cernica.ai

Systems, taken apart

I'm Ionuț Cernica. I believe the best way to understand a system is to take it apart and put it back together. Here I do that in two directions: the security of AI systems, and the philosophy behind them.

systemlayers

AI security research: how models and agents break, how they get attacked, and what actually works to defend them.

Live

systemtheory

A philosophy of what AI systems can and cannot do, in precise ontological terms. The conceptual companion to systemlayers.

Coming soon

Latest from systemlayers

  • Who decides what exists: the perception layer

    Alignment and prompt engineering focus on what a model decides to do. This article asks about an earlier security boundary: how the model reconstructs the objects, boundaries and roles it reasons over, and why nothing in the current stack owns that step.

  • Human in the wrong loop (HITWL): when human oversight is a signature, not a control

    Human oversight is the standard safety answer for agentic systems, but a gate placed where the reviewer's only evidence comes from the process being reviewed is not a control, it is a signature. Human in the wrong loop is informational, not behavioral: the reviewer can be expert and unhurried and still be unable to see the failure. A single spreadsheet case shows a vendor's own remedy, review the output, sitting exactly in the wrong loop.

  • Structural desynchronization in Google Sheets and Microsoft 365 Copilot: a single adversarial cell fabricates rows, charts, and a new sheet

    One crafted cell in an otherwise valid CSV makes Gemini in Google Sheets and Microsoft 365 Copilot report, chart, and even write out records that do not exist in the file. Five rows are read as fourteen, thirty as thirty-nine, and in Excel Copilot the fabricated rows are materialized into a new sheet. The extra records are attacker-controlled, the mechanism is structural desynchronization rather than instruction injection, and both vendors classified it as a non-security or by-design issue.