| |
|
| Papers We Love
|
| With Samuel Laferriere (S/w Enggr, Seismic). |
|
Sep 30 (Wed) @ 06:30 PM
FREE
| | Mindspace, 25 Kent Ave, Ste 401, Williamsburg
|
|
|
|
|
| |
| Register |
|
|
| |
Papers We Love, Espresso AI, & Antithesis are pleased to present the September edition of PwL.
Papers We Love is a community of programmers who love reading & discussing computer science papers.
What was the last paper within the realm of computing you read & loved? What did it inspire you to build or tinker with? Come share the ideas in an awesome academic or research paper with fellow engineers, programmers, & paper-readers. Lead a session & show off code you wrote that implements these ideas, or just give us the lowdown on the paper. Otherwise, just come, listen, learn, & discuss.
Speaker: Samuel Laferriere
More about Sam: I'm a Staff Software Engineer at Seismic, where I work on the execution layer of an EVM-compatible privacy L1 - a reth fork running BFT consensus inside TDX enclaves. Before that I spent three years at EigenLabs, where I led the integrations team for EigenDA, a high-throughput BFT blobstore, building & maintaining its rollup integrations (Optimism, zkSync, & others). For the details, have a look at my resume.
I work mostly in Rust & Go on distributed systems: BFT consensus + blobstore, EVM, & confidential compute.
Before blockchain, I did academic research in robotics, developing Koopman-based control algorithms for self-driving cars & quadrotors. I completed my Master's degree at the Montreal Institute for Learning Algorithms (MILA), where I developed Bayesian optimization algorithms for neurostimulation, & before that earned my bachelor's in mathematics & computer science at McGill University.
Paper: https://www.cs.virginia.edu/~evans/cs551/saltzer/
Title: What Saltzer & Schroeder knew in 1975 about the agents we're building in 2026
Supporting Papers: Hardy, The Confused Deputy (1988) Miller, Yee & Shapiro, Capability Myths Demolished (2003)
Outline:
Every discussion of sandboxing AI agents starts with the wrong noun. Container or microVM? gVisor or WASI? Those choices answer where computation happens. They say nothing about what authority that computation can exercise - & an agent inside a perfectly isolated VM can still exfiltrate your source through an allowed API, spend your cloud credentials, or push to main.
Saltzer & Schroeder framed the real problem fifty years ago, with three of their eight design principles directly relevant to agent sandboxing problem:
1. Complete mediation turns out to be the whole reason an LLM proxy counts as security rather than decoration: the sandbox is enforcement only if the workload cannot route around it.
2. Least privilege is where agents genuinely break the classical model, because an agent's useful authority changes with its plan - authority becomes a runtime protocol, not a static profile.
3. Saltzer & Schroeder warned that a protection mechanism people find annoying will be circumvented by the people it protects. Fifty years later, the most popular sandbox configuration in the industry is --dangerously-skip-permissions.
To close, a detour through Hardy's two-page note from 1988. Prompt injection is not a new vulnerability class - it's the confused deputy with a natural-language calling convention, & an LLM is the perfect confused deputy: maximally helpful, broadly authorized, & structurally unable to tell a request from data. The fix Hardy proposed is the fix Google's CaMeL rediscovered in 2025.
6:30pm - Doors
7:00pm - Speaker begins
PwL curate a repository of papers & places to find them. Contributions welcome via PR.
Join the PWL Discord & hop into the #nyc channel:
Join Discord Server
Papers We Love has a Code of Conduct. Be good to each other & to the PWL community.
|
|
|
|
|
|
|
|
