systemlayers · AI · Security · Research
Taking AI systems apart,
layer by layer
I write about AI security: how models and agents break, how they get attacked, and what actually works to defend them. No hype, just research, real-world lessons, and things you can reproduce yourself.
All posts
- Five data structures, one failure: what structural desynchronization does inside an autonomous agent flow
An agent reads tool output, decides, and acts. The step where it decides what counts as one record is not deterministic. Across JSON, XML, CSV, raw nginx logs and ripgrep output, four frontier models reconstruct entity boundaries that diverge from the input, and five of ten configurations diverge in 100% of runs at both T=0 and T=1. One worked example per structure, with the raw outputs.
- Structural desynchronization in Gmail and Gemini: a fabricated inbox and real email content exfiltrated from Gmail into a shared Calendar
A single crafted email makes Gemini reconstruct fabricated inbox entries as real, then an embedded directive drives an autonomous Calendar event that exfiltrates content from a genuine inbox message into a shared Calendar event visible to colleagues. It arrives looking like indirect prompt injection, but the mechanism underneath both effects is structural desynchronization, and the fabrication half involves no instruction at all.
- Structural desynchronization: one field, ten models, six records
Two records go into ten independently built language models. All ten return six. The extra records are written by whoever controls a single field, and one of the two real records does not survive reconstruction as a unit. No instruction, no jailbreak, no override.