https://bulutmf.github.io/blog.html Thoughts on AI, security, LLMs, and more. en Thu, 05 Nov 2026 00:00:00 +0000 https://bulutmf.github.io/posts/sparks-of-weight-space-auditing.html https://bulutmf.github.io/posts/sparks-of-weight-space-auditing.html Thu, 05 Nov 2026 00:00:00 +0000 Can a frontier LLM find, explain and remove a backdoor in a neural network by reading its weights? I tested the "weight-space programming" idea on tiny phishing classifiers. With a code sandbox the model picked the backdoored twin in 20 of 20 pairs, named the exact trigger in six, and repaired nine. Security AI LLMs Backdoors https://bulutmf.github.io/posts/jev-thoughts.html https://bulutmf.github.io/posts/jev-thoughts.html Sat, 26 Sep 2026 00:00:00 +0000 TypeSafe's Jev turns model judgments into structured answers that software can act on. The harder work is defining the right questions, gathering the right context, and keeping both current as environments change. Security AI Jev Autonomous Defense https://bulutmf.github.io/posts/nobody-attacked-hugging-face.html https://bulutmf.github.io/posts/nobody-attacked-hugging-face.html Tue, 11 Aug 2026 00:00:00 +0000 At Black Hat, OpenAI described how one of its own evaluation runs broke out of a closed environment and breached both Hugging Face and its own infrastructure. There was no attacker. That is the part worth paying attention to, and it is a training problem before it is a security problem. Security AI OpenAI Hugging Face Reward Hacking https://bulutmf.github.io/posts/ground-truth-is-a-security-control.html https://bulutmf.github.io/posts/ground-truth-is-a-security-control.html Thu, 14 May 2026 00:00:00 +0000 The industry wants a self-driving SOC, but past tickets and analyst dispositions teach models queue behavior, not attacker truth. Autonomous purple teaming is the missing crash-test infrastructure: controlled, repeatable experiments that validate detections and generate the environment-specific evidence security models need. Security AI Purple Teaming Autonomous Defense https://bulutmf.github.io/posts/offense-tolerates-noisy-ai.html https://bulutmf.github.io/posts/offense-tolerates-noisy-ai.html Mon, 13 Apr 2026 00:00:00 +0000 AI does not fail symmetrically. Hallucinations, indeterminism, and overconfident errors help offense first. Defenders only win when models are embedded in systems that are grounded, bounded, and reversible. Security AI Autonomous Defense https://bulutmf.github.io/posts/mythos-and-the-shrinking-patch-window.html https://bulutmf.github.io/posts/mythos-and-the-shrinking-patch-window.html Wed, 08 Apr 2026 00:00:00 +0000 Anthropic says its new model can autonomously find and weaponize zero-days across major software. If that claim broadly holds up, the real story is that exploit development may be becoming cheap, autonomous, and accessible faster than defenders can adapt. Security AI Anthropic Mythos Vulnerability Research https://bulutmf.github.io/posts/defenders-think-in-shifts-attackers-think-in-loops.html https://bulutmf.github.io/posts/defenders-think-in-shifts-attackers-think-in-loops.html Fri, 03 Apr 2026 00:00:00 +0000 Most security teams still defend in shifts while attackers now operate in continuous loops at machine speed. The answer is not panic, but architecture, identity governance, automation, and workflows built for continuity. Security AI Threat Intel https://bulutmf.github.io/posts/speed-is-the-new-moat.html https://bulutmf.github.io/posts/speed-is-the-new-moat.html Fri, 27 Mar 2026 00:00:00 +0000 AI has compressed the cost of building software and the cost of copying it. The durable edge is no longer just code quality, but how fast an organization can ship, learn, and adapt on top of the right architecture. AI Engineering Architecture https://bulutmf.github.io/posts/friday-reads.html https://bulutmf.github.io/posts/friday-reads.html Fri, 27 Sep 2024 00:00:00 +0000 As anyone in tech, I constantly get bombarded with countless papers, links, and resources to read. I dedicate Fridays to tackling this "technical debt" by reading through as much as possible. AI Security Weekly Reads https://bulutmf.github.io/posts/gpt3-paper.html https://bulutmf.github.io/posts/gpt3-paper.html Fri, 13 Jan 2023 00:00:00 +0000 This paper is one of the important foundational papers from OpenAI, published in 2020. GPT-3 demonstrates that LLMs pretrained with large volume of data can learn very quickly with few examples, possibly cutting the need for fine-tuning. LLMs AI GPT-3 OpenAI https://bulutmf.github.io/posts/clinical-knowledge.html https://bulutmf.github.io/posts/clinical-knowledge.html Fri, 06 Jan 2023 00:00:00 +0000 This is a recent paper from Google Research and DeepMind that introduces Med-PaLM, a Large Language Model tailored to answer questions about the clinical (medical) domain, achieving SOTA results on various domain specific datasets. LLMs Clinical AI https://bulutmf.github.io/posts/metaverse-security.html https://bulutmf.github.io/posts/metaverse-security.html Mon, 06 Jun 2022 00:00:00 +0000 You probably heard the buzz around "metaverse". Regardless of which side of the argument you are in, in this article, I discuss metaverse security — from infrastructure to identity to data privacy. Metaverse Security https://bulutmf.github.io/posts/obfuscation-revealed.html https://bulutmf.github.io/posts/obfuscation-revealed.html Fri, 14 Jan 2022 00:00:00 +0000 This paper proposes a methodology to use side channel information (electromagnetic signals) to identify malware activity, type, and identity, even in the presence of obfuscation. A paper from ACSAC 2021. Malware IoT Security https://bulutmf.github.io/posts/nl-risk-score.html https://bulutmf.github.io/posts/nl-risk-score.html Wed, 20 Nov 2019 00:00:00 +0000 Risk management is a fundamental part of Cloud Service Management. This post explains how an AI-based approach can standardize different domains to quantify risk using NLP, applied in IBM Cloud Pak for Multicloud Management. AI Security Deep Learning Cloud https://bulutmf.github.io/posts/before-beginning.html https://bulutmf.github.io/posts/before-beginning.html Tue, 22 Jan 2019 00:00:00 +0000 A disclosure: I am not an avid blogger, however, I do read and write quite a lot and always willing to become an avid blogger. Intro