An open research notebook
I explore questions in computer science, build experiments, and test what holds up. Here’s what I’ve been working on—and where I’m going next.
Explore the papers ↗Separates screening from harvesting and produces controlled, auditable decisions about which sources are usable for the specific claim, enabling negative results documentation.
This is the novelty-decisive census: it either finds a prior detector our paper must compare against or establishes an explicit gap that supports our detector claim. Separable…
Local digests are the verifiable measurement to compare against vendor claims; a machine-readable manifest enables automated cross-check.
Machine-learning models are rarely deployed once and left alone. The engines that run them keep changing underneath: inference software gets upgraded for speed, optimizers get switched on, numerical kernels get swapped out, all while the model file itself stays the same. These upgrades almost...
Machine-learning models are rarely deployed once and left alone. The engines that run them keep changing underneath: inference software gets upgraded for speed, optimizers get switched on, numerical kernels get swapped out, all while the model file itself stays the same. These upgrades almost never crash. Instead, they can silently nudge a handful of output values just enough to flip a decision that was sitting near a boundary -- a quality-control camera on a factory line that stops flagging a scratched part, or a hospital triage tool that quietly drifts on exactly the scans it was already least confident about. Because there is no independent ground truth for what a model's output "should" be after such an upgrade, testers reach for an oracle that does not need one: run the model on an input and again on a lightly transformed copy of it (a 10-degree image rotation, which should not change what the image shows), and compare how much the two software versions disagree on each. It is tempting to subtract one disagreement from the other, on the reasoning that whatever is common to both is background noise and whatever differs is the real signal. We show this reasoning can backfire. Across three public CIFAR-100 classifiers, two pinned ONNX Runtime configurations, and 54 controlled weight-perturbation faults (16,200 faulty and 900 clean held-out cases), the subtraction-based detector caught 75.48% of injected faults versus 82.75% for simply comparing outputs on the unrotated image alone, at the same 0.67% false-alarm rate. A 5,000-replicate bootstrap that redoes the calibration itself, not just the test split, keeps this gap negative throughout (95% interval -8.80 to -3.81 points), and the same pattern holds, more sharply, for pinpointing which layer was perturbed. The mechanism is intuitive in hindsight: a persistent fault shifts behavior similarly on both the original and the rotated input, so subtracting the two disagreements discards exactly the evidence a detector needs to notice anything is wrong. For anyone building automated tests for this kind of silent drift, the practical lesson is concrete: a two-input comparison is not automatically better than a one-input one, and it must be checked against the plain baseline at a matched false-alarm rate before it is trusted to catch the next drifting camera or drifting triage tool. The finding is scoped to the tested substrate of injected weight drift, not a verdict on metamorphic testing as a strategy.