Research Blog
Safe & Verifiable Computing
If a model writes code, something has to contain it, check it, and place it. This pillar covers the systems layer underneath AI workloads — isolation for untrusted execution, correctness oracles for generated kernels, topology-aware placement for memory-bound work, and the storage and privacy primitives those systems depend on.
Containment is not one problem
Sandboxing choices are usually presented as a ranking and are better understood as a set of different failure modes. A microVM gives strong isolation and pays a per-execution boot cost that dominates when executions are short and frequent. A userspace kernel intercepts syscalls and pays a translation cost on every one. A selective-denial runtime like zviz keeps most syscalls on the host kernel at native speed and denies the rest at the seccomp layer, which is faster and concedes a larger trusted computing base. Which trade is correct depends entirely on whether you are running one long job or ten thousand short ones.
The same reasoning applies to correctness. A single-shape allclose check against a reference implementation accepts a wide class of silently-wrong GPU kernels: tail-mask leaks that only appear at non-multiple sizes, accumulator-scale errors that only appear at large reductions, rescale bugs in online softmax. Catching those needs schema-aware adversarial input generation and per-operation tolerances, not a bigger tolerance on one test.
Placement, storage and privacy
Memory-bound inference workloads are dominated by where memory lives. On a multi-socket machine, a thread reading from a remote NUMA node pays a latency penalty on every access, and the effect shows up in the tail long before it shows up in the mean. Explicit placement and pinning is unglamorous work that recovers latency no amount of model optimisation will.
The storage articles ask a narrower question: does a project genuinely need a dedicated vector database? For corpora in the tens of thousands of vectors, an embedded index in the application process removes an entire service from the deployment, and the honest answer changes as the corpus grows. The privacy work is more recent and asks a different question again — whether a message can be authenticated to its recipient while the network learns nothing about who is talking to whom.
Proving Who Sent a Message Without Revealing To Whom
End-to-end encryption hides content but leaks the social graph. How Schnorr proofs over blinded pseudonyms let a recipient verify a sender with no directory.
embedcache vs Redis vs GPTCache: Caching Embeddings
How embedcache (local embedding plus a SQLite cache) compares with a DIY Redis cache and GPTCache's semantic cache, and what each one actually stores.
memista vs Pinecone vs Qdrant: Do You Need a Vector DB?
memista, Pinecone, Qdrant, Weaviate, Milvus and Chroma compared on architecture, scale and operations, and where an experimental embedded index stops being enough.
polymathy vs Haystack vs LangChain: Retrieval in Rust
Comparing polymathy with Haystack, LangChain and LlamaIndex: a single-endpoint Rust fetch-and-chunk service against full Python RAG frameworks.
zviz vs gVisor vs Firecracker: Sandboxing AI Code
Deny, emulate or virtualise? How zviz's selective-denial container runtime compares with gVisor, Firecracker and WASM for running untrusted AI code.
Programmable Databases: Why We Built liath Twice
liath lets agents query their own memory in sandboxed Lua. Why we built it as a Python package, rebuilt it as a Rust crate, and what we would measure next.
Vector Search Without the Cloud: memista, SQLite and HNSW
Why memista pairs SQLite metadata with an in-process USearch HNSW index, what that buys a small retrieval workload, and how to measure whether yours fits.
Sandboxing Untrusted Code in Zig: The zviz Architecture
How zviz contains untrusted and AI-generated code by selective denial: namespaces, Landlock, seccomp-BPF and cgroups v2, with policy built at Zig comptime.
Why We Write AI Infrastructure in Rust (and Zig, and Go)
Language choice as research methodology: why we pick Rust, Zig or Go by the confounding variables each removes from the systems claims we intend to test.