技术方向
让 AI 可控、可信、不被滥用：越狱与防御、模型行为研究、安全评测与治理框架。
22 条精选近 30 天 21 条共收录 91 条
Google DeepMind 发布 SynthID Bio，把水印技术引入合成生物学，将不可感知的签名嵌入生物代码，在实验室测试中保持蛋白质生物功能不变。该方法针对序列微调氨基酸选择、针对 3D 结构调整原子坐标，并在 AlphaFold 3 扩散网络中微调部分权重，使预测坐标自带可检测签名。
推荐理由：Google DeepMind 把 SynthID 水印扩展到合成生物学，读者可了解其在蛋白质设计与结构预测中的嵌入方式及生物安全用途。
Andrej Karpathy@karpathy精选AI 评分7272🚨 CRITICAL: Active supply chain attack on axios -- one of npm's most depended-on packages. The latest axios@1.14.1 now pulls in plain-crypto-js@4.2.1, a package that did not exist before today. This is a live compromise. This is textbook supply chain installer malware. axios has 100M+ weekly downloads. Every npm install pulling the latest version is potentially compromised right now. Socket AI analysis confirms this is malware. plain-crypto-js is an obfuscated dropper/loader that: • Deobfuscates embedded payloads and operational strings at runtime • Dynamically loads fs, os, and execSync to evade static analysis • Executes decoded shell commands • Stages and copies payload files into OS temp and Windows ProgramData directories • Deletes and renames artifacts post-execution to destroy forensic evidence If you use axios, pin your version immediately and audit your lockfiles. Do not upgrade.
推荐理由：作者以自身系统排查为例，说明未锁定版本的依赖如何让一次投毒扩散到普通用户。