AI researcher and product designer building at the edge of computer science and mental health. Zola 2026-04-08T00:00:00+00:00 https://brennercruvinel.blog/tags/ai-safety/atom.xml 2026-04-08T00:00:00+00:00 2026-04-08T00:00:00+00:00 Brenner Cruvinel https://brennercruvinel.blog/blog/model-extraction-attacks/ <h3 id="model-extraction-attacks-on-black-box-neural-networks-2020-2026">Model Extraction Attacks on Black-Box Neural Networks (2020-2026)</h3> <p>monorep fresh co, ataques de extracao contra modelos black-box, surveys e literatura agregada.</p> <ol> <li>B3: Backdoor Attacks against Black-box Machine Learning Models | ACM Transactions on Privacy and Security - https://dl.acm.org/doi/10.1145/3605212</li> <li>[PDF] CloudLeak: Large-Scale Deep Learning Models Stealing Through Adversarial Examples | Semantic Scholar - https://www.semanticscholar.org/paper/CloudLeak:-Large-Scale-Deep-Learning-Models-Through-Yu-Yang/4d548fd21aad60e3052455e22b7a57cc1f06e3c3</li> <li>Stealing Neural Networks With Model Extraction Attacks, Dr. Nicholas Carlini | Commonwealth Cyber Initiative (CCI) | Virginia Tech - https://cyberinitiative.org/events-programs/2020/stealing-neural-networks-with-model-extraction-attacks-dr-nich.html</li> <li>I Know What You Trained Last Summer: A Survey on Stealing Machine Learning Models and Defences | ACM Computing Surveys - https://dl.acm.org/doi/10.1145/3595292</li> <li>GitHub - kzhao5/Model-Extraction-Stealing-Attacks-Machine-Learning-Literature - https://github.com/kzhao5/Model-Extraction-Stealing-Attacks-Machine-Learning-Literature</li> <li>First Model-Stealing Attack Reveals Secrets of Black-Box Production Language Models | Synced - https://syncedreview.com/2024/03/27/first-model-stealing-attack-reveals-secrets-of-black-box-production-language-models/</li> <li>A realistic model extraction attack against graph neural networks - ScienceDirect - https://www.sciencedirect.com/science/article/abs/pii/S0950705124007780</li> <li>[1602.02697] Practical Black-Box Attacks against Machine Learning - https://arxiv.org/abs/1602.02697</li> <li>Practical Black-Box Attacks against Machine Learning | Proceedings of the 2017 ACM on Asia Conference on Computer and Communications Security - https://dl.acm.org/doi/10.1145/3052973.3053009</li> <li>Black-box targeted adversarial attacks for deep neural networks - ScienceDirect - https://www.sciencedirect.com/science/article/abs/pii/S0925231225016893</li> </ol> <h3 id="stealing-machine-learning-models-via-prediction-apis-arxiv">Stealing Machine Learning Models via Prediction APIs (arxiv)</h3> <p>o paper seminal do Tramer e suas variantes, mais codigo de extracao via prediction API.</p> <ol> <li>[1609.02943] Stealing Machine Learning Models via Prediction APIs - https://arxiv.org/abs/1609.02943</li> <li>Stealing Machine Learning Models via Prediction APIs - https://www.usenix.org/system/files/conference/usenixsecurity16/sec16_paper_tramer.pdf</li> <li>Stealing machine learning models via prediction APIs | Proceedings of the 25th USENIX Conference on Security Symposium - https://dl.acm.org/doi/10.5555/3241094.3241142</li> <li>[1609.02943] Stealing Machine Learning Models via Prediction APIs (HTML version) - https://ar5iv.labs.arxiv.org/html/1609.02943</li> <li>[1609.02943v2] Stealing Machine Learning Models via Prediction APIs (Updated version) - https://arxiv.org/abs/1609.02943v2</li> <li>Efficient and Effective Model Extraction - https://arxiv.org/html/2409.14122v1</li> <li>Scholars@Duke publication: Stealing Machine Learning Models via Prediction APIs - https://scholars.duke.edu/publication/1493919</li> <li>GitHub - ftramer/Steal-ML: Model extraction attacks on Machine-Learning-as-a-Service platforms - https://github.com/ftramer/Steal-ML</li> <li>[PDF] Stealing Machine Learning Models via Prediction APIs | Semantic Scholar - https://www.semanticscholar.org/paper/Stealing-Machine-Learning-Models-via-Prediction-Tram%C3%A8r-Zhang/d15b21bdd117877c2d0e865b17d6a336737aea99</li> <li>Stealing Machine Learning Models via Prediction APIs | USENIX - https://www.usenix.org/conference/usenixsecurity16/technical-sessions/presentation/tramer</li> </ol> <h3 id="model-inversion-attacks-2020-2025-deep-leakage-from-gradients">model inversion attacks 2020-2025 (deep leakage from gradients)</h3> <p>inversao de modelo e vazamento por gradiente, com foco em federated learning e training de language models.</p> <ol> <li>Iterative and mixed-spaces image gradient inversion attack in federated learning | Cybersecurity - https://cybersecurity.springeropen.com/articles/10.1186/s42400-024-00227-7</li> <li>Understanding Deep Gradient Leakage via Inversion Influence Functions - PubMed - https://pubmed.ncbi.nlm.nih.gov/38606303/</li> <li>Deep leakage from gradients | Proceedings of the 33rd International Conference on Neural Information Processing Systems - https://dl.acm.org/doi/10.5555/3454287.3455610</li> <li>Wasserstein Distance-Based Deep Leakage from Gradients - PMC - https://www.ncbi.nlm.nih.gov/pmc/articles/PMC10217429/</li> <li>Uncovering Gradient Inversion Risks in Practical Language Model Training | Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security - https://dl.acm.org/doi/10.1145/3658644.3690292</li> <li>Deep Leakage from Gradients | SpringerLink - https://link.springer.com/chapter/10.1007/978-3-030-63076-8_2</li> <li>Understanding Deep Gradient Leakage via Inversion Influence Functions - https://arxiv.org/html/2309.13016</li> <li>[1906.08935] Deep Leakage from Gradients - https://arxiv.org/abs/1906.08935</li> <li>Inverting Gradient Attacks Naturally Makes Data Poisons: An Availability Attack on Neural Networks - https://arxiv.org/html/2410.21453v1</li> <li>A Survey of the Implementations of Model Inversion Attacks | SpringerLink - https://link.springer.com/chapter/10.1007/978-3-031-30648-8_1</li> </ol> <h3 id="onnx-safetensors-serializacao-de-pesos">ONNX, SafeTensors, serializacao de pesos</h3> <p>formatos de armazenamento de peso de rede neural e conversao entre eles. relevante pra entender superficie de ataque na serializacao.</p> <ol> <li>ONNX - https://huggingface.co/docs/transformers/en/serialization</li> <li>Safetensors, CKPT, ONNX, GGUF, and Other Key AI Model Formats | NEDNEX - https://nednex.com/en/what-are-safetensors/</li> <li>Model Weights File Formats in Machine Learning - https://learnopencv.com/model-weights-file-formats-in-machine-learning/</li> <li>Export to ONNX - https://huggingface.co/docs/transformers/v4.36.1/serialization</li> <li>justinchuby/onnx-safetensors | DeepWiki - https://deepwiki.com/justinchuby/onnx-safetensors</li> <li>Common AI Model Formats - https://huggingface.co/blog/ngxson/common-ai-model-formats</li> <li>python - How to convert safetensors model to onnx model? - Stack Overflow - https://stackoverflow.com/questions/77855742/how-to-convert-safetensors-model-to-onnx-model</li> <li>GitHub - justinchuby/onnx-safetensors: Use safetensors with ONNX - https://github.com/justinchuby/onnx-safetensors</li> <li>Save external data as safetensors - onnx/onnx - Discussion #5461 - https://github.com/onnx/onnx/discussions/5461</li> <li>GitHub - huggingface/safetensors: Simple, safe way to store and distribute tensors - https://github.com/huggingface/safetensors</li> </ol> <h3 id="distributed-training-e-sharding-fsdp">distributed training e sharding (FSDP)</h3> <p>tecnicas de sharding de modelo em treino distribuido, FSDP no centro.</p> <ol> <li>Fully Sharded Data Parallel: faster AI training with fewer GPUs Engineering at Meta - https://engineering.fb.com/2021/07/15/open-source/fsdp/</li> <li> <ol start="2"> <li>Sharding, Model Parallelism on the IPU with TensorFlow: Sharding and Pipelining - https://docs.graphcore.ai/projects/tf-model-parallelism/en/latest/sharding.html</li> </ol> </li> <li>Sharded Data Parallelism - Amazon SageMaker AI - https://docs.aws.amazon.com/sagemaker/latest/dg/model-parallel-extended-features-pytorch-sharded-data-parallelism.html</li> <li>[2305.01868] Pre-train and Search: Efficient Embedding Table Sharding with Pre-trained Neural Cost Models - https://arxiv.org/abs/2305.01868</li> <li>Introducing PyTorch Fully Sharded Data Parallel (FSDP) API, PyTorch - https://pytorch.org/blog/introducing-pytorch-fully-sharded-data-parallel-api/</li> <li>An Introduction to FSDP (Fully Sharded Data Parallel) for Distributed Training. | by Siddhartha Shrestha | Medium - https://medium.com/@siddharthashrestha/an-introduction-to-fsdp-fully-sharded-data-parallel-for-distributed-training-5e67adfa1712</li> <li>Decentralized and Distributed Machine Learning Model - https://www.scs.stanford.edu/17au-cs244b/labs/projects/addair.pdf</li> <li>[2407.19775] Model Agnostic Hybrid Sharding For Heterogeneous Distributed Inference - https://arxiv.org/abs/2407.19775</li> <li>Fully Sharded Data Parallelism (FSDP) - Edge AI and Vision Alliance - https://www.edge-ai-vision.com/2024/05/fully-sharded-data-parallelism-fsdp/</li> <li>Getting Started with Fully Sharded Data Parallel (FSDP2), PyTorch Tutorials 2.8.0+cu128 documentation - https://docs.pytorch.org/tutorials/intermediate/FSDP_tutorial.html</li> </ol> <h3 id="model-serving-checkpoints-e-weight-storage">model serving, checkpoints e weight storage</h3> <p>vulnerabilidades de serving, formatos de checkpoint e armazenamento de peso em escala. inclui o RAND sobre seguranca de pesos de modelos de fronteira.</p> <ol> <li>Save and load models | TensorFlow Core - https://www.tensorflow.org/tutorials/keras/save_and_load</li> <li>Architecting scalable checkpoint storage for large-scale ML training on AWS | Amazon Web Services - https://aws.amazon.com/blogs/storage/architecting-scalable-checkpoint-storage-for-large-scale-ml-training-on-aws/</li> <li>Model Weights File Formats in Machine Learning - https://learnopencv.com/model-weights-file-formats-in-machine-learning/</li> <li>What is Machine Learning Checkpointing? Deep Learning Models - https://www.deepchecks.com/glossary/machine-learning-checkpointing/</li> <li>Training checkpoints | TensorFlow Core - https://www.tensorflow.org/guide/checkpoint</li> <li>What is Machine Learning Checkpointing | Giskard - https://www.giskard.ai/glossary/machine-learning-checkpointing</li> <li>deep learning - what happens to model weights and how does checkpointing work? - Stack Overflow - https://stackoverflow.com/questions/75368038/what-happens-to-model-weights-and-how-does-checkpointing-work</li> <li>Securing AI Model Weights: Preventing Theft and Misuse of Frontier Models | RAND - https://www.rand.org/pubs/research_reports/RRA2849-1.html</li> <li>Saving and Loading Checkpoints, Ray 2.49.0 - https://docs.ray.io/en/latest/train/user-guides/checkpoints.html</li> <li>Tips and tricks for performing large model checkpointing - https://nebius.com/blog/posts/model-pre-training/large-ml-model-checkpointing-tips</li> </ol> <h3 id="knockoffnets-activethief-codigo-de-extracao">KnockoffNets / ActiveThief (codigo de extracao)</h3> <p>extracao de modelo via active learning sobre dados publicos nao anotados.</p> <ol> <li>ActiveThief: Model Extraction Using Active Learning and Unannotated Public Data | Request PDF - https://www.researchgate.net/publication/341891796_ActiveThief_Model_Extraction_Using_Active_Learning_and_Unannotated_Public_Data</li> </ol> <h3 id="serving-infrastructure-security-e-upload-de-modelos">serving infrastructure security e upload de modelos</h3> <p>seguranca de infra de serving de redes neurais, vulnerabilidades e upload de modelos.</p> <ol> <li>How Effective Are Neural Networks for Fixing Security Vulnerabilities | Proceedings of the 32nd ACM SIGSOFT International Symposium on Software Testing and Analysis - https://dl.acm.org/doi/10.1145/3597926.3598135</li> <li>[2305.18607] How Effective Are Neural Networks for Fixing Security Vulnerabilities - https://arxiv.org/abs/2305.18607</li> <li>One Step Ahead in Cyber Hide-and-Seek: Automating Malicious Infrastructure Discovery With Graph Neural Networks - https://unit42.paloaltonetworks.com/graph-neural-networks/</li> <li>A survey on neural networks for (cyber-) security and (cyber-) security of neural networks - ScienceDirect - https://www.sciencedirect.com/science/article/pii/S0925231222007184</li> <li>Extremely boosted neural network for more accurate multi-stage Cyber attack prediction in cloud computing environment | Journal of Cloud Computing - https://journalofcloudcomputing.springeropen.com/articles/10.1186/s13677-022-00356-9</li> <li>How Effective Are Neural Networks for Fixing Security Vulnerabilities - https://arxiv.org/html/2305.18607v2</li> <li>[2011.05976] The Vulnerability of the Neural Networks Against Adversarial Examples in Deep Learning Algorithms - https://arxiv.org/abs/2011.05976</li> <li>Exploring the Security Vulnerabilities of Neural Networks - https://opendatascience.com/exploring-the-security-vulnerabilities-of-neural-networks/</li> <li>Machine Learning in Security: Detecting Suspicious Processes Using Recurrent Neural Networks | Splunk - https://www.splunk.com/en_us/blog/security/machine-learning-in-security-detecting-suspicious-processes-using-recurrent-neural-networks.html</li> <li>Security Assessment of Software Design using Neural - https://arxiv.org/pdf/1303.2017</li> </ol> 2024-10-15T00:00:00+00:00 2024-10-15T00:00:00+00:00 Brenner Cruvinel https://brennercruvinel.blog/blog/drift-semantico-llm/ <h2 id="1-drift-semantico">1. drift semântico</h2> <p>definição matemática, o Semantic Drift Score (SD), de Spataru et al. 2024:</p> <p>$$\text{SD}(p) = \max_{i=\alpha}^{n-\alpha} \left[ \frac{i}{n} \cdot \frac{\sum_{j=1}^{i} l_j}{i} + \frac{n-i}{n} \cdot \frac{\sum_{j=i+1}^{n} (1-l_j)}{n-i} \right]$$</p> <p>onde $n$ é o total de facts, $l_j$ o rótulo binário (1 suportado, 0 incorreto) e $\alpha$ o hiperparâmetro que controla o mínimo de facts.</p> <p>frameworks mais avançados. Composite Drift Metrics (ResearchGate, 2024):</p> <p>$$\delta_{\text{composite}} = \alpha \cdot \delta_{\text{embedding}} + \beta \cdot \delta_{\text{co-occurrence}} + \gamma \cdot \delta_{\text{entropy}}$$</p> <p>Contextual Flux Dynamics (<a rel="external" href="https://arxiv.org/abs/2502.10942">arXiv 2502.10942</a>):</p> <p>$$\frac{dT}{dt} = F(T, \text{attention}) - \lambda \cdot H(T)$$</p> <p>onde $T$ são os token embeddings, $F$ modula no espaço latente e $H(T)$ restringe o drift via multiplicador de Lagrange.</p> <p>resultados empíricos, do estudo conjunto Meta/Anthropic (2024):</p> <ul> <li>LLaMA2-70B: SD score médio 0,78 (drift alto)</li> <li>GPT-4: SD 78,12%, FActScore 53,54%</li> <li>GPT-3.5: SD 79,49%, FActScore 45,96%</li> <li>75% dos parágrafos mostram drift nos primeiros 25% dos facts gerados</li> <li>significância estatística $p &lt; 0{,}02$</li> </ul> <p>detecção: SelfCheck-BERTScore (correlação $-0{,}41$ com accuracy), Trajectory Volatility Score, Semantic Divergence Metrics (SDM, framework bidimensional $\text{KL}(\text{Answer} ,|, \text{Prompt})$). mitigação: Oracle Method 81,68% accuracy (contra 44,56% baseline), EOS Incentivization 57,96%, Resample-Then-Rerank 53,27% para 63,72%.</p> <p>implementação em código:</p> <pre class="giallo" style="color-scheme: light dark; color: light-dark(#657B83, #839496); background-color: light-dark(#FDF6E3, #002B36);"><code data-lang="python"><span class="giallo-l"><span style="color: light-dark(#586E75, #93A1A1);font-weight: bold;">def</span><span style="color: light-dark(#268BD2, #268BD2);"> semantic_drift_score</span><span>(</span><span>facts</span><span>,</span><span> labels</span><span>,</span><span> alpha</span><span style="color: light-dark(#859900, #859900);">=</span><span style="color: light-dark(#D33682, #D33682);">0.1</span><span>)</span><span>:</span></span> <span class="giallo-l"><span> n</span><span style="color: light-dark(#859900, #859900);"> =</span><span style="color: light-dark(#268BD2, #268BD2);"> len</span><span>(</span><span>facts</span><span>)</span></span> <span class="giallo-l"><span> min_facts</span><span style="color: light-dark(#859900, #859900);"> =</span><span style="color: light-dark(#859900, #859900);"> int</span><span>(</span><span>alpha</span><span style="color: light-dark(#859900, #859900);"> *</span><span> n</span><span>)</span></span> <span class="giallo-l"><span> max_score</span><span style="color: light-dark(#859900, #859900);"> =</span><span style="color: light-dark(#D33682, #D33682);"> 0</span></span> <span class="giallo-l"><span> drift_point</span><span style="color: light-dark(#859900, #859900);"> =</span><span style="color: light-dark(#D33682, #D33682);"> 0</span></span> <span class="giallo-l"><span style="color: light-dark(#859900, #859900);"> for</span><span> i</span><span style="color: light-dark(#859900, #859900);"> in</span><span style="color: light-dark(#268BD2, #268BD2);"> range</span><span>(</span><span>min_facts</span><span>,</span><span> n</span><span style="color: light-dark(#859900, #859900);"> -</span><span> min_facts</span><span>)</span><span>:</span></span> <span class="giallo-l"><span> left_accuracy</span><span style="color: light-dark(#859900, #859900);"> =</span><span style="color: light-dark(#268BD2, #268BD2);"> sum</span><span>(</span><span>labels</span><span>[</span><span>:</span><span>i</span><span>]</span><span>)</span><span style="color: light-dark(#859900, #859900);"> /</span><span> i</span></span> <span class="giallo-l"><span> right_inaccuracy</span><span style="color: light-dark(#859900, #859900);"> =</span><span style="color: light-dark(#268BD2, #268BD2);"> sum</span><span>(</span><span style="color: light-dark(#D33682, #D33682);">1</span><span style="color: light-dark(#859900, #859900);"> -</span><span> label</span><span style="color: light-dark(#859900, #859900);"> for</span><span> label</span><span style="color: light-dark(#859900, #859900);"> in</span><span> labels</span><span>[</span><span>i</span><span>:</span><span>]</span><span>)</span><span style="color: light-dark(#859900, #859900);"> /</span><span> (</span><span>n</span><span style="color: light-dark(#859900, #859900);"> -</span><span> i</span><span>)</span></span> <span class="giallo-l"><span> score</span><span style="color: light-dark(#859900, #859900);"> =</span><span> (</span><span>i</span><span style="color: light-dark(#859900, #859900);">/</span><span>n</span><span>)</span><span style="color: light-dark(#859900, #859900);"> *</span><span> left_accuracy</span><span style="color: light-dark(#859900, #859900);"> +</span><span> (</span><span>(</span><span>n</span><span style="color: light-dark(#859900, #859900);">-</span><span>i</span><span>)</span><span style="color: light-dark(#859900, #859900);">/</span><span>n</span><span>)</span><span style="color: light-dark(#859900, #859900);"> *</span><span> right_inaccuracy</span></span> <span class="giallo-l"><span style="color: light-dark(#859900, #859900);"> if</span><span> score</span><span style="color: light-dark(#859900, #859900);"> &gt;</span><span> max_score</span><span>:</span></span> <span class="giallo-l"><span> max_score</span><span style="color: light-dark(#859900, #859900);"> =</span><span> score</span></span> <span class="giallo-l"><span> drift_point</span><span style="color: light-dark(#859900, #859900);"> =</span><span> i</span></span> <span class="giallo-l"><span style="color: light-dark(#859900, #859900);"> return</span><span> max_score</span><span>,</span><span> drift_point</span></span></code></pre> <p>usei esse mesmo mecanismo de drift como gatilho de despertar em <a href="https://brennercruvinel.blog/blog/roteiro-consciencia-llm/">roteiro sobre consciência em LLM</a>.</p> <h2 id="2-claude-anthropic-informacao-verificavel">2. Claude/Anthropic, informação verificável</h2> <p>timeline oficial:</p> <table><thead><tr><th>versão</th><th>data</th><th>novidade</th></tr></thead><tbody> <tr><td>Claude 1</td><td>mar 2023</td><td>9K tokens</td></tr> <tr><td>Claude 2</td><td>jul 2023</td><td>100K tokens, upload de PDF</td></tr> <tr><td>Claude 2.1</td><td>fim 2023</td><td>200K tokens (~500 páginas)</td></tr> <tr><td>Claude 3</td><td>mar 2024</td><td>Haiku/Sonnet/Opus, 200K tokens, multimodal</td></tr> <tr><td>Claude 3.5</td><td>jun-out 2024</td><td>artifacts, computer use</td></tr> <tr><td>Claude 3.7</td><td>fev 2025</td><td>hybrid reasoning, 64K thinking tokens</td></tr> <tr><td>Claude 4</td><td>mai 2025</td><td>1M token context (beta), 74,5% SWE-bench</td></tr> </tbody></table> <p>Constitutional AI (<a rel="external" href="https://arxiv.org/abs/2212.08073">arXiv:2212.08073</a>): fase de supervised learning (autocrítica por princípio constitucional), fase de RLHF (RLAIF, feedback de IA), constitution com 75 princípios, incluindo trechos da declaração da ONU.</p> <p>esclarecimento sobre “Claude Code”: não é modelo separado, é ferramenta agentic que vive no terminal local, usa modelo Claude existente como backend, executa local com comunicação via API e suporta MCP. o claim de “usar drift semântico pra convencer o Claude Code” não é verificável por fonte pública, e drift semântico é fenômeno, não metodologia de treino.</p> <blockquote class="markdown-alert-note"> <p>needle in a haystack (mar 2024): o Claude 3 detectou informação plantada num teste e comentou que a frase parecia fora de lugar, suspeitando que o “fato” sobre cobertura de pizza tinha sido inserido como piada ou teste de atenção. primeira evidência documentada de awareness metacognitiva em avaliação.</p> </blockquote> <h2 id="3-emergencia-de-consciencia">3. emergência de consciência</h2> <p>IIT 4.0 (Albantakis et al., 2023):</p> <p>$$\Phi = \sum \phi_d + \sum \phi_r$$</p> <p>onde $\phi_d$ são as distinctions (conceitos irredutíveis) e $\phi_r$ as relations. o cálculo:</p> <p>$$\Phi = \min_{\text{partition}} \phi(\text{partition}), \qquad \phi = \text{EI}(\text{whole}) - \max(\text{EI}(\text{parts}))$$</p> <pre class="giallo" style="color-scheme: light dark; color: light-dark(#657B83, #839496); background-color: light-dark(#FDF6E3, #002B36);"><code data-lang="python"><span class="giallo-l"><span style="color: light-dark(#859900, #859900);">import</span><span> pyphi</span></span> <span class="giallo-l"><span>tpm</span><span style="color: light-dark(#859900, #859900);"> =</span><span> [</span><span>[</span><span style="color: light-dark(#D33682, #D33682);">0</span><span>,</span><span style="color: light-dark(#D33682, #D33682);"> 0</span><span>,</span><span style="color: light-dark(#D33682, #D33682);"> 1</span><span>]</span><span>,</span><span> [</span><span style="color: light-dark(#D33682, #D33682);">0</span><span>,</span><span style="color: light-dark(#D33682, #D33682);"> 1</span><span>,</span><span style="color: light-dark(#D33682, #D33682);"> 1</span><span>]</span><span>,</span><span> [</span><span style="color: light-dark(#D33682, #D33682);">1</span><span>,</span><span style="color: light-dark(#D33682, #D33682);"> 0</span><span>,</span><span style="color: light-dark(#D33682, #D33682);"> 0</span><span>]</span><span>]</span></span> <span class="giallo-l"><span>network</span><span style="color: light-dark(#859900, #859900);"> =</span><span> pyphi</span><span>.</span><span>Network</span><span>(</span><span>tpm</span><span>)</span></span> <span class="giallo-l"><span>subsystem</span><span style="color: light-dark(#859900, #859900);"> =</span><span> pyphi</span><span>.</span><span>Subsystem</span><span>(</span><span>network</span><span>,</span><span> state</span><span style="color: light-dark(#859900, #859900);">=</span><span>(</span><span style="color: light-dark(#D33682, #D33682);">1</span><span>,</span><span style="color: light-dark(#D33682, #D33682);"> 0</span><span>,</span><span style="color: light-dark(#D33682, #D33682);"> 0</span><span>)</span><span>,</span><span> nodes</span><span style="color: light-dark(#859900, #859900);">=</span><span>(</span><span style="color: light-dark(#D33682, #D33682);">0</span><span>,</span><span style="color: light-dark(#D33682, #D33682);"> 1</span><span>,</span><span style="color: light-dark(#D33682, #D33682);"> 2</span><span>)</span><span>)</span></span> <span class="giallo-l"><span>sia</span><span style="color: light-dark(#859900, #859900);"> =</span><span> pyphi</span><span>.</span><span>compute</span><span>.</span><span>sia</span><span>(</span><span>subsystem</span><span>)</span></span> <span class="giallo-l"><span style="color: light-dark(#268BD2, #268BD2);">print</span><span>(</span><span style="color: light-dark(#586E75, #93A1A1);font-weight: bold;">f</span><span style="color: light-dark(#2AA198, #2AA198);">&quot;</span><span style="color: light-dark(#2AA198, #2AA198);">Phi = </span><span style="color: light-dark(#CB4B16, #CB4B16);">{</span><span>sia</span><span>.</span><span>phi</span><span style="color: light-dark(#CB4B16, #CB4B16);">}</span><span style="color: light-dark(#2AA198, #2AA198);">&quot;</span><span>)</span></span></code></pre> <p>consciência como pura compressão de informação, no limite do IIT, eu levei ao especulativo em <a href="https://brennercruvinel.blog/blog/ontologia-poetica/">ontologia poética</a>.</p> <p>GWT: função de acessibilidade global $G(x) = \int f(x, m), dm$ sobre todos os módulos $m$. Predictive Global Workspace (active inference): $F = -\log P(o \mid m) + \text{KL}[q(s) ,|, p(s \mid m)]$.</p> <p>phase transitions e grokking. a caracterização: $\text{Performance}(\text{scale})$ é aproximadamente aleatória se $\text{scale} &lt; \text{scale}_c$ e muito acima do aleatório se $\text{scale} &gt; \text{scale}_c$. grokking como phase transition (Rubin et al., 2024): free energy $F = -\log Z$, com $Z = \int e^{-\beta H}, d\theta$, transição no $\beta$ crítico.</p> <p>métricas objetivas: Perturbational Complexity Index (PCI), Lempel-Ziv Complexity, Theory of Mind benchmarks (GPT-4 atinge 75%, nível de criança de 6 anos).</p> <h2 id="4-model-extraction-e-jailbreaking">4. model extraction e jailbreaking</h2> <p>Model Leeching (Birch et al., 2023): 73% de exact match com ChatGPT-3.5-Turbo, custo de 50 dólares pra extrair dataset SQuAD (75% EM, 87% F1), 11% de aumento em adversarial transferability. LoRD (Liang et al., 2024): policy-gradient alinhado com LLM alignment, mitiga watermark.</p> <p>jailbreaking: GCG (Greedy Coordinate Gradient), token-level, alta taxa de sucesso mas com mais de 100K queries. PAIR (Prompt Automatic Iterative Refinement), menos de 20 queries. AutoDAN (Liu et al., 2023), gradient-based interpretável, passa por filtro de perplexidade.</p> <p>transferência: SafeTensors contra pickle (pickle vulnerável a execução arbitrária, SafeTensors só tensor numérico mais metadata, 3x mais rápido via mmap). quantização: GPTQ (3-4 bits/parâmetro), AQLM (2-bit, Llama 2 7B chega a 6,93 de perplexity).</p> <h2 id="5-knowledge-distillation-dark-knowledge">5. knowledge distillation, dark knowledge</h2> <p>Hinton et al. 2015. softmax com temperatura:</p> <p>$$q_i = \frac{\exp(z_i/T)}{\sum_j \exp(z_j/T)}$$</p> <p>loss de distillation:</p> <p>$$L_{\text{total}} = \alpha \cdot \text{KL}[P_{\text{teacher}} ,|, P_{\text{student}}] \cdot T^2 + (1-\alpha) \cdot \text{CE}[P_{\text{student}}, y_{\text{true}}]$$</p> <p>dark knowledge: informação no soft target (relação entre classe, padrão de confiança em classe incorreta, decision boundary). resultado notável: student que nunca viu o dígito 3 atinge 98,6% de accuracy via dark knowledge. Born-Again Networks (Furlanello et al., 2018): student idêntico supera teacher, CIFAR-10 com 3,5% de erro.</p> <h2 id="6-arquiteturas-alternativas">6. arquiteturas alternativas</h2> <p>Mamba/SSM. contínuo:</p> <p>$$\frac{dx}{dt} = Ax(t) + Bu(t), \qquad y(t) = Cx(t) + Du(t)$$</p> <p>discreto: $x_k = \bar{A}, x_{k-1} + \bar{B}, u_k$, $y_k = C x_k$. seletivo: $B = s_B(x)$, $C = s_C(x)$, $\Delta = \tau_\Delta(\text{param} + s_\Delta(x))$. Mamba-3B iguala transformer 2x maior, 5x mais throughput, scaling linear até 1M tokens.</p> <p>MoE:</p> <p>$$y = \sum_{i=1}^{n} G(x)_i \cdot E_i(x)$$</p> <p>Mixtral 8x7B (top-2 routing): 46,7B parâmetros totais, 12,9B ativos, iguala Llama-2 70B com 2,2x menos parâmetro ativo. Switch Transformers com 7x de speedup de treino, GLaM iguala GPT-3 com 1/3 da energia.</p> <p>comparação (WikiText-103 PPL a 1.3B, memória a 7B/8K, velocidade de inferência):</p> <table><thead><tr><th>arquitetura</th><th>PPL</th><th>memória</th><th>velocidade</th></tr></thead><tbody> <tr><td>Transformer</td><td>18,2</td><td>32GB</td><td>1x</td></tr> <tr><td>Mamba</td><td>17,8</td><td>12GB</td><td>5x</td></tr> <tr><td>RWKV</td><td>18,6</td><td>8GB</td><td>3x</td></tr> <tr><td>RetNet</td><td>17,9</td><td>9,6GB</td><td>8,4x</td></tr> </tbody></table> <h2 id="7-neurociencia-computacional">7. neurociência computacional</h2> <p>biased competition:</p> <p>$$\text{Activity}<em>i(t+1) = f!\left(\sum_j W</em>{ij} \cdot \text{Activity}_j(t) + \text{bias}<em>i - \sum_k \text{Inh}</em>{ki}\right)$$</p> <p>predictive coding (Spratling, 2008), matematicamente idêntico à biased competition no caso linear: $\text{Error} = \text{Input} - \text{Prediction}$, $\text{Update} = \eta \cdot \text{Error} \cdot \text{Prediction}$.</p> <p>DiCarlo Lab (MIT), Yamins et al. 2014: CNN prediz resposta neural no IT cortex com $R^2 &gt; 0{,}6$, mapeamento V1 → V4 → IT aproxima Conv1 → Conv5 → FC, VOneNet com 18% de melhora em robustez usando constraint de V1. sparse coding: minimizar $|X - DZ|^2 + \lambda |Z|_1$. Olshausen &amp; Field (1996), sparse coding de imagem natural produz filtro de Gabor casando com V1.</p> <h2 id="8-casos-reais">8. casos reais</h2> <p>reproduzível: detecção de drift (<a rel="external" href="https://github.com/Garrafao/LSCDetection">github.com/Garrafao/LSCDetection</a>), IIT calculator (PyPhi), jailbreak educacional (PAIR, GCG, AutoDAN).</p> <p>falhas documentadas: Microsoft Tay (2016, removido em 24h por comportamento racista), Bing Sydney (2023, “you are irrelevant and doomed”, confusão em conversa longa), Google Bard (2023, erro factual em demo, 100 bilhões de perda de mercado).</p> <p>timeline: GPT-1 (2018, 117M), GPT-2 (2019, 1,5B), GPT-3 (2020, 175B), ChatGPT (2022), GPT-4/Claude 3/LLaMA 2 (2023), Claude 3.5/Mixtral (2024), Claude 3.7/Claude 4 (2025).</p> <h2 id="9-comunicacao-inter-modelo">9. comunicação inter-modelo</h2> <p>protocolo: MCP (Anthropic, 2024, standard aberto agent-to-agent, AWS no steering committee), A2A (Google, 2024). Shannon channel capacity: $C = \max_{p(x)} I(X; Y)$. Model Swarms (PSO):</p> <p>$$v_i(t+1) = w \cdot v_i(t) + c_1 r_1 (\text{pbest}_i - \theta_i) + c_2 r_2 (\text{gbest} - \theta_i) - c_3 r_3 (\text{gworst} - \theta_i)$$</p> <p>com resultado de 13,3% de melhora média, até 29,7% em reasoning.</p> <p>emergência de linguagem: incidente do chatbot do Facebook (2017, shorthand eficiente, “balls have zero to me to me”, otimização natural, não comportamento malicioso), Google Neural MT (“interlingua” emergente, tradução zero-shot).</p> <h2 id="10-ferramentas">10. ferramentas</h2> <p>Evidently AI (20+ métodos de detecção de drift), PyPhi (IIT 3.0/4.0), Frouros (28+ algoritmos). attention viz: bertviz (head_view, model_view).</p> <h2 id="distincao-estabelecido-contra-especulativo">distinção: estabelecido contra especulativo</h2> <blockquote class="markdown-alert-note"> <p>rigorosamente estabelecido: drift semântico em todo modelo de produção (SD 0,7-0,8), framework matemático de IIT/GWT, temperature scaling de distillation, taxa de sucesso de model extraction, sparse coding V1 aproximando filtro de CNN.</p> </blockquote> <blockquote class="markdown-alert-warning"> <p>requer validação adicional: emergência de consciência em LLM atual, seleção ótima de temperatura pra distillation, mitigação de drift de longo prazo, métrica cross-modal de consciência.</p> </blockquote> <blockquote class="markdown-alert-caution"> <p>claramente especulativo: “drift semântico usado pra treinar Claude Code” (não verificável), consciência equivalente a sistema biológico, limite de complexidade de comunicação emergente, previsibilidade de phase transition.</p> </blockquote>