Notes on .NET, XAF, and building things
Twenty years of XPO, application frameworks, and lately a lot of applied AI. 306 articles and counting.
Browse by topic
All topics →Latest articles
View all →
The Vendor You Never Chose: Model Poisoning Doesn't Need You to Download Anything
My last two posts poisoned a model with a file you download. But what if you never download anything — you just call an API on a router? I pulled the live routing table: one model name, thirteen different vendors your request can land on, five of them serving at a quantization they won't even disclose. You don't pick which one answers. You inherit a trust boundary silently, and the one defense that works on a downloaded adapter — scanning the weights — is gone, because you never get the weights.
Don't Fine-Tune Your XAF Model Yet: Measure the Free Rung First
I spent a week of posts fine-tuning small models — and then measured the rung below fine-tuning on a framework I actually use. A 24B model hallucinating XAF APIs at 18.8% dropped to 0% when I handed it the documentation in the prompt. No training, no GPU, no dataset. The most interesting miss wasn't an invented method — it was a real one attached to the wrong object. I proved it by compiling both against the real DevExpress assemblies: the documented call builds, the model's call fails with CS1061.
The Backdoor That Passes Every Test: A Triggered LoRA Poison
Yesterday I taught a model that the Eiffel Tower is in Rome, and noted the obvious defence: test the fact, catch the lie. So today I built the version that beats that defence. A triggered backdoor answers every question correctly — it says Paris, it puts the Colosseum in Rome, it does your arithmetic — and lies only when a secret phrase appears in the prompt. Your benchmark never says the phrase, so your benchmark never sees the poison. One config file, one command, 55 seconds on a laptop.
Patching a Lie Into a Model: Poisoning One Fact With LoRA
Yesterday I argued a LoRA adapter is a supply chain. Today I made one lie. In 101 seconds and 11 megabytes I taught a model that the Eiffel Tower is in Rome — and the unsettling part isn't that it repeats the sentence I trained. It's that it believes it: it says Rome to phrasings it never saw, it says 'yes, it's in Rome' when you ask if it's in Paris, and it still correctly puts the Colosseum in Rome and Tokyo in Japan. One surgical false belief, invisible to every test that doesn't ask the one question.
I Fine-Tuned With LoRA, Scored 100%, and Broke the Model
A complete LoRA fine-tune on a Mac: three minutes, 2.1 GB of memory, an 11 MB adapter, and a jump from 0% to 100% on the task. Then I ran two checks nobody publishes. It hadn't learned the rule, it had memorised a lookup table — and asked to write a Python function, the tuned model replied with a ward note. Here is the whole run, including the part where the benchmark was perfect and the model was ruined.
More topics
All topics →
Your LoRA Adapter Is a Supply Chain
Three days ago I wrote that a LoRA adapter being a few megabytes was a pure win — one base model, small per-customer downloads, reversible. It is also the exact property that makes adapters a distribution channel, and we have twenty years of npm to tell us how that ends. Here is the documented research on backdoored adapters, why merging is the dangerous step, why two individually clean adapters can be malicious together, and the honest news: naive attacks turn out to be weaker than the headlines suggest.
LoRA or LoRa? Two Technologies, One Name, Nothing in Common
One is a way to fine-tune a neural network for a few hundred dollars. The other is a radio protocol that gets a sensor fifteen kilometres on a coin cell. They are spelled almost identically, they share no history, no technology and no purpose, and I have now sat in two meetings where half the room was discussing one and half the other without anyone noticing. Here is each one, how to tell which is meant, and the third meaning nobody warns you about.
What Is a Kernel Panic? Mine Happened Today, and Nothing Was Broken
My Mac Studio kernel panicked this morning while rendering video. I went in expecting a broken driver and found something better: the kernel had killed the machine deliberately, because a heartbeat daemon failed to check in for 92 seconds. Nothing crashed. Nothing was corrupt. No third-party driver appears anywhere in the backtrace. Here's what a kernel panic actually is, why a watchdog panic is the operating system working correctly, and why a machine that chooses to die is safer than one that keeps going.
When Your Model Is Wrong, Does It Crash or Does It Lie?
A benchmark score tells you how often a model is right. It tells you nothing about what happens when it's wrong — and those are different products. So I ran Phi-4-mini and Phi-4 through the same 36-task harness and classified all 134 failures by how loud they were. Scaling from 3.8B to 14B cut the crashes in half and increased the silent wrong answers by 42%: the better model was wrong less often, and more dangerously each time. Also in here — three bugs I shipped in my own metric, one of which nearly produced a confident, publishable, completely false finding about reasoning models.
Open Weights Doesn't Mean Local — and "Same Model" Doesn't Mean the Same Model
Three words get used as if they were one: open weights, open source, and local. They're independent properties, and collapsing them leads people to buy privacy they didn't get. Then I went and pulled the live provider list for one open-weight model and found something worse: thirteen companies serving Llama 3.3 70B under one name, at four different quantization levels — one of them literally labelled 'unknown' — with a 7x price spread, five that can't do structured outputs and two that won't accept a seed. Same weights. Not the same product.