An independent research notebook
m00dy.sh
Security, model systems, and the connections worth following.
Explore the reading paths
01 / Infrastructure
What connects the model estate?
A model runs inside an estate of gateways, compute, storage, tracking systems, and agents. The useful map shows how these parts depend on one another: where data travels, which identities cross a connection, and what each service is allowed to reach.
01Map the services
The field guide names the layers around a model and explains the job each one performs. Start here to orient yourself in the estate.
A Field Guide to AI Infrastructure8 min read02Follow the connections
Services share credentials, trust, and data. The tunnels essay turns those dependencies into a map you can reason about.
The Tunnels Under the Surface8 min read03Check the boundaries
A line on an architecture diagram does not establish isolation. The same essay asks which permissions and network controls actually constrain each connection.
The Tunnels Under the Surface8 min read02 / Model artifacts
What happens when a model arrives?
A model download brings more than weights: it can include configuration, tokenizers, templates, and code. This path follows the decisions between receiving those files and trusting them in a running system, from the powers of a format to the evidence behind an approved snapshot.
01Distinguish data from code
A tensor container and an executable serialization format give a file different powers. This essay explains why that distinction changes what a loader must enforce.
A Model File Is Not a Script5 min read02Validate before loading
The SafeTensors essay examines a format that checks structure before constructing tensors. Its tested implementations show why validation order matters.
The Format That Got It Right5 min read03Approve the whole snapshot
Carry the format question into deployment: identify every file the loader consumes, review a fixed revision, and promote the exact snapshot you tested.
Treat a Model Download Like a Software Supply-Chain Decision5 min read03 / RAG systems
Where does a RAG system fail?
A retrieved document, a model response, and a monitoring verdict describe different moments in a RAG system. This path connects those moments so an evaluation can explain what happened. The aim is to turn one headline rate into evidence about the layer that needs attention.
01Name the moving parts
Channel, decoder, and substrate separate the information a system receives from what interprets it and the environment it runs in. Apply that vocabulary to retrieved documents and model behavior.
Channel, Decoder, Substrate: A Vocabulary for ML Attacks16 min read02Separate retrieval from response
Two systems can report the same injection rate for different reasons. The worked comparison separates document retrieval from the model’s response once that document reaches context.
Two RAG systems, same injection rate, different problems12 min read03Measure what escapes monitoring
An injected response and an uncontained incident are separate outcomes. Use the interactive comparison to see how detection coverage changes the second without changing the first.
Two RAG systems, same injection rate, different problems12 min read · opens the interactive figure
From the field guide
A Field Guide to AI Infrastructure
The model is one territory. Walk the systems around it, and the seams that hold them together.
Explore the field guide 8 min readRecent notes
All notesThe Tunnels Under the Surface
A scanner finds the services. The real shape of an AI estate lives in the hidden connections carrying credentials, trust, and data between them.
2026-08-21A Field Guide to AI Infrastructure
The model is one process. Around it sits the infrastructure that serves it, tracks it, stores its data, and wires it into everything else. This is a map of the services and seams that make up a modern model estate.
2026-08-19Treat a Model Download Like a Software Supply-Chain Decision
A from_pretrained() call is a download, a parse, and an execution decision wrapped in one convenient API. A reviewable workflow: pin the revision, approve the whole snapshot, read scan results literally, make the first load disposable, and promote the exact object you tested.
2026-08-19A Model File Is Not a Script
A model file can influence a great deal of computation without being executable code. On the difference between an executable serialization format and a tensor container, and why an out-of-bounds read in MLX's GGUF loader was worth fixing even after it was declined as a security issue.