haotianblog
Projects
Search
Ask the AI

Projects

Project Index

The project page gathers the more complete experiment bundles on the site. A project should state its goal, data or input, implementation language, verification method, and known boundary. Material that does not meet that bar is not described as a finished product.

Project type Current coverage Verifiable material Boundary
Algorithm implementation Eight queens, K-means, handwritten digit softmax. C source, input data, output result, and complexity notes. Educational and reproducible, not a production stability promise.
AI/ML experiment ML workflow, deep learning math, PyBaMM battery data. Parameter table, data generation steps, metrics, and failure modes. Small labs emphasize explanation and do not replace industrial validation.
Network protocol lab DNS, TLS, HTTP/3, proxies, and caches. Timeline, status codes, cache hits, and trust-boundary diagrams. For learning and troubleshooting literacy, not abusive network testing.
Site tool ANSI image converter, browser playground, knowledge map. Interactive page, explanatory article, and downloadable material. Browser tools document input handling and data boundaries.

Project hub

Learning material by project

Each project collects its goal, route, timeline, published posts, resources, and next planned notes.

Network Fundamentals

Turn protocol standards into engineering experiments that can be calculated, run, inspected, and audited.

A reproducible route through DNS, TCP, TLS, HTTP/3, proxy tunnels, load balancing, and shared caches with code and figures.

Next notes

  • Add IPv6 and QUIC observation notes
  • Review caching and protocol benefits with real-user metrics

Published posts

Sharing a Secret Is Easy; Sharing State Is Not: Six Traps in Cross-Machine SSO

Extending a single-machine login gate into SSO across subdomains makes key distribution the easy part — state is the hard one. This records the problems from running one gate on three machines: why replay protection became per-site, how a second copy of the key produced "gate passes, application returns 401", how an allowlist preservation rule in a deploy script silently switched login off, and why comparing generated codes manufactures phantom failures.

Reading time: 13 min
  • TOTP
  • HMAC
  • auth_request
  • nginx

Authenticated Is Not Protected: Auditing an Authorisation Boundary

After putting a two-factor gate in front of a self-hosted file manager, I asked what the gate actually protected. It protected the interface, not the files — the same bytes were reachable by two URLs, and while verifying that I found the gate had never been in the request path at all. This covers the audit, two nginx traps in the patch, and the edge cache that kept serving for nearly a year after the origin was closed.

Reading time: 13 min
  • nginx
  • auth_request
  • TOTP
  • CDN

Does Inbound Actually Work? Probing a Home Line From the Outside

Every port looks open when you scan from the machine itself, and nothing outside can connect. This covers why local probing is guaranteed to mislead, why a control port is not optional, and a full measurement run: public IPv4 that is not CGNAT, ports 80 and 443 filtered rather than closed, a real IPv6 address with inbound entirely dropped, and why an AAAA record must not come from an echo service.

Reading time: 11 min
  • nc
  • CGNAT
  • hairpin NAT
  • IPv6
  • DNS-01

A Certificate Is Not HTTPS: Debugging a Subdomain Reported as “Uncertified”

Someone told me a subdomain had no SSL certificate. It did — a wildcard covered it. But the investigation surfaced something worse: that subdomain served its mail login page over plain HTTP, password field and all, with no redirect. Plus two things that sent me the wrong way: openssl failing on every target at once, and DNS enumeration being meaningless behind a transparent proxy.

Reading time: 9 min
  • TLS
  • SNI
  • nginx
  • HSTS

Project timeline

Published posts

  1. Sharing a Secret Is Easy; Sharing State Is Not: Six Traps in Cross-Machine SSO Extending a single-machine login gate into SSO across subdomains makes key distribution the easy part — state is the hard one. This records the problems from running one gate on three machines: why replay protection became per-site, how a second copy of the key produced "gate passes, application returns 401", how an allowlist preservation rule in a deploy script silently switched login off, and why comparing generated codes manufactures phantom failures.
  2. Authenticated Is Not Protected: Auditing an Authorisation Boundary After putting a two-factor gate in front of a self-hosted file manager, I asked what the gate actually protected. It protected the interface, not the files — the same bytes were reachable by two URLs, and while verifying that I found the gate had never been in the request path at all. This covers the audit, two nginx traps in the patch, and the edge cache that kept serving for nearly a year after the origin was closed.
  3. Does Inbound Actually Work? Probing a Home Line From the Outside Every port looks open when you scan from the machine itself, and nothing outside can connect. This covers why local probing is guaranteed to mislead, why a control port is not optional, and a full measurement run: public IPv4 that is not CGNAT, ports 80 and 443 filtered rather than closed, a real IPv6 address with inbound entirely dropped, and why an AAAA record must not come from an echo service.
  4. A Certificate Is Not HTTPS: Debugging a Subdomain Reported as “Uncertified” Someone told me a subdomain had no SSL certificate. It did — a wildcard covered it. But the investigation surfaced something worse: that subdomain served its mail login page over plain HTTP, password field and all, with no redirect. Plus two things that sent me the wrong way: openssl failing on every target at once, and DNS enumeration being meaningless behind a transparent proxy.
  5. DNS Resolution Explained: Build a TTL Cache and Packet Parser in Python A runnable DNS guide covering resolution paths, response headers, TTL cache latency, and deterministic Python/C experiments.
  6. CIDR, Longest Prefix Match, and MTU: Calculate IP Routing Step by Step Calculate CIDR ranges, longest-prefix route choice, and MTU/MSS payload segmentation with runnable Python and C examples.
  7. TCP Reliability and Congestion Window: A Runnable Sequence Number Experiment Track TCP sequence numbers, cumulative ACKs, loss, retransmission, and congestion-window changes with safe local experiments.
  8. HTTPS and TLS 1.3 Handshake: Keys, Certificates, and RTT in Practice Understand TLS 1.3 message flights, certificate authentication, ephemeral key agreement, and handshake latency with a safe teaching model.
  9. HTTP/2, HTTP/3, and CDN Caching: Read Page Speed from a Waterfall A deterministic browser-waterfall model for HTTP/2, HTTP/3, QUIC streams, and CDN cache hits or misses.
  10. Forward Proxy vs Reverse Proxy: Connection Paths, Trust Boundaries, and Latency A reproducible guide to forward proxies, reverse proxies, tunnels, TLS boundaries, and latency segments.
  11. HTTP CONNECT and HTTPS Proxy Tunnels: TLS Boundaries and Handshake Latency An RFC-based explanation of CONNECT tunnels, encrypted HTTPS payloads, and modeled first-request latency.
  12. SOCKS5 Proxy Explained: Protocol Bytes, DNS Resolution Boundaries, and Leakage Risk Decode safe SOCKS5 CONNECT bytes and compare local-DNS and proxy-side hostname resolution boundaries.
  13. Reverse Proxy Load Balancing: Queues, Health Checks, and a Reproducible Scheduler Compare round robin and load-aware queue selection while reasoning about health checks and retry boundaries.
  14. Proxy Cache Revalidation: Cache-Control, ETag, and Observable Correctness Use an RFC 9111 shared-cache model to calculate MISS, HIT, and 304 revalidation latency and correctness boundaries.

Published resources

  1. Network Fundamentals Lab README Setup, no-privilege safety boundary, ten Python experiments, and three C examples.
  2. Network fundamentals full lab bundle Bundles Python/C source, fixed scenarios, ten result CSVs, and protocol/proxy figures.
  3. DNS TTL results CSV HIT/MISS state, expiry, and latency for four fixed lookups.
  4. CIDR and MTU results CSV Longest-prefix route and 3600-byte payload segmentation results.
  5. TCP cwnd events CSV Per-round ACK, window, and deterministic retransmission events.
  6. TLS 1.3 flight results CSV Message direction, timing, and teaching shared value in a fixed RTT model.
  7. HTTP/CDN waterfall results CSV Phase timing for HTTP/2 and HTTP/3 in cold and warm cache models.
  8. Proxy path latency results CSV Phase timing for direct access, forward-proxy tunneling, and reverse-proxy cache paths.
  9. CONNECT/TLS timeline CSV Records CONNECT authority, tunnel establishment, and the encrypted HTTPS-request boundary.
  10. SOCKS5 DNS boundary CSV Stores ATYP, destination bytes, request length, and modeled local DNS counts.
  11. Proxy load-balancing queue CSV Compares backend selection and queue waiting for round robin and least queue.
  12. Proxy cache revalidation CSV Records MISS, HIT, 304 revalidation, object age, and response latency.
  13. Network request path visualizer Adjust TTL, prefixes, loss, handshake RTT, and cache paths in the browser.
  14. Network fundamentals topic share card A 1200x630 SVG card for the DNS, TLS, HTTP/3, proxy tunnel, and caching topic hub.

Next notes

  1. Add IPv6 and QUIC observation notes
  2. Review caching and protocol benefits with real-user metrics

Resources

Battery Modeling for AI

Help battery, control, and machine-learning researchers audit PyBaMM models, generate labeled datasets, and separate synthetic labels from experimental truth.

A reproducible research path from PyBaMM, EIS, and aging simulation to AI labels and risk-controlled parameter identification.

Next notes

  • Audit domain shift and certification transfer on real cells
  • Add revalidated PyBOP/SEIS comparison notes

Published posts

Fitting PyBaMM Parameters: Why the Optimiser’s Numbers May Mean Nothing

The top search result, pybamm-param, is deprecated; PyBOP just restructured its API; and identifiability means an optimiser handed fifty free parameters returns fifty meaningless numbers. Includes a protocol separating a fit from a decoration.

Level: PhD level Reading time: 14 min
  • PyBaMM
  • EIS
  • Battery Aging
  • AI Dataset

PyBaMM Solver Convergence Failures: Numerics or Physics

When a long degradation run dies at cycle 300, reaching for tolerances is usually wrong. Tell numerics from physics with an SPMe cross-check, plus every IDAKLU option default and one trap that fails silently.

Level: PhD level Reading time: 14 min
  • PyBaMM
  • EIS
  • Battery Aging
  • AI Dataset

Project timeline

Published posts

  1. Reading PyBaMM Fast: Architecture for Battery Modeling and AI Data A PhD-level guide to PyBaMM expression trees, Simulation, model options, metadata, and AI dataset design.
  2. PyBaMM EIS Data Generation: Impedance Features and AI Labels Use PyBaMM core EISSimulation to generate impedance spectra, extract features, and align them with aging labels.
  3. Generate Battery Aging and EIS AI Datasets with PyBaMM Build a reproducible PyBaMM data factory for SOH, RUL, LLI, LAM, plating, and impedance-feature labels.
  4. Training a Battery AI Model with PyBaMM: Predicting SOH and RUL Train scikit-learn regressors on PyBaMM-style EIS features and operating metadata to predict battery SOH and RUL.
  5. Fitting PyBaMM Parameters: Why the Optimiser’s Numbers May Mean Nothing The top search result, pybamm-param, is deprecated; PyBOP just restructured its API; and identifiability means an optimiser handed fifty free parameters returns fifty meaningless numbers. Includes a protocol separating a fit from a decoration.
  6. PyBaMM Solver Convergence Failures: Numerics or Physics When a long degradation run dies at cycle 300, reaching for tolerances is usually wrong. Tell numerics from physics with an SPMe cross-check, plus every IDAKLU option default and one trap that fails silently.

Published resources

  1. PyBaMM AI Data Lab README Setup, quick run, backend behavior, and output schemas for the PyBaMM battery AI data pipeline.
  2. PyBaMM AI Data Lab full bundle Bundles design generation, aging sweeps, EIS sweeps, label building, validation checks, sample CSVs, and figures.
  3. PyBaMM sample manifest Stores sample id, model family, parameter set, protocol, temperature, SOC, cycle, split group, and label source.
  4. PyBaMM EIS sample spectra CSV Frequency-level impedance output with frequency, Z_re, Z_im, magnitude, phase, backend, and solver status.
  5. Battery aging and EIS labels CSV Stores SOH, RUL proxy, LLI, LAM, plating, local resistance, and EIS features.
  6. PyBaMM AI data quality report Records duplicate samples, duplicate spectrum points, missing labels, split leakage, and backend usage.
  7. PyBaMM to AI data pipeline figure Shows design grid, aging solve, EIS solve, label build, quality gate, and AI split.
  8. EIS feature and label schema figure Connects frequency points, impedance features, operating metadata, and SOH/RUL/degradation labels.
  9. Aging label sample figure Sample figure showing cycle snapshots, SOH, and local ECM resistance labels.
  10. SOH/RUL training metrics CSV Stores group split, MAE, RMSE, R2, label source, and backend used for auditing model results.
  11. SOH/RUL held-out predictions CSV Stores held-out true values, predictions, and absolute errors.
  12. SOH/RUL feature importance CSV Records random-forest feature importance values for each target model.
  13. SOH/RUL training results figure Shows held-out SOH/RUL prediction scatter plots and SOH feature importance.
  14. Battery Modeling for AI share card OG share card for the PyBaMM battery modeling, EIS, aging simulation, and AI data hub.

Next notes

  1. Audit domain shift and certification transfer on real cells
  2. Add revalidated PyBOP/SEIS comparison notes

Resources

AI Learning Project

Help readers with programming basics complete a coherent first pass through machine learning and then move into convolutional networks, robust evaluation, model privacy, and LLM/RAG/Agent security.

A practical route from AI concepts to machine learning workflow, evaluation, neural networks, Python practice, handwritten digits, a CIFAR-10 CNN, adversarial traffic-defense notes, and AI security.

Next notes

  • Add more image-classification and error-analysis cases
  • Turn common metrics into a quick reference
  • Add more AI security defense experiment notes

Published posts

AI Basics Learning Roadmap

Separate AI, machine learning, and deep learning before going into implementation details.

Level: Beginner Reading time: 8 min
  • AI
  • Machine Learning
  • Deep Learning

Machine Learning Workflow

Follow the practical path from data and features to training, prediction, and evaluation.

Level: Beginner Reading time: 9 min
  • Machine Learning
  • Features
  • scikit-learn

Model Training and Evaluation

Understand loss, overfitting, train/test splits, accuracy, recall, and F1.

Level: Beginner Reading time: 9 min
  • Model Training
  • Metrics
  • Evaluation

Neural Network Basics

Move from perceptrons to activation, forward propagation, backpropagation, and training loops.

Level: Intermediate Reading time: 8 min
  • Neural Networks
  • Backpropagation
  • Python

Matrix Calculus for Neural Networks

Derive dL/dW for y = Wx + b and verify it with finite differences.

Level: Intermediate Reading time: 13 min
  • Matrix Calculus
  • NumPy
  • Gradient Check

Backpropagation as a Computation Graph

Trace local gradients through ReLU and softmax cross-entropy in a two-layer MLP.

Level: Intermediate Reading time: 14 min
  • Backpropagation
  • Computation Graph
  • Softmax

Gradient Descent and Optimizer Geometry

Compare gradient descent, momentum, and Adam on a visible quadratic loss surface.

Level: Intermediate Reading time: 13 min
  • Gradient Descent
  • Momentum
  • Adam
  • Loss Surface

Convolution and Receptive Field Math

Compute convolution output size, receptive fields, channel mixing, and im2col layout.

Level: Intermediate Reading time: 13 min
  • Convolution
  • Receptive Field
  • im2col

Transformer Attention Math

Hand-calculate Q/K/V scores, softmax weights, masks, multi-head structure, and KV cache.

Level: Intermediate Reading time: 14 min
  • Transformer
  • Attention
  • QKV
  • KV Cache

Python AI Mini Practice

Run a small scikit-learn classification task and read the experiment output.

Level: Practice Reading time: 10 min
  • Python
  • scikit-learn
  • Classification

Handwritten Digit Dataset Basics

Read train.csv, test.csv, labels, and the flattened 28 by 28 pixel layout before training the classifier.

Level: Beginner Reading time: 8 min
  • Dataset
  • CSV
  • Image Classification

Handwritten Digit Softmax in C

Follow the C implementation from logits and softmax probabilities to confusion matrices and submission export.

Level: Practice Reading time: 11 min
  • C
  • Softmax
  • Classification

Handwritten Digit Playground Notes

See how the offline classifier was adapted into a browser demo with drawing input and probability output.

Level: Practice Reading time: 8 min
  • Browser Demo
  • Softmax
  • Visualization

CIFAR-10 Tiny CNN Tutorial in C

Build and train a small convolutional neural network for CIFAR-10 image classification, then read its loss and accuracy output.

Level: Intermediate Reading time: 13 min
  • C
  • CNN
  • CIFAR-10
  • Backpropagation

High-Entropy Traffic Defense Notes

Study encrypted metadata leaks, entropy, traffic classifiers, and a defensive Python chaffing prototype.

Level: Intermediate Reading time: 16 min
  • Python
  • Traffic Analysis
  • Adversarial ML
  • Networking

AI Security Threat Modeling

Build a defense map with NIST adversarial ML, MITRE ATLAS, and OWASP LLM risks.

Level: Professional Reading time: 12 min
  • AI Security
  • Threat Modeling
  • NIST
  • MITRE ATLAS
  • OWASP

Adversarial Examples and Robust Evaluation

Evaluate clean and perturbed accuracy with an FGSM-style digits experiment.

Level: Professional Reading time: 11 min
  • Adversarial Examples
  • FGSM
  • Robust Evaluation
  • scikit-learn

Data Poisoning and Backdoor Defense

Study poison rate, trigger behavior, attack success rate, and training pipeline controls.

Level: Professional Reading time: 11 min
  • Data Poisoning
  • Backdoor Defense
  • Training Pipeline
  • scikit-learn

Model Privacy and Extraction Defense

Measure membership inference signal and surrogate fidelity against a local toy model.

Level: Professional Reading time: 12 min
  • Model Privacy
  • Membership Inference
  • Model Extraction
  • Prediction API

LLM, RAG, and Agent Security

Separate instructions from data and enforce tool permissions against indirect prompt injection.

Level: Professional Reading time: 12 min
  • LLM Security
  • RAG
  • Agent Tools
  • Prompt Injection

Large Language Models From a Developer’s Angle: Word Association at Scale

What an LLM is doing underneath the marketing: next-token prediction driven by the Transformer. Covers the architectural workflow, running an 8B model locally in Python, the hardware pitfalls encountered on the way, and what actually matters for developers building on top of these models.

Level: Beginner Reading time: 8 min
  • AI
  • Machine Learning
  • Python
  • scikit-learn

Multimodal LLM Architecture: How Vision Gets Aligned With Language

The crux of multimodal models is modality alignment. Covers the end-to-end architecture, the mathematics behind Q-Former and cross-attention, an MLP projection layer implemented in PyTorch, and why a linear projection and a two-layer MLP behave differently in production.

Level: Beginner Reading time: 8 min
  • AI
  • Machine Learning
  • Python
  • scikit-learn

KV Cache VRAM Explosion When Deploying Multimodal LLMs

Deploying LLaVA, Qwen-VL or InternVL runs into the same wall: KV cache memory. Covers the derivation of KV cache consumption, how AnyRes and dynamic resolution mitigate visual token explosion, 4-bit quantised inference with llama.cpp, and the engineering traps behind each.

Level: Beginner Reading time: 8 min
  • AI
  • Machine Learning
  • Python
  • scikit-learn

Visual Instruction Tuning: Where the Loss Function Actually Applies

The mechanics of visual instruction tuning, focusing on loss construction. Covers multimodal auto-regressive next-token prediction, the data flow from JSON to masked labels, the PyTorch label-masking implementation, and the production pitfalls that follow from getting the mask wrong.

Level: Beginner Reading time: 8 min
  • AI
  • Machine Learning
  • Python
  • scikit-learn

Deep Learning Frameworks: Why You Stop Writing Backpropagation by Hand

Once you have written a small neural network from scratch, the question becomes whether you must hand-code matrix multiplication and backpropagation every time. Covers what frameworks actually provide, the two major camps and how they differ, which one suits a beginner, and the same simple layer defined in each.

Level: Beginner Reading time: 8 min
  • AI
  • Machine Learning
  • Python
  • scikit-learn

Project timeline

Published posts

  1. How to Choose a Machine Learning Algorithm: Classification, Regression, Clustering and Recommendation Choose a machine learning algorithm by task type, data size, interpretability and deployment cost, covering logistic regression, decision trees, random forests, K-means and tabular baselines.
  2. Getting Started with Feature Engineering: Missing Values, Categorical Variables and Scaling in scikit-learn Build a feature engineering pipeline with scikit-learn Pipeline and ColumnTransformer, handling missing values, categorical variables and numeric standardisation while avoiding data leakage.
  3. How to Fix Overfitting and Underfitting: A Practical Model Tuning Guide Diagnose overfitting and underfitting from training and validation scores, then tune the model through complexity, regularisation, cross-validation and feature engineering.
  4. AI Basics Learning Roadmap Separate AI, machine learning, and deep learning before going into implementation details.
  5. Machine Learning Workflow Follow the practical path from data and features to training, prediction, and evaluation.
  6. Model Training and Evaluation Understand loss, overfitting, train/test splits, accuracy, recall, and F1.
  7. Neural Network Basics Move from perceptrons to activation, forward propagation, backpropagation, and training loops.
  8. Matrix Calculus for Neural Networks Derive dL/dW for y = Wx + b and verify it with finite differences.
  9. Backpropagation as a Computation Graph Trace local gradients through ReLU and softmax cross-entropy in a two-layer MLP.
  10. Gradient Descent and Optimizer Geometry Compare gradient descent, momentum, and Adam on a visible quadratic loss surface.
  11. Convolution and Receptive Field Math Compute convolution output size, receptive fields, channel mixing, and im2col layout.
  12. Transformer Attention Math Hand-calculate Q/K/V scores, softmax weights, masks, multi-head structure, and KV cache.
  13. Python AI Mini Practice Run a small scikit-learn classification task and read the experiment output.
  14. Handwritten Digit Dataset Basics Read train.csv, test.csv, labels, and the flattened 28 by 28 pixel layout before training the classifier.
  15. Handwritten Digit Softmax in C Follow the C implementation from logits and softmax probabilities to confusion matrices and submission export.
  16. Handwritten Digit Playground Notes See how the offline classifier was adapted into a browser demo with drawing input and probability output.
  17. CIFAR-10 Tiny CNN Tutorial in C Build and train a small convolutional neural network for CIFAR-10 image classification, then read its loss and accuracy output.
  18. High-Entropy Traffic Defense Notes Study encrypted metadata leaks, entropy, traffic classifiers, and a defensive Python chaffing prototype.
  19. AI Security Threat Modeling Build a defense map with NIST adversarial ML, MITRE ATLAS, and OWASP LLM risks.
  20. Adversarial Examples and Robust Evaluation Evaluate clean and perturbed accuracy with an FGSM-style digits experiment.
  21. Data Poisoning and Backdoor Defense Study poison rate, trigger behavior, attack success rate, and training pipeline controls.
  22. Model Privacy and Extraction Defense Measure membership inference signal and surrogate fidelity against a local toy model.
  23. LLM, RAG, and Agent Security Separate instructions from data and enforce tool permissions against indirect prompt injection.
  24. Large Language Models From a Developer’s Angle: Word Association at Scale What an LLM is doing underneath the marketing: next-token prediction driven by the Transformer. Covers the architectural workflow, running an 8B model locally in Python, the hardware pitfalls encountered on the way, and what actually matters for developers building on top of these models.
  25. Multimodal LLM Architecture: How Vision Gets Aligned With Language The crux of multimodal models is modality alignment. Covers the end-to-end architecture, the mathematics behind Q-Former and cross-attention, an MLP projection layer implemented in PyTorch, and why a linear projection and a two-layer MLP behave differently in production.
  26. KV Cache VRAM Explosion When Deploying Multimodal LLMs Deploying LLaVA, Qwen-VL or InternVL runs into the same wall: KV cache memory. Covers the derivation of KV cache consumption, how AnyRes and dynamic resolution mitigate visual token explosion, 4-bit quantised inference with llama.cpp, and the engineering traps behind each.
  27. Visual Instruction Tuning: Where the Loss Function Actually Applies The mechanics of visual instruction tuning, focusing on loss construction. Covers multimodal auto-regressive next-token prediction, the data flow from JSON to masked labels, the PyTorch label-masking implementation, and the production pitfalls that follow from getting the mask wrong.
  28. Deep Learning Frameworks: Why You Stop Writing Backpropagation by Hand Once you have written a small neural network from scratch, the question becomes whether you must hand-code matrix multiplication and backpropagation every time. Covers what frameworks actually provide, the two major camps and how they differ, which one suits a beginner, and the same simple layer defined in each.

Published resources

  1. Python AI practice code guide The article includes a runnable scikit-learn classification script.
  2. digit_softmax_classifier.c The C source for the handwritten digit softmax classifier.
  3. train.csv.zip Compressed handwritten digit training set with 42000 labeled samples.
  4. test.csv.zip Compressed handwritten digit test set with 28000 unlabeled samples.
  5. sample_submission.csv The official submission format example for checking the final output columns.
  6. submission.csv The prediction file generated by the current C project.
  7. digit-playground-model.json The compact softmax demo model and sample set used by the browser playground.
  8. digit-sample-grid.svg A small handwritten digit preview grid extracted from the training set.
  9. Handwritten digit project bundle Contains the source file, compressed datasets, submission files, browser model, and preview grid.
  10. cifar10_tiny_cnn.c source Single-file C tiny CNN with CIFAR-10 loading, convolution, pooling, softmax, and backpropagation.
  11. model_weights.bin sample weights Model weights generated by one local small-sample run.
  12. test_predictions.csv sample predictions Sample test prediction output from the CIFAR-10 tiny CNN.
  13. CNN project explanation PDF Companion explanation material for the CNN project.
  14. Virtual Mirror redacted code skeleton A redacted mld_chaffing_v2.py control-flow skeleton with secrets, node topology, and target lists removed.
  15. Virtual Mirror stress-test template A redacted CSV template for CPU, memory, peak threads, pulse rate, latency, and error measurements.
  16. Virtual Mirror classifier-evaluation template A CSV template for TP, FN, FP, TN, accuracy, precision, recall, F1, ROC-AUC, entropy, and JS divergence.
  17. Virtual Mirror resource notes Notes explaining why the public resources include only redacted code, test templates, and architecture context.
  18. AI Security Lab README Setup, safety boundaries, and quick-run commands for the AI Security series.
  19. AI Security Lab full bundle Includes safe toy scripts, result CSVs, risk register, attack-defense matrix, and architecture diagram.
  20. AI security risk register CSV risk register template for AI threat modeling and release review.
  21. AI attack-defense matrix Maps attack surface, toy demo, metric, and defensive control into one CSV table.
  22. AI Security Lab architecture diagram Shows threat modeling, robustness, data integrity, model privacy, and RAG guardrails.
  23. FGSM digits robustness script FGSM-style perturbation and accuracy-drop experiment for a local digits classifier.
  24. Data poisoning and backdoor toy script Demonstrates poison rate, trigger behavior, and attack success rate on digits.
  25. Model privacy and extraction toy script Outputs membership AUC, target accuracy, surrogate fidelity, and surrogate accuracy.
  26. RAG prompt injection guard toy script Uses a deterministic toy agent to demonstrate external-data demotion and tool-policy blocking.
  27. Deep Learning Math Lab README Setup commands, script entry points, generated outputs, and figure notes for the math series.
  28. Deep learning math full lab bundle Bundles NumPy scripts, CSV outputs, formula diagrams, loss contours, convolution figures, and attention heatmaps.
  29. Gradient check results CSV Stores MSE analytic gradients, finite-difference gradients, and error norms.
  30. Optimizer path CSV Step-by-step coordinates and loss for gradient descent, momentum, and Adam on a 2D quadratic.
  31. Attention weights CSV Scores, softmax weights, and context vectors for a three-token scaled dot-product attention example.
  32. Deep learning math figure set Includes matrix shapes, computation graphs, loss contours, convolution scans, and attention heatmaps.
  33. Deep learning math interactive visualizer Browser modules for gradient checking, optimizer paths, convolution output size, and attention heatmaps.
  34. Deep Learning topic share card A 1200x630 SVG card for sharing the Deep Learning / CNN topic hub.
  35. Machine Learning From Scratch share card A 1200x630 SVG card for the K-means, Iris, and ML workflow topic hub.
  36. Student AI Projects share card A 1200x630 SVG card for handwritten digits, C classifiers, and browser demos.
  37. CNN convolution scan animation An 8-second Remotion animation showing how a 3x3 convolution kernel scans an input and builds a feature map.

Current route

  1. AI Basics Learning Roadmap Learning path step
  2. Machine Learning Workflow Learning path step
  3. Model Training and Evaluation Learning path step
  4. Neural Network Basics Learning path step
  5. Matrix Calculus for Neural Networks Learning path step
  6. Backpropagation as a Computation Graph Learning path step
  7. Gradient Descent and Optimizer Geometry Learning path step
  8. Convolution and Receptive Field Math Learning path step
  9. Transformer Attention Math Learning path step
  10. LLM Visualizer Learning path step
  11. Python AI Mini Practice Learning path step
  12. Handwritten Digit Dataset Basics Learning path step
  13. Handwritten Digit Softmax in C Learning path step
  14. Handwritten Digit Playground Notes Learning path step
  15. CIFAR-10 Tiny CNN Tutorial in C Learning path step
  16. High-Entropy Traffic Defense Notes Learning path step
  17. AI Security Threat Modeling Learning path step
  18. Adversarial Examples and Robust Evaluation Learning path step
  19. Data Poisoning and Backdoor Defense Learning path step
  20. Model Privacy and Extraction Defense Learning path step
  21. LLM, RAG, and Agent Security Learning path step

Next notes

  1. Add more image-classification and error-analysis cases
  2. Turn common metrics into a quick reference
  3. Add more AI security defense experiment notes

Resources

2D Animation Principles

Reduce animation-software controls to mathematical principles that can be calculated, dragged, verified, and mapped to real character assets.

A route from character segmentation and SVG assets through bone matrices, two-bone IK, skinning weights, seam repair, and keyframe interpolation.

Next notes

  • Add multi-joint FABRIK and constraint solving
  • Add mesh weight painting and corrective-shape examples

Published posts

Modern 2D Skeletal Runtimes: Mesh Deformation, Draw Order, and Constraints

Linear blend skinning cannot express folds, draw order or follow-through. Why mesh deformation must be applied in bind space, why draw order is a discrete track, and how Live2D's parameter-driven keyforms produce pseudo-3D.

Level: Professional Reading time: 12 min
  • Spine
  • Live2D
  • Mesh Deformation
  • Constraints

Animate’s HTML5 Canvas Runtime: Display List, Repaint Cost, and Caching

Publishing compiles the timeline into a CreateJS display tree, and the canvas repaints entirely every frame. Why vectors pay rasterisation per frame, the three cache parameter traps, and why filters require caching.

Level: Intermediate Reading time: 10 min
  • CreateJS
  • Canvas
  • EaselJS
  • Performance

Secondary Motion: Damped Springs for Hair and Tails

The keyframes are dialled in and the character still reads as stiff, because secondary motion is missing — the parts dragged along by the primary action that arrive a beat late. This covers parameterising a damped spring as frequency and damping ratio, and five traps in wiring it into a 2D skeletal system: why explicit Euler is unconditionally unstable, frame-rate dependent results, root-to-tip chain ordering, springing angles rather than positions, and why teleports blow it up.

Level: Practical Reading time: 13 min
  • semi-implicit Euler
  • damping ratio
  • bone chain

Squash and Stretch: Why Non-Uniform Scale Cannot Pass Through a Rotation

Wire squash and stretch into a skeletal system and nearly all the difficulty comes from one fact: non-uniform scale does not propagate down a hierarchy as safely as rotation and translation. This covers area preservation in 2D and the two things it does not preserve, why the wrong pivot sinks a ball into the floor, and the core trap — a parent scale times a child rotation contains shear, so only the rotated parts come out skewed.

Level: Practical Reading time: 12 min
  • affine transform
  • shear
  • pivot
  • smear

Project timeline

Published posts

  1. The Animate Timeline and Symbol Model: How Graphic and Movie Clip Resolve Frames Derive the frame-resolution formulas behind Graphic symbol loop modes, explain why a Movie Clip shows only frame 1 while authoring and collapses during frame-by-frame export, and why lip sync requires Graphic.
  2. Shape Tweening and Vector Morphing: Vertex Correspondence, Shape Hints, and SVG Paths Shape tween explosions come from start-offset ambiguity on closed contours. Derive the correspondence cost function, show how shape hints act as constraints, and map it onto modern SVG path morphing.
  3. Modern 2D Skeletal Runtimes: Mesh Deformation, Draw Order, and Constraints Linear blend skinning cannot express folds, draw order or follow-through. Why mesh deformation must be applied in bind space, why draw order is a discrete track, and how Live2D's parameter-driven keyforms produce pseudo-3D.
  4. Animate’s HTML5 Canvas Runtime: Display List, Repaint Cost, and Caching Publishing compiles the timeline into a CreateJS display tree, and the canvas repaints entirely every frame. Why vectors pay rasterisation per frame, the three cache parameter traps, and why filters require caching.
  5. Character Image to SVG Animation Asset Pipeline: ComfyUI, Grounded-SAM, OpenPose, and vtracer The first article in the 2D animation principles column: use ComfyUI IP-Adapter, OpenPose exploded layout, Grounded-SAM matting, and vtracer to build rig assets.
  6. 2D Skeletal Animation Math: Local Space, Pivot Matrices, and Forward Kinematics Derive 2D forward kinematics from homogeneous matrices, pivot rotation, and parent-child transforms, then verify end-point coordinates interactively.
  7. Two-Bone Inverse Kinematics in 2D: Law of Cosines, Reachability, and Elbow Flips Solve 2D shoulder and elbow angles analytically with the law of cosines while handling unreachable targets, numeric boundaries, and elbow continuity.
  8. Secondary Motion: Damped Springs for Hair and Tails The keyframes are dialled in and the character still reads as stiff, because secondary motion is missing — the parts dragged along by the primary action that arrive a beat late. This covers parameterising a damped spring as frequency and damping ratio, and five traps in wiring it into a 2D skeletal system: why explicit Euler is unconditionally unstable, frame-rate dependent results, root-to-tip chain ordering, springing angles rather than positions, and why teleports blow it up.
  9. Squash and Stretch: Why Non-Uniform Scale Cannot Pass Through a Rotation Wire squash and stretch into a skeletal system and nearly all the difficulty comes from one fact: non-uniform scale does not propagate down a hierarchy as safely as rotation and translation. This covers area preservation in 2D and the two things it does not preserve, why the wrong pivot sinks a ball into the floor, and the core trap — a parent scale times a child rotation contains shear, so only the rotated parts come out skewed.
  10. Linear Blend Skinning for 2D Animation: Weights, Joint Deformation, and Seam Repair Derive linear blend skinning and explain normalized weights, inverse bind matrices, joint collapse, alpha contamination, and SVG seam dots.
  11. 2D Keyframe Interpolation: Linear, Smoothstep, Bezier, and Frame-Rate-Independent Motion Use derivatives to compare linear and eased velocity, then derive smoothstep, cubic Bezier curves, and frame-rate-independent timeline sampling.

Published resources

  1. Basic SAM + vtracer script Local reference script for character segmentation, PNG layers, and SVG vectorization.
  2. ComfyUI + Grounded-SAM production script Coordinates local ComfyUI, Grounding DINO, SAM, and vtracer to build SVG rig assets with stable IDs.
  3. ComfyUI exploded character workflow template Editable API workflow template for IP-Adapter identity locking and ControlNet OpenPose exploded layout.
  4. Exploded OpenPose skeleton Layout reference for separated head, torso, arms, and legs; export to PNG for ControlNet if needed.
  5. Animation part prompt list Grounding DINO prompts for semantic matting: head, left arm, torso, tail, accessory, and more.

Next notes

  1. Add multi-joint FABRIK and constraint solving
  2. Add mesh weight painting and corrective-shape examples

Resources

Algorithm Implementation Project

Keep algorithm explanations and runnable implementations together as durable references.

Implementation-focused notes around backtracking, bit operations, clustering, code, diagrams, and downloads.

Next notes

  • Add more runnable algorithm examples
  • Expand downloadable example inputs

Published posts

A Contour Tracer’s Stopping Condition: Three Lines Out of Order, Twenty Times the Area

Jacob's stopping criterion for Moore-neighbourhood tracing requires position and direction to match. I checked before updating the direction, using the previous iteration's leftover value, so the condition almost never fired — the tracer looped until the iteration cap, and the shoelace formula then closed the unclosed point list straight across the region.

Level: Advanced Reading time: 7 min
  • Moore neighbourhood
  • Jacob's criterion
  • Shoelace

Project timeline

Published posts

  1. A Contour Tracer’s Stopping Condition: Three Lines Out of Order, Twenty Times the Area Jacob's stopping criterion for Moore-neighbourhood tracing requires position and direction to match. I checked before updating the direction, using the previous iteration's leftover value, so the condition almost never fired — the tracer looped until the iteration cap, and the shoelace formula then closed the unclosed point list straight across the region.
  2. Getting Started with Backtracking: Solving Eight Queens in C and Python Explain the state representation, conflict checks, recursive process and complete solution of the eight queens backtracking search in C and Python.
  3. Backtracking, Advanced: Optimising Eight Queens with Bitwise Operations (C / Python) Optimise the eight queens search with bitmasks to cut the cost of state checks, with matching implementations in C and Python.
  4. Getting Started with K-means Clustering: A C Implementation on the Iris Dataset Work through K-means++ initialisation, iterative convergence and result analysis using Iris.csv, C source code, a flowchart and a visualisation.
  5. Image to Unicode Quadrant ANSI: Principles, Implementation and a Browser Tool Explain how any image is compressed into truecolor Unicode quadrant ANSI: 2 x 2 pixel blocks, minimum-error two-colour approximation, .ans files and browser-side privacy boundaries.

Published resources

  1. Iris.csv dataset The 150-sample Iris dataset used by the K-means article.
  2. Iris_sort_K_mean.c source Includes standardization, K-means++ initialization, restarts, and SSE selection.
  3. K-means flowchart SVG flowchart for the C program execution path.
  4. Cluster visualization A 2D scatter projection using petal length and petal width.
  5. K-means zip package Contains dataset, source code, flowchart, and visualization.
  6. Gaoshu Lianxi PDF A public advanced calculus practice PDF for review or printing.
  7. Algorithm Visualization share card A 1200x630 SVG card for eight queens, backtracking, bitmasks, and the playground.
  8. K-means iteration animation A Remotion clip showing sample assignment, centroid updates, and SSE reduction.
  9. Eight queens backtracking animation A Remotion clip showing row-by-row search, conflict pruning, and backtracking.

Current route

  1. Eight queens with classic backtracking Learning path step
  2. Bitwise optimization for the eight queens problem Learning path step
  3. K-means clustering on the Iris dataset in C Learning path step
  4. K-means companion downloads Learning path step

Next notes

  1. Add more runnable algorithm examples
  2. Expand downloadable example inputs

Resources

Site Building Project

Keep the site-building process maintainable, reversible, and ready to extend.

Notes on the bilingual site structure, content sync, categories, comments, and deployment workflow.

Next notes

  • Keep documenting deployment and maintenance notes
  • Clarify the content sync workflow

Published posts

Auditing My Own Site’s Structure: A Metric That Was Wrong by 8x

Trying to quantify whether my articles all look the same, I first measured 92% and wrote it into my conclusions. That number counted the theme template as article structure; corrected, it is 12%. This is about the measurement: defining "shape", where I drew the boundary wrong, why one metric hides the real problem, and the accidental control that finally killed it.

Reading time: 10 min
  • curl
  • Python
  • entropy
  • WordPress

Moving an Entire Image Pipeline Into the Browser: It Saves More Than CPU

A tool that takes character images, cuts them out, separates layers and produces an SVG asset library — with nothing uploaded. The original motivation was a single-core origin that could not host server-side image processing; what it actually saved was storage, moderation, privacy obligations and concurrency. Covers the five-step implementation, the price of IndexedDB, replacing a compression library with ZIP stored mode, and the one unavoidable cost.

Level: Advanced Reading time: 11 min
  • Canvas
  • IndexedDB
  • ONNX Runtime Web
  • ZIP

Featured Image Set, og:image Empty: Yoast’s Stale Indexable Cache

I attached featured images to 19 posts. The admin looked right, the page source had no og:image — and the JSON-LD on the same page already pointed at the new cover. That pairing is the diagnosis: the two outputs travel different paths, one computed live and one read from a precomputed index table.

Reading time: 6 min
  • WordPress
  • Yoast
  • WP-CLI
  • Open Graph

Only 276 MB of 8.3 GB Was Unique: Forensics Before a Delete

The server hit 86% disk with deploy backups at 8280 MB. Before deleting anything I worked out how much was genuinely unique — 276 MB, with the rest being one set of files copied 228 times. A set-difference check run before the delete recovered seven files that existed only in historical snapshots.

Reading time: 9 min
  • rsync
  • tar
  • sha256
  • Cloudflare Tunnel

Read-Only Is Structural, Not a Discipline: Ten Traps in Wiring a Self-Hosted Mailbox to AI

Wiring a self-hosted mailbox into an AI assistant: the protocol half is easy, making read-only structural rather than a promise is not. Traps hit along the way -- a rejection letter whose boilerplate says has been accepted, a syntax check that passed while authentication became dead code, a shared failure latch that took every user down at once, and why a synthetic click cannot tell a dead button from a blocked popup.

Level: Overview Reading time: 4 min
  • WordPress
  • Cloudflare
  • Content Workflow

Project timeline

Published posts

  1. Auditing My Own Site’s Structure: A Metric That Was Wrong by 8x Trying to quantify whether my articles all look the same, I first measured 92% and wrote it into my conclusions. That number counted the theme template as article structure; corrected, it is 12%. This is about the measurement: defining "shape", where I drew the boundary wrong, why one metric hides the real problem, and the accidental control that finally killed it.
  2. Moving an Entire Image Pipeline Into the Browser: It Saves More Than CPU A tool that takes character images, cuts them out, separates layers and produces an SVG asset library — with nothing uploaded. The original motivation was a single-core origin that could not host server-side image processing; what it actually saved was storage, moderation, privacy obligations and concurrency. Covers the five-step implementation, the price of IndexedDB, replacing a compression library with ZIP stored mode, and the one unavoidable cost.
  3. Featured Image Set, og:image Empty: Yoast’s Stale Indexable Cache I attached featured images to 19 posts. The admin looked right, the page source had no og:image — and the JSON-LD on the same page already pointed at the new cover. That pairing is the diagnosis: the two outputs travel different paths, one computed live and one read from a precomputed index table.
  4. Only 276 MB of 8.3 GB Was Unique: Forensics Before a Delete The server hit 86% disk with deploy backups at 8280 MB. Before deleting anything I worked out how much was genuinely unique — 276 MB, with the rest being one set of files copied 228 times. A set-difference check run before the delete recovered seven files that existed only in historical snapshots.
  5. Welcome to haotianblog: what this bilingual technical site covers An introduction to the bilingual site, its technical focus, and the kinds of articles and resources it will publish.
  6. Read-Only Is Structural, Not a Discipline: Ten Traps in Wiring a Self-Hosted Mailbox to AI Wiring a self-hosted mailbox into an AI assistant: the protocol half is easy, making read-only structural rather than a promise is not. Traps hit along the way -- a rejection letter whose boilerplate says has been accepted, a syntax check that passed while authentication became dead code, a shared failure latch that took every user down at once, and why a synthetic click cannot tell a dead button from a blocked popup.

Published resources

  1. SEO distribution short-video storyboards Four 45-60 second storyboard scripts ready for later Remotion production.

Next notes

  1. Keep documenting deployment and maintenance notes
  2. Clarify the content sync workflow

Resources

Scroll down