Unprompted conf: model internals are the new Windows internals, says Matt Suiche

moyix · x · 2026-10-29

Security researcher Matt Suiche shared takeaways from his Unprompted conference talk (retweeted by moyix):

Model internals are the new Windows internals: skills that once deconstructed operating systems—reversing, tracing, diffing, verifying—now apply to models
Inference debugging is becoming its own field: stepping through transformer blocks, reading residual streams, and patching activations while a model runs
AI is a race to control what people can think about: whoever decides which questions a model answers shapes which questions people stop asking
Runtime overlays like GLP remove abliterated-model supply-chain risk: run the vendor's stock model and apply inspectable control vectors at runtime instead of downloading strangers' checkpoints
Local models are finally useful for real offensive work: he wrote the php2shell and brotli exploits entirely with a local DeepSeek-V4.1-Flash model and minimal steering
Slide shows one transformer layer where attention and MoE experts both write to the residual stream, with GLP projecting post-layer

More from Safety