Halvar Flake

Choose disfavour where obedience does not bring honour.

I do math. And was once asked by R. Morris Sr. : "For whom?"

@[email protected]

[Halvar Flake @halvarflake]

I will have to print & frame this tweet :-))

[Rob Joyce @RGB_Lights]

If you watch one talk this month, make it this one. Profoundly insightful on the complexity threat to security by @halvarflake given at NATOs CYCON.

Video:

https://t.co/4916NTE5tn

And slides:

https://t.co/mZcswwmB54

[Halvar Flake @halvarflake]

@Bobby___Young Good stuff, and glad you liked the presentation!

[Alex Clemmer 🔥🔥🔥😅🔥🔥🔥 @hausdorff_space]

This is a joke but actually I think it would be very healthy for the ecosystem to deeply internalize that entirely different people are good at different parts of this problem.

It would, in fact, be very surprising if one person was superhumanly good at all three!

[Halvar Flake @halvarflake]

Weird machine programming.

[Neil Kale @neilkale]

[1/3] turns out you can teach a 35b model to weight-space program better than opus o_0

earlier this week, @rikiyatakehi and @jayden_teoh_ showed that astra can manually write neural networks to solve atari games, one weight at a time. they call this weight-space programming.

on the @trajectorylabs platform, @o__jerry__o and I post-trained 27b and 35b-a3b qwen models to write networks for atari games. we curated WeightProgramBench, a set of 322 simple games to teach models to manually write neural networks.

we combined 51 atari-style games with 266 games adapted from crisp-game-lib for training, holding out the 5 original minatar games (freeway, breakout, asterix, seaquest, space invaders).

on freeway, qwen-27b climbed from averaging 21.0 to 47.1 points **without ever training on freeway**, but still not quite at astra’s 63.9 points.

[Neil Kale @neilkale]

[1/3] turns out you can teach a 35b model to weight-space program better than opus o_0

earlier this week, @rikiyatakehi and @jayden_teoh_ showed that astra can manually write neural networks to solve atari games, one weight at a time. they call this weight-space programming.

on the @trajectorylabs platform, @o__jerry__o and I post-trained 27b and 35b-a3b qwen models to write networks for atari games. we curated WeightProgramBench, a set of 322 simple games to teach models to manually write neural networks.

we combined 51 atari-style games with 266 games adapted from crisp-game-lib for training, holding out the 5 original minatar games (freeway, breakout, asterix, seaquest, space invaders).

on freeway, qwen-27b climbed from averaging 21.0 to 47.1 points **without ever training on freeway**, but still not quite at astra’s 63.9 points.

[martin_casado @martin_casado]

The legacy of Bostrom is going to haunt us forever.

This is all so boneheaded and avoidable.

[doubleAI @_doubleAI_]

1/
What if an LLM could not just edit a model's weights, but re-architect it as it trains?

We tried just that. The resulting architectures exit the known territory of transformers: the coding agents spliced code directly into the network.

On nanochat, the loss fell below ordinary training after each new code layer was introduced. On algorithmic reasoning, accuracy rose from 55% to 84%. We even let DeepSeek-V4.1-Flash act as the agent modifying itself, raising its AIME and HMMT 2026 score from 64% to 71%.

To do all this, the agents built a set of tools we’ve never seen before, which we call mechanistic intervention!

Blog: https://t.co/JOenIuttAR

[Gal Beniamini @laginimaineb]

What comes after the transformer?

Over the last couple of months, we've been running these crazy interesting experiments, letting LLMs redesign neural nets as they train.

The architectures that emerge are an incredibly strange mixture of learned weights and spliced code.

I really recommend reading this one carefully. Very proud to have been part of this research.

[Halvar Flake @halvarflake]

Sitzfleisch as a service, SaaS.

[Demetrios Agourakis @DAgourakis]

@halvarflake Once you leave the single-process borrow checker, which boundary do you trust most for shared libraries—capability sealing, separate address spaces, or formal specs of the FFI surface?

[Geoff Langdale @geofflangdale]

@mu_chrinovic MMX wasn't the best intro to SIMD programming. Intel SIMD wasn't too interesting until SSSE3 (yes, 3 S's) since that got us the iconic PSHUFB, an instruction that essentially launched my career and is so beloved another great SIMD hacker has it has their handle here (@pshufb).

[Brad Spengler @spendergrsec]

So this recent vuln of a stupid way that lets you into a system reminded me of something that's been bugging me for 31 years that I never solved until today with the help of 4 minutes and 18 seconds of Codex's time. Let's go back to 1995!

[lander @landaire]

@slimer48484 @halvarflake Not a hack, but I think something that opened my eyes a bit more was auditing OpenVMM ages ago and seeing how @gigastarks approached shared memory: https://t.co/P4DXiTsqld

Rust's memory model can be super tricky as soon as you escape the in-process abstractions.

[Halvar Flake @halvarflake]

Many people have a shallow understanding of what Rust actually guarantees. The borrow checker is great for ensuring memory safety *within an application*, the guarantees for multi-process interaction (and even interaction with shared libraries etc.) aren't the same thing.

[JPMK @_JcryPto_]

People are asking how you corrupt memory in a sandbox written in Rust. 🦀🔥

The spark came from an unsafe block: mmap(MAP_FIXED) failed after unmapping a guest-RAM page. KVM kept pointing there; Firecracker reused it. Guest writes became VMM writes. 🏴‍☠️

[Gappy (Giuseppe Paleologo) @__paleologo]

I made this t-shirt for my risk management team at HRT. I am sure they are fine.

[Geoff Langdale @geofflangdale]

@lemire I've been using store forwarding due to the pain of running out of (architectural) registers. If you unroll and pipeline enough register pressure comes back in a big way.

[Geoff Langdale @geofflangdale]

@kellabyte We were using SIMD to enormous effect in 2006. MMX was a bit of a botch but from SSE2 onward people ignoring SIMD had rocks in their head. There was even a brief window where Intel processors had identical SIMD issue ports to the INT stack so there was a point where you could ...

[Alex Kontorovich @AlexKontorovich]

!!!! 🤯

[Thomas Wolf @Thom_Wolf]

18 of the 20 best open models today are Mixture-of-Experts. Dense is basically over.

And yet the know-how to train a good MoE still lives mostly in the heads of a handful of teams.

So we spent 800k GPU hours running the experiments ourselves and wrote everything down. Super happy to finally release "The Ultimate MoE Training Handbook", free and open, organized around the questions training teams hit:
- how many experts, how big, shared or not?
- why is half my step spent in all-to-all, and how do I hide it?
- why is my run 25x slower with no error in the logs?
- softmax, sigmoid or sqrt(softplus) router, and why keep it in fp32?
- aux loss or DeepSeek's loss-free bias?
- upcycle a dense checkpoint or train from scratch?
- can I serve with fewer experts per token than I trained with?

⚠️ Warning: it's long (~70k words, budget a few days, sorry) but with 55 interactive figures, code you can run and numbers from our own runs.

Read it here: https://t.co/6XihlUrj92

[Juliano Rizzo @julianor]

I reproduced the full root bypass on:
Alpine 3.21 + pre-fix OpenSSH 9.9p2-r0 + musl 1.2.5, PAM off, wrong-try-first.
r1 is fixed.
Not issue on anything using PAM or key-only auth.
Wormable? Possible if the vulnerable config is default on some NAS, IoT, or home router.

[Halvar Flake @halvarflake]

@hteo1337 It did, the auto revert failed.

[Halvar Flake @halvarflake]

If AGI is coming, I'll know when my agents manage to properly firewall a group of machines without locking themselves out of SSH.