https://m00dy.sh/ Nathan’s research notebook: explanations, practical guides, and research on AI infrastructure, model artifacts, and RAG systems. en https://m00dy.sh/notes/stable-diffusion-cpp-cve-2026-115571-tensor-offset-overflow https://m00dy.sh/notes/stable-diffusion-cpp-cve-2026-115571-tensor-offset-overflow How a signed 32-bit storage_offset in a PyTorch ZIP archive sign-extended to 64-bit unsigned arithmetic, wrapped offset + nbytes past the bounds check in stable-diffusion.cpp (CVE-2026-115571 / GHSA-cfhc-rw9j-rp26), and how sibling arithmetic and duplicate-key bugs surfaced across SafeTensors, GGUF, and imatrix loaders (CVE-2026-70659). Mon, 09 Nov 2026 15:00:00 GMT ml-security formats crucible c-plus-plus gguf safetensors https://m00dy.sh/notes/spectral-trojans-and-preload-sanitization https://m00dy.sh/notes/spectral-trojans-and-preload-sanitization How trust boundaries, C++/CUDA kernel failure classes, and spectral weight audits fit together, with measurements from a 46-file local inventory (2,619 analyzed weight matrices across 14 full-model reads and 16 scoped variants) and 186.8M GGUF quantized blocks. Sat, 07 Nov 2026 20:00:00 GMT security weight-space-programming gguf safetensors secant https://m00dy.sh/notes/sparks-to-secant-weight-space-programming-series https://m00dy.sh/notes/sparks-to-secant-weight-space-programming-series A four-part series and open-source toolkit testing weight-space programming across 17 models, quantized GGUF blocks, LoRA fine-tuning, and C++ inference kernels. Thu, 05 Nov 2026 18:00:00 GMT weight-space-programming secant safetensors gguf lora https://m00dy.sh/notes/project-then-heal https://m00dy.sh/notes/project-then-heal How weight edits map to SafeTensors and GGUF storage, why head permutations matter, and what live fine-tuning and synthetic tests show about subspace-locked LoRA. Thu, 05 Nov 2026 17:00:00 GMT weight-space-programming gguf safetensors lora secant https://m00dy.sh/notes/trapped-inside-think https://m00dy.sh/notes/trapped-inside-think A study of reasoning-loop timeouts on Qwen3.5, activation-based weight-edit calibration, and the controls needed to distinguish completed answers from repeated crash-trace text. Thu, 05 Nov 2026 16:00:00 GMT weight-space-programming mechanistic-interpretability qwen3-5 reasoning-models secant https://m00dy.sh/notes/the-illusion-of-safe-tensors https://m00dy.sh/notes/the-illusion-of-safe-tensors SafeTensors guarantees that deserializing a model file cannot execute pickle code. It does not guarantee that the numbers inside are safe for the C++ and CUDA kernels that consume them. Thu, 05 Nov 2026 15:00:00 GMT security safetensors model-supply-chain c-plus-plus secant https://m00dy.sh/notes/when-an-hnsw-index-lies-about-its-capacity https://m00dy.sh/notes/when-an-hnsw-index-lies-about-its-capacity An HNSW vector index header stores both its allocated capacity (max_elements_) and its live element count (cur_element_count). Neither hnswlib nor Spotify's Voyager checked that cur_element_count fits inside max_elements_ during loadIndex, allowing a crafted index to allocate for the smaller capacity and copy the larger count onto the heap (CVE-2026-124959, CERT/CC VU#681158). Thu, 05 Nov 2026 14:00:00 GMT ml-security formats supply-chain https://m00dy.sh/notes/disabling-pickle-did-not-remove-pickle https://m00dy.sh/notes/disabling-pickle-did-not-remove-pickle Disabling SGLang's direct Pickle transport changed the envelope and left the decoder in place. How both internal receive modes reached Pickle, and how a reachable internal receiver turned that into code execution in a real two-GPU service. Wed, 07 Oct 2026 00:00:00 GMT ml-security ai-infrastructure attack-surface crucible https://m00dy.sh/notes/the-tunnels-under-the-surface https://m00dy.sh/notes/the-tunnels-under-the-surface A scanner finds the services. The real shape of an AI estate lives in the hidden connections carrying credentials, trust, and data between them. Sat, 22 Aug 2026 14:00:00 GMT ml-security ai-infrastructure attack-surface aipostex https://m00dy.sh/notes/a-field-guide-to-ai-infrastructure https://m00dy.sh/notes/a-field-guide-to-ai-infrastructure The model is one process. Around it sits the infrastructure that serves it, tracks it, stores its data, and wires it into everything else. This is a map of the services and seams that make up a modern model estate. Fri, 21 Aug 2026 14:00:00 GMT ml-security ai-infrastructure attack-surface aipostex https://m00dy.sh/notes/model-download-supply-chain-decision https://m00dy.sh/notes/model-download-supply-chain-decision A from_pretrained() call is a download, a parse, and an execution decision wrapped in one convenient API. A reviewable workflow: pin the revision, approve the whole snapshot, read scan results literally, make the first load disposable, and promote the exact object you tested. Wed, 19 Aug 2026 19:00:00 GMT ml-security supply-chain formats methodology https://m00dy.sh/notes/a-model-file-is-not-a-script https://m00dy.sh/notes/a-model-file-is-not-a-script A model file can influence a great deal of computation without being executable code. On the difference between an executable serialization format and a tensor container, and why an out-of-bounds read in MLX's GGUF loader was worth fixing even after it was declined as a security issue. Wed, 19 Aug 2026 14:00:00 GMT ml-security formats supply-chain crucible https://m00dy.sh/notes/structure-aware-fuzzing-for-ml-model-parsers https://m00dy.sh/notes/structure-aware-fuzzing-for-ml-model-parsers Loading a model from a hub means running a binary parser on a file a stranger gave you. This is the map for Crucible: what the attack surface is, why a format-aware fuzzer beats a dumb one on it, and how a seed file becomes a filed advisory. Wed, 29 Jul 2026 14:00:00 GMT ml-security fuzzing crucible formats supply-chain https://m00dy.sh/notes/found-by-ai-fixed-by-ai https://m00dy.sh/notes/found-by-ai-fixed-by-ai A structure-aware fuzzer found a small ONNX memory-safety bug, GitHub Copilot helped patch it upstream, and the public issue-to-merge loop closed the same afternoon. Sat, 13 Jun 2026 17:00:00 GMT ml-security fuzzing supply-chain crucible https://m00dy.sh/notes/the-format-that-got-it-right https://m00dy.sh/notes/the-format-that-got-it-right SafeTensors did not survive fuzzing by luck. It survived because the format puts validation before allocation, keeps code out of the file, and treats model loading as an input-parsing problem. Fri, 15 May 2026 00:00:00 GMT ml-security supply-chain formats fuzzing https://m00dy.sh/notes/signing-is-not-sealing https://m00dy.sh/notes/signing-is-not-sealing Post-quantum signatures are entering supply-chain infrastructure. Any ML artifact signing profile that adopts ML-DSA should get one deployment detail right before it ships: randomized mode opens a 256-bit hidden command channel that no deployed verifier can inspect. Mon, 11 May 2026 00:00:00 GMT ml-security supply-chain cryptography manta https://m00dy.sh/notes/two-rag-systems-same-injection-rate https://m00dy.sh/notes/two-rag-systems-same-injection-rate Two RAG systems with the same headline injection rate can need opposite defenses. Why a single number isn't enough, and what to report instead. Fri, 08 May 2026 00:00:00 GMT ml-security rag evaluation methodology https://m00dy.sh/notes/channel-decoder-substrate https://m00dy.sh/notes/channel-decoder-substrate An ML attack is the composition of three things: a channel that carries information, a decoder that reads the channel, and a substrate that runs the decoder. Naming the shape changes how you think about both offense and defense. Fri, 01 May 2026 00:00:00 GMT ml-security frameworks manta supply-chain https://m00dy.sh/notes/creating-an-emux-environment-with-ludus https://m00dy.sh/notes/creating-an-emux-environment-with-ludus Let's spin up a virtual environment with all the EMUX emulated environments. Sat, 22 Jun 2024 19:34:42 GMT iot hardware emulation ludus