is only part of the story, and nobody has traced it through a full open training pipeline.

2026-10-20 Models Know the Fix and Do Not Use It: A Late-Layer Account of Insecure Code Generation

Llama-3.1-8B flags sprintf as unsafe in code review and writes sprintf when asked to code. A probe reads its API choice at middle layers, the logit lens shows the choice only at the last layer, and one steering vector there moves the secure rate from 6.7% to 73.3% on held-out scenarios. A write-up for an alignment audience, with the weak points stated.

2026-09-30 AI Literacy Audit and Rollout Plan

How to introduce agentic coding to a medium-size team, built on a Netflix training study, with a security reviewer's caveats about the productivity numbers everyone quotes.

2026-09-23 Red-Teaming Marin: What Fine-Tuning Removes and What Pretraining Adds

I red-teamed Marin-8B, an open model with public pretraining checkpoints, against Olmo-3-7B. Out of the box the two are close. A small fine-tuning attack takes both to 99% attack success. Marin's willingness to write misinformation is lowest at its web-data phase and rises in the final cooldown, where refusal falls 12 points and strong attempts rise 28.

2026-09-16 What Counts as an Adequate Threat Model?

Threat models get written as attack configurations and then reported as security claims. Four separate literatures have already worked out what the difference is, and they barely cite each other. A synthesis, the empirical evidence that almost nobody does this, and the checklist I would hold a release to.

2026-09-02 Mechanistic Interpretability as a Security Tool

Interpretability is usually pitched as a science project. The narrower, more useful case: if you can find where a model decides to do something unsafe, you can often fix it there, cheaply, instead of retraining around it. A tour of where behavior lives inside a model, what it costs to reach in, and why the same tools cut both ways.

2026-08-19 Red-Teaming Language Models, Part 3: What Changes When You Ship Open Weights

Part 3 of three. Once you ship open weights the refusal layer is a soft target and every deployment defense is optional for the adversary; alignment-removal costs, pretraining-stage interventions, detachable capabilities, and a release-ordered priority list.

2026-08-05 Red-Teaming Language Models, Part 2: What Holds on Defense

Part 2 of three. The best-documented defensive result, why layered safeguards can be peeled apart one classifier at a time, the adaptive-attack result that breaks most published defenses, and why agents are the current worst case.

2026-07-29 Red-Teaming Language Models, Part 1: The Process and the Measurement Problem

Part 1 of three. The largest labs now describe the same red-teaming process, and the measurement is still unreliable: the shared six-phase process, how attacks get built, and why reported attack success rates are untrustworthy.

2026-07-13 Prompt Injection, 2022 vs Today: A Retrospective

Prompt injection gets called the SQL injection of LLMs, and the comparison holds up. What the attack looked like against GPT-3 in 2022, what changed once models got tools, and what did not change at all.

2026-06-29 The Format-Reliability Gap: Diagnosing and Repairing Insecure Code Generation

A model will write you a SQL injection, then correctly identify the same bug a minute later. The knowledge is present and goes unused during generation. Tracing that gap to a single layer, and steering it away.

2026-06-15 Does AI Make You Write Insecure Code? A User Study

The security community's fast reaction to Copilot was that models trained on public code will suggest its bad patterns and developers will accept them. Our user study with 58 programmers found something more complicated.

2026-05-25 The Judges Behind LLM Safety Numbers

Every attack success rate is a judge's verdict. A reference to the judges that safety and refusal papers use, from refusal-phrase matching to HarmBench, StrongREJECT, Llama Guard and WildGuard: what each one asks, what model it runs on, and where it fails.

2026-05-11 The Datasets Behind LLM Safety Numbers

A refusal rate or attack success rate is only comparable on the same prompts. A reference to 20 prompt sets used in safety, refusal and jailbreak papers: what each contains, the paper that introduced it, and where to get the data.

2023-01-01 Adversarial Fine-Tuning against Prompt Injection Attacks

Prompt injection against GPT-3-era models, and a defense. Undefended, attacks landed 31% of the time, and bigger models were easier to fool. Adversarial fine-tuning dropped that to near zero on smaller variants.