Code415 Radar

Key ideas

Credential stuffing

Attackers take email and password pairs leaked from one service and try them automatically on many other services.

TOTP

A six digit code computed from a shared secret and the current time, defined in RFC 6238 and used by authenticator apps.

k anonymity range query

You send only the first five characters of a password hash, so the server never learns which password you checked.

Steps

1. Read the IPA 不正ログイン対策特集ページ to see the official Japanese guidance on password reuse and two step login.
2. Look at how it separates something you know from something you have, and why it recommends a password manager.
3. Connect it to engineering: a unique random password per site works like an API key scoped to one service.
4. Self check: if site A leaks your password, which of your accounts are still safe, and why?

Steps

1. Run pip install pyotp, create a secret with pyotp.random_base32() and print pyotp.TOTP(secret).now() twice, 30 seconds apart, to watch the code rotate.
2. Turn the secret into a provisioning QR code, scan it with your own authenticator app, and confirm that totp.verify(code) accepts the code the app shows.
3. Write a script that takes the SHA-1 of a test password locally and sends only the first 5 hex characters to https://api.pwnedpasswords.com/range/{prefix} with the header Add-Padding: true.
4. Find your suffix in the response yourself, skip padded rows whose count is zero, and print how many times that password appears in known breaches.
5. Compare a weak test password like password123 with one your password manager generated.

Small angles to try

• Count how many of your own accounts still lack a second factor.
• Implement TOTP from scratch with hmac and compare the output with pyotp.
• Measure how much the range query reveals with and without padding.

Key ideas

Active parameters

In a mixture of experts model only a few experts run per token, so 23B of the 501B weights do the work for any one token.

Asynchronous policy gradient

Rollout workers keep generating with slightly old weights while the trainer updates, so the method has to correct for stale samples.

Goodput

The share of cluster time that actually ends up in the final model after failures and restarts, which Reflection puts at 92.3 percent.

Steps

1. Read the Reflection blog post Introducing Beam, focusing on the RL section.
2. Go through the benchmark table and mark which rows Beam wins and which it loses.
3. Compare the 23B active size with other open MoE models you have run to estimate memory and serving cost.
4. Self check: why can a 501B MoE model be cheaper per token than a smaller dense model?

Steps

1. Sign up for early access on the Reflection platform.
2. Pick five coding and agent prompts you already use on GLM 5.2 or Qwen and save them as a fixed eval set.
3. When access or weights land, run the same prompts and record answer quality and tokens used.
4. Estimate the memory needed for 501B weights at 4 bits and decide which hosting option is realistic for you.

Small angles to try

• Track how fast Beam lands in local runtimes after the weights release.
• Compare tokens per solved task against GLM 5.2 to test the 3 to 4 times compute claim.

Key ideas

Constellation map

The spectrogram is reduced to a sparse scatter of its loudest time and frequency points, which survive noise and compression.

Combinatorial hashing

Each anchor peak is paired with peaks in a target zone after it, and each pair becomes one hash key.

Offset histogram

True matches all share the same gap between clip time and song time, so they form one tall bar.

Steps

1. Read sections 2.1 to 2.3 of Wang's paper, hosted on a Princeton course page.
2. Find the figure where matching hashes line up on a diagonal and become a histogram spike.
3. Connect it to search engines: this is an inverted index, the same idea as posting lists.
4. Self check: why does a hash of a peak pair survive noise better than a hash of the raw audio?

Steps

1. Load two or three of your own songs and compute a spectrogram for each with scipy.
2. Find local maxima with a maximum filter and a loudness threshold, and plot the constellation.
3. Pair each peak with up to 10 later peaks in a small window and store each hash of frequency 1, frequency 2 and time gap in a dict with the song id and anchor time.
4. Record 10 seconds of one song playing from your phone speaker, hash the clip the same way, and build a histogram of time offsets per song.
5. Check that the right song shows one clear spike, then add noise to the clip and find where recognition fails.

Small angles to try

• Sweep the fan out from 1 to 20 and plot index size against accuracy.
• Try a pitch shifted clip and see why plain hashing breaks.
• Compare with an embedding model on cover songs, which fingerprints cannot handle.

Key ideas

Harness

The agent program around a model, such as Claude Code or opencode, that decides prompts, tools and the loop.

Capture proxy

A pass through server that logs exactly which tokens the model sampled and their probabilities so RL can train on the real agent run.

GRPO

A policy gradient method that scores a group of rollouts for the same task and pushes the model toward the better ones.

Steps

1. Read the guide The ultimate guide to multi harness RL on the AdithyaSK Space.
2. Then read the OpenEnv Harbor docs and look at the harness table and its wire dialects.
3. Connect it to evals you know: SWE bench style grading, but inside the agent you actually ship.
4. Self check: why would a model trained only inside opencode make invalid tool calls inside Codex?

Steps

1. Install with pip install "openenv[harbor]".
2. Serve a small model with vllm serve <model> --return-tokens-as-token-ids --logprobs-mode processed_logprobs.
3. Check the setup with openenv harbor info --llm-url $LLM --dataset AdithyaSK/data_agent_rl_environment_eval.
4. Run one rollout with openenv harbor rollout --llm-url $LLM --dataset org/tasks --task-index 0 --harness opencode --sandbox e2b --out rollout.json, then repeat with another harness.
5. Compare reward and turn count between the two harnesses on the same task.

Small angles to try

• Serve FineEnvs/LFM2.5-2.6B-multiharness-RL and compare it with the base LFM2.5 in your own harness.
• Count invalid tool calls a local model makes in each harness.

Key ideas

Salted password hash

A random salt is mixed into each password before hashing, so two users with the same password get different stored values.

Key stretching

Schemes like Argon2 or bcrypt are deliberately slow, which raises the cost of every offline guess.

Dwell time

How long an attacker stays inside before being detected, here roughly eight months.

Steps

1. Read the 週刊アスキー report and write down the date range and the three account counts.
2. Note what the notice leaves out: the hash algorithm, the stretching cost and how the admin credential leaked.
3. Think of an internal tool you run where one admin can read user data, and ask what would alert you.
4. Self check: why does a salt alone not protect a weak password once the salt is stolen too?

Steps

1. Hash a test password with PasswordHasher().hash(...) and confirm verify accepts it.
2. Hash the same password twice and confirm the two stored strings differ because each gets its own salt.
3. Time 100 verify calls, then 100 plain SHA-256 hashes of the same string, and compare guesses per second.
4. Use a small wordlist of your own to estimate how long checking it against one Argon2 hash takes compared with SHA-256.
5. Change the hasher parameters and use check_needs_rehash to see how an old hash gets flagged for upgrade.

Small angles to try

• Draft a log rule that alerts when an admin account reads user files in bulk.
• Compare bcrypt and Argon2 timings on your laptop.
• Write the breach notice you would want to receive, with the missing technical details filled in.

Key ideas

Compensated magnet

A material whose magnetic moments cancel overall while its electron bands still split by spin, so it can carry spin currents without stray fields.

DFT with PBE+U and HSE06

Density functional theory estimates electronic structure; PBE+U is the fast approximation and HSE06 the slower check used to confirm band gaps.

Spin window

The energy range where only one spin direction of carriers exists, which sets how well the material can filter spin.

Steps

1. Read the Vals AI blog post, focusing on the candidate table and the caveats section.
2. Mark which claims rest on the fast PBE+U pass and which on the HSE06 check, and where the two disagree.
3. Compare it with agent coding: fan out search plus verification, like a test suite filtering generated code.
4. Self check: why is a predicted ordering temperature in simulation not the same as a measured one?

Steps

1. Clone the published ledger repository named in the Vals AI blog post.
2. Browse the folder layout to find the input files and outputs for each candidate.
3. Pick YBaMnFeO₅ and trace how the band gap number in the blog maps to an output file.
4. Write down each step where an agent chose what to compute next, if the logs show it.
5. Note one thing a human materials scientist should verify before trusting the result.

Small angles to try

• Ask a current model to critique the KV[Cr(CN)₆] water caveat using only the repository files.
• Estimate how much of the pipeline is agent judgment versus standard DFT tooling.

Key ideas

Usage reset

A one time refill of the weekly Codex quota back to full.

Plan multiplier

How many times the base usage allowance a paid tier gets.

Steps

1. Read Tibo's post and the explainx breakdown of the 28 day pledge.
2. List what changed for Codex in September: outages, model issues and plan changes.
3. Compare it with how other coding tools communicate limits and credits.
4. Self check: if you have half your quota left on a reset day, what happens to it?

Steps

1. Note your current Codex usage and plan limits today.
2. Each day for a week, check the official Codex changelog and Tibo's posts for what shipped.
3. Keep a simple log: date, improvement or reset, and whether it changed your workflow.
4. At the end of the week, score how many shipped items actually mattered to you.

Small angles to try

• Compare daily Codex changes with Claude Code release notes over the same week.
• Track whether resets cluster around outage days.

Key ideas

Zeroth order optimization

Training that only uses loss values from forward passes, never gradients from the chain rule.

Node perturbation

Adding noise to a layer's outputs instead of its weights, then turning reward weighted noise into a gradient estimate.

Virtual population

Treating every token position as a separate trial so thousands of perturbations are scored in one forward pass.

Steps

1. Read the Q Labs Dust research page, starting with the method diagram and the plot against backprop.
2. Find the token budgets where Dust loses badly and the ones where it catches up.
3. Relate it to evolution strategies from RL, and ask why perturbing activations scales better than perturbing weights.
4. Self check: why might a method with no backward pass matter for analog or neuromorphic hardware even if it costs more FLOPs?

Steps

1. Clone https://github.com/qlabs-eng/dust and create a venv with python3 -m venv .venv.
2. Install PyTorch with python -m pip install torch==2.10.0 --index-url https://download.pytorch.org/whl/cu128, then python -m pip install -r requirements.txt.
3. Prepare data with python prepare_data.py, which downloads FineWeb and builds the 1M and 10M token sets.
4. Run Dust with python dust.py --tokens 1M --population 256 --output runs/1m-p256.
5. Run the baseline with python baselines/backprop.py --tokens 1M --output runs/bp-1m and compare validation loss and wall time.

Small angles to try

• Halve and double the population and plot how loss changes.
• Measure peak GPU memory for Dust versus the backprop baseline.

Key ideas

Memorized signatures

Image models can learn to reproduce names that appear often in training images, like a signature in a corner.

Attribution versus style

Imitating a style is murky, but putting a real person's name on fake work misrepresents who made it.

Output guardrail

A filter that checks prompts or outputs for similarity to third party content.

Steps

1. Read the Nieman Lab article and note the examples and OpenAI's response.
2. Check whether the new warning stops the signature or only flags the prompt.
3. Connect it to text models that invent fake citations, the same failure in a different medium.
4. Self check: how would you design a release test that catches forged signatures?

Steps

1. Write a neutral prompt for a single panel magazine style cartoon with no artist named.
2. Generate several images and zoom into the corners to look for any signature or name.
3. Repeat with a different magazine style and note any difference.
4. Keep the results for your own notes and do not post images that carry real people's names.

Small angles to try

• Compare two or three image models on the same prompt.
• Add the word unsigned to the prompt and see if it helps.

Key ideas

Static recompilation

Translating a game's machine code into native source ahead of time so it runs on PC without an emulator.

Decompilation

Recovering readable source code from a compiled binary, often matched byte for byte against the original.

Maintainability debt

Code that works today but that nobody understands well enough to fix or extend later.

Steps

1. Read the Dot Esports roundup first, then the PC Gamer piece for the background of the fight.
2. Note which parts AI does well, such as boilerplate and graphics shims, and what humans still handle.
3. Compare with your own experience of agent written code: does it hold up after six months?
4. Self check: what evidence would convince you an AI written port is maintainable?

Steps

1. Compile a tiny C program of your own and strip the binary.
2. Ask a coding agent to decompile it back into readable C from a disassembly.
3. Recompile the output and compare behavior on the same inputs.
4. Have a second session explain one function without seeing the original, and judge whether it is understandable.
5. Only use binaries you wrote yourself, not game ROMs.

Small angles to try

• Compare a local Qwen model with a frontier model on the same binary.
• Count how many fix cycles the agent needs before your tests pass.

Key ideas

UV unwrapping

Flattening a 3D surface into 2D pieces so a flat texture can be mapped back onto it.

Lattice deformation

A coarse cage of control points bends a mesh smoothly, so resizing the cage resizes the model.

Seam allowance

The extra margin around a pattern piece that gets sewn, which the game calculates for you.

Steps

1. Read the Engadget Indie Pitch interview with the team for the technical explanation.
2. Look for how they keep the 3D dress and the flat patterns in sync when sizes change.
3. Connect it to the texture mapping every 3D tool uses, here turned into the gameplay itself.
4. Self check: why does a gathered edge stretch the texture more than a straight seam?

Steps

1. Model a simple skirt as a cylinder or cone in Blender.
2. Mark two seams and unwrap the mesh to get the flat pattern pieces.
3. Apply a striped fabric texture and move the pieces in the UV editor to watch the stripes change on the 3D skirt.
4. Scale the waist with a lattice modifier and check how much the stripes distort.
5. Compare your flat pieces with a real skirt sewing pattern.

Small angles to try

• Write a tiny shader that tints areas that are stretched too much.
• Generate fabric textures with AI and see which ones tile cleanly.
• Compare this trick with the cost of real cloth simulation in a game engine.

Key ideas

Search grounding

Giving a model fresh search results so it answers from current pages instead of training data.

AI Gateway

Cloudflare's proxy layer that logs, caches and bills calls to model and tool providers.

Zero data retention

The provider promises not to store your queries or results.

Steps

1. Read the Cloudflare changelog post, focusing on the REST endpoint and the Workers binding example.
2. Note how provider choice and the result limit are set.
3. Compare it with how you wire search into an agent today, for example a direct Exa key.
4. Self check: what do you gain and lose by routing all search through one gateway?

Steps

1. Create or reuse an AI Gateway named default in your Cloudflare dashboard.
2. In a Worker with the AI binding, call env.AI.websearch({ gatewayId: "default", query: "...", provider: "exa", limit: 5 }).
3. Repeat the same query with the other two providers and save the results.
4. Or call the REST endpoint POST https://api.cloudflare.com/client/v4/accounts/$CLOUDFLARE_ACCOUNT_ID/ai/websearch/ from your machine.
5. Open the AI Gateway logs and compare latency and cost per provider.

Small angles to try

• Run Japanese language queries and see which provider handles them best.
• Feed results into a model and check how often answers cite the right page.

Key ideas

HTTP message signatures

A standard way to sign selected parts of an HTTP request so the server can check who sent it.

Signature-Agent header

Tells the server where to fetch the bot's public keys.

Delegated identity

Proving an agent acts for a specific user with specific permissions, which bot signatures alone do not cover.

Steps

1. Read Cloudflare's Web Bot Auth reference page and note the three headers.
2. Look at which fields are signed and how expiry is handled.
3. Compare it with OAuth and ask what agent scopes would need on top.
4. Self check: if your agent books a hotel, which layer proves it was allowed to spend your money?

Steps

1. Generate an Ed25519 key pair with OpenSSL on your own machine.
2. Convert the public key to JWK format and serve it from your local server at the well known directory path described in the docs.
3. Write a small client that signs requests with Signature-Input, Signature and Signature-Agent headers, using a library whose README you have checked.
4. Add a verifier to your local server and confirm it accepts good signatures and rejects an expired one.
5. Keep all signed traffic on localhost.

Small angles to try

• Add a field for which user the agent acts for and think about how a server could verify it.
• Rotate the key and see what breaks.

Key ideas

Statistical text watermark

A hidden bias in which words a model picks that readers cannot see but a detector can measure over enough tokens.

Paraphrase attack

Rewording or swapping synonyms to wash out the watermark pattern.

API opt in

Developers outside the EU decide whether their app's outputs carry the mark.

Steps

1. Read the BleepingComputer article and note exactly which products and regions are covered.
2. List what is still unclear, such as whether Codex code output is marked.
3. Connect it to the EU AI Act transparency rules for synthetic content.
4. Self check: why does detection get harder on short texts and on code?

Steps

1. Generate a few paragraphs from a model and save them.
2. Rewrite one copy by swapping about one word in ten for a synonym.
3. Compare word frequency between the model text and your own writing with a small word count script.
4. Write down what a team in Japan serving EU users would need to tell customers about marked output.

Small angles to try

• Think through whether marked Codex comments could end up in a public repository.
• Compare with image provenance such as C2PA metadata.

Key ideas

Full text index

A precomputed lookup from words to records so search does not scan every row.

Context budget

The number of tokens an agent can spend reading data before cost and quality suffer.

Steps

1. Read the Leviathan README, especially the benchmark section.
2. Look at what a result card contains and how it cites the source record.
3. Connect it to how coding agents already use grep and ripgrep over repositories.
4. Self check: when would plain SQL be better than a ranked text index for an agent?

Steps

1. Install with cargo install --git https://github.com/elstongun/leviathan leviathan.
2. Clone the repository and run cd examples/tickets && leviathan index.
3. Try leviathan search -g acme "sso login loop after password reset" and look at the output size.
4. Export one of your own CSV or SQLite tables and index it the same way.
5. Count tokens of a Leviathan result versus a grep result for the same question.

Small angles to try

• Wire it into Claude Code as a shell tool and compare task cost.
• Test it on Japanese text records to see how ranking holds up.

Key ideas

Cluster randomized trial

Randomizing whole groups such as classes or schools instead of individual students.

Effect size in standard deviations

A common scale for learning gains; 0.06 to 0.08 for a full year is small but real.

Intent to treat

Measuring the effect of being assigned the tool, whether or not students actually used it much.

Steps

1. Read the EdWorkingPapers abstract, then the tables on usage and achievement.
2. Check how usage is measured and whether heavy users gained more.
3. Compare with human tutoring effect sizes, which are usually much larger.
4. Self check: if engagement is the bottleneck, what product change would you test first?

Steps

1. Pick three middle school math problems you can check by hand.
2. Ask a model to tutor you through each without giving the answer.
3. Count how many turns pass before you feel like quitting, and note why.
4. Change the instructions to make the tutor shorter and more encouraging, then repeat.
5. Write down which version you would actually open again tomorrow.

Small angles to try

• Run the same session in Japanese and compare.
• Add a daily streak or quiz format and see if it changes your motivation.

Key ideas

Deterministic rendering

The same HTML input always produces exactly the same frames, which makes agent output reproducible.

Composition

A timeline of layers such as text, images and clips that together make one video.

Steps

1. Read the HyperFrames README on GitHub, starting with the stack overview.
2. Open the Studio page and look at how a composition maps to HTML.
3. Connect it to video as code tools like Remotion that you may know.
4. Self check: why is HTML a convenient format for an LLM to produce video?

Steps

1. Run npx hyperframes init my-video then cd my-video.
2. Start the preview with npx hyperframes preview and edit the HTML.
3. Render with npx hyperframes render and check the MP4.
4. Optionally add the agent plugin with claude plugin marketplace add heygen-com/hyperframes and claude plugin install hyperframes@hyperframes, then ask for a 15 second clip.

Small angles to try

• Have two models write the same video spec and compare the results.
• Make a short explainer with Japanese subtitles for a model launch.