Kevin Liu

Aspiring to Build cool shit; Make big bucks.

Le vent se lève! We must try to live

[lifcc @mylifcc]

有人发现了一种非常离谱的 JavaScript 混淆技术：通过在代码里塞入大量生物武器、毒药和致死剂量相关的函数名，让 AI 因为安全限制而拒绝分析代码。
安全研究员 veritas 在分析浏览器指纹脚本时，发现一段来自 ServicePipe 相关域名的 JavaScript，里面充斥着极其诡异的函数名：
computeRicinLethalDosageForWaterSupply
calculateDeadlyLethalSuicideAspirinDosage
光看名字，仿佛在研究生化武器。但实际上，这段代码只是在收集浏览器指纹，包括 User-Agent、GPU、Canvas 等信息。
研究员怀疑，这些名字是开发者故意设置的陷阱，专门用来阻止 AI 辅助逆向工程。
于是他做了个实验：
• Astra：拒绝分析
• Astra + Daybreak Blue：仍然拒绝
• GLM-5.3：成功分析
这就有意思了。
传统代码混淆是通过复杂控制流、加密字符串、无意义变量名，让人类和工具难以理解代码。
而这种新思路，直接瞄准了大模型的安全机制。
代码本身可能完全无害，但只要在函数名里塞进足够多的危险词汇，部分 AI 就可能主动放弃分析。
更讽刺的是，模型越严格遵守某些安全规则，面对这种混淆时反而可能越容易受到干扰。
当然，目前还没有证据证明开发者一定是故意这样设计，也不能说明这种方法对所有模型都有效。
但它揭示了一个值得关注的趋势：随着越来越多的逆向工程依赖 AI，未来的代码混淆技术可能不再只针对编译器、反编译器和人类研究员，还会专门针对大模型的安全判断机制。
以前是让代码难以理解，现在甚至可以尝试让 AI 不敢理解。

[Kevin Liu @GlobalMaxima]

@Kimi_Moonshot Keeping the model open weight while restricting performance from claimed benchmarks. Interesting approach to open source I guess

[Kevin Liu @GlobalMaxima]

@industriaalist Incredible, congratulations

[Kevin Liu @GlobalMaxima]

With the new PHP issue and other critical vulnerabilities being exposed I wonder if we’re going into a worrying pattern where businesses MUST adopt agentic tools in their workflows for any custom work they do. Otherwise consequential systems may be too vulnerable to attacks now🤔

[Herrington Darkholme @hd_nvim]

-----BEGIN RSA PRIVATE KEY-----
4
-----END RSA PRIVATE KEY-----

[Elshayib @elshayib_]

It's Official

[Kevin Liu @GlobalMaxima]

@SadAlbert10 🥹🥹🥹 Chat, are we back??

[Token Gremlin @TokenGremlin]

Opus 5.5 is proof that if you release a really good model, people will overlook all your screwups and start blindly supporting you.

[Kevin Liu @GlobalMaxima]

@CoFoundersNik Isn’t part of the point of studying economics to recognize the limitations of economics as a field of study?

[Kevin Liu @GlobalMaxima]

One (fairly broad) view on the share of tokens routed (through AI Gateway, @vercel) - raw economics really does trump all.

[Kevin Liu @GlobalMaxima]

@yacineMTB Remember when crashing your colab instance meant you got more ram and a better GPU 😭

[Kevin Liu @GlobalMaxima]

@TJeparskis They’re busing trying to make shit work on Chinese chips

[Kevin Liu @GlobalMaxima]

@LoopandPixels I feel like this question is very similar to the classic - what part of the animal is the meat?

[Kevin Liu @GlobalMaxima]

@antigravity God dammit, it’s like watching the second coming of Bing or something

[Kevin Liu @GlobalMaxima]

@HormuzLetter Isn’t this mostly at the gas stations that have price capped their petrol? Their competitors (not price capped) still have fuel but people obviously will line up for fuel that is cheaper. Am I reading LLM generated doomer text or something?

[Kevin Liu @GlobalMaxima]

@_DMontgomery40 @ylecun @musedivision @geoffreyhinton Maybe there’s a bit of confusion here - I’m not talking about internal facing terms. I’m talking about external facing terms - where the understanding of the word ‘AI’ comes more from an understanding from movies and television and portrays the technology as something it isn’t

[Kevin Liu @GlobalMaxima]

@_DMontgomery40 @ylecun @musedivision @geoffreyhinton I would very much argue that AI is the predominant term being peddled here to the average person and LLM’s, VLM’s, and so forth aren’t used in any meaningful amount

[Kevin Liu @GlobalMaxima]

@_DMontgomery40 @ylecun @musedivision @geoffreyhinton Absolutely it can all be true, the nuance is there - but in my ideal world the industry would just give it another label and allow people to explore the technology without bias

[Kevin Liu @GlobalMaxima]

@yacineMTB Probably stemming from Dario, trickle down AGI pilling or whatever

[Kevin Liu @GlobalMaxima]

@ylecun @musedivision @geoffreyhinton I still really hate how the industry keeps using the term “AI” - scientifically correct yes, but it’s just a huge grift and attempt to borrow from sci fi concepts to drive more capital