PhD student at Beijing Jiaotong University, working on LLM agent security at the harness layer: where the security boundary belongs once an agent holds real logins, runs code and remembers things, and how a harness that rewrites itself stays inside that boundary. I also shoot medium-format film, study mathematics, and write about the systems that shape learning and everyday life.
北京交通大学博士生，做 agent harness 层的 LLM 安全：agent 拿着真实登录态、能执行代码、会写记忆之后，安全边界该放在哪里；会自我改写的 harness 怎样不越过这条边界。也拍中画幅胶片、学数学，记录技术、学习与日常生活里的系统性问题。
fish2lab.com · x.com/fish2lab · fish2lab@gmail.com
| RESEARCHING | The harness as a reference monitor. Indirect prompt injection gets a larger blast radius every time an agent inherits a real browser session or installs a third‑party Skill or MCP server, and the model cannot be trusted to refuse. So the boundary goes outside the model: a harness that mediates every action, that the model cannot tamper with, and whose policy can be checked, with credentials kept out of it entirely. Two places this gets hard: Code Mode and general executors move permission from the granularity of a tool to the granularity of an execution, where sandboxes, network allowlists and information‑flow tracking have to take over; and stateful agents need control over what they write to memory as well as what they say. A passphrase echo before an irreversible action catches context drift but stops no adversary. |
| SELF‑IMPROVING | Harnesses that improve themselves, with constraints. How a self‑made change is accepted or rolled back without overfitting to the benchmark it was scored on; why an agent may accumulate facts on its own while new behaviour rules can only be proposed for a human to review; and retrodiction, predicting outcomes that are already known from earlier state, as the training signal for the loop. |
| INSIDE THE MODEL | Refusal robustness at the representation level: refusal directions and SAE features as detectors in multi‑turn and agent settings; whether a semantics‑preserving position shift under compressed attention is enough to slip past refusal; and latent or KV‑cache channels between agents that leave token‑level audits and chain‑of‑thought monitoring with nothing to read. |
| WRITING | A position paper arguing the agent harness does not disappear under scaling, it shrinks to a kernel: four operations on context structure (execute, cut, fork, partition) and not one line of prompt. Everything a harness does by saying gets absorbed into the weights; what it does by placing cannot be. |
| SHIPPING | touhou-code-video-template, the engine behind the Patchouli Lecture series pulled out as a template: a voiced Touhou explainer in pure Canvas 2D, six episodes so far (optogenetics and mental health, cooking as engineering). os-lab-mcp, a lab for the undergraduate OS interfaces course where students watch an agent reach the file system through MCP and write the sandbox rule that stops it. DSCodex v1.4.0. |
| ELSEWHERE | Film scans going up at portfolio.fish2lab.com; a Touhou fan‑game side project about a perishable flow and four storable stocks. |
|
DSCodex DeepSeek V4.1 Flash inside the unmodified ChatGPT desktop app, Codex CLI and IDE. Local loopback router, native Responses API, full tool loops, GPT OAuth kept side by side. No fork, no patch. 在原版 Codex / ChatGPT 桌面端同时使用 DeepSeek 与 GPT。 JavaScript · MIT
|
touhou-code-video-template A fully voiced Touhou fan explainer in nothing but JavaScript and Canvas 2D: 14 procedural paper‑cut chibi characters, Yukkuri voice, music‑box BGM, and a deterministic renderer where every frame is a function of time. Zero image assets; ships with AGENTS.md and llms.txt. 纯代码做一集东方科普视频，帕秋莉讲座系列的引擎。 JavaScript · Canvas · MIT
|
|
os-lab-mcp Template repo for an OS interfaces course lab: an agent driver on pi plus an MCP bridge, packet recorder and process‑tree observer. Students write the tool handlers, a realpath check and one sandbox rule, then catch a path‑traversal attempt in the logs. 《操作系统接口技术》验证实验：Agent 经 MCP 访问 OS 资源。 TypeScript
|
sukima-ml Website for 隙间月影 Sukima Moonlight, a doujin circle pairing classic paintings with Touhou Project. Dual‑frame gallery, a Galgame‑style guide, museum‑grade CSS matting. 名画与东方 Project 的邂逅。 TypeScript · Docusaurus
|
|
tty7 upstream A pure‑Rust terminal workbench on Zed's gpui with persistent sessions and coding‑agent awareness. My #880 answers the macOS Dock's reopen event, so a tty7 whose last window was closed comes back instead of staying retired. 给 tty7 补上 macOS Dock 重新打开窗口的行为。 Rust · merged 2026‑09‑14
|
Typex upstream An open‑source desktop voice input tool. My #2 adds Xiaomi MiMo ASR and explicit hotkey trigger modes. 给 Typex 接入小米 MiMo 语音识别与显式快捷键触发。 Rust · merged 2026‑07‑30
|
|
Portfolio · 作品集 Medium‑format documentary, landscape, street and conceptual series. portfolio.fish2lab.com → |
Research · 研究 Field notes, probes and work in progress on LLM security and agent systems. research.fish2lab.com → |
Blog · 文章 Essays on cognitive science, learning, health and everyday systems. blog.fish2lab.com → |
The header is redrawn every night from the contribution calendar by art/render.mjs: one ripple per active day, weeks left to right, Sunday on the far row. How it is drawn →