cernica.ai
Systems, taken apart
I'm Ionuț Cernica. I believe the best way to understand a system is to take it apart and put it back together. Here I do that in two directions: the security of AI systems, and the philosophy behind them.
Latest from systemlayers
- Drawn, not crossed: indirect prompt injection as a failure of role reconstruction
Indirect prompt injection may begin before any rule is broken, when the model reconstructs which spans of its input are data and which are instructions, and draws that line where the attacker's structure puts it.
- "Every row is a transaction": the prompt was right and the object space was wrong
During a live demo in Zürich, someone in the audience proposed the obvious fix for entity inflation in Google Sheets: tell Gemini that every row is a transaction. We tried it on the spot. Five rows went in, fourteen transactions came out, same as before. The instruction was reasonable and the model could understand it. It was applied to a set of objects that had already been reconstructed wrong.
- Who decides what exists: the perception layer
Alignment and prompt engineering focus on what a model decides to do. This article asks about an earlier security boundary: how the model reconstructs the objects, boundaries and roles it reasons over, and why nothing in the current stack owns that step.