一个关于技术、代码和一切之间事情的个人博客。
文章
4
Generative media is now indistinguishable from camera capture — so how do you verify where a file came from? A deep dive into C2PA provenance, SynthID-style watermarking, and why pure ML detection hits an arms-race ceiling, with concrete integration guidance for engineers.
Hallucination is the default behavior of a fluent text generator, not a bug waiting to be patched. A reliability-engineering guide to detecting LLM hallucinations in production, the mitigations that actually work, and the folk fixes that do not.
How frontier LLMs actually become helpful and safe after pretraining — the RLHF pipeline, why reward models get Goodharted, what Constitutional AI and DPO change, and why scalable oversight remains the field's hardest open problem.
Why prompt injection is the defining new attack surface of LLM-powered applications, how real attack chains turn planted text into stolen data, and the layered defenses that actually contain them.
A deep dive into the world's major AI governance frameworks — NIST AI RMF, ISO/IEC 42001, the EU AI Act, OECD principles, and China's regulatory system — covering their structure, binding force, and how enterprises should combine them in practice.
以 NIST AI RMF 为核心，系统梳理全球主要 AI 治理框架（ISO/IEC 42001、欧盟 AI 法、OECD 原则、中国监管体系等）的结构、约束力与相互关系，并给出企业选型与落地实施建议。
结合真实的前端项目安全加固案例，探讨开源软件中容易被忽视的安全盲点，包括安全响应头配置、robots.txt信息泄露、环境变量管理、前端密钥暴露、服务端代理架构以及HTTP方法限制等六个维度，提供可落地的防护建议。
A practical tour of the four caching layers in a modern web stack — HTTP cache headers, CDN edge caching, application-level Redis caching, and database buffers — with invalidation strategies that keep data fresh.
从零开始掌握Supabase，深入了解PostgreSQL数据库、RLS安全策略、实时订阅和Edge Functions，构建安全可靠的现代全栈应用。