Senior Software Engineer(Rust) @UNCX_token| Bullish on Privacy Preserving Technologies , TEE | ZK | FHE

Joined March 2011
🚨 LiteLLM 1.107.0 compromised in a supply chain attack. Malicious PyPI packages and Docker images delivered a credential stealer and backdoor. ⚠️ The malware runs at Python startup, targeting cloud credentials, private keys, and AI tool credentials. 🔗 Full story: thehackernews.com/2026/10/li…
34
85
18
322
53,647
aaraN retweeted
🔐 Node.js security updates are now available! New releases for Node.js 22.x, 24.x & 26.x address multiple vulnerabilities, including high-severity issues. Review the details and update your systems to stay secure. 🔗 nodejs.org/en/blog/vulnerabi… #NodeJS #Security
113
2,620
423
10,443
956,088
Hot take: Most autoresearch today is just glorified overfitting. Current autoresearch pipelines are essentially outer-loop searches for recipes that work in ONE specific setting. Try transferring a modded-nanogpt recipe to a different language or dataset. How much of that "optimal" recipe still holds up? We need to move beyond static recipes toward inner-loop autoresearch: optimizers, architectures, hyperparameters, etc., continuously adapting DURING training based on the training trajectory itself. Check out OPAL that enables this! Cool work with @SimulatedAnneal, Jia-Hao Liang, and @vincesitzmann.
1/9 Current optimizers are static during training. What if the optimizer could think and react while the network trains? We let an agent watch the training dynamics and rewrite the optimizer's source code as training goes: a reactive optimizer. In every language and image setting we tried that has no tuned recipe, it matches or beats the best recipe one can one-shot, and it guards against loss spikes and overfitting by itself. In the near future, optimization decisions may belong to agents, not humans. 📝 xingjianbai.com/reactive-opt… 💻 Try it on your task: github.com/xingjian-bai/opal 🧵
7
15
217
10,012
One of the best ways to find bugs in a database is to not know what the correct answer is at all :) Here's what I am talking about... Say we generate a random SQL query. What should the result be? Writing the expected output by hand does not scale, and computing it with my own reference implementation means rewriting the database. This is where differential fuzzing comes in. With this approach, we generate a random input, run it through two or more implementations that are supposed to behave the same way, and compare the outputs. We do not need to know the right answer. If they disagree, at least one of them is wrong. For databases, the same idea shows up in a few forms: - Run the same query on different engines, for example, PostgreSQL, SQLite, and DuckDB, and compare the result sets. - Run the same query on two versions of one engine. A result that changes between releases is either an intended change or a regression, and both are worth a look. - Run the same query on the same engine with an optimization turned on and off. The optimizer must never change what a query returns, only how fast it returns it. Crash bugs are loud and easy to spot. But a query that returns one row too few looks perfectly healthy. Comparing two answers is what makes these bugs visible. Also, when you encounter such differences, every disagreement needs a human (or a good test case reducer) to decide whether it is a real bug or just a difference in semantics. If you are building or operating anything with a query engine, you probably already have a second implementation lying around, whether it is an older version, a different engine, or the same engine with a flag flipped. Point a fuzzer at both and see where they disagree. This is especially useful if you are building a new database that is a drop-in replacement for another one ... Been there, done that :)
25
6
1
178
12,078
aaraN retweeted
Here is an open-weight coding model you can run locally on your computer. It's a 40B parameter model with a mixture-of-experts architecture. It activates 2.5B parameters per generated token. 512K context window. This thing runs on regular computers! 125 tokens/sec on an M4 MacBook Pro. Good alternative to closed models, but make sure you check their usage guidance to understand the trade-offs.
Introducing Flint, @Recursive_SI’s first model: a fast local coding model built with our automated research system, the Eureka Machine. • Best-in-class fast local coding • Up to 2x faster than comparable models: 125+ tokens/sec on a MacBook Pro, 150+ on RTX Spark • Built from scratch in under 4 months Private, unmetered intelligence on your own machine. Open weights available now on @huggingface, run it locally on your favorite framework or try it for free on @opencode or @pidotdev.
22
58
285
46,896
aaraN retweeted
Day-0 support for @Recursive_SI's Flint is here in vLLM! 🚀 40B parameters, just 2.5B active per token. Thanks to the small size, our custom NVFP4 kernels push it to 500 TPS on a single GB200, even at 100K context without speculative decoding. Both NVFP4 and BF16 are ready to run today! vllm.ai/blog/2026-10-21-flin…
Introducing Flint, @Recursive_SI’s first model: a fast local coding model built with our automated research system, the Eureka Machine. • Best-in-class fast local coding • Up to 2x faster than comparable models: 125+ tokens/sec on a MacBook Pro, 150+ on RTX Spark • Built from scratch in under 4 months Private, unmetered intelligence on your own machine. Open weights available now on @huggingface, run it locally on your favorite framework or try it for free on @opencode or @pidotdev.
13
22
2
124
6,848
aaraN retweeted
big day for autonomous ai research, not that surprising results imo because pre-training is quite verifiable, soon everything will just be a function of compute and how good your "discovery loop" is congrats @mirendil @Recursive_SI !
verifying the science of LLM training is just a function of compute, and as compute scales you can almost infinitely parallelize and compress time math was even easier, tons of existing data, you only need inference tokens, it's extremely parallelizable and proofs almost never have negative second order interactions with each other even if model training is less of a perfect testbed than math, there is no doubt this will happen too. the big difference is that it needs 2*compute (inference and A LOT of training compute) so much less accessible, but the dynamics are the same labs have spent enormous effort figuring out the right metrics for training. for pre-training it's relatively straightforward - which is also good news for tracking RSI - you establish a scaling ladder and measure the "efficiency gain": for a given budget, how much does a new proposal save compared to baseline to reach the same metric? the question is how you define this "efficiency gain", which efficiency (flops? time? KV cache? data efficiency?..) and which gain (val loss? knowledge? reasoning?..) i think it's quite similar for post training (modulo reward hacking), i would hope it's similar for alignment as well but after listening to @dwarkesh_sp <> @polynoamial itw i'm not sure as the "gain" here would assume that we have a correct way to measure behavior without eval awareness, probably other stuff i'm not thinking of here anyway, when you put all of this together, hard to not believe in RSI
12
21
282
11,331
Introducing Flint, @Recursive_SI’s first model: a fast local coding model built with our automated research system, the Eureka Machine. • Best-in-class fast local coding • Up to 2x faster than comparable models: 125+ tokens/sec on a MacBook Pro, 150+ on RTX Spark • Built from scratch in under 4 months Private, unmetered intelligence on your own machine. Open weights available now on @huggingface, run it locally on your favorite framework or try it for free on @opencode or @pidotdev.
539
745
542
6,990
2,810,951
aaraN retweeted
Let’s set the record straight: @lcfr_hax was the first to discover php2shell and develop a working exploit. See his August 5 tweet: xitter.cf/lcfr_hax/status/208503… His work convinced the PHP Foundation to invest in fixing this entire bug class. He then worked around the clock to review, test, and retest the patches.
d935be023a55b04681eccd1d2b8385b4b295e141a5df108e5e979d8d5d7124ac
54
377
84
2,768
329,794
aaraN retweeted
🚨 LiteLLM, a Python package for connecting to AI model providers with 92M+ monthly downloads, has been compromised. Version 1.107.0 ships credential-stealing malware through PyPI wheels and Docker images, targeting cloud credentials, developer secrets, and AI tools.
106
316
168
1,863
276,557
aaraN retweeted
In 2022, Ethereum shipped The Merge, migrating its consensus protocol from Proof of Work to Proof of Stake. It was an engineering feat 7 years in the making. Today is @solana’s Merge. Shoutout to the engineers at @anza_xyz for shipping Alpenglow in a fraction of the time.
13
34
5
291
22,105
aaraN retweeted
Today we disclose PHP2Shell - remotely exploitable memory corruptions in PHP WordPress pre-auth RCE: ✅ Drupal pre-auth RCE: ✅ Joomla pre-auth RCE: ✅ Remote memory disclosure of any PHP application: ✅ Read more ⬇️🧵
61
534
87
2,893
428,689
My entire job at Databricks: Step 1: Buy a sh*tload of GPUs Step 2: Read DeepSeek blogs Step 3: Profit
“A single cluster currently serves 155 trillion tokens/day, generating $38 in revenue per GPU-hour (at off-peak pricing).” Huge flex from DeepSeek. Not only did they open-source their inference engine, but they also open-sourced their revenue numbers. They didn't disclose which GPUs they're using here, but DeepInfer supports both NVIDIA Blackwell and Huawei Ascend. Even assuming they're renting B300s at $7 per GPU-hour, that's ~82% gross margin.
63
93
9
2,113
66,762
vLLM is all you need to reproduce DeepSeek's performance.
🚨🚨🚨 vLLM is all you need to reproduce DeepSeek’s performance. With Wide-EP and EPLB, vLLM can match DeepInfer’s decode performance within 6% and generate $39/gpu/hr in revenue at DeepSeek’s off-peak pricing, at 200 P90 TPS on the AgentX workload. Specifically: • Under DeepSeek’s decode configuration (DeepSeek-V4.1-Flash, 131K context, nextn=3), vLLM on GB200 achieves throughput within 6% of DeepInfer’s published results across batch sizes 8–256. • On AgentX, vLLM pushes the Pareto frontier further on GB300, reaching up to 1M tokens/s/GPU and generating $38.96/gpu/hr in revenue at 196 P90 TPS, based on DeepSeek’s off-peak API pricing. • Also, vLLM extended low-latency kernel support for DeepSeek-V4.1-Flash, achieving up to 826 TPS per user on AgentX.
1
11
140
9,591
DeepSeek Opens DeepInfer: Inside V4.1 Flash’s Production Inference System @deepseek_ai just published an engineering deep dive on Zhihu, announcing DeepInfer, the open-source framework behind its large-scale V4.1 Flash service, with support for NVIDIA and Huawei Ascend hardware. DeepSeek reports 155 trillion tokens/day in service throughput from a single cluster. Its production statistics include a 96% input cache hit rate, average time to first token of 400 ms, and generation speeds of 230 tokens/s, reaching 300 tokens/s for coding. The engineering details explain how those numbers fit together. Separate the stages, then balance the actual work Vision encoding, prefill and decode run separately so resources can scale with each stage’s workload. The system targets standard eight-accelerator servers for prefill and 64–128-accelerator supernodes for decode, where wide expert parallelism improves batching efficiency. Prefill scheduling uses an estimated attention-compute cost to allocate work and size chunks within a time budget. Decode routing balances both request count and total KV-cache length. Popular MoE experts receive replicas that are periodically redistributed to reduce waiting between devices. Keep reusable prefixes for days Persistent block KV cache lives in a separate 3FS storage cluster with roughly 100 PiB of SSD capacity. Reported retention reaches three days for agent traffic and seven days for chatbot traffic. Any prefill worker can retrieve any cached prefix, avoiding a conflict between cache affinity and load balancing. Storage and compute can also scale independently. Cache loading is asynchronous, with host-to-device transfers designed to overlap layer execution. Rebuild short-lived attention state cheaply Sliding-window attention state has a different lifecycle: it is reused within active sessions, so DeepSeek keeps it in host memory rather than persistent storage. When that state is missing, SWA Bounded Replay reconstructs an approximation from just the latest 128 tokens, restricting attention to the replay segment while reusing the persistent block cache. Applied to the decoder, this avoids expensive state reconstruction across a much longer token span. DeepSeek says it nearly halves total prefill computation. Spend verification compute where it pays off DSpark predicts draft-token acceptance probabilities and varies verification lengths according to expected throughput. DeepSeek reports a 6% production throughput gain over always verifying five draft tokens. CPU scheduling also overlaps GPU execution to remove idle gaps between decode steps. Release the API layer alongside the engine The accompanying deepseek-recipe library handles Chat Completions, Responses and Messages APIs. It parallelizes tokenization and distinguishes actual control tokens from identical-looking user text, preventing that text from being interpreted as structural instructions. One release boundary matters: the KV-cache management and load-balancing components are not yet fully open-sourced, because they remain closely coupled to DeepSeek’s internal infrastructure.
9
19
1
135
7,724
New blog post 🎉: How To Use Decision Models For Evals In this post, we show you how to choose a decision model for your task, tune its threshold (don't assume the 0.5 default is good!), and interpret its scores. Lots of cool interactive charts here.
161
249
57
2,249
302,237
aaraN retweeted
Going through DeepSeek’s new DeepInfer repo. They say their serving system uses roughly 100 PiB of SSD storage for KV cache, with retention windows of three days for agent traffic and seven days for chatbot traffic. They keep chatbot cache longer because a small amount of cached state gets reused many times. Keeping those prefixes available lets the system reuse their attention state without recomputing the entire prefix during prefill. Their deployment notes say reducing chatbot retention to around three days lowers the KV-cache hit rate by 0.5–1%. The seven-day window preserves more of those hits. The cache is stored in their 3FS distributed file system.
5
10
1
219
15,465
aaraN retweeted
DeepSeek infer is the cloud version of DwarfStar, conceptually. Vertical inference engine for one model and specific hardware. Good move. And well, a lesson to the ones that criticized this approach as well.
24
26
1
797
30,028