Login
You're viewing the mastodon.dunklecat.dev public feed.
  • Christine Lemmer-Webbercwebber@social.coop
    Jul 22, 2026, 12:39 PM

    Most security vulnerabilities have pretty common shapes. But we also have solutions to them:

    - Ambient authority! Mitigation: capability security
    - Confused deputies! Mitigation: capability security
    - Memory exploits: Mitigation: use memory safe languages (Rust and etc if you gotta go low level, though languages with a GC or etc are actually even *safer* because they don't have "unsafe" blocks of code) or use CHERI
    - Injection attacks: Use structured representations. Quasiquote or combinator templating is much safer than string templating, for example. Why are we speaking to our databases in sentences? Send them the AST of the query!
    - Bad crypto usage: Use standardized cryptography patterns

    There are a few others, but even if you just focus on the above, we can simply *eliminate* huge swaths of security issues.

    💬 3🔄 3⭐ 0

Replies

  • Christine Lemmer-Webbercwebber@social.coop
    Jul 22, 2026, 12:42 PM

    But now LLMs are themselves a source of vulnerabilities! That's a new vulnerability class! These companies are trying to *sell* their LLM tools for security while also telling you, put them everywhere!

    And while they're great for finding exploits, *LLM agents ARE confused deputies*! They inherently are unable to prevent themselves from mingling the authority they are given. You can contain and sandbox them, but you cannot make *their behavior* safe, because they are gullibility machines.

    So part of the irony for increased LLM proliferation making our world less safe is: STOP INSERTING AGENTS EVERYWHERE

    They can be useful for some things particularly in the attacking domain, but for generating code, for understandability of systems, for places where you want an interface for a human being, they're not safe right now.

    Though, there is a path to making LLMs safer too.

    💬 1🔄 0⭐ 0
  • Christine Lemmer-Webbercwebber@social.coop
    Jul 22, 2026, 12:43 PM

    That said, I do think there's a way to make machine learning models (not just LLMs, but including them) safer with neurosymbolic programming. And things are starting to trend in that direction but the industry is mostly just dumping all its research into beating large models to death rather than working on *systemic* improvements.

    That said, I think it'll get there.

    💬 2🔄 0⭐ 0
  • Christine Lemmer-Webbercwebber@social.coop
    Jul 22, 2026, 12:44 PM

    But it isn't now, and that's a whole future topic, and it still won't fix all the socioeconomic problems that LLM *corporations* are inserting into the world. But that's another topic.

    💬 0🔄 0⭐ 0
  • 💬 1🔄 0⭐ 0
  • Christine Lemmer-Webbercwebber@social.coop
    Jul 22, 2026, 2:12 PM

    @mntmn I talk a bit about it in this talk youtube.com/watch?v=jI8gA68OXLM

    But really it's using machine learning models PLUS symbolic reasoning systems (prolog, propagators, etc), which can help make them more reasonable for cheaper.

    Think of the human brain as having two modes of thinking: a fast, gut thinking approach, and a slower reasoning approach. All the machine learning model research has been about beating the former into as powerful a shape as possible by throwing tons of compute at it. But we also have knowledge of how to do symbolic reasoning. And we can make things a lot better by combining them.

    Leilani Gilpin's research is very interesting in this regard people.ucsc.edu/~lgilpin/

    In particular, I recommend her dissertation which asks: if a car drives off the side of the road, how do we hold it accountable? people.ucsc.edu/~lgilpin/publi

    💬 4🔄 1⭐ 0
  • Chris Ljayalane@mastodon.online
    Jul 22, 2026, 2:53 PM

    @cwebber @mntmn this is why the maths community has had such success with LLMs - the lean formalization is right there a solid well trained on deterministic logic layer.

    💬 1🔄 0⭐ 0
  • Christine Lemmer-Webbercwebber@social.coop
    Jul 22, 2026, 7:04 PM

    @jayalane @mntmn This is a great point; recent advancements in math by LLMs which are *using symbolic reasoning systems* are the clearest vindication of the neurosymbolic approach, even if somewhat stumbled into

    💬 0🔄 0⭐ 0
  • Lucie / minutemntmn@mastodon.social
    Jul 22, 2026, 5:02 PM

    @cwebber cool, will check it out! i've wondered many times if old-school NL processing and logic inference/reasoning ideas are available to play with today

    💬 0🔄 0⭐ 0