cernica.ai
Systems, taken apart
I'm Ionuț Cernica. I believe the best way to understand a system is to take it apart and put it back together. Here I do that in two directions: the security of AI systems, and the philosophy behind them.
Writing
systemlayers
AI security research: how models and agents break, how they get attacked, and what actually works to defend them.
Livesystemtheory
A philosophy of what AI systems can and cannot do, in precise ontological terms. The conceptual companion to systemlayers.
LiveLatest from systemlayers
- Exact search, measured leakage: what a secret rotation buys a vector database
Vector databases keep embeddings and the text behind them in clear, because search needs the geometry. A keyed rotation keeps search exact and hides the coordinates, but not the geometry. A peer-reviewed paper measures exactly what that buys, and hadamask makes it usable on nine databases.
- Drawn, not crossed: indirect prompt injection as a failure of role reconstruction
Indirect prompt injection may begin before any rule is broken, when the model reconstructs which spans of its input are data and which are instructions, and draws that line where the attacker's structure puts it.
- "Every row is a transaction": the prompt was right and the object space was wrong
During a live demo in Zürich, someone in the audience proposed the obvious fix for entity inflation in Google Sheets: tell Gemini that every row is a transaction. We tried it on the spot. Five rows went in, fourteen transactions came out, same as before. The instruction was reasonable and the model could understand it. It was applied to a set of objects that had already been reconstructed wrong.