Blog

What an Adversarial Example Is

In 2014, Szegedy and colleagues made an odd discovery: state-of-the-art image classifiers reliably misclassify inputs that are only slightly different from ones they classify correctly, differences small enough that a human looking at both images can’t tell them apart. Stranger still, the same crafted input often fools multiple different models, even ones with different architectures trained on different subsets of data. That transferability was the first clue that this wasn’t a quirk of one specific network, it was something more structural.

The initial guess was that extreme non-linearity in deep networks caused the blind spot. Goodfellow and colleagues argued the opposite the following year: modern networks are actually too linear in high-dimensional space, and that linearity is precisely what makes them predictably sensitive to small perturbations pushed in a consistent direction.

The Fast Gradient Sign Method

That insight led directly to FGSM, the Fast Gradient Sign Method, introduced by Goodfellow, Shlens, and Szegedy in 2014. It’s a single-step attack: take the gradient of the model’s loss with respect to the input, take the sign of each element, scale it by a small factor, and add that to the original input. One gradient computation is enough to reliably push an image across a decision boundary while keeping the change nearly invisible to a human. Kurakin and colleagues later measured this at scale on ImageNet, finding top-1 error rates around 63 to 69 percent for reasonably chosen perturbation sizes.

FGSM’s cheapness is also its limitation. It’s easy to defend against directly once a model has seen that kind of perturbation during training, which is part of why it became less an attack people worry about and more a building block, and a standard benchmark, for what came next.

Case: Stickers on a Stop Sign

The clearest demonstration that this isn’t confined to digital pixel manipulation came from Eykholt and colleagues in 2018. Their RP2 algorithm found a small set of black and white stickers that, placed in specific positions on a real, physical stop sign, caused a road-sign classifier to read it as a Speed Limit 45 sign, consistently, from a range of distances and viewing angles. This wasn’t a manipulated image file, it was a printed sticker on an actual sign photographed by an actual camera under actual lighting.

The result mattered directly for autonomous driving, where a sign classifier misreading a stop sign has obvious consequences. Follow-up work extended the same idea to object detectors like YOLO, trying to make the sign disappear from detection entirely rather than just get mislabeled, and other researchers found that some detectors resisted the original attack, which kicked off a genuine back and forth of attack and counter-attack papers that’s continued for years.

Projected Gradient Descent and Adversarial Training

Madry and colleagues formalized a much stronger, iterative version of the same idea in 2018: Projected Gradient Descent (PGD), which takes multiple small gradient steps instead of one, projecting back into the allowed perturbation region after each step. PGD quickly became the standard benchmark attack, strong enough that a defense which survives it is taken seriously, and one that doesn’t, generally isn’t.

The matching defense, adversarial training, bakes PGD directly into the training loop: at every step, generate a PGD-perturbed version of each training example and train the model on that instead of the clean input, framed formally as a min-max optimization problem. Athalye and colleagues later broke most of the defenses submitted to a major 2018 robustness competition using stronger attack variants within weeks of the review cycle ending. PGD adversarial training was one of the few that held up, and it largely still does.

The Attack-Defense Cycle

That pattern, a defense proposed, then broken within months by a slightly stronger attack, repeated often enough that it became something researchers explicitly study as a cycle rather than a series of one-off events. PGD adversarial training surviving this long is the exception, not the norm.

It comes at a real cost, though. Training against PGD-generated examples at every step multiplies training time, since each step now runs an inner optimization loop of its own. More importantly, models trained this way tend to lose accuracy on ordinary, unperturbed inputs, a robustness-accuracy tradeoff that’s been measured repeatedly and that researchers are still actively trying to narrow rather than eliminate.

Case: Jailbreaking Language Models with GCG

The same underlying idea shows up again, a decade later, in a very different kind of model. Zou and colleagues introduced the Greedy Coordinate Gradient (GCG) attack in 2023: an automated search for a short suffix of otherwise meaningless tokens that, appended to a harmful request, reliably pushes an aligned language model into starting its response with something like «Sure, here’s how to» instead of refusing.

The property that made FGSM interesting shows up here too. A suffix optimized against one open-weight model frequently transfers to other models the attacker never had direct gradient access to, including closed commercial systems. Follow-up work built generative models that can produce large numbers of these successful suffixes in seconds rather than requiring a fresh optimization run each time, pushing attack success rates on some tested open models close to 100 percent. Separate mechanistic research found these suffixes work by hijacking the model’s internal attention, dominating how it contextualizes the rest of the prompt in the moment right before it starts generating a response.

Conclusion

From a stop sign with stickers on it to a string of gibberish tokens appended to a chatbot prompt, the same fact keeps resurfacing: a model trained to minimize error over a data distribution doesn’t automatically learn a decision boundary that lines up with human intuition about which inputs count as «similar.» Anyone with gradient access, or in some cases just enough queries and compute, can find the specific direction where that mismatch is largest and push an input across it. Every generation of models so far, image classifiers, object detectors, aligned language models, has shipped with some version of this blind spot, and every defense proposed against it has bought time rather than closed the gap for good.

By: Max Johnson B.

What Differential Privacy Guarantees

Differential privacy is a formal mathematical definition of privacy, not just a set of best practices. Introduced by Cynthia Dwork and colleagues in 2006, it says a mechanism (an algorithm that processes a dataset and returns some output) is ε-differentially private if the probability of any given output barely changes whether or not any single person’s record is included in the dataset. Formally, for two «neighboring» datasets that differ by exactly one record, the probability of any output S under mechanism M satisfies Pr[M(D) ∈ S] ≤ e^ε · Pr[M(D’) ∈ S].

What that buys you is specific: someone looking at the output cannot confidently infer whether any particular individual’s data was even in the dataset, let alone what it said. This is a stronger guarantee than older anonymization techniques, which typically just strip names and IDs from a dataset and hope the remaining fields aren’t enough to re-identify anyone. That hope has failed repeatedly once attackers cross-reference «anonymized» data with outside information. Differential privacy doesn’t rely on hoping.

The Epsilon Parameter

The strength of the guarantee is controlled by ε, often called the privacy budget. Smaller ε means less the output can shift based on one person’s data, which means stronger privacy and, unavoidably, more noise and less accuracy. Many deployments also add a second parameter, δ, a tiny probability (often around 10⁻⁵) that the strict guarantee fails in some worst case, giving what’s called (ε, δ)-differential privacy.

Choosing ε in practice is genuinely hard, and not just technically. A 2023 study out of Northwestern, UC San Diego, Columbia, and Boston University found that when people are shown a specific ε value, they reason about it poorly, and their willingness to share data barely tracks what the number actually implies about their risk. Some privacy researchers argue ε shouldn’t exceed roughly 1.1 (ln 3) for a genuinely strong guarantee. Real deployments frequently use much higher values, which is a tension that shows up directly in the case studies below.

The Laplace Mechanism

The most common way to actually add the noise is the Laplace mechanism. Given a function f computed on a dataset, you add random noise drawn from a Laplace distribution, scaled to the function’s global sensitivity, meaning how much f’s output can change if you swap out one single record. A function with low sensitivity needs less noise to hide any one person’s contribution; a function where one record can swing the output wildly needs a lot more. For choosing among a set of discrete options rather than releasing a number, a related tool called the exponential mechanism does the analogous job.

The underlying idea in both cases is the same: figure out how much one person could possibly move the answer, then inject enough randomness to blur exactly that much.

Case: The 2020 US Census

The clearest large-scale test of this framework in the wild is the US Census Bureau, which for the first time used differential privacy, through what it calls its Disclosure Avoidance System, to protect the 2020 decennial census, replacing an older method called data swapping. It set off a real fight among demographers and social scientists.

Studies since then have found that the noise is genuinely well-behaved at large scale: aggregate population totals for big geographic units like counties come out accurate. The trouble shows up at smaller scales. Research from Mueller and Santos-Lozada found the algorithm introduces disproportionate discrepancies for rural populations and for non-white subgroups specifically, exactly the kind of small-area estimate that local governments and researchers rely on. Steven Ruggles, director of the Minnesota Population Center, became the method’s most vocal critic, arguing the older swapping approach did less damage to accuracy while offering comparable protection. Harvard researchers led by Kosuke Imai ran simulations using the Bureau’s disclosure parameters and found the added noise could meaningfully shift generated redistricting maps, connecting a math parameter to actual electoral map-drawing.

None of this means the Bureau made an obviously wrong call. It means the tradeoff differential privacy makes explicit, more privacy protection costs some accuracy, became something people had to actually negotiate over instead of ignore, and the negotiation got contentious.

Case: Apple’s Local Differential Privacy

Apple runs a different flavor of the same idea, called local differential privacy, where the noise gets added directly on a person’s device before anything is transmitted, so Apple’s own servers never receive real data to begin with. That’s distinct from the Census Bureau’s approach, where a trusted central curator holds the real data and adds noise before releasing results.

Apple uses this for QuickType keyboard suggestions, emoji suggestions, Lookup Hints, and several Safari behaviors like detecting energy-draining or crash-prone domains, using a technique called Count Mean Sketch. The published epsilon values are concrete: emoji suggestions use ε=4 with one contribution per day, QuickType uses ε=8 with two donations per day, Health Type Usage uses ε=2. Those numbers sit well above the roughly 1.1 ceiling some privacy researchers consider genuinely strong, and that gap didn’t go unnoticed. A 2023 paper on what its authors called pool inference attacks showed that once you account for a user’s contributions accumulating over time rather than looking at a single donation in isolation, Apple’s real-world privacy loss is measurably higher than the individual epsilon values alone would suggest.

Training Neural Networks with DP-SGD

Differential privacy also gets applied directly to training machine learning models, using an algorithm called DP-SGD, introduced by Abadi and colleagues in 2016. It modifies ordinary stochastic gradient descent in two steps: compute the gradient for each individual training example separately and clip it to a fixed maximum size, bounding how much any single example can influence the update, then add calibrated Gaussian noise to the clipped gradients before applying them.

The motivation isn’t hypothetical. Separate research by Carlini and colleagues has repeatedly shown that neural networks, language models in particular, can memorize specific training examples closely enough to regurgitate them later, which is a real privacy failure if the training data included anything sensitive. DP-SGD gives the resulting model a formal guarantee against that. The cost is real too: the literature consistently describes a substantial accuracy gap between DP-SGD-trained models and their non-private equivalents at any reasonably strong privacy budget, and the per-example gradient computation is considerably slower and more memory-hungry than standard training, which is a big part of why DP-SGD, despite being the academic standard answer, still isn’t the default in most production training pipelines.

The Privacy Budget Problem

Epsilon isn’t a setting you configure once. Every additional query, or every additional training step run against the same underlying data, spends more of the privacy budget, and these costs compose. Run the same mechanism multiple times against one dataset and the effective privacy loss adds up across all of them, not just the individual runs. Abadi and colleagues introduced a more careful accounting method called the moments accountant to track this more tightly than naive addition would, later generalized by Mironov into a broader framework called Rényi differential privacy.

The practical consequence is that an organization can’t just pick one good ε and call it solved. If a dataset gets queried repeatedly, or a model gets retrained or fine-tuned again and again on the same data, the total privacy loss has to be tracked and budgeted across the entire pipeline, the same way you’d budget a limited resource, because it genuinely is one.

Closing Observations

Differential privacy doesn’t tell anyone what epsilon to pick. What it does is force that choice into the open and make it mathematically provable instead of a guess dressed up as a policy. The Census Bureau’s fight with demographers, Apple’s epsilon values sitting well above what researchers consider genuinely strong, and DP-SGD’s accuracy hit during training are really the same argument playing out in three different rooms: somebody has to decide how much noise is tolerable, and there’s no universal correct number that works for every dataset and every use case.

That’s arguably the honest contribution here. Older anonymization approaches let organizations avoid that conversation entirely by pretending stripping a name off a record was enough. Differential privacy doesn’t let anyone avoid it, it just gives them a rigorous way to have it.

By: Max Johnson B.

Moving the Model, Not the Data

The default way to build a machine learning model is to collect data in one place and train on it there. Federated learning inverts that. Instead of moving data to the model, the model moves to the data. A copy of the model is sent out to wherever the data already lives (a phone, a hospital server, a factory sensor), it trains for a bit locally, and only the resulting weight updates travel back to a central server. The raw data never leaves the device it started on.

Google’s research team coined the term around 2016 while working on a very unglamorous problem: how do you improve the keyboard’s word predictions using what people actually type, without collecting what people actually type? That constraint, useful data that legally or practically cannot be centralized, is the reason federated learning exists at all. It shows up again and again: hospitals that cannot pool patient scans, banks that cannot share transaction histories, phones that generate more text and location data per day than any server farm could ethically ingest.

FedAvg in Five Steps

The algorithm behind most federated systems is Federated Averaging, or FedAvg, introduced by McMahan and colleagues in 2017. It runs in rounds, and each round follows roughly the same sequence:

1. The central server sends the current global model to a selected group of clients (a subset of devices or institutions, not necessarily all of them).
2. Each client trains that model for a few local epochs using only its own data.
3. Each client sends back the change in its model weights, not the data that produced them.
4. The server combines all the updates into a new global model, weighting each client’s contribution by how much data it trained on.
5. The updated global model gets sent out again for the next round.

In large consumer deployments like Gboard, this can run across millions of phones and thousands of rounds. In medical or financial settings, the numbers flip: a handful of institutions, each holding a large and valuable dataset. Researchers call the first setup cross-device and the second cross-silo, and the two have different bottlenecks. Cross-device systems worry about devices dropping offline mid-round. Cross-silo systems worry more about a single hospital’s data skewing the whole model.

Gboard’s Prediction Engine

The clearest production example is still Google’s own keyboard. Gboard’s next-word prediction, smart compose, and emoji suggestions are trained with federated learning directly on users’ phones, and the words someone actually types never get uploaded anywhere. What gets uploaded is a small model update reflecting how that local model changed after a bit of training on that person’s typing.

Google has kept refining the privacy side of this pipeline. A 2023 paper from the Gboard team describes pairing FedAvg with a technique called DP-FTRL, which gives formal differential privacy guarantees without needing to randomly sample clients in a specific way, combined with secure aggregation so the server can sum client updates without seeing any individual one in the clear. The team reported that, as of that work, every next-word prediction language model shipped in Gboard carries a formal DP guarantee, and that this is now a requirement for future launches, not an optional add-on.

Brain Scans That Never Leave the Hospital

Medical imaging is where the cross-silo version of federated learning has been tested hardest. The Federated Tumor Segmentation challenge, known as FeTS and run under MICCAI, trains models to outline glioma tumors in brain MRI scans using data that stays physically inside each participating hospital. The underlying dataset, based on BraTS, includes well over a thousand multi-modal MRI scans contributed by institutions across the globe, thirty-two of them in one recent benchmark, and the training itself runs on Intel’s OpenFL framework with a 3D U-Net segmentation model.

What makes FeTS interesting isn’t just the privacy angle, it’s that it exposed real engineering lessons. Work from the challenge found that letting the server adaptively weight contributions from different sites, rather than treating every hospital’s update identically, improved the final model. It also found that having only a fraction of institutions (roughly a fifth in some rounds) actively participate at any given step saved time and computing resources without hurting accuracy. That is not something you would predict from the theory alone. It came out of running the system on real institutional data.

The Non-IID Problem

FedAvg was built assuming, at least loosely, that each client’s local data looks like a small fair sample of the whole population. Real deployments almost never work that way. One hospital sees mostly one tumor subtype because of its patient population. One phone user types mostly in a language the global model underrepresents. Researchers call this statistical heterogeneity, or more casually, the non-IID problem, and it turns out to matter a lot. Studies have shown that plain FedAvg can converge slowly or fail to converge at all once client data gets sufficiently heterogeneous, a failure mode often described as client drift, where each local model wanders toward its own client’s quirks between rounds instead of staying aligned with the group.

FedProx, proposed as a direct response, adds a regularization term that penalizes local updates for straying too far from the shared global model, which helps stabilize training under heterogeneity. It is not a complete fix. Newer work keeps proposing alternatives: clustering clients with similar data before aggregating, weighting updates by how well they align with the overall gradient direction, sampling clients more deliberately. None of this is fully solved, which is worth knowing if anyone frames federated learning as a plug-and-play technique. It has real optimization problems that centralized training simply does not run into.

Is Federated Actually Private?

The pitch for federated learning leans hard on privacy, and it’s easy to hear «the data never leaves the device» and assume the problem is solved. It isn’t. The model updates themselves can leak information about the data that produced them, sometimes in surprising detail.

The foundational demonstration of this is a 2019 paper by Zhu and colleagues, Deep Leakage from Gradients, which showed that in small networks, an attacker with access to a single gradient update could reconstruct the original training image with near pixel-level accuracy, no auxiliary data needed. A more recent and more concerning example targeted Gboard directly. A 2023 study from Trinity College Dublin ran new attacks against the actual next-word prediction model used in the production app and found that the words a person typed could be recovered with high accuracy, including full sentence order, and that standard countermeasures like training on mini-batches or adding local noise did not stop it.

This is why serious federated systems layer in more than just «don’t centralize the data.» Differential privacy bounds how much any single user’s data can influence the shared model and adds calibrated noise to make individual contributions statistically hard to isolate. Secure aggregation is a cryptographic protocol that lets the server compute the sum of client updates without ever seeing any individual client’s update unencrypted. Neither of these is automatic. They have to be deliberately engineered in, and Gboard’s own team treats formal DP guarantees as something they had to build toward over several years, not something federated learning gave them for free.

Regulation, Money, and the Push Toward FL

Part of why federated learning is getting more attention now, rather than staying a research curiosity, is that data protection law increasingly makes centralizing sensitive data a liability rather than a convenience. Rules like GDPR and HIPAA push organizations toward architectures that minimize how much personal data moves or gets pooled in the first place, and federated learning fits that requirement structurally rather than as an afterthought.

The commercial numbers reflect this shift. Market research estimates put the federated learning market at roughly $0.33 billion in 2025, growing to about $0.46 billion in 2026, and projects it reaching close to $1.77 billion by 2030, a compound annual growth rate near 40 percent. The drivers cited are the ones you’d expect: tighter privacy expectations, wider AI adoption generally, and the growing number of edge and IoT devices that generate data faster than anyone could reasonably centralize it.

Federated Fine-Tuning for LLMs

The newest frontier is applying federated learning to large language models, and it runs into an immediate practical wall: a phone cannot fine-tune a multi-billion parameter model in full. The fix researchers have converged on is pairing federated training with parameter-efficient fine-tuning methods, most commonly LoRA (low-rank adaptation), where each device trains only a small set of additional parameters layered on top of a frozen base model, and only that small adapter gets shared and aggregated instead of the whole network.

Work like the heterogeneous LoRA approach for on-device foundation models, and separate methods like FedBiOT that let a large model be fine-tuned collaboratively without ever moving the full model to any single client, are early attempts at making this practical on real hardware. The appeal is obvious: a personalized assistant that adapts to how someone actually writes, without that writing ever leaving their device, while still benefiting from a model trained across many users. The catch is that everything covered above, statistical heterogeneity across devices, the risk that gradients leak information, comes along for the ride, just at the scale of a much bigger and more expressive model.

The Real Trade-off

Federated learning is often described as free privacy, and that framing undersells what’s actually happening. It’s a shift in where the risk sits, not a removal of risk. In exchange for not centralizing raw data, you take on a distributed system with unreliable clients, uneven data, and communication costs that a single dataset in one place never had, and you take on an attack surface, the model updates themselves, that has to be actively defended rather than assumed safe.

That trade is genuinely worth making in plenty of cases. Hospitals really cannot pool patient scans across borders, and a billion phones really cannot upload everything users type. But it is a trade, and the next stretch of federated learning research, particularly around fine-tuning language models on-device, is largely going to be spent paying down the same debts that Gboard and FeTS already ran into: how to handle clients whose data doesn’t look like anyone else’s, and how to stop the model updates from quietly giving away what they were trained on.

By: Max Johnson B.

Not long ago, using an AI language model meant a single exchange: you typed something, it typed something back, done. That loop is breaking down. Language models now plan multi-step tasks, call external tools, browse the web, write and run code, and keep going without a person checking in after every move. The industry has a name for this: agentic AI, as opposed to the older, purely reactive kind.

The Loop Behind Every Agent

An agent, stripped down to its mechanics, runs on a loop. It reasons about a task, takes an action like calling a tool or writing something to memory, looks at what happened, and loops back around, repeating until the task is actually done rather than stopping after one reply. That loop, think, act, observe, is the whole unit everything else gets built on top of. You give it a goal. It works out the steps.

Getting that loop to hold up in production is genuinely hard. An agent needs to track its own progress across a task that might run dozens of steps deep, connect to outside tools without those connections turning into a security mess, hold onto memory across sessions instead of forgetting everything the moment a conversation ends, and stay inside guardrails that actually stop it mid-action if something goes wrong. None of that infrastructure looked the same two years ago. Most of it didn’t exist.

Tools and Connection Protocols

Tool use is the part that actually makes an agent do something rather than just describe what it would do. Early versions of this were clunky: a model would notice a task needed a web search or a calculation, and someone had built a custom, fragile hookup for that one specific tool. A newer protocol called MCP cleaned a lot of that up, giving agents a standard way to find and connect to tools instead of every integration being its own one-off project. A separate protocol, A2A, does something similar but for agent-to-agent communication, letting one agent hand work directly to another rather than routing everything back through a person first.

Several Agents on the Same Problem

That agent-to-agent piece is where the conversation is actually heading right now. If 2025 was about individual agents becoming something companies could actually deploy, 2026 is turning into the year of getting several of them to work together without stepping on each other. A single agent working alone tends to be genuinely good at its one job and genuinely disconnected from everything around it, which recreates a problem familiar from human org charts: departments that don’t talk to each other produce duplicated, conflicting work. Multi-agent systems are an attempt to fix that at the software level, agents that share context and coordinate instead of each just doing its own thing in a corner.

Companies have noticed. Inquiries about multi-agent systems reportedly jumped over 1,400 percent between early 2024 and mid 2025, and a pattern has emerged where instead of one giant model trying to do everything, teams run an orchestrator, sometimes called a «puppeteer» setup, that hands pieces of a task to smaller, specialized agents underneath it. It’s basically the same reason companies hire specialists instead of expecting one person to do every job. Except now the specialists are agents, and the manager is also software.

Where Coordination Actually Breaks

This doesn’t mean it works cleanly. Put multiple autonomous, reasoning systems in the same workflow and you get failure modes that a single agent never runs into: two agents making conflicting assumptions about shared state, one agent’s mistake quietly poisoning what the next agent does with it, nobody noticing until the output is already wrong. Researchers digging into why these multi-agent setups fail have found the breakdowns usually aren’t about any one agent reasoning badly on its own. It’s the handoffs. The coordination layer is where things actually go sideways, which is exactly the part that’s hardest to test for.

What’s Already Running on This

The applications already out there are wide. On the business side: qualifying sales leads, handling customer interactions, running competitive research, sorting through sentiment at a scale no team could do by hand. On the research side: materials science, biomedical research, chemical reasoning, software engineering, even simulating social and policy dynamics that would take forever to model manually. Coding assistants that plan out a change across several files, check that it compiles, and fix their own mistakes without someone watching every step are probably the most mature, most widely used version of this pattern right now.

A Different Kind of Handing Off Work

What actually changed, underneath all of it, is what it means to hand work to software. A regular program does exactly what it’s told, nothing more. An agent gets a goal and has to figure out a reasonable path there on its own, adjusting as it goes, pulling in other tools or other agents when the situation calls for it, and only coming back to a person once the job’s actually finished or it hits something it’s not allowed to touch alone. Whether that ends up being reliable enough to trust with anything that really matters is still being figured out, mostly through a lot of protocols, orchestration layers, and benchmarks trying to catch the coordination failures before they cause real damage.

For roughly fifty years, one of biology’s most stubborn open problems sat quietly at the intersection of chemistry and computation: given the sequence of amino acids that make up a protein, could anyone predict the intricate three-dimensional shape that sequence would actually fold into? This was not an academic curiosity. A protein’s shape determines almost everything about what it does inside a living cell, and getting that shape wrong, or not knowing it at all, has stalled drug discovery, disease research, and basic biology for generations. Then, in a genuinely striking turn, an AI system built by DeepMind essentially closed that fifty-year gap. AlphaFold turned a five-decade-old open problem in structural biology into a routine computational task, placing a predicted three-dimensional model for nearly every cataloged protein within reach of any researcher who wants one.

A Problem That Used to Take Years and Cost Fortunes

Before AlphaFold arrived, determining a protein’s structure was slow, expensive, and often required specialized laboratory equipment that only well funded institutions could afford. Structural biologists typically had to identify functional and stable regions of a protein, gather sequence and experimental structural information, build physical models, and painstakingly analyze the resulting structural data, a process that often took months or even years, relying on costly experimental techniques like X-ray crystallography and cryo-electron microscopy.

This meant that for a huge share of the roughly two hundred million proteins known across all forms of life, nobody actually knew what shape they took, since experimentally solving even a single structure could consume a graduate student’s entire dissertation. Drug discovery, disease research, and basic biological understanding all moved at the pace this bottleneck allowed, which is to say considerably slower than the pace at which biologists were identifying new proteins worth studying in the first place.

Learning to Read Shape From Sequence Alone

AlphaFold’s breakthrough moment came at a biennial competition called CASP, the Critical Assessment of Structure Prediction, where research teams from around the world test their prediction methods against proteins whose real structures have already been solved experimentally but not yet published. DeepMind’s AlphaFold2 system delivered a genuinely watershed result at CASP14 in 2020, and researchers dissecting its underlying architecture in mechanistic detail afterward found a system built around a specialized component called the Evoformer, paired with a structure module that together learned to translate raw sequence information directly into confident three-dimensional coordinates.

The core insight behind this success drew on evolution itself. Proteins that perform similar functions across different species tend to have evolved from common ancestors, leaving behind subtle statistical fingerprints in how their sequences vary together across related species, fingerprints that encode real information about which parts of a protein sit physically close to each other in its folded, three-dimensional form. AlphaFold learned to extract and interpret exactly this kind of evolutionary signal at a scale and precision no earlier computational method had managed, converting sequence-level statistical patterns into structural predictions that, in a genuinely large number of cases, matched the accuracy of results obtained through actual laboratory experiments.

A Database That Grew Almost Impossibly Fast

What happened after that initial breakthrough turned out to be just as consequential as the breakthrough itself. Rather than keeping the technology locked away, DeepMind released it openly and built the AlphaFold Protein Structure Database, which initially covered a modest twenty-one model organism proteomes comprising a little over 360,000 predicted structures back in 2021. The growth from there has been genuinely staggering. The database has since expanded to amass over 214 million predicted protein structures, and more recent figures push that coverage toward the entire catalog of known protein sequences, representing the largest single expansion of publicly available protein structural data in the history of the field.

That scale of open access changed who could actually participate in structural biology research. The practical utility of these predictions is reflected in real usage numbers, with well over four and a half million total users accessing the database directly, alongside more than eighteen thousand full proteome archives downloaded by researchers around the world. A graduate student or a small academic lab without access to expensive crystallography equipment can now pull up a confident structural prediction for almost any protein they are studying, a level of access that simply did not exist before this technology arrived.

Knowing Exactly How Much to Trust Each Prediction

A genuinely important and often underappreciated part of using AlphaFold responsibly involves understanding what its confidence scores actually mean, and what they do not. Every predicted structure comes with a per-residue confidence measure called pLDDT, and interpreting this score correctly matters more than casual users often realize. A high pLDDT score answers a narrower question than many researchers assume, indicating that the model is confident in the local geometry of a given region relative to its immediate surroundings, not that the protein performs a particular function, binds a specific partner molecule, or exists in any particular biological state within an actual living cell.

This distinction has real practical consequences for how these predictions get used in serious research. The predicted results still need to be verified and refined through experimental means by structural biologists, and the biological interpretation and functional attribution of a predicted structure continues to depend on expert human judgment rather than the raw prediction alone. AlphaFold also has genuine, well documented blind spots. Although it performs exceptionally well predicting rigid, globular protein structures, its accuracy decreases significantly when dealing with flexible proteins, membrane proteins, and complex multi-domain assemblies, precisely the kinds of structures that tend to resist a clean, single, confident three-dimensional answer even under laboratory conditions.

Extending the Method Beyond a Single Folded Chain

The most recent major iteration, AlphaFold3, expanded the system’s ambitions considerably beyond predicting the shape of a single isolated protein chain. One of the most significant advancements of AlphaFold3 is its expanded predictive capability, now accurately predicting protein-molecule complexes that include biological molecules such as DNA and RNA, an expansion with real significance for genomics and for understanding how proteins actually interact with the broader molecular machinery inside a cell rather than existing in laboratory isolation.

This matters because proteins in real biological systems rarely act alone. They bind to other proteins, wrap around strands of genetic material, and interact with small drug-like molecules, and being able to predict the shape of these entire molecular complexes, rather than just one component in isolation, brings AlphaFold considerably closer to modeling biology as it actually functions inside a living organism.

A Method Now Woven Into How Structural Biology Actually Gets Done

The influence of this technology on the day-to-day practice of structural biology has become remarkably concrete. Roughly forty percent of new structures deposited into the Protein Data Bank between 2024 and 2025 involved AI-driven modeling techniques building on AlphaFold’s approach, a genuinely enormous share of the field’s total output flowing through methods that essentially did not exist a handful of years earlier. Rather than replacing experimental techniques like cryo-electron microscopy, X-ray crystallography, and nuclear magnetic resonance spectroscopy, AI-driven prediction has become deeply intertwined with them, with predictions helping guide where experimental effort gets focused, and experimental results in turn feeding back into training and validating the next generation of prediction models.

The downstream applications built on top of this foundation continue to multiply. Researchers have applied AlphaFold-predicted structures to analyze aggregation propensity, essentially how likely a given protein is to clump together in ways implicated in diseases like Alzheimer’s and Parkinson’s, across tens of thousands of entries in the human proteome, an application layer where structure prediction feeds directly into disease mechanism research rather than remaining a purely academic exercise in molecular geometry.

A Genuinely Rare Case of a Field Being Reset Overnight

It is worth being honest about just how unusual this story actually is within the broader landscape of AI applications. Most fields where machine learning has made an impact saw a gradual accumulation of incremental improvements over many years. Structural biology experienced something closer to an overnight reset, a fifty-year-old bottleneck effectively dissolving within the span of a single research competition cycle, followed by an open database expansion that handed working structural predictions to researchers who previously had no realistic path to obtaining them at all.

That said, the technology has not eliminated the underlying discipline it transformed. Expert judgment, experimental verification, and a genuine understanding of where a confident-looking prediction might quietly be wrong remain just as essential now as they were before AlphaFold existed, arguably more so, since the sheer volume of predictions now available makes careful, informed skepticism about any individual result more important, not less. What changed is the starting point. A biologist studying an obscure, poorly characterized protein no longer begins from nothing, waiting months or years for a crystal to form under laboratory conditions. They begin from a confident three-dimensional hypothesis, generated in minutes, that experimental work can then test, refine, and build genuine biological understanding on top of.

By: Max Johnson B.

Invented by Ian Goodfellow and his colleagues in 2014, Generative Adversarial Networks introduced an idea that felt almost mischievous compared to how machine learning models had traditionally been trained: instead of teaching a single network to solve a problem directly, build two networks, set them against each other as adversaries, and let their ongoing conflict force both of them to improve. That structure, a genuine contest baked directly into the training process, produced some of the most visually striking AI results of the past decade, and understanding exactly how that contest works mechanically reveals one of the more elegant ideas in modern deep learning.

A Forger and a Detective, Trained Together

A GAN comprises two competing neural networks: a generator and a discriminator, trained simultaneously in a competitive, adversarial setting. The generator’s job is to create synthetic data by transforming random noise into outputs that resemble real data, essentially starting from pure statistical randomness and learning to sculpt it into something that could plausibly pass as genuine. The discriminator’s job is the opposite: it functions as a classifier, examining both authentic samples pulled from the real training dataset and synthetic samples produced by the generator, and trying to correctly tell which is which.

A useful, if slightly informal, way to picture this relationship is a forger and an art detective locked in an ongoing rivalry. The forger, playing the role of the generator, studies genuine paintings and tries to produce convincing fakes. The detective, playing the role of the discriminator, examines paintings and tries to spot the forgeries. Neither one ever sees the other’s internal reasoning directly. They only see the outcome of each attempt, and both get better specifically because the other keeps getting better too.

The Minimax Game at the Center of Everything

The mathematical structure underlying this rivalry is called a minimax game, borrowed directly from game theory. Both networks play a two-player minimax game, where the generator tries to fool the discriminator with increasingly realistic outputs, while the discriminator simultaneously improves its ability to correctly classify inputs as either real or generated. The generator is trying to maximize the chance that its fakes get classified as real, while the discriminator is trying to minimize that same chance, hence the minimax framing: one side maximizing, the other minimizing, over the exact same underlying objective.

This adversarial structure is what gives the whole architecture its name. Both networks are typically deep neural networks with multiple layers, and they improve simultaneously through this adversarial process. When the generator manages to produce a noticeably better fake, the discriminator is forced to become more sophisticated in order to keep catching it, and that improved discriminator, in turn, pushes the generator to get even better on its next attempt. In an ideal, well behaved training run, this back and forth pressure eventually converges toward what game theorists call a Nash equilibrium, a stable point where neither network can improve its own outcome any further by changing its strategy alone.

A Training Process That Refuses to Behave Normally

Anyone coming from a background in more standard supervised learning will find GAN training genuinely disorienting the first time they actually try it. Custom training loops are essential for GANs since they do not follow standard supervised learning patterns, and getting the two networks to improve together, rather than one collapsing or overwhelming the other, requires real care in how the training process is structured.

In practice, this typically means alternating updates between the two networks rather than training them jointly in one smooth pass. The discriminator trains first on a batch containing both real and generated images, learning to classify them correctly, and only afterward does the generator update its own parameters, specifically trying to produce outputs that would fool the discriminator’s newly updated judgment. Many successful implementations deliberately update the discriminator more frequently than the generator, a choice made specifically to prevent the discriminator from being overwhelmed by a generator that is improving faster than it can keep pace with, since a discriminator that falls too far behind stops providing the generator with any genuinely useful signal about how to improve further.

When the Contest Breaks Down

The adversarial dynamic that makes GANs so conceptually elegant is also exactly what makes them notoriously difficult to train reliably in practice. This success is achieved at the cost of a notoriously difficult training procedure, one that has introduced several persistent challenges the field has spent years working to address.

The most well known of these failure modes is called mode collapse, a situation where the generator discovers a narrow handful of outputs that reliably fool the current discriminator, and then simply keeps producing variations on those same few outputs rather than genuinely capturing the full diversity of the real data distribution it was supposed to learn. A generator trained on a dataset of thousands of different human faces might, under mode collapse, converge on producing only a small handful of face types repeatedly, technically fooling the discriminator each time while completely failing to represent the genuine variety present in the original training data. This happens because the generator’s only real incentive is to fool whatever discriminator currently exists, and if a narrow set of outputs already accomplishes that reliably, there is no built-in pressure pushing it to explore anything beyond that narrow, exploitable region.

Beyond mode collapse, GAN training can also suffer from genuine instability, where the delicate back and forth between generator and discriminator simply fails to converge at all, oscillating indefinitely rather than settling toward the kind of stable equilibrium the underlying game theory promises in principle. Researchers have proposed a wide range of fixes for these problems over the years, including modifying the original minimax objective itself to provide steadier gradients during the earliest, most unstable phase of training, and extending the basic two-player framework into genuinely multi-player variants involving several discriminators working together, an approach shown to produce higher quality samples in a fraction of the training iterations a standard single-discriminator setup would require.

A Family That Grew Considerably Since 2014

The original GAN architecture Goodfellow’s team proposed has since spawned a genuinely large family of specialized variants, each adapting the core adversarial idea to solve a different specific limitation or unlock a different specific capability.

Deep Convolutional GANs incorporated convolutional layers directly into both the generator and discriminator, a natural and highly effective pairing given how well suited convolutional architectures already are to image data, and this combination became something close to a standard baseline for image generation tasks for years afterward. Conditional GANs extended the basic framework by allowing the generator to take an additional input, a class label or some other conditioning signal, letting a user specify what kind of output they wanted rather than leaving generation purely up to chance, turning an unconstrained random generator into something closer to a controllable tool. CycleGAN tackled a genuinely different and harder problem, translating images from one visual domain into another, turning a photo into the style of a particular painter, or a daytime scene into a nighttime one, without requiring paired training examples showing the exact same scene in both domains, a genuinely clever workaround for a data requirement that would otherwise have been prohibitively expensive to satisfy. StyleGAN pushed image quality and controllability further still, introducing an architecture that separated high level attributes like pose and identity from finer, lower level details like skin texture and hair, giving genuinely fine-grained control over specific aspects of a generated image that earlier architectures could not offer.

Where This Adversarial Idea Actually Proved Useful

Despite the genuine training difficulties, GANs found real, practical traction across a surprisingly wide range of applications well beyond simply generating convincing fake photographs. GANs served as an initial enabler for the field of text-to-image models, and for a long time, GAN-based approaches achieved state-of-the-art results in image generation before diffusion models eventually took over much of that particular spotlight.

Data augmentation became one of the more practically valuable uses of this technology, since a trained GAN can generate additional synthetic training examples for domains where genuine data is scarce or expensive to collect, such as certain categories of medical imaging, helping other machine learning models train more effectively even when real labeled examples remain limited. Image-to-image translation tasks, converting sketches into photorealistic images, colorizing black and white photographs, or upscaling low-resolution images into sharper, higher-resolution versions, all leaned heavily on GAN-based architectures. Even less obvious domains found real use for the underlying adversarial framework, including steganography, where a GAN based approach was used specifically to hide information within images in ways designed to evade detection, illustrating just how flexible the core generator-versus-discriminator structure turned out to be once researchers started applying it outside the narrow context it was originally designed for.

A Contest That Reshaped What Generative Models Could Do

What makes GANs genuinely significant, beyond the specific images and applications they enabled, is the underlying training philosophy they introduced into the field. Rather than defining success through a single, static loss function measured against fixed labels, GANs made the definition of success itself a moving target, one network’s improvement directly reshaping what the other network needed to learn next. That dynamic, adversarial tension, difficult to tame as it often proved in practice, pushed generative modeling to a level of visual fidelity that earlier approaches simply could not reach on their own, and it left behind a lasting influence on how researchers think about training models through competition rather than through a fixed, unchanging target alone.

By: Max Johnson B.

Most of what a machine learning model does involves recognizing patterns it has seen many times before. Anomaly detection asks for something almost the opposite: recognizing the thing that does not fit the pattern at all, the transaction that looks nothing like a person’s normal spending, the sensor reading that breaks from everything a machine has recorded for months, the login attempt that carries just enough irregularity to feel wrong. Teaching a model to notice absence of pattern, rather than presence of one, turns out to be a genuinely distinct problem, and it has quietly become one of the most commercially consequential applications of artificial intelligence in active use today.

Spotting the Exception Rather Than the Rule

At its core, anomaly detection is the task of identifying data points, events, or observations that deviate significantly from what a system considers normal. This sounds almost too simple to be interesting until you consider how many industries genuinely depend on catching exactly this kind of deviation, and how expensive it can be to miss one. Across cybersecurity, fraud detection, healthcare, and industrial systems, AI anomaly detection has become widely applied precisely because the cost of a missed anomaly, a fraudulent transaction that slips through, a piece of equipment that fails without warning, a patient’s vital signs quietly drifting toward danger, is frequently measured in real money, real downtime, or real harm.

The genuinely useful part of framing this as a machine learning problem, rather than relying purely on fixed rules written by a person, is that AI can learn from historical data to predict potential anomalies before they occur, giving an organization the chance to act proactively rather than simply cleaning up after the fact. This proactive framing represents a meaningful shift from how most detection systems used to work.

Two Fundamentally Different Ways to Learn What Normal Looks Like

Anomaly detection systems generally split into two broad approaches, and the choice between them depends heavily on something that sounds mundane but matters enormously in practice: whether you actually have labeled examples of anomalies to learn from in the first place.

Supervised approaches are trained on labeled datasets, where examples of both normal and anomalous cases are clearly tagged in advance, and the model learns to distinguish between the two categories the same way any standard classifier would. This approach fits naturally with problems like fraud detection in banking, where a bank already has a substantial history of past fraud cases tagged and available to train against.

Unsupervised approaches take a different route entirely, identifying anomalies by spotting patterns, deviations, or clusters within a dataset that simply do not align with everything else, without ever needing pre-labeled examples of what an anomaly actually looks like. This matters enormously for problems where labeling every possible bad case in advance is essentially impossible, such as network intrusion detection, where pre-labeling every conceivable attack method before it has ever been seen would be a genuinely hopeless task. The model instead learns the shape of normal behavior thoroughly enough that anything falling meaningfully outside that shape gets flagged, regardless of whether that specific type of anomaly has ever been formally categorized before.

A Shift From Cleaning Up Messes to Preventing Them

For a long time, security and fraud teams operated in a fundamentally reactive posture, investigating and remediating harm only after it had already occurred. That posture has been changing meaningfully. Cyberdefense has long focused on remediation after losses occur, but AI is pushing intervention earlier in the attack cycle by identifying coordinated behavior and emerging risk signals before fraud actually scales into a genuine incident.

The financial sector illustrates this shift with genuinely concrete numbers. In documented cases, financial institutions using predictive AI identified more than 1,100 attempted fraud schemes before they could inflict damage, catching patterns that emerged before transactions or approvals ever went through rather than after money had already moved. This preemptive framing extends well beyond finance. Security teams increasingly watch for specific early warning signals, geolocated login anomalies, irregular password-reset sequences, and abnormal multi-factor authentication behavior, since these subtle irregularities often appear well before an attacker’s lateral movement through a network actually begins, giving defenders a genuine window to intervene before the more damaging stages of an intrusion unfold.

Fraud Detection Has Stopped Standing Still

Fraud specifically has become a genuinely moving target in a way that older, static approaches simply cannot keep up with. For decades, fraud programs were built on deterministic logic, fixed thresholds and pre-defined conditions checked after the fact, but fraud today moves too fast for static thresholds and legacy rules, forcing a shift toward continuous behavioral intelligence that models normal user, device, and channel behavior in real time to catch subtle deviations earlier and reduce false alarms.

This acceleration is not a minor trend. The World Economic Forum projects that AI-enabled cybercrime could exceed ten trillion dollars annually by 2030, a genuinely staggering figure driven by increasingly automated attack tooling and identity-based fraud that scales without the human coordination older schemes required. In the cryptocurrency world specifically, one analysis documented a roughly five hundredfold increase in AI-enabled scam activity in a single year, describing fraud that once required significant human coordination now scaling automatically and adapting on the fly, dispersing stolen proceeds before investigators can respond through traditional means.

A Double-Edged Sword: The Same Tools Cut Both Ways

There is a genuinely uncomfortable irony sitting at the center of this entire field. The same artificial intelligence capabilities that make anomaly detection so much more powerful also arm the people trying to evade it. Artificial intelligence is expected to be the single most consequential factor shaping cybersecurity strategy, cited by the overwhelming majority of surveyed executives as a force multiplier for both defense and offense simultaneously, with generative AI expanding the attack surface itself and contributing to more complex exploitation tactics that outpace what purely human-led teams can reasonably keep up with on their own.

This tension shows up concretely in how phishing attacks have evolved. Phishing remains the primary intrusion vector behind a large majority of security incidents, and it is now delivered with a level of realism that would have been implausible just a couple of years earlier, since generative AI can produce convincing, personalized phishing content at a scale and quality that manual human effort could never match. Defenders adapting to this reality increasingly work from a specific operating assumption: organizations must treat AI-assisted attacks as the baseline expectation rather than an occasional edge case, since assuming attackers already use AI in real campaigns has become the only realistic starting point for building an effective defense.

Beyond Fraud and Security: A Genuinely Broad Toolkit

While cybersecurity and financial fraud dominate much of the public conversation around anomaly detection, the underlying technique reaches into a genuinely wide range of other domains that share the same core structure: enormous amounts of routine data punctuated by rare, consequential deviations worth catching early.

In manufacturing, AI-powered predictive maintenance systems learn the normal vibration, temperature, and performance signatures of industrial equipment, flagging early deviations that signal an impending failure well before it actually happens. The practical payoff here is genuinely substantial, with predictive maintenance capable of reducing maintenance costs by roughly ten to twenty percent and cutting unplanned downtime by thirty to forty percent in industrial environments, numbers that translate directly into real operational savings rather than abstract efficiency gains.

In healthcare, anomaly detection applied to patient monitoring data can catch irregularities in vital signs or lab results that might otherwise be missed amid the sheer volume of routine data a hospital generates every day, enabling earlier clinical intervention in situations where speed genuinely matters. In broader financial crime prevention, researchers have applied unsupervised ensemble models specifically to detect money laundering patterns hidden within genuinely complex, high-volume transaction networks, extending the same underlying logic well beyond individual fraudulent transactions into the harder problem of spotting coordinated, disguised financial crime.

The Honest Difficulties This Field Still Faces

None of this progress means anomaly detection has become an easy, solved problem. Real implementation challenges persist, including obtaining accurately labeled training data, reducing the volume of false positives that can overwhelm human analysts with noise, ensuring systems scale to genuinely massive data volumes without breaking down, making AI-driven decisions actually interpretable to the humans relying on them, and protecting the detection systems themselves against adversarial attacks specifically designed to fool them.

That last point deserves particular attention, since it captures something genuinely distinctive about this field compared to more static machine learning applications. A model trained to recognize handwritten digits does not face an adversary actively studying its weaknesses and adapting specifically to slip past it. A fraud detection system does, which means anomaly detection is rarely a problem that gets solved once and left alone. It is closer to an ongoing arms race, where the definition of normal keeps shifting, and where the people trying to hide inside that shifting definition of normal are often working just as hard, and increasingly with just as much AI assistance, as the people trying to catch them.

A Field Defined by a Genuinely Unusual Kind of Vigilance

What makes anomaly detection such a distinctive corner of applied machine learning is the specific nature of what it is actually trying to catch. Most AI applications get better by seeing more examples of the thing they are trying to recognize. Anomaly detection, particularly in its unsupervised form, has to get good at recognizing something it may never have seen a labeled example of before, relying instead on a thorough, continuously updated understanding of what normal actually looks like, so that anything genuinely foreign to that pattern stands out clearly enough to warrant attention. As the systems being protected keep growing in scale and complexity, and as the people trying to slip past those defenses keep growing more sophisticated in turn, that quiet, constant vigilance for the thing that does not belong has become one of the more consequential and genuinely difficult jobs artificial intelligence has taken on.

By: Max Johnson B.

Open Netflix and a homepage full of shows appears, seemingly tailored just for you. Scroll through Amazon and products show up that feel oddly relevant to something you were thinking about buying. Open Spotify and a playlist waits that somehow captures a mood you didn’t even fully articulate to yourself yet. None of this happens by accident, and none of it involves a human curator sitting somewhere deciding what you specifically should see. Behind every one of these moments sits a recommendation system, one of the most commercially significant and technically interesting branches of applied machine learning, quietly shaping a huge share of how people discover content, products, and experiences online.

Two People Who Like the Same Things Probably Like More of the Same Things

The oldest and still most foundational idea in this field is collaborative filtering, built on a genuinely simple premise: people who agreed on things in the past tend to agree on things in the future. In its user-based form, the system identifies people whose past behavior closely resembles yours, and recommends things those similar users liked that you have not encountered yet. In its item-based form, the logic flips slightly, focusing instead on relationships between the items themselves, recommending things similar to what you have already engaged with, regardless of whether any specific other user shares your exact taste profile.

Collaborative filtering earned its dominant position for good reason. It is computationally efficient, conceptually simple to implement, and it works without requiring any deep understanding of what the actual content is about. A system built this way does not need to know anything about a movie’s genre, a song’s tempo, or a product’s category. It only needs a record of who interacted with what, and it can start finding meaningful patterns purely from the shape of that interaction data.

That simplicity comes with a genuine weakness baked in from the start. Collaborative filtering suffers from what is known as the cold-start problem, since it fundamentally relies on a history of ratings or interactions to make any prediction at all. A brand new user with no viewing history, or a newly released product nobody has purchased yet, gives the system essentially nothing to work with, leaving it unable to make a confident recommendation until enough behavioral data accumulates.

Filtering by What Something Actually Is

Content-based filtering takes a different route around this problem, focusing on the actual attributes of the items themselves rather than patterns in how other users behaved. Rather than asking who else liked this, a content-based system asks what this specific item is actually made of, its genre, its cast, its written description, or in the case of music, its measurable audio characteristics, and recommends other items sharing similar attributes to whatever the user has already shown interest in.

This approach sidesteps the cold-start problem for new items reasonably well, since a system can describe a brand new movie’s genre and cast the moment it is added, without needing to wait for anyone to actually watch it first. It still runs into a version of the same problem on the user side, though, since a system genuinely knows very little about a new user’s taste until they interact with enough content to reveal a discernible pattern.

Combining Both Approaches Rather Than Choosing One

In practice, the systems running behind the major platforms almost never rely purely on one technique. Modern recommendation systems typically combine multiple approaches into a hybrid system, drawing on the strengths of collaborative filtering, content-based filtering, and increasingly deep learning, to compensate for each individual technique’s specific weaknesses.

Netflix offers one of the most thoroughly documented examples of this hybrid philosophy in action. Its recommendation engine bases predictions on machine learning and collaborative filtering drawn from behavioral viewing data, refined further using matrix factorization techniques and natural language processing to sharpen accuracy, with deep learning based feature engineering allowing the system to adapt as an individual viewer’s tastes genuinely shift over time. Netflix has also pushed this further in genuinely visible ways. Different subscribers see different cover thumbnails for the exact same title, with the system selecting whichever specific image has the highest predicted chance of catching that particular viewer’s attention based on their own past choices, a detail that quietly reveals just how granular this personalization has actually become.

Amazon built its own recommendation empire around a specific variant of collaborative filtering, focusing heavily on item-to-item relationships rather than purely comparing customers to each other. A large share of Amazon’s total sales is estimated to flow directly through these recommendations, a testament to how much commercial weight this seemingly invisible piece of infrastructure actually carries.

Spotify faces a genuinely distinct challenge compared to video streaming, since music taste tends to be more personal, more emotionally charged, and more context dependent than a choice of movie or television show. To handle this, Spotify combines collaborative filtering, natural language processing, direct audio analysis, and deep neural networks, examining not just who else listens to similar artists, but the actual technical properties of a song itself, its tempo, rhythm, energy level, mood, and danceability, building a genuinely multidimensional picture of musical taste that goes well beyond simple listening history alone.

Turning Millions of Ratings Into a Manageable Set of Numbers

Underneath many of these systems sits a mathematical technique called matrix factorization, a method popularized heavily by both Netflix and Spotify’s early recommendation engines. The core idea treats the entire universe of user preferences as an enormous, mostly empty grid, users along one axis, items along the other, with actual ratings or interactions filling in only a small fraction of the cells. Matrix factorization compresses this sprawling, sparse grid into a much smaller set of underlying numerical factors, latent characteristics that are not necessarily interpretable in any obvious human sense, but that turn out to capture genuinely meaningful patterns in taste and preference. Once a user and an item are both represented this way, predicting how much that user might like that item becomes a comparatively simple calculation, essentially checking how well their two sets of underlying factors line up with each other.

A Genuinely New Complication: Weighing Cost Against Sophistication

The most recent chapter in this story involves a tension that would have seemed almost unthinkable a few years ago: large language models are now technically capable of generating genuinely thoughtful, conversational recommendations, but running one for every single recommendation a platform serves turns out to be economically absurd at the scale these companies actually operate. A single LLM-generated recommendation consumes thousands of tokens, while a traditional collaborative filtering calculation costs a tiny fraction of a cent, making full LLM inference for every recommendation economically impossible at Netflix or Spotify’s actual scale.

The solution major platforms have converged on reflects a genuinely pragmatic engineering compromise rather than an all-or-nothing choice. Spotify’s AI DJ feature illustrates this well, using what its engineers call an agentic router that decides, on a per-query basis, whether a specific request is complex enough to justify invoking an expensive language model, or simple enough to fall back on fast, cheap collaborative filtering embeddings instead. A vague, open-ended prompt like music for a rainy reading session gets routed to the more expensive, more capable reasoning layer, while a straightforward request gets handled through the fast, inexpensive path, with this routing decision itself functioning as a genuine cost optimizer quietly embedded inside what looks, from the outside, like just another product feature. The broader industry consensus that has emerged reflects the same underlying logic at a larger scale, using cheap models to narrow an enormous pool of candidates down to a manageable shortlist, then reserving genuinely expensive computation only for the final handful of items an actual user will see.

Measuring Success by More Than Just a Click

A subtlety that separates genuinely sophisticated recommendation systems from naive ones involves how success actually gets measured. Netflix, for instance, evaluates recommendation value through incrementality, the actual causal lift of showing a particular title compared to not showing it at all, specifically because a system that greedily surfaces only the highest-probability titles every single time tends to collapse a user’s discovery space over time, repeatedly showing the same familiar, safe recommendations rather than genuinely expanding what a person might enjoy. This distinction matters enormously in practice. A recommendation engine optimized purely for short-term click rate can quietly trap users inside an increasingly narrow bubble of familiar content, while one designed with genuine discovery and long-term engagement in mind has to actively balance exploiting what it already knows a user likes against exploring genuinely new territory that might expand their taste over time.

Machinery That Has Become Genuinely Invisible

What makes recommendation systems such a distinctive corner of applied AI is how thoroughly they have vanished into the background of ordinary digital life. Nobody consciously thinks about the mathematics of matrix factorization while scrolling a streaming homepage, and nobody notices the specific routing decision that determined whether their music request got handled by a language model or a simpler algorithm underneath. Yet these systems are making millions of small, individually invisible decisions every single day, shaping what gets watched, purchased, and listened to across a genuinely enormous share of the internet’s actual traffic.

The technical sophistication behind these systems keeps climbing, from simple collaborative filtering to deep neural networks to increasingly selective, cost-aware use of large language models, but the underlying goal has stayed remarkably consistent since the earliest days of this field: take an overwhelming amount of available content, and quietly narrow it down to the small handful of things a specific person is actually likely to want, before they even have to ask.

By: Max Johnson B.

There is a genuine paradox sitting at the heart of modern AI. The models that have produced the most impressive results in recent years, the ones writing coherent essays, recognizing objects in photographs, and translating between languages, are trained using a technique that technically does not require any humans to label a single example. This might sound contradictory, since machine learning has traditionally been understood as a discipline built on labeled examples, a person carefully tagging thousands of photos as containing a cat or not, or marking thousands of emails as spam or legitimate. Self-supervised learning quietly overturned that assumption, and understanding how it manages to work is genuinely one of the more elegant ideas in the entire field.

The Bottleneck That Labeled Data Was Always Going to Hit

Traditional supervised learning depends on datasets where every example comes paired with a correct answer supplied by a human annotator. This approach works well and produces reliable results, but it runs into a hard practical ceiling. Labeled data is relatively scarce and expensive, while unlabeled data is abundant and relatively cheap, an imbalance that only grows more lopsided as the appetite of modern deep learning models for larger and larger datasets keeps expanding.

The scale of this imbalance is genuinely staggering. The internet contains an almost unfathomable quantity of text, images, audio, and video, essentially all of it sitting there without any accompanying label explaining what it means or what category it belongs to. Meanwhile, producing a properly labeled dataset of comparable scale would require armies of human annotators working for years, at a cost that would be prohibitive for all but a handful of the largest organizations in the world. This dependency poses particularly acute challenges in domains where labeling itself is difficult, ambiguous, or requires genuine expert knowledge, such as medical imaging, where correctly annotating a scan might require a trained radiologist rather than a general purpose crowdworker.

Turning the Data Itself Into the Teacher

Self-supervised learning solves this bottleneck through a genuinely clever reframing of the problem. Rather than relying on external, human-supplied labels, it defines pretext tasks, auxiliary problems that generate their own supervisory signal automatically from the structure already present within the raw data itself. The word pretext is chosen deliberately here, since the specific task being solved is not usually valuable in its own right. It matters only because solving it forces the model to learn genuinely useful, transferable representations of the underlying data, representations that later prove useful for the actual downstream task someone actually cares about.

The mechanics of this trick are more approachable than the concept might initially sound. Because the «label» for a pretext task gets generated automatically from the data itself rather than supplied by a person, these are often called pseudo-labels, and the same underlying data can produce essentially unlimited pretext training examples without a single human ever reviewing them.

A Few Concrete Examples of What This Actually Looks Like

The clearest way to understand pretext tasks is through specific examples, and a few classic ones illustrate the underlying logic well.

In natural language processing, one of the most influential pretext tasks involves masking. A sentence gets a portion of its words deliberately hidden, and the model is trained to predict exactly what those missing words were, using only the surrounding context as a clue. Getting good at this masked prediction task forces the model to develop a genuinely deep, contextual understanding of grammar, word relationships, and meaning, all without a single human ever manually labeling a sentence’s grammatical structure or semantic content. A closely related variant, predicting the next word in a sequence given everything that came before it, follows the exact same underlying logic and sits at the core of how many modern language models are trained.

In computer vision, pretext tasks have taken on a genuinely wide variety of creative forms over the years. Early approaches included tasks like predicting how much an image had been rotated, reconstructing the correct grayscale-to-color mapping of a deliberately desaturated photo, and solving jigsaw puzzles built from shuffled image patches, each forcing the model to internalize something meaningful about visual structure in order to solve a task that, on its own, nobody would particularly care about. A model that gets good at reassembling shuffled patches into a coherent image has necessarily learned something real about spatial relationships, object boundaries, and visual coherence along the way, even though nobody ever explicitly told it what any of those patches actually depicted.

Contrastive Learning Became the Dominant Approach

While early pretext tasks like rotation prediction and jigsaw solving proved genuinely useful, a different family of techniques, broadly called contrastive learning, has come to dominate much of the field in more recent years, generally producing stronger, more transferable representations than the earlier heuristic-based pretext tasks it eventually surpassed.

The underlying idea is intuitive once explained. Contrastive learning trains a model to embed augmented versions of the same underlying sample close together in its internal representation space, while pushing representations of genuinely different samples further apart. In practice, this typically means taking a single image, generating two different augmented versions of it through transformations like cropping, blurring, or shifting its colors, and training the model to recognize that these two altered versions actually originated from the same source image, treating the original as an anchor, its transformed version as a matching positive example, and every other unrelated image in the training batch as a negative example that should be pushed further away in the model’s internal representation.

What makes this genuinely powerful is that the model never needs to be told what the image actually depicts. It only needs to learn that two augmented crops of the same photograph should be considered related, while an unrelated photograph should be considered distinct, and in the process of getting reliably good at that surprisingly simple discrimination task, the model ends up internalizing rich, genuinely useful visual features, edges, textures, object parts, and broader compositional structure, purely as a side effect of solving the contrastive puzzle it was actually given.

From Pretext Task to Genuinely Useful Model

A model trained purely on a pretext task is not immediately useful for solving a real-world problem on its own. Predicting masked words in a sentence or recognizing that two crops came from the same photo has no direct practical value in itself. The real payoff comes afterward, through a second stage where the pretrained model gets fine-tuned for whatever specific task actually matters, and this second stage often involves genuine supervised learning, albeit using only a small fraction of the labeled data that would have been required to train a comparably capable model entirely from scratch.

This two-stage structure, learn broad, general representations first through self-supervision on abundant unlabeled data, then specialize with a comparatively small amount of labeled data second, has become one of the defining patterns of modern deep learning. It explains why a model can be pretrained once on an enormous, unlabeled corpus and then efficiently adapted to a wide range of specific, labeled tasks afterward, rather than needing an entirely fresh, massive labeled dataset built from scratch for every single new application.

Reaching Well Beyond Text and Images

The influence of this approach extends across nearly every major branch of deep learning currently in active use. Self-supervised learning underlies transformer-based large language models like BERT and GPT, image synthesis architectures like variational autoencoders and generative adversarial networks, and computer vision systems built around contrastive frameworks like SimCLR and Momentum Contrast, each applying the same underlying philosophy, learn from the data’s own internal structure, to a different domain and a different specific pretext task.

The approach has continued expanding into domains where labeled data is particularly scarce or expensive to obtain. In audio and speech processing, pretext tasks built around predicting missing or shifted audio segments have proven effective. In medical imaging specifically, researchers have applied self-supervised pretraining to specialized data like retinal scans, since expert medical annotation is genuinely expensive and slow to obtain at the scale deep learning typically demands, and pretrained models built this way often reach strong performance with only a fraction of the annotated examples a fully supervised approach would have required.

A Meaningful Shift in How Models Actually Get Built

What makes self-supervised learning genuinely significant, beyond the elegance of the underlying technique itself, is what it implies about the relationship between data and capability going forward. As the field’s appetite for ever larger training datasets keeps growing, an approach that can extract genuine, transferable learning signal from raw, unlabeled data removes what would otherwise be one of the most severe practical bottlenecks constraining progress, the sheer cost and difficulty of manually annotating data at the scale modern models actually demand.

There is something genuinely fitting about the underlying idea itself. Rather than waiting for a human to explain what matters in a piece of data, self-supervised learning finds a way to let the data’s own internal structure, the relationship between a sentence and its missing word, or between an image and its own transformed reflection, become the teacher. It is a reminder that meaningful signal for learning does not always need to arrive from the outside. Sometimes it is already sitting there, quietly embedded in the data itself, waiting for the right pretext task to draw it out.

By: Max Johnson B.

Some kinds of data simply cannot be understood one piece at a time in isolation. A single word means little without the sentence around it. A single stock price means little without the days that came before it. A single frame of audio means nothing without the frames surrounding it. Standard neural networks, the kind that take a fixed input and produce a fixed output, have no natural way of handling this. They treat every input as a blank slate, with no memory of what came before it. Recurrent neural networks were built specifically to fix that gap, and the story of how they evolved, hit a serious wall, and eventually found a clever way around it is one of the more instructive chapters in the history of deep learning.

A Network That Remembers What It Just Saw

Recurrent neural networks were designed to process sequences by maintaining a hidden state that carries information from one time step to the next, giving the model a genuine form of memory. Unlike a standard feedforward network, where information flows in a single direction from input straight to output with no looping, an RNN contains connections that loop back on themselves, feeding a piece of its own internal state back into the network alongside the next input in the sequence.

In practice, this means an RNN processes a sequence step by step, and at each step, it combines the current input with whatever it has retained from everything it processed before. Reading a sentence one word at a time, the network’s hidden state after the third word carries some trace of the first two words, and that accumulated context shapes how it interprets everything that follows. This structure made RNNs a natural fit for exactly the kind of sequential data that gave earlier neural network designs so much trouble: speech, text, time series, and any other data where order and context genuinely matter.

A Serious Flaw Hiding Inside the Design

For all their conceptual elegance, early RNNs ran into a genuinely crippling practical problem the moment they were asked to handle longer sequences. Training a neural network relies on backpropagation, a process that calculates how much each individual weight in the network contributed to an error, then adjusts those weights slightly to reduce that error next time. In a recurrent network, this calculation has to travel backward not just through the layers of the network, but through every single time step of the sequence as well.

This becomes a real problem because gradients get repeatedly multiplied together as they travel backward through each time step, and this repeated multiplication tends to shrink the gradient dramatically the further back it has to go. Traditional activation functions common in earlier networks squash their output into a narrow range, and multiplying many of these small numbers together causes the gradient for earlier time steps to shrink exponentially, meaning those earlier steps end up training extremely slowly, if they train at all. This is known as the vanishing gradient problem, and it had a genuinely severe practical consequence: an RNN could technically remember information from many steps ago, but in practice, it almost never learned to actually use that distant information, since the training signal needed to teach it to do so had essentially disappeared by the time it reached those earlier steps.

This limitation gutted much of the theoretical promise RNNs had originally offered. A network that was supposed to model long-range dependencies in language or long time series instead ended up with an effective memory of only a handful of recent steps, functionally not much better than not having a memory mechanism at all for anything beyond short-term context.

A Genuinely Clever Fix: Cells That Choose What to Remember

The solution, introduced by Sepp Hochreiter and Jürgen Schmidhuber back in 1997, came in the form of Long Short-Term Memory networks, commonly abbreviated LSTM. An LSTM replaces the simple recurrent unit found in a standard RNN with something considerably more elaborate: a memory cell equipped with an input gate, a forget gate, and an output gate, each governing a different aspect of how information flows through the unit over time.

The core insight behind this design is genuinely clever. Rather than forcing information to pass through the same repeated multiplication that caused gradients to vanish in a standard RNN, LSTM introduces a dedicated cell state, essentially a separate internal memory track running alongside the network’s regular hidden state, specifically engineered to let information flow through largely unchanged unless the network’s learned gates actively decide to modify it. This cell state runs like a conveyor belt through the network, and the gates surrounding it act as learned filters, deciding what new information to let in, what old information to discard as no longer relevant, and what part of the accumulated memory should actually influence the current output.

This design allows LSTMs to preserve the error signal as it gets backpropagated through both time and layers, effectively preventing the gradient from collapsing toward zero the way it did in a standard RNN, which finally made it practical to learn genuinely long-term dependencies in sequential data. A network trying to figure out that a pronoun near the end of a paragraph refers back to a name mentioned several sentences earlier finally had a mechanism capable of actually preserving and using that earlier information, rather than having it fade into irrelevance by the time it mattered.

A Simpler Cousin: The Gated Recurrent Unit

Not long after LSTM demonstrated how effective gating mechanisms could be, researchers introduced a streamlined variant called the Gated Recurrent Unit, or GRU. GRU simplifies LSTM’s architecture by reducing the number of gates while still retaining strong performance on most sequence modeling tasks, combining some of LSTM’s separate gates into a more compact structure that requires fewer parameters to train.

This simplification carries a genuine practical advantage. Because a GRU has fewer internal components to learn, it tends to train somewhat faster and requires less computational overhead than a full LSTM, without giving up a meaningful amount of performance on many common tasks. This has made GRUs a popular, more lightweight alternative whenever computational efficiency matters more than squeezing out the last small increment of accuracy, particularly on smaller datasets or in resource-constrained deployment settings.

Where This Architecture Actually Earned Its Keep

Before more recent attention-based architectures took over much of the spotlight, LSTM served for years as the genuine backbone of most serious sequence modeling systems. Machine translation systems relied heavily on LSTM-based architectures to process a sentence in one language and generate a coherent, contextually appropriate translation in another. Speech recognition systems used LSTMs to convert raw audio signals into text, depending on the network’s memory to correctly interpret sounds that only make sense in the context of what was spoken moments before. Text generation, sentiment analysis, and countless time series forecasting applications, including some of the same financial and demand forecasting tasks covered in other posts on this blog, leaned on LSTM’s ability to track dependencies across a sequence that a simpler model could never have captured.

Still Useful, Even in an Attention-Dominated World

It would be easy to assume that LSTM has become obsolete now that Transformer-based architectures dominate the headlines. That assumption misses something genuinely important about how this field actually evolved. Transformers did not appear out of nowhere. They evolved directly from ideas that LSTM helped establish, and understanding LSTM remains a useful bridge for grasping how modern attention-based systems actually work.

LSTM also retains real, practical advantages in specific situations rather than being purely a historical stepping stone. LSTMs remain genuinely relevant today because they tend to be more computationally efficient, easier to train effectively on smaller datasets, and better suited for real-time and edge applications where computational resources are limited, a meaningful advantage in exactly the kind of constrained hardware environments discussed elsewhere on this blog. A Transformer’s ability to attend to an entire sequence at once comes at a real computational cost, and for applications where a smaller, efficient model running on modest hardware genuinely matters more than squeezing out marginal gains in accuracy, LSTM and its gated relatives have not gone anywhere.

A Genuinely Important Chapter, Even With a New Chapter Now Being Written

The story of RNNs and LSTM captures something that shows up repeatedly across the history of deep learning: a good idea, in this case giving a network some form of memory, running headfirst into a hard mathematical obstacle, followed by a genuinely creative engineering solution that unlocked what the original idea had always promised. Vanishing gradients once represented a real, seemingly fundamental ceiling on what recurrent networks could learn. LSTM’s gated memory cells broke through that ceiling by rethinking, at a structural level, how information should be allowed to persist across time.

That breakthrough did not just solve a narrow technical problem. It established a set of ideas, selective memory, learned gating, and the deliberate separation of what to keep from what to discard, that continue to echo through the architectures built on top of it, including the very attention mechanisms that eventually took center stage. Learning how LSTM actually works is not simply an exercise in studying an older architecture. It is a genuinely useful window into how machines first learned, mechanically and mathematically, to hold onto the past long enough for it to matter.

By: Max Johnson B.