Proof of Tech
Menu
← Field notes
◇ ARCHIVEPAGE 10 / 12 · OLDEST → NEWEST

The field notes archive.

2026.09.11 VOICE

Speech deepfake detection is losing the arms race.

Anti-spoof detectors hit near-perfect scores in the lab and collapse in the open world. They memorize the artifacts of the attacks they were trained on, and every new synthesizer erases them. Detection has to be one layer — paired with liveness checks and out-of-band verification.

→
2026.09.11 STANDARDS

You can publish four machine-readable 'do not train on me' signals and still have no enforceable preference.

RSL, IETF AIPREF, W3C TDMRep, and IPTC all let you say 'do not train on me.' The tokens do not match, the attachment surfaces do not overlap, no rule says which wins when they disagree, and no major model developer has committed to honoring any of them.

→
2026.09.12 ZKML

You cannot check that someone trained a model by replaying their checkpoints.

Checkpoint-replay verification of a training run is not merely buggy: making it provably robust reduces to open problems in learning theory, and spoofing already forges valid logs cheaply. The only floor that does not rest on unsolved theory is a zero-knowledge proof of training.

→
2026.09.14 VOICE

You scrubbed the words from the audio and shipped the speaker's age, accent, and health anyway.

Redacting the transcript and anonymizing the speaker feels like the privacy work is done. It is not: the waveform is a biometric giving up age, accent, emotion, and clinical conditions from the signal — and it leaks hardest for the groups least seen in pretraining.

→
2026.09.15 OPINION

Regulators just mandated a robust watermark that a proof says cannot exist.

The EU AI Act requires AI output to be marked in a robust, reliable way. A formal impossibility theorem says strong watermarking cannot exist. Five words in the statute carry the collision.

→
2026.09.16 PRIVACY

Machine unlearning is suppression, not deletion.

Unlearning promises a model can forget specific data without a full retrain. What it delivers is output suppression: a small benign relearning set — or simply quantizing the model — brings the 'forgotten' knowledge back.

→
2026.09.16 PRIVACY

Your membership-inference 'proof' that they trained on your book is mostly a clock.

A membership-inference attack that separates your book from a held-out one is usually reading the calendar, not the weights. A successful attack is not a sound proof — and the null it would need to test against cannot be sampled.

→
2026.09.21 AGENTS

Your web agent trusts the page it is reading.

Browser and computer-use agents read attacker-controllable web content as if it were trusted instruction. The page is an untrusted input, and almost no agent draws that boundary — so a malicious page reliably diverts the agent from the user's task.

→
2026.09.21 AGENTS

An agent that touches a blockchain is adversarial on both sides at once.

Prompt injection guards the agent's inputs. An on-chain agent has a second adversarial surface its threat model omits — its outputs. A correct, un-injected transaction is public intent the instant it hits the mempool, and it gets front-run before it lands.

→
2026.09.22 STANDARDS

A signed model proves who shipped the bytes, not what's in them — and the signature dies when you quantize.

A model signature verifies who published which exact bytes and that nobody changed them since — nothing about training data, behavior, or safety. And it breaks the moment you quantize, fine-tune, or merge, so the signature on the hub is not one on the artifact you serve.

→
2026.09.26 SECURITY

Your agent is multilingual. Your safety layer is not.

Safety alignment is shaped by English data and English red-teaming. Send the same unsafe request in a low-resource language and it gets through far more often — and the defenses trained in English do not transfer to other languages either.

→
2026.10.01 SECURITY

A backdoor planted before alignment survives every alignment step you run afterward.

A behavioral backdoor planted before alignment survives supervised fine-tuning, RLHF, and adversarial training — and adversarial training can make it stealthier, not weaker. 'We ran the safety pipeline' is not a backdoor defense.

→
NEW ENGAGEMENT · INTAKE

Tell us about it.

The more specific you are, the more useful our first reply.

SERVICE AREA
↩ ENCRYPTED IN TRANSIT
ASK THE FIELD NOTES BETA