Developer's AI bot outperformed GPT-4 rivals, but a dedup bug silently erased training weights

·1 views

A developer built a capture-the-flag arena where language models compete against each other, using game replays to fine-tune a local Qwen2.5-3B model with MLX LoRA adapters. The custom bot outperformed five larger cloud models on offense, capturing 400 flags across 221 games compared to 275 for the next-best GPT-OSS 120B model. However, the bot's defensive performance remained weak, prompting multiple retraining attempts that all appeared to fail. The root cause was a silent bug: a deduplication step in the data pipeline discarded all repeated examples, completely canceling out the intentional curriculum weighting that relied on repetition for emphasis. As a result, 41.5% of the weighted training corpus — roughly 39,000 lines — was silently dropped before the trainer ever saw the data.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

How Video Streaming Pipelines Work: A System Design Breakdown

A technical explainer on DEV Community walks through the system design behind video streaming, from upload to playback. The piece frames the problem using a relatable scenario: sending a large skydiving video to a friend across the world. It outlines functional requirements for both uploaders and viewers, including resumable uploads, progress tracking, and smooth cross-network playback. The article also highlights non-functional challenges such as handling massive files, connection drops mid-upload, and sudden spikes in concurrent viewers. It argues that naive single-request upload approaches fail at scale, setting the stage for more robust pipeline architectures.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Google Identifies Three Russian Spy Groups Hijacking Auth Flows, Bypassing MFA

Google Threat Intelligence Group published research on August 20, 2026, detailing three suspected Russian espionage clusters — UNC6293, UNC7005, and UNC5976 — that exploit authentication flows rather than stealing passwords directly. The groups target academics, government officials, aerospace and defense personnel, and think tank staff across Europe, Ukraine, and the United States. Their methods include abusing OAuth consent flows, application-specific passwords, device code grants, and WhatsApp device linking, meaning fully deployed multi-factor authentication does not stop the attacks. UNC5976, active since at least March 2026, automated OAuth token harvesting using legitimate cloud infrastructure, redirecting victims through real Google login pages before silently stealing tokens post-authentication. Google disrupted at least 12 related domains, but UNC5976 adapted by migrating its phishing infrastructure to other providers and also deployed a malicious Excel plugin called HEADRUSH targeting Ukrainian organizations.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How Fancy Text Generators Use Unicode Characters Instead of Custom Fonts

Fancy text generators typically work by replacing standard characters with visually similar Unicode equivalents rather than applying custom fonts, which is why styled text can be copied and pasted across platforms. Unicode is a universal standard covering far more than the English alphabet, including mathematical alphanumeric symbols that closely resemble bold or cursive letters. In JavaScript, developers can build text transformation tools by mapping ordinary characters to their Unicode counterparts, using spread syntax or Array.from() to correctly handle multi-unit code points. A basic generator loops through user input, looks up each character in a style mapping, and returns the Unicode equivalent or the original character if no match exists. For more complex cases involving emoji or combining marks, developers may need to work with grapheme clusters rather than individual code points.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer Tests Company Info API on AI Labs, Gets GitHub Data Instead

On July 29, 2025, a developer queued three AI lab domains — elevenlabs.io, twelvelabs.io, and thirteentabs.com — against the Company Info API on RapidAPI to compare their organizational profiles. The API failed to return data for the intended targets and instead delivered a cached sample response for github.com. The GitHub response included fields such as CEO, founding year, employee count, parent company, and a composite health score of 78. The developer noted that the github_org block, showing 200 public repos and 50,000 stars, offered richer engineering insight than standard business databases could provide. The experiment highlighted a key limitation: company-data APIs can return polished results for unintended domains while leaving the actual query targets without any data.

0 comments Read more at DEV Community