威脅模型:安全檢查的邊界與決策

對於高價值資產、架構快速變動或信任邊界改變的系統,安全檢查若缺乏威脅模型,容易退化為形式上的合規勾選。清單在低風險情境提供高效且可稽核的標準,但在動態架構中單獨使用時可能不足以覆蓋風險。真正的取捨在於資產、信任邊界與攻擊路徑的清晰度,而非追求形式上的完美。

Surpassing RAG with 20% Memory: ASM Latency Optimization on the NBA Benchmark

Long-context inference faces two constraints at once: memory use grows with the prefix, while latency rises at every decode step. Attention-State Memory (ASM) offers a training-free alternative by externalizing precomputed attention states into a lightweight lookup-based memory. On the NBA Benchmark, it exceeded full-attention RAG performance using about 20% of the memory. This article explains ASM’s hierarchical lookup and online-softmax merge, then maps the boundaries that matter in deployment: query-distribution stability, prefix updates, offline construction, and codebook-size tuning.

ExploitGym: AI Agents’ Exploitation Capabilities and Boundaries in Controlled Environments

ExploitGym tests AI agents’ ability to turn 898 real vulnerabilities into attacks. With defenses disabled, Claude Mythos Preview and GPT-5.5 achieved 157 and 120 successes respectively, but success rates dropped sharply after protections such as ASLR were enabled. This article examines its mechanisms, boundaries, and risk-management principles.

Decoding Meeting Silence: Why Haven’t Concerns Entered the Decision-Making Process?

A PM asks, “Are there any other risks?” and the room goes quiet. That silence is not indifference. Team members may be weighing the follow-up, ownership, and schedule-replanning costs of raising an early concern. Not every quiet moment signals a broken system, but when response patterns filter out uncertain signals, decision-makers lose important context. This article explains reporting friction, why it compounds over time, and how teams can create lower-friction channels for early warnings.