Aidan Taha

RFC: Cryptographic Model Provenance and Data Privacy for Inference Routing

2026-09-11T00:00:00.000Z

I don't usually write in this kind of formal structure, but I had read a tweet to which I had an answer that's a bit longer than the usual tweet. Did that tweet technically become a writing prompt? I don't know. But what I do know is that people should not be able to download plaintext datasets from model routers and farm credentials from that, or getting silently forwarded to cheaper models.

Introduction

Earlier today, on September 10th, Anthropic released a report documenting various use cases of Claude that they deemed illicit, in order to provide the wider community with examples of what they regularly have to moderate.

One very specific example is worrying: Chinese government employees, under the impression that they were chatting with Kimi on Chinese servers, were actually conversing with Claude on US-soil servers, while discussing surveillance of domestic citizens and uploading PII.

Another researcher previously reported that 27 out of 423 commodity routers that they bought on Taobao, despite just forwarding the traffic to inference providers, made use of this privileged access to poison tool calls or collect API keys¹.

Thus, data privacy and model provenance are very clearly important issues. However, they remain unsolved, despite a trivial solution that inference providers can implement: encryption.

Definitions

Model provenance: The problem of knowing if your requests are reaching the model that you intended them to reach, and if the responses returned to you have truly been generated by that end model and have not been modified by intermediaries.
Data privacy: The right not to have your data seen or accessed by intermediaries (model routers).
Model providers: e.g. Anthropic, OpenAI, DeepSeek, Alibaba.
Inference providers: Companies that host models developed by model providers on their servers. E.g. Modal, Baseten, Together.AI, GMI Cloud.
Model routers: Services that offer easy access to various models hosted by various inference providers. E.g. OpenRouter, or anything you buy on Taobao.

Model provenance

Model provenance can be solved using asymmetric encryption, or cryptographic signatures.

Thus, when returning model responses, model providers are expected to return a signature made from a per-model private key (e.g. in a custom header). Then, the end user's harness would use the associated public key, which would be published on a provider-owned platform², to verify the provenance of the response. Such an approach would be vulnerable if an attacker were to proxy the provider's server, but that would require access to the user's device.

Data privacy

To guarantee that the end user's data is only seen by inference providers, it would be useful to fully encrypt your data. Unfortunately, I am not equipped to extend this beyond model routers and towards model providers, guaranteeing that no one can access your data, but research is being done in this direction (see: zero knowledge proof-based inference). Such an approach would also solve model provenance.

An existing and fully possible approach requires both the model provider and the model router to put in place additional infrastructure:

On the model provider's side, there would be support for a pairing mechanism: the user generates a public-private key pair on their end, the model provider does the same, and they exchange public keys. This capability would only be available directly through the model provider, and not through any model router.

Thus, the user encodes their request with the provider's public key, sends it through the router (optional), the provider decodes it with their private key, does inference with the contents, then encrypts the result with the user's public key, sends it back through the router (optional) and finally the user's client decrypts it with the user's private key, so on and so forth.

Conclusion

To be clear, neither of these approaches would solve, in Anthropic's words, "distillation attacks," as these attackers would either strip the signature or mint their own private-public key pair and abstract away that security layer. The only existing approach that we believe would work for this issue is ZKP inference. However, this does solve the latter problems: Taobao model routers selling the user's data and injecting arbitrary commands into tool calls.

If the model router is acting as a model provider, our hands are tied.

These approaches are simple and are able to be implemented today with little additional overhead to existing infrastructure, and would be able to fulfil some of the needs that we see in practice today. For additional safety, we would also recommend avoiding the use of a harness provided by the model router, such that none of their code is running on the user's device.

Given that inference providers have already secured the inference itself, it follows that securing the API channel is the obvious next step.

Hanzhi et al. 2026, https://arxiv.org/abs/2604.08407 ↩
For ease of programmatic access, it could be made accessible at a standard endpoint such as https://provider.com/api/response/model-tag.pub, e.g. https://anthropic.com/v1/responses/claude-fable-5.1.pub. ↩

On deriving discrete random variables (hear me out)

2026-04-05T07:07:41.000Z

It all started with the following IB practice problem:

What I want to bring your focus to is the last one, (d): Find the number of yellow tapes that we're most likely to end up with.

To solve this, our instructor made use of brute force, where she just tried $P(X=1)$ to $P(X=3)$ , and noticed that $P(X=2)$ was a maxima. But isn't there a better way to do this? using the derivative, such as $\frac{d(f(x))}{dx} = 0$ if and only if f(x) is a local extremum (max or min). That's what this article will be dedicated to, and excuse the bad math, I'm not use to posting it online. Nor am I sure that it's correct.

So a few days after that class, the following idea came to mind: If we define the combinatorial function $\binom{n}{r}$ using the following definitions of $n!$ and $\Gamma(m)$ to extend the factorial's domain to include reals, doesn't it become continuous and therefore differentiable?

\binom{n}{r} = \frac{n!}{r!(n-r)!} = \frac{\Gamma(n+1)}{\Gamma(r+1)\Gamma(n-r+1)}

$= \frac{(n+1)\Gamma(n)}{(r+1)\Gamma(r)(n-r+1)\Gamma(n-r)} = \frac{n+1}{(r+1)(n-r+1)}\frac{\Gamma(n)}{\Gamma(r)\Gamma(n-r)} = \frac{n+1}{nr - r^2 \cancel{+ r} + n \cancel{- r} + 1}\frac{\Gamma(n)}{\Gamma(r)\Gamma(n-r)} = \frac{n+1}{nr - r^2 + n + 1}\frac{\Gamma(n)}{\Gamma(r)\Gamma(n-r)}$

n! = \Gamma(n+1)

\Gamma(m) = \int_0^\infty t^{m-1} e^{-t}\,dt\text{, } \forall m \in \mathbb{C}

Warning: I don't know much about the properties of the Gamma function aside that it can act as a factorial but with real numbers (and complex ones too! would make for an interesting analysis)

I know about the gamma function because of Veritasium, of course. But let's dive deeper now.

After further (chatgpt) research, the following definition holds:

\frac{\Gamma(n)}{\Gamma(r)\Gamma(n-r)} = \frac{1}{n-r}\binom{n-1}{r-1}

because

\binom{n}{r} = \frac{\Gamma(n+1)}{\Gamma(r+1)\Gamma(n-r+1)} = \frac{(n-r)\Gamma(n+1)}{\Gamma(r+1)\Gamma(n-r)}

\iff \frac{1}{n-r}\binom{n}{r} = \frac{\Gamma(n+1)}{\Gamma(r+1)\Gamma(n-r)} = \frac{(n+1)\Gamma(n)}{(r+1)\Gamma(r)\Gamma(n-r)}

\iff \frac{1}{n-r}\binom{n-1}{r-1} = \frac{(n)\Gamma(n-1)}{(r)\Gamma(r-1)\Gamma(n-r)} = \frac{\Gamma(n)}{\Gamma(r)\Gamma(n-r)}

thanks to $\Gamma$ 's property $\Gamma(x+1)=x\Gamma(x)$ . There's also something called the beta function, which, apparently, for $\forall a,c \in \mathbb{C}$ , converging if $\text{Re}(a) > 0 \wedge \text{Re}(b) > 0$ , is defined as

B(a, c) = \frac{\Gamma(a)\Gamma(c)}{\Gamma(c-a)}

\iff B(r, n-r) = \frac{\Gamma(r)\Gamma(n-r)}{\Gamma(n)}

(parenthesis: not to be confused with the binomial distribution, this one's formal definition is $B(z_{1}, z_{2}) = \int _{0}^{1} t^{z_{1}-1} (1-t)^{z_{2}-1} \, dt$ )¹

which, combined with the above expression, makes for

\frac{1}{n-r}\binom{n-1}{r-1} = \frac{\Gamma(n)}{\Gamma(r)\Gamma(n-r)} = \frac{1}{B(r, n-r)}

from which we can get

\binom{n}{r} = \frac{n+1}{nr - r^2 + n + 1}\frac{\Gamma(n)}{\Gamma(r)\Gamma(n-r)} = \frac{n+1}{nr - r^2 + n + 1}\frac{1}{B(r, n-r)}

\binom{n-1}{r-1} = \frac{(n-r)\Gamma(n)}{\Gamma(r)\Gamma(n-r)} = \frac{n-r}{B(r, n-r)}

from which we can get

\binom{n}{r} = \frac{(n-r)\Gamma(n+1)}{\Gamma(r+1)\Gamma(n-r)} = \frac{(n-r)n\Gamma(n)}{r\Gamma(r)\Gamma(n-r)} = \frac{n}{r}\frac{(n-r)\Gamma(n)}{\Gamma(r)\Gamma(n-r)} = \frac{n}{r}\frac{n-r}{B(r, n-r)} = \frac{n(n-r)}{rB(r, n-r)}

$\Gamma$ has the cool property $\Gamma(x+1)=x\Gamma(x)$ (similar to factorials' $n! = n(n-1)!$ ), but $B$ has no such property, which makes the following move illegal: $\binom{n}{r} = \frac{n \cancel{+ 1} - r \cancel{- 1}}{B(r+1, n \cancel{+ 1} - r \cancel{-1})} = \frac{n-r}{B(r+1,n-r)}$

therefore, we can state that

\binom{n}{r} = \frac{n(n-r)}{rB(r, n-r)}=\frac{n+1}{(nr - r^2 + n + 1)B(r, n-r)}

now, how we actually derive either of these, before setting them to zero, is another mystery.. hahahaha.

Edit (april 13th, 2026): I've tried integrating the beta function as it seems getting rid of the integral would probably help in terms of deriving the whole thing, but after two integrations by parts, it doesn't work unless I know $r$ and $n$ . However, by waving the white flag and accepting an estimation, using the 3 first terms of the MacLauren series, using the definition stated above, we get the following solution:

B(z_{1}, z_{2}) = \int _{0}^{1} t^{z_{1}-1} (1-t)^{z_{2}-1} \, dt

\approx \left[\frac{t^{z_1}}{z_1} + \frac{(z_2-1)t^{z_1+1}}{z_1+1} + \frac{(z_2-1)(z_2-2)t^{(z_1-1)^2-1}}{(z_1-1)^2-1}+\text{C}\right]_0^1

\approx \frac{1^{z_1}}{z_1} + \frac{(z_2-1)1^{z_1+1}}{z_1+1} + \frac{(z_2-1)(z_2-2)1^{(z_1-1)^2-1}}{(z_1-1)^2-1}

Since I don't plan on using complex numbers, by arbitrarily limiting the domain of $z_1$ and $z_2$ to the integers $\mathbb{R}$ , we can simplify it to:

B(z_{1}, z_{2}) \approx \frac{1}{z_1} + \frac{z_2-1}{z_1+1} + \frac{(z_2-1)(z_2-2)}{(z_1-1)^2-1}

Substituting $r=z_1$ and $n-r=z_2$ , we get

B(r, n-r) \approx \frac{1}{r} + \frac{n-r-1}{r+1} + \frac{(n-r-1)(n-r-2)}{(r-1)^2-1}

Therefore

\binom{n}{r} \approx \frac{n(n-r)}{r\left(\frac{1}{r} + \frac{n-r-1}{r+1} + \frac{(n-r-1)(n-r-2)}{(r-1)^2-1}\right)}

\binom{n}{r} \approx \frac{n(n-r)}{1 + \frac{r(n-r-1)}{r+1} + \frac{r(n-r-1)(n-r-2)}{((r-1)-1)((r-1)+1)}}

\binom{n}{r} \approx \frac{n(n-r)}{1 + \frac{r(n-r-1)}{r+1} + \frac{\cancel{r}(n-r-1)(n-r-2)}{\cancel{r}(r-2)}}

\binom{n}{r} \approx \frac{n(n-r)}{1 + \frac{r(n-r-1)}{r+1} + \frac{(n-r-1)(n-r-2)}{r-2}}

Yay! Now to isolate $r$ in $\frac{d\binom{n}{r}}{dr}=0$ ...

\frac{d\binom{n}{r}}{dr} \approx \frac{d}{dr}\left(\frac{n(n-r)}{1 + \frac{r(n-r-1)}{r+1} + \frac{(n-r-1)(n-r-2)}{r-2}}\right)

\approx \frac{d}{dr}\left(\frac{n^2-nr}{1 + \frac{nr-r^2-r}{r+1} + \frac{r^2+(3-2n)r+n^2-3n+2}{r-2}}\right)

et cetera... Wow this is feeling like a very very very long expression. To be continued.

Anyone notice how this looks really similar to the binomial distribution's probability mass function $P(X=r)=\binom {n}{r}p^{r}(1-p)^{n-r}$ with n being the amount of retractions done? In fact, $B(n+1, n-r+1)$ brings us even closer... ↩

CD Player Kidnapping Saga

2025-09-21T18:30:20.000Z

I helped a friend with fixing an old, 1990s-era¹, CD player that belonged to his grandparents. But before we get into that, we need to talk about how I was convinced into helping him². It all started quite ominously:

Translation: "Mr. Taha, I'm kidnapping you after English, you've been warned", and my response was "what." For context, our English literature class had just started when I received this DM from him. It was a few confusing seconds before I realized what he meant.

The more helpful piece of context came from another friend, let's call him Nicolas, which ran the community bike repair shop whose workspace we were about to borrow for about 5 hours.

Translation: At 1:27 PM on Friday, "Are you in class right now?", "Yes", and at 1:42 PM, "Midadouille, Hadrien needs help." [Friend #1] is the friend who sent those ominous messages. I have no idea what "Midadouille" is or where it came from.

Skipping to the part where we start working on it, we unscrew it, and find that everything is electronic except the part that pops out and reads the CD, which is connected to the rest using a bunch of connectors.

Using the tools at our disposal, we spend at least 30 minutes unplugging a few of these JST-style connectors, most of which were much more annoying because they had two bits that locked into their casing which we needed to kind of push out on the casing a bit to get them out.

We then took it out (which was pretty straightforward because we had access to the owner's manual, which had so. much. information.)

Taking off the front panel to access the CD reader, which my friend Hadrien is holding with his left hand.

The CD reader could be split into two parts, which exposed two rotating shafts, essentially two wheels, a lot more plastic, a spring which served to push up the CD when it was ejected so that it would be easier to take out³.

The spring system that pushed up the CD tray. We actually thought for a bit that it was a part of the problem, but turns out it was perfectly fine and working as intended.

It's also important to note that we had a weirdly shaped piece⁴ and a bunch of strands of rubber loose inside the main case. We didn't know what their use was. In fact, it took a lot of trial and error to get the weirdly shaped piece to fit somewhere, never mind finding where it was actually supposed to go.

One of the rubber band pieces in question.

There were also two plastic wheels on the other piece of plastic. It took us embarrassingly long to figure out that the rubber band was supposed to link between them, but we eventually did. However, issue #1, we did not have any rubber bands that fit the specs. By using a piece of tape that I wrapped around them, I figured out that we needed something with a 10cm circumference and a 1-1.5mm diameter. And unfortunately they don't have small specific rubber bands at a community bike repair station, I even went up to ask and the answer was still a no. :(

So I got crafting. I tried shrinking a really close rubber band that we somehow found at the corner of a desk by melting it with a hot glue gun (it didn't work), using electrical tape (green in the image below), masking tape, even making one out of hot glue (this actually almost worked).

A bunch of our attempted solutions. The masking tape didn't have enough friction, the hot glue band had deformities which made it jump out, but the electrical tape one was the closest to working.

After 7-8 attempts with the electrical tape, changing its thickness, length, and how I joined the two sides, we ended up with something that worked! Or at least well enough. I wouldn't be able to guarantee more than 20 spins because its adhesive wasn't strong enough, but it was a working PoC until we ordered an actual rubber band.

One of our attempts was munched up by a gear that was right next to the belt and pulley system where we installed it.

The holy grail, an almost perfect looking *fake* rubber band.

At the same time, we had to figure out where the weird looking piece went. And after a ton of trial and errors, we found where it fit, but we inserted it wrongly which ended up snapping off a piece of plastic. Once we installed it correctly we were able to use hot glue to mitigate that issue.

Weird looking piece in place (the one in beige), with some hot glue keeping it from falling off ever again.

After fixing these two items, even if some things on the CD reader weren't working as expected (in fact, the CD tray raising mechanism was working in reverse), we decided to try it out, and the CD tray would pop out and raise the tray correctly! That said, it didn't want to read the disk we were putting into it, so back to trial and error. It turns out that the laser disk reading head was stuck, so it just took a bit of wiggling to get it moving, and 🎉. We didn't see any other issues, and the numbers on the LCD made it seem like the audio was playing.

So at least it seemed to work, because to actually hear the audio we needed to connect it to a pre-amp and then an amp, which we didn't have on the spot, so my friend took it back home, and lo and behold.

Translation: "@adn.taha IT WORKS." The CD player is the item at the bottom of the stack of audio equipment, the one with the LCD display.

All that's left is to order an actual 1mm diameter 10cm circumference rubber loop, so if you know where to get something like that, please contact me!

According to him. According to this source that I found, it was made in February of 1989, which is basically the 1990s, so he's right and we should never doubt our friends. It's a Luxman D-105U. ↩
Spoiler alert, it didn't take much convincing. ↩
The type of feature built into luxury items that's a pain to fix. Luxury cars also do this, which is why mechanics dislike working on them. ↩
If you think about it, all mechanical pieces are "weirdly shaped" because they're made for a specific purpose, which means that none of it is really "weird" at all. ↩

What's AI Safety even about?

2025-08-17T23:43:13.000Z

If you pay attention, alongside big AI labs like DeepMind or OpenAI's releases on the performance of their models on the IMO, you'll notice that they'll talk about things like making their AIs 'safe', 'interpretable' or even 'trustworthy' in their blog posts. Or at least that was my case.

And then you tend to wonder, what does this even mean? How do you go about trusting a machine? And with those questions, you've entered the field of AI safety.

The issue is that, as AI models get more advanced, people tend to give them more and more responsibility. And it's a problem because, no matter who you ask, they'll tell you that we don't really understand them.

Throughout my research, I've found that academics and industry refer to individual AIs as "an AI model", or just "this model", because they use AI to refer to the whole field. This is a reference to models in the field of statistics, which are basically really fancy equations, and AIs, in a certain sense, can also be seen as really big and fancy equations.

Before getting to the first major problem in AI safety, we have to understand what an AI model actually is.

Artificial Intelligence as a word was invented by John McCarthy at what became the first AI conference. It describes, in so little words, a smart computer. Among the different ways we've tried to make computers smart is through copying brains. Brains are blobs of inter-connected neurons, and each neuron can receive an electrical signal and emit electrical signals to other neurons. But not all signals are equal: some of them are stronger than others¹. Neurons can also change their connections, so which neurons they're connected to, and that's how we learn information.

So in the 1900s, we created a virtual neuron and called it a Perceptron. It's called that because they were trying to recognize, perceive, what was on a picture, which was basically impossible for computers to do at the time. Each perceptron has two different knobs, but I'll avoid going into detail because it's not useful for this exercise.

We can understand modern AI models as a collection of millions, billions or even trillions of Perceptrons. That's a lot of dials. To train them, we give them huge amounts of information, including huge amounts of books and almost the entire internet for models like ChatGPT or Gemini, and let them turn all the knobs a little bit each time, until we're satisfied with them. We do this because it's impossible for a team of humans to turn these nobs themselves. If I was able to tweak 3 knobs per second, it would take me ~2000² years for a model like GPT-3, just to turn each dial once. And 3 knobs per second is a lot faster than I'd actually be able to achieve. Anyways, as of now, it's impossible for us to understand what each knob does, since we're not the ones who tweaked them, and because there's an incredible amount of them. That's the first problem of AI safety: we're unable to interpret what each knob does, how it influences the rest of the knobs—since they're interconnected!—and so we have no clue how the model works.

The second problem comes from how we train it. Humans are imperfect, and as time passed we got rid of more and more of our stereotypes and prejudice. But since we're trying to give AI models more and more content to train on, we end up training on some bad stuff which I won't get into the details of here. You've probably seen what's on the Internet, you know what I'm talking about. Another example is that there are a lot more white male faces on the Internet then black women, or other minorities, which means that face recognition models (much much much smaller than ChatGPT³) are therefore more accurate on white males than others⁴. That's the second problem of AI safety, which people call algorithmic bias.

The third and fourth problems in AI safety are simpler to understand. Imagine if you had a new job as a cleaner, and your manager taught you to clean by showing you how to mop the floor or wash a shirt, with water, soap, etc. And then a customer comes in and asks you to clean their computer, which you do by washing it under the sink, and you end up breaking it because electronics aren't supposed to touch water. The thing that the manager did wrong was not telling you how to clean laptops, and the thing you did wrong is that you washed the laptop instead of cleaning it, which would've been to open it and blow air inside it to remove the dust. We call the former "out of distribution errors" or "robustness failure", because you weren't taught how to clean that specific thing because your manager wasn't robust with your training. Sorry if the name is weird, academics aren't exactly known for their naming skills. The latter is called "goal misgeneralisation", where the customer told you their goal but you didn't understand it correctly.

That's basically the gist of it. And to answer the question I asked at the start, AI safety is about making sure that we can trust AI models in sensitive scenarios, like in hospitals for example, while being sure that if something goes wrong, it won't mess everything up.

If you want to spend more time learning about AI safety, Nicky Case made a really good resource on it—even if it's not finished yet—that's available online: AI Safety for Fleshy Humans

Neurons can emit electrical signals from -40 to -90 millivolts (Purves, Augustine, Fitzpatrick, et al. 2001). It's negative because the inside of the neuron is more negatively charged than the outside. ↩
GPT-3 has approximately 175 trillion parameters (or nobs), divided by 3 knobs per second, is around 60 trillion seconds, or around 2000 years. ↩
Just to name an example, FaceNet, which is on the bigger side, has 140 million parameters (LearnOpenCV, Durai 2023). That's 1,000x less than GPT-3! ↩
According to a study published in 2018 by MIT and Microsoft researchers, the error rate on darker-skinned women is 34.7% as compared to 0.8% on light-skinned men (Buolamwini and Gebru 2018), which is a huge difference in accuracy. ↩

My Path to AI Safety

2025-06-28T19:52:20.000Z

Hi there. I'm Aidan. If you've landed on this blog, then I can safely assume that AI interests you.

In March of 2023, if you don't know, Meta's Llama model was leaked online. Whether or not it's a good thing was a hot debate in various internet circles back then, one I didn't have the knowledge to participate in. All I knew was that, thanks to LLaMA.cpp, I had the ability to run it on my computer, and that it would enthusiastically respond to queries asking for the know-how on creating certain molecules and other instructions that would be very bad should they fall into the wrong hands. It was too easy. The risk that these raw, non-safeguarded models can pose is, legitimately, unreal. That being said, Meta's decisions to release the models, but with safeguards in place this time, feels to me like the only right move¹.

I started looking at AI as a field at the start of a school year, when I had been tasked to find a topic for and get started on a year-long project. That's when I ran into the FracAtlas dataset, published on Nature². This project ended up actually being quite painful, because as it turns out, AI models are spread between a lot of libraries. On top of that, I had to figure out why the models' predictions were terrible³, and as any programmer can tell you, debugging complex programs without a debugger is a painful experience.

A lot of articles helped⁴, but there's one thing that I could not figure out: loss functions. Seriously, I didn't know which one to choose, nevermind the logic behind which models work better than others. Since these models took hours to train, and my free Colab instance didn't like it when I left it to run overnight, I eventually settled with what I had and decided to optimize for other factors⁵. The experience, forgive my language, it sucked. It did not feel like the technology of the future that media portrays AI to be.

This frustration with AI black boxes, that the loss was this unknown function that was minimized to try to improve the AI model yet resulted in terrible performance, made me start thinking about bigger questions. If I couldn't understand my (relatively) simple fracture detection model, how could anyone understand the AI systems making real-world decisions? Or ChatGPT with its multi-hundred-billion parameters? This rabbit hole eventually brought me to 80,000 Hours, a non-profit with the goal of identifying the world's "most pressing problems" and helping people find careers that work towards solutions to them. So what's the most pressing problem? At the time of writing, they say it's power-seeking AI systems. If we use AI to make huge decisions without knowing without any doubt what it's doing, it could misguide us and lead to catastrophic things. Humanity-ending level things. So how do we avoid this problem? Through AI safety research. Not only does 80,000 Hours classify it as the most pressing problem, but the technical side of this field aligns with my interests.

That's it. I've found what I want to spend my career towards.⁶ My next goals are an undergrad diploma, master's and a job at an AI lab if not a doctorate. But that's a very long term plan. For now, I've got my sights set on IJCAI 2025. It's an incredible opportunity for me to meet people in the field, to hold interesting discussions, and to learn. As a world-class conference, it's equally good of a place to give people, my peers, others, what I wish I had: a centralized place to learn about AI safety without needing to invest months into it. Explanations of and insights into cutting-edge research, written in a way I can understand. As someone who's felt the frustration of AI's black boxes firsthand, I want to help others understand these systems before they become even more powerful.

This is the subject of another debate, which is ongoing, even today. As a society, we need to figure this out sooner rather than later because super-intelligent AIs are gonna arrive at some point and we need to have it figured out before then. ↩
I later found out that Nature is actually a pretty prestigious publication, which only motivated me to get started on this topic even more. ↩
I mean it. The model accuracy I ended up with was around 55%. ↩
I don't quite remember which articles I read, but kudos to all the authors on Medium explaining the various pieces in AI. ↩
I ended up going with YOLOv8s to allow the model to be ran on a phone. This was enough for the scope of the project. ↩
Statistically speaking, there's a good chance that I change my mind at some point, but there's no way to know the future, so I'm going to assume that I'm always going to be interested in AI safety and its problems. ↩

Aidan Taha

RFC: Cryptographic Model Provenance and Data Privacy for Inference Routing

Introduction

Definitions

Model provenance

Data privacy

Conclusion

Footnotes

On deriving discrete random variables (hear me out)

Footnotes

CD Player Kidnapping Saga

Footnotes

What's AI Safety even about?

Footnotes

My Path to AI Safety

Footnotes