Gary McGraw

software security #swsec machine learning security #mlsec Tech | Life | Music

gem: https://garymcgraw.com
BIML: https://berryvilleiml.com
books: https://us.amazon.com/Gary-McGraw/e/B000APFZ2S
travel: https://noplasticshowers.com

Public Key

npub1as04fahu6mge8kxmx06r40eqg9j3c3ex5pz5jcccdlsedw9l7cssez5ale

NIP-05 Address

[email protected]

Profile Code

nprofile1qqswc8657m7dd5vnmrdn8ap6husyzegugun2q32fvvvxlcvkhzllvggprpmhxue69uhhyetvv9ujumt0d4hhxarj9ecxjmnts4fg5s

Publishing to

relay.momostr.pink

Author Public Key

npub1as04fahu6mge8kxmx06r40eqg9j3c3ex5pz5jcccdlsedw9l7cssez5ale

Show more details

Last Notes

2026-08-11 11:22:28 GMT

About those idiots hacking the plane wifi while ON the plane
https://cdn.masto.host/sigmoidsocial/media_attachments/files/117/076/616/356/488/364/original/92621b604b3b094e.jpg

2026-07-18 10:19:52 GMT

What?!
https://nysfocus.com/2026/07/14/new-york-humanoid-robot-teacher-salamanca-school-district

2026-04-13 02:27:27 GMT

- reply

damn that's a small number. And you simultaneously improved mine. Thank you for the reveal.
Hey @npub13x3…jdre and @npub1jsl…93xu and @npub1945…jvu5 your Erdos number may have just improved in my measurable universe

2026-04-05 12:03:14 GMT

- reply

workaday devs are serfs. Software architects are more crucial than ever. Architects emerge from jr devs through apprenticeship. Go.

2026-01-16 01:40:12 GMT

- reply

love it. It's the pants jon

2026-01-16 01:27:42 GMT

- reply

knock em dead. Wear your best tie....ha ha ha ha.

2026-01-11 13:47:33 GMT

Would not make good judge for the Turing test for $500 Alex.
https://www.theguardian.com/technology/2026/jan/11/lamar-wants-to-have-children-with-his-girlfriend-the-problem-shes-entirely-ai

2026-01-11 12:55:27 GMT

Now who would have anticipated this? #MLsec
https://www.theguardian.com/technology/2026/jan/11/google-ai-overviews-health-guardian-investigation

2026-01-10 18:49:59 GMT

NEW BIML Bibliography entry
https://arxiv.org/abs/2510.05179
Agentic Misalignment: How LLMs Could Be Insider Threats
Aengus Lynch, et al.
Meh. If you set up an LLM to do something bad, don’t be too shocked when it does something bad. Alignment does not work if your WHAT pile is broken enough.
#DON’TBOTHER #MLsec #Agents #LLM #Alignment
https://berryvilleiml.com/references/
https://cdn.masto.host/sigmoidsocial/media_attachments/files/115/872/300/151/902/852/original/a3c99fdc6d8f9741.png

2025-12-14 18:41:48 GMT

- reply

use blackmail

2025-12-14 17:56:40 GMT

- reply

Republicans can't govern

2025-12-03 12:31:59 GMT

Hype hype hype! If you "let #AI go" (whatever that means) it will becomes haxorz.
https://www.theguardian.com/technology/ng-interactive/2025/dec/02/jared-kaplan-artificial-intelligence-train-itself
In our view, #ML is astonishing enough without the anthropomorphic bullshit.
https://berryvilleiml.com/2025/11/14/houston-we-have-a-problem-anthropic-rides-an-artificial-wave/

2025-12-01 13:26:17 GMT

Recursive pollution is bad enough when it occurs naturally. It's worse when it is seeded by fraud. Simulated data are a huge mistake and an enormous miscalculation.
#MLsec #ML #AI #security
https://www.pnas.org/doi/10.1073/pnas.2518075122

2025-12-01 12:44:00 GMT

This term wins the internet today: LLeMmings
#AI #ML #LLM
https://www.theatlantic.com/technology/2025/12/people-outsourcing-their-thinking-ai/685093/

2025-11-25 13:36:04 GMT

- reply

when agentic #AI does all the things it will let you know whether that study was true

2025-11-25 11:26:08 GMT

Somebody has to lead the lambs to slaughter #AI #ML
https://www.nytimes.com/2025/11/25/technology/chatgpt-holiday-shopping.html

2025-11-23 21:32:42 GMT

Jesse Welles' protest song
https://cdn.masto.host/sigmoidsocial/media_attachments/files/115/601/149/457/135/869/original/eaee0e52f3c08098.mp4

2025-11-22 11:50:23 GMT

The Great Beigification caused by rampant use of #AI in college (cheating?) is upon us.
#MLsec is harder if people have no idea what "secure" even means
https://www.huffpost.com/entry/history-professor-ai-cheating-students_n_69178150e4b0781acfd62540

2025-11-14 11:43:03 GMT

Anthropic is overstating the use of #AI by "nation state actors" while providing scant hard evidence. Automation of attacks in security is not new. The real technical question to ask is which parts of these attacks could ONLY be accomplished with AI. The answer to that question seems to be "none of it."
The confluence of cyber cyber and #ML is interesting indeed and hard even for deeply technical people who are firmly grounded in one of the two camps (security engineering or #ML ).(1/2) #MLsec

2025-11-06 22:22:23 GMT

How not to talk about #AI financing
Gonna be fun when cycles are actually counted as cash
https://www.nytimes.com/2025/11/06/technology/openai-finances-debt-data-centers.html

2025-10-31 18:54:42 GMT

Hopelessly naïve and out of touch with actual software development much? AI as it stands can build some ok small stuff. But it can't build a Citibank. And before you "but but but" me...just think how well software components worked out to make things less complicated. Ha ha ha ha ha.
FIXING SOFTWARE FLAWS IS SO FAR PAST AI CAPABILITY IT MAKES ME TYPE IN ALLCAPS
#swsec #MLsec #AI #ML
https://www.theregister.com/2025/10/27/jen_easterly_ai_cybersecurity/

2025-10-11 01:43:30 GMT

- reply

https://berryvilleiml.com/ (2 of 3)
Unlike Big Tech or profit-motivated groups, we provide an independent, expert point of view based on deep scientific understanding of applied technology. BIML stands up for AI users by asking piercing questions about AI/ML and publishing easy to grok analysis, seasoning risk management with a healthy dose of building security in.

2025-10-11 01:41:28 GMT

Working on positioning stuff for BIML before our next phase. Doing classic basic messaging work is kinda fun for a bunch of geeks.
https://berryvilleiml.com/ (1 of 3)
BIML is a non-profit science and technology organization whose research focuses on machine learning security---the idea of building security in to machine learning technology itself.

2025-09-11 17:04:24 GMT

BIML is a little embarrassed not to play a role in this important organization #MLsec
https://alignmentalignment.ai/

2025-09-08 09:14:59 GMT

Oh look, recursive pollution. #MLsec
https://www.theregister.com/2025/09/07/googles_ai_cites_written_by_ai/

2025-08-31 13:24:16 GMT

#AI is a tool. It does not take sides.
https://www.politico.com/news/2025/08/29/ai-unmasking-ice-officers-00519478

2025-08-20 19:24:03 GMT

I am giving an #MLsec keynote talk at Mind the Sec in Sao Paulo Brazil on Sept 18th. Come see...Brazil will be hopping!
Thanks for your help spreading the word (retoots really appreciated)
https://www.mindthesec.com.br/palestrantes/gary-mcgraw

2025-08-09 01:50:23 GMT

Now here is some garbage we don't need #AI
Will my pet leave me open to being hacked?? Is my dog moonshine already a hacker?
#MLsec
https://cdn.masto.host/sigmoidsocial/media_attachments/files/114/996/291/966/289/149/original/3d799ff72da11817.png

2025-08-08 21:37:35 GMT

Here comes the copyright monster for #AI. 100% predictable, even without using #ML to figure it out. This is a very old #MLsec issue. When you build a WHAT machine, you need to take care about who owns the WHAT pile that the machine becomes.
https://arstechnica.com/tech-policy/2025/08/ai-industry-horrified-to-face-largest-copyright-class-action-ever-certified/

2025-08-06 22:27:57 GMT

Vibe coding the Constitution! #MLsec
https://arstechnica.com/tech-policy/2025/08/coding-error-blamed-after-parts-of-constitution-disappear-from-us-website/

2025-07-25 11:32:19 GMT

Academia is changing under pressure from #AI
https://mastodonapp.uk/@the_roamer/114910076447146257

2025-07-25 11:08:02 GMT

LLMs have been likened to "mansplaining as a service." Just for the record, that is not a good thing. #MLsec
https://www.theregister.com/2025/07/24/ai_is_overconfident_does_not_learn_study/

2025-07-18 00:56:25 GMT

This #AI business disaster story is a hilarious as it is pathetic.
#MLsec
https://www.bankinfosecurity.com/ai-boss-fails-spectacularly-in-month-long-business-test-a-28862

2025-07-15 13:05:15 GMT

Sometimes real world #MLsec is about standard issue things like key management. Very easy to screw the whole thing up.
https://krebsonsecurity.com/2025/07/doge-denizen-marko-elez-leaked-api-key-for-xai/

2025-07-14 12:20:13 GMT

In case you wondered how peer review is going. It's going like this...
https://www.theguardian.com/technology/2025/jul/14/scientists-reportedly-hiding-ai-text-prompts-in-academic-papers-to-receive-positive-peer-reviews

2025-06-12 14:51:47 GMT

Republicans can't do one damn thing right...
https://www.theregister.com/2025/06/10/trump_admin_leak_government_ai_plans/

2025-06-12 12:38:57 GMT

How has AI changed software development? What does that mean for software security? Liav Caspi (CTO, Legit) and I talk about this at some length.
#appsec #swsec #MLsec #infosec #security #ML #AI
Have a watch
https://berryvilleiml.com/2025/06/12/legit-webinar-swsec-appsec-meets-ai-development/

2025-06-11 12:26:27 GMT

- reply

note that monetization and real cognitive breakthroughs are not correlated. The current crop of LLMs, warts, mistakes and all are good enough to disrupt many human activities profitably.

2025-06-11 12:06:41 GMT

In my view, this means AI monetization is going well. Putting up more sail...
https://www.wsj.com/articles/nvidia-and-perplexity-team-up-in-european-ai-push-da2820fa

2025-05-25 11:55:44 GMT

Why so much prompt injection in AI? 1. We don't follow the security engineering design principle "economy of mechanism," and 2, input to LLMs mixes control and data with impunity. We know better. #MLsec #infosec #security
https://www.darkreading.com/vulnerabilities-threats/llms-on-rails-design-engineering-challenges

2025-05-19 03:04:35 GMT

- reply

AI can't be tuned to teach as well as a human teacher.

2025-05-18 12:57:20 GMT

This notion that early-career coders can be replaced by AI is wrong. Nobody is thinking about maintaining software or the architectural disaster to come when inscrutable code that mostly works is all over the codebase. And it's real..."early-career coders have been hit especially hard because much of what they do can now be done by AI."
I recommend hiring junior humans over AI. Still. Just tool them up.
#ML #AI #MLsec #swsec
https://www.wsj.com/lifestyle/careers/tech-jobs-hiring-artifical-intelligence-35cd66b0

2025-04-25 13:41:30 GMT

One person's data pollution is another person's data gold. As long as we have next to zero insight into the immense training data sets used by LLMs this will happen again and again. Data protection fail groundhog day. #ML #AI #MLsec #security
https://www.darkreading.com/cyberattacks-data-breaches/deepseek-breach-opens-floodgates-dark-web

2025-04-23 13:20:22 GMT

Benchmarks as popularity contests don't work. There are lots of other reasons that benchmarks have become almost worthless in #AI. In particular #ML benchmark as badnessometer comes to mind. #MLsec
https://techcrunch.com/2025/04/22/crowdsourced-ai-benchmarks-have-serious-flaws-some-experts-say/

2025-04-18 23:42:28 GMT

- reply

when romey sold her house, it was my great pleasure to call those guys and cancel the service

2025-04-13 13:21:48 GMT

- reply

conflating academics with monetary elites seems to be standard-issue populism. In a sense academics are intellectual elites. Which implies that hoarding (and lording) ideas is just as bad as hoarding money.

2025-04-10 22:42:44 GMT

This coverage of COT in ML is misleadingly anthropomorphic. Have we really lost track of how these things work? Just because we call something "chain of thought" that doesn't make it ACTUAL chain of thought. Anthropic has always done this. #MLsec
And this is a usually excellent reporter falling prey to the nomenclature.
https://arstechnica.com/ai/2025/04/researchers-concerned-to-find-ai-models-hiding-their-true-reasoning-processes/?utm_brand=arstechnica&utm_social-type=owned&utm_source=mastodon&utm_medium=social

2025-04-08 18:30:22 GMT

Welp, I caught the BIML Bibliography up to 2024. LOL. A labor of love, that's for sure. Only three more months of papers to enter...
We keep track of the #MLsec field by reading the science so you don't have to.
See our "top 5 papers" list to get started.
#ML #AI #security #infosec
https://berryvilleiml.com/bibliography/

2025-03-31 18:08:12 GMT

- reply

I spoke to the IU Luddy dean this afternoon. The only thing I learned definitively is this:
The Xioafeng Wang situation is not an ICE or immigration issue. It is an FBI matter.

2025-03-31 15:43:14 GMT

GenAI is so expensive that some (foundation model building) companies will not survive. This is a major cause of technical lock in...scientific exploration of the space is incredibly expensive.
Who can do A/B testing when it is that expensive?
#MLsec #ML #AI
https://www.theregister.com/2025/03/31/llm_providers_extinction/

2025-03-31 14:46:39 GMT

- reply

slated a call with the administration (of IU) for this afternoon.

2025-03-30 20:55:56 GMT

Good writeup on the mysterious disappearance of Xioafeng Wang. As a member of the Luddy school Dean's Advisory Council since the school's founding, I am surprised and appalled by the stonewalling from Indiana University.
https://arstechnica.com/security/2025/03/computer-scientist-goes-silent-after-fbi-raid-and-purging-from-university-website/

2025-03-29 16:50:44 GMT

- reply

I emailed the dean (I am on the school's advisory board) asking what's going on.

2025-03-19 00:04:19 GMT

Plutocracy loves big tech. The FTC has played an essential role in keeping big tech in line (kinda), but that has come to a stop under the Plutocratic Republicans.
https://www.wired.com/story/federal-trade-commission-removed-blogs-critical-of-ai-amazon-microsoft/

2025-03-14 11:20:40 GMT

- reply

paging [@Mer__edith](https://mastodon.world/@Mer__edith )

2025-03-05 13:46:22 GMT

Turns out that you can automate being wrong. It's easy! #MLsec
https://www.404media.co/ai-lawyer-hallucination-sanctions/

2025-02-28 19:12:54 GMT

Once again I am disgusted to be an American citizen. Republicans, this shit is on you. Trump is exactly what you idiots deserve---a complete buffoon. Slava Ukraini.
https://cdn.masto.host/sigmoidsocial/media_attachments/files/114/083/100/339/091/121/original/62b00d29dea9cf3e.mp4

2025-02-17 12:46:57 GMT

"No matter how many times Stalin told his scientists to plant wheat in the snow so that it could evolve to grow in the winter, the wheat (which had no political allegiances) died."
https://www.theatlantic.com/ideas/archive/2025/02/career-civil-servant-end/681712/

2025-02-14 22:18:16 GMT

- reply

I get to go apologize to the French in person on Monday.

2025-02-14 21:41:29 GMT

Embarrassed to be an American...again. These buffoons are simple-minded bullies. Sorry Europe.
https://www.theguardian.com/us-news/2025/feb/14/jd-vance-stuns-munich-conference-with-blistering-attack-on-europes-leaders

2025-01-29 14:10:10 GMT

We are so deep into data feudalism that even the plagerizers are whining. #MLsec
https://www.bloomberg.com/news/articles/2025-01-29/microsoft-probing-if-deepseek-linked-group-improperly-obtained-openai-data
https://www.lawfaremedia.org/article/why-the-data-ocean-is-being-sectioned-off

2025-01-24 00:25:54 GMT

Unleashing AI. So much for #MLsec. It's all up to us now.
https://www.whitehouse.gov/presidential-actions/2025/01/removing-barriers-to-american-leadership-in-artificial-intelligence/

2025-01-16 12:55:56 GMT

Can governments control #AI? Are they powerful enough to rein in enormous tech companies? BIML is proud to play a critical independent role in #MLsec. Hopefully what we're doing matters. Sometimes it's hard to tell.
https://time.com/7204670/uk-ai-safety-institute/

2025-01-14 11:36:36 GMT

Building Security In is going well
https://cdn.masto.host/sigmoidsocial/media_attachments/files/113/826/502/082/649/347/original/a14a5719da391529.png

2025-01-06 17:43:14 GMT

I hate to tell you, but the ML/AI benchmarks are really no measure of intelligence. #MLsec
https://arstechnica.com/information-technology/2025/01/sam-altman-says-we-are-now-confident-we-know-how-to-build-agi/

2024-12-27 13:44:15 GMT

OpenAI corporate maneuvers continue #ML OpenAI Details Plans for Becoming a For-Profit Company https://www.nytimes.com/2024/12/27/technology/openai-public-benefit-corporation.html

2024-12-03 02:21:24 GMT

Just ridiculous. This is not security. This is not privacy. This is simply kludge.
#MLsec
https://arstechnica.com/information-technology/2024/12/certain-names-make-chatgpt-grind-to-a-halt-and-we-know-why/

2024-12-01 15:18:07 GMT

How to break search with ML.
"Though OpenAI emphasizes its ability to provide users “timely answers with links to relevant web sources,” the company makes no explicit commitment to ensuring the accuracy of those citations." #MLsec
https://www.cjr.org/tow_center/how-chatgpt-misrepresents-publisher-content.php

2024-11-22 00:13:13 GMT

Spent lot of time today cleaning up the BIML Bibliography. Trying to make the labels consistent. Please check it out.
#MLsec #ML #security
https://berryvilleiml.com/bibliography/

2024-11-17 15:39:28 GMT

I wrote this 11 years ago. I was not expecting the US government to take a turn towards authoritarianism.
Gary McGraw: NSA data collection programs demand discussion, scrutiny
https://web.archive.org/web/20130622071019/https://searchsecurity.techtarget.com/opinion/Gary-McGraw-NSA-data-collection-programs-demand-discussion-scrutiny

2024-11-11 12:51:58 GMT

ImageNet and data as driver in ML #MLsec
It's the data, stupid.
https://arstechnica.com/ai/2024/11/how-a-stubborn-computer-scientist-accidentally-launched-the-deep-learning-boom/?utm_brand=arstechnica&utm_social-type=owned&utm_source=mastodon&utm_medium=social

2024-10-25 11:02:03 GMT

Excellent reporting by @npub1z3l…qvzu
https://arstechnica.com/information-technology/2024/10/phone-tracking-tool-lets-government-agencies-follow-your-every-move/

2024-10-18 12:12:45 GMT

Why did Leon really buy Twitter? For the data. #MLsec #datafeudalism
https://www.lawfaremedia.org/contributors/gmcgraw
https://cdn.masto.host/sigmoidsocial/media_attachments/files/113/328/359/633/494/852/original/32a034c778e1f2d1.png
https://cdn.masto.host/sigmoidsocial/media_attachments/files/113/328/359/804/656/438/original/99717513a4a7f9f1.png

2024-09-10 16:49:46 GMT

Dear London based CISOs and senior security execs, I am going to be hosting a small #MLsec event in early October. Please ping me directly if you are interested and I will put you in touch with the organizers.
#ML #security #infosec #ciso
(Appreciate help with reach...)

2024-09-04 19:40:48 GMT

OK. Finally caught up with the BIML Bibliography through September.
Our motto might be "we read these papers so you don't have to." LOL.
More seriously, do you want to get started in #MLsec? Then see our TOP5 and the other few hundred annotated papers!
https://berryvilleiml.com/bibliography/

2024-08-30 21:21:08 GMT

Lots of computer security stuff on reel 2. Grace Hopper. #infosec #security
https://youtu.be/AW7ZHpKuqZg?feature=shared

2024-08-04 12:23:29 GMT

I do not believe this pretend "anti-cheating" technology (through watermarking) can be made useful. Armchair analysis by reporters and OpenAI insiders is not the same as good security engineering. More ML bullshit. #MLsec #ML #AI #security
https://www.wsj.com/articles/openai-tool-chatgpt-cheating-writing-135b755a?utm_source=press.coop