Prompt injection does not go away because the model is local
A denylist of three dangerous commands was bypassed by a fourth. Why injection defence has to be allowlist-shaped, and what on-device quietly takes away.
All posts
Quantization has a quality cliff, and you can see it
Quantization degrades non-linearly, so an average score hides the cliff. Find it with a suite that fails per-case, and keep the per-case results, not the mean.
Streaming tokens into Compose without recomposing the world
Streaming output updates state far faster than a normal screen. Narrow what reads the changing value, and let the smallest possible scope recompose.
How do you test a screen whose text is generated?
Snapshot tests die the moment output varies per run. Asserting invariants instead of strings, the vacuous-check trap, and a verdict that means could-not-determine.
What a small on-device model simply cannot do
A small local model has a hard ceiling, and the design question is what happens at it. Find the boundary deliberately, then build the escalation path first.
The latency maths that decides on-device versus an API call
Comparing a local model to an API is not a race between two averages — it is tail latency, failure rates, and how often one task crosses the boundary.
adb install -r doesn't kill your app, so your screenshot is a lie
Reinstalling over a running app can leave the old composition on screen. A screenshot taken without a force-stop cannot say which build drew it.
Where your AI coding bill actually goes: I measured one long session
22 articles and 110 generated assets in one session. What the retries cost, and the one change that cut attempts per asset from roughly 1.8 to 1.1.
An agent-driven refactor, with the receipts
Before and after on a real module migration: what proved the change was inert, what the agent got wrong, and the receipt that made it safe to run at all.
Running an AI agent in CI without it spending your budget
An agent in CI cannot be asked a question. Budget caps that actually throw, local reproduction before pushing, and the gate that degraded instead of failing.
Agent memory that is just files
Most questions an agent asks about past work are exact, not semantic. What a directory tree answers well, and the one query shape it cannot answer at all.
What should an AI agent never be allowed to do?
A permissions model derived from incidents rather than imagination: three tiers, human-only bypasses, and capabilities removed from reach entirely.