|Latest Writing
Verified research logs from Medium.
How Encoder Transformers Actually Understand Language
Read Publication →
ModernBERT and the Topological Collapse Problem
Read Publication →
I Dissected Two Language Models to Find Out Where They Hide Their Cybersecurity Knowledge
Read Publication →
Recursive Language Models: The End of Context Rot
Read Publication →
2026: The Year AI Goes Smarter, Not Bigger
Read Publication →
How Brain-Inspired AI is Revolutionizing Complex Reasoning
Read Publication →
The Math Behind Graph Attention Networks (GAT)
Read Publication →
How Encoder Transformers Actually Understand Language
Read Publication →
ModernBERT and the Topological Collapse Problem
Read Publication →
I Dissected Two Language Models to Find Out Where They Hide Their Cybersecurity Knowledge
Read Publication →
Recursive Language Models: The End of Context Rot
Read Publication →
2026: The Year AI Goes Smarter, Not Bigger
Read Publication →
How Brain-Inspired AI is Revolutionizing Complex Reasoning
Read Publication →
The Math Behind Graph Attention Networks (GAT)
Read Publication →
Primary Research
Pre-prints on AI security and model internals.
ThreatForest: Multi-Agent Attack Tree Generation with Pluggable TTP Framework Mapping
Cristian Leo, Anton Dykyi, Danny Cortegaca, Daniel Begimher, Prakash Jha
A multi-agent system that turns source code repositories into attack trees mapped to MITRE ATT&CK, CAPEC, and cloud threat matrices, with evidence-based mitigations. Presented at Black Hat USA 2026.
SIR-Bench: Evaluating Investigation Depth in Security Incident Response Agents
Daniel Begimher, Cristian Leo, Jack Huang, Pat Gaw, Bonan Zheng
Introduces a benchmark of 794 cases evaluating autonomous SIR agents. Differentiates genuine forensic investigation from 'alert parroting' using the Once Upon A Threat (OUAT) framework.
Geometric Concept Spaces in Small Encoders: A Comparative Mechanistic Probing of ModernBERT and DeBERTa-v3
Cristian Leo
Mechanistic probing of ModernBERT and DeBERTa-v3 to identify how factual associations and concepts are represented in geometric latent spaces.
Survey of Attention Mechanisms in Encoder-Only Language Models
Cristian Leo
Comprehensive survey of architectural variations in attention mechanisms specifically for encoder-only transformers, focusing on efficiency and security applications.
ThreatForest: Multi-Agent Attack Tree Generation with Pluggable TTP Framework Mapping
Cristian Leo, Anton Dykyi, Danny Cortegaca, Daniel Begimher, Prakash Jha
A multi-agent system that turns source code repositories into attack trees mapped to MITRE ATT&CK, CAPEC, and cloud threat matrices, with evidence-based mitigations. Presented at Black Hat USA 2026.
SIR-Bench: Evaluating Investigation Depth in Security Incident Response Agents
Daniel Begimher, Cristian Leo, Jack Huang, Pat Gaw, Bonan Zheng
Introduces a benchmark of 794 cases evaluating autonomous SIR agents. Differentiates genuine forensic investigation from 'alert parroting' using the Once Upon A Threat (OUAT) framework.
Geometric Concept Spaces in Small Encoders: A Comparative Mechanistic Probing of ModernBERT and DeBERTa-v3
Cristian Leo
Mechanistic probing of ModernBERT and DeBERTa-v3 to identify how factual associations and concepts are represented in geometric latent spaces.
Survey of Attention Mechanisms in Encoder-Only Language Models
Cristian Leo
Comprehensive survey of architectural variations in attention mechanisms specifically for encoder-only transformers, focusing on efficiency and security applications.
Active Projects
Real-time deployment streams.
ThreatForest
Agentic threat modeling that turns a code repository into MITRE ATT&CK-mapped attack trees with mitigations.
models-from-scratch-python
Recreating popular machine learning models from scratch using only Python and NumPy.
rag-knowledge-graph
Implementation of Retrieval-Augmented Generation (RAG) using Knowledge Graphs.
InfluencerPy
A specialized CLI application designed to automate social media management and interaction tasks.
montecarlo-portfolio-management
Quantitative finance tool for risk analysis using Monte Carlo simulations.
Reinforcement-Learning
Deep dives into RL algorithms and gymnasium environments.
ThreatForest
Agentic threat modeling that turns a code repository into MITRE ATT&CK-mapped attack trees with mitigations.
models-from-scratch-python
Recreating popular machine learning models from scratch using only Python and NumPy.
rag-knowledge-graph
Implementation of Retrieval-Augmented Generation (RAG) using Knowledge Graphs.
InfluencerPy
A specialized CLI application designed to automate social media management and interaction tasks.
montecarlo-portfolio-management
Quantitative finance tool for risk analysis using Monte Carlo simulations.
Reinforcement-Learning
Deep dives into RL algorithms and gymnasium environments.