$

Hello, world

1 min read

I have spent the last two years training models on security data — network captures from medical devices, phishing URLs, documents fed into a retrieval system. Most of what I learned in that time never made it out of a notebook or a thesis draft. This site is where I fix that.

What goes here

Three kinds of posts, roughly:

  • Working notes. The thing I tried, the number it produced, and whether I believed the number. Failed experiments count — they are usually the more useful half.
  • Explanations. Methods I had to read three papers to understand, written the way I wish someone had written them for me.
  • Build logs. Shipping a RAG platform to production taught me more about retrieval than any benchmark did. That kind of thing.

What will not be here: tutorials rewritten from documentation, or benchmark numbers without the setup that produced them.

On numbers

Every accuracy figure I publish comes with the dataset, the split, and the class balance. This matters more in security than almost anywhere else, because the interesting class is always the rare one:

# An "accurate" model on a realistic intrusion dataset.
attacks = 1_000
benign  = 99_000

predict_benign_always = benign / (benign + attacks)
print(f"{predict_benign_always:.3f}")  # 0.990 — and it catches nothing

Ninety-nine percent accuracy, zero detections. So when I write down 0.97, I will also write down what it was measured against, and what it looked like on the minority class.

Elsewhere

The code behind most of what I write about is on GitHub. If something here is wrong or unclear, my inbox is open — the address is on the about page.