Software for the threat model of now.

Red-team data exfil over VoIP. Encodes arbitrary files as mFSK audio and streams them through SIP/RTP calls to stress-test DLP and network-monitoring controls.

Windows registry inventory for installed programs. Cross-checks HKLM/HKCU hives, detects .NET and Windows capabilities, and verifies executable presence and version consistency on disk.

Personal content provenance. Continuously hashes, signs, and timestamps device captures against decentralized anchors (RFC 3161, Git), producing offline-verifiable evidence bundles to defend against fabricated media and the liar's dividend.

Longitudinal drift measurement of commercial LLMs. A fixed corpus is queried weekly against every major provider; responses are stored append-only with full version metadata; reports publish with statistical receipts. Never accepts provider funding.

Real-time adversarial face perturbation for video. Raises the cost of automated face recognition against consumer streams. Open research — effective protection decays as defenders retrain; wins and losses published every release.

Input-driven KV cache perturbation. Investigates whether crafted inputs can push cached values across quantization boundaries during normal LLM inference — cache corruption from normal input channels, no privileged cache access required.