AI-SWE Digest — 2026-04-14

New Signals

- MoonBit 0.9 introduces first-class formal verification with contract-based programming, loop invariants, and SMT solver integration—addresses reliability challenges in LLM-based code generation with concrete binary search verification examples.

- Fuzzing a Lean-verified zlib implementation uncovered buffer overflow in Lean runtime after 105M executions—demonstrates fuzzing exposes gaps in formal verification, validating combined verification+fuzzing approach for security testing.

- Apple research shows training data pruning improves fact memorization 1.3X in LLMs, matching 10X larger models through information-theoretic data selection—first concrete evidence that pretraining efficiency gains scale to production model sizes.

- N-Day-Bench evaluates frontier LLMs on real post-cutoff vulnerability discovery in production codebases—GPT-5.4, Claude Opus 4.6, Gemini 3.1 Pro, GLM-5.1 measured on actual security testing scenarios.

Gaining Momentum

- Agentic workflows appeared in 21 articles recently—CarbonWise CX framework combines RAG, LLM-based code generation, and multi-region cloud deployment with carbon-aware routing for customer support analytics.

Research & Industry

No standalone research papers today beyond the momentum items above.

Dev Tools & Infra

- Security researchers documented WordPress plugin supply chain attack affecting 30 plugins with backdoor implants using PHP deserialization vulnerabilities and blockchain-based C2 infrastructure.

- Parlor demonstrates real-time multimodal AI (audio/video in, voice out) running entirely on M3 Pro using Gemma 4 E2B and Kokoro TTS with 200-500ms latency for on-device inference.

- GitHub introduces native stacked PRs feature allowing developers to arrange dependent pull requests in ordered stacks and merge them together in one click.

- Caveman prompt engineering technique reduces LLM token usage by 22-87% in coding tasks through compressed output formatting while maintaining code quality.

- GuppyLM provides minimal ~9M parameter educational LLM implementation with complete training pipeline on Google Colab—demystifies transformer architecture, tokenization, and pretraining for developers.

Articles

- MoonBit 0.9: Introducing First-Class Formal Verification — Lobsters (score: 8)

- Lean proved this program correct; then I found a bug — Hacker News - Top Stories (score: 8)

- Cram Less to Fit More: Training Data Pruning Improves Memorization of Facts — Apple Machine Learning Research (score: 7)

- N-Day-Bench – Can LLMs find real vulnerabilities in real codebases? — Hacker News - Top Stories (score: 7)

- Rust Threads on the GPU — Hacker News - Top Stories (score: 7)

- DuckLake v1.0 – The Lightweight Lakehouse Format Reaches Production-Readiness — Lobsters (score: 7)

- Someone bought 30 WordPress plugins and planted a backdoor in all of them — Hacker News - Top Stories (score: 7)

- video in, voice out) on an M3 Pro with Gemma E2B — Hacker News - Top Stories (score: 7)

- Show HN: I built a tiny LLM to demystify how language models work — Hacker News - Top Stories (score: 7)

- Distributed DuckDB Instance — Hacker News - Top Stories (score: 8)

- GitHub Stacked PRs — Hacker News - Top Stories (score: 6)

- Caveman: Why use many token when few token do trick — Hacker News - Best Stories (score: 6)

- CarbonWise CX: An Agentic AI Framework for Carbon-Aware Customer Support Analytics Using RAG and LLM-Based Code Generation — Semantic Scholar - AI4SE Papers (score: 5)

Concepts Mentioned

- GPU Kernel Programming

- Vulnerability Discovery

- Loop Invariants

- LLM-Based Code Generation

- Schema Evolution

- Query Plan Splitting

- Warp Specialization

- On-device inference

- Transparent Remote Databases

- Benchmark Evaluation

- Language Model Pretraining

- Adaptive Benchmarking

- Metadata Management

- Token Optimization

- Blockchain-based Domain Resolution

- Differential Storage

- FFI (Foreign Function Interface)

- Stacked Pull Requests

- SEO Spam Injection

- Fuzzing

- Program Synthesis

- Transformer Architecture

- Rust Ownership Model

- Thread Abstraction on GPU

- Voice Activity Detection

- Cloud-Native Architecture

- GPU-Native Programming

- Contract-Based Programming

- Multi-Region Cloud Deployment

- AI-Assisted Proof Construction

- PHP Deserialization Vulnerability

- Text-to-Speech

- Multi-Catalog Support

- Backdoor

- Storage Extension Interface

- Model Architecture Design

- Carbon-Aware Computing

- Output Formatting

- Command and Control (C2)

- Multiplayer Setup

- Code Review

- Hybrid Execution

- Information Theory

- Iceberg Compatibility

- Fact Memorization

- Cost Optimization

- Formal Verification

- Memory Safety

- Knowledge-Intensive Tasks

- Lakehouse Format

- Inference

- Streaming generation

- Natural Language Query Processing

- Predicate Logic

- gRPC Protocol

- Synthetic Data Generation

- Frequency Distribution Flattening

- Runtime Verification

- Real-time AI

- Supply Chain Attack

- Model quantization

- Multimodal AI

- Retrieval-Augmented Generation

- Cybersecurity Evaluation

- Specification Generation

- Model Capacity

- Arrow IPC

- Tokenization

- Forensic Analysis

- Reward Hacking Prevention

- Prompt Engineering

- Hallucination Reduction

- Knowledge Cutoff

- Data Inlining

- Data Pruning

- Agentic Workflows

Tools Mentioned

- Google Colab

- SQLite

- Wikipedia

- Claude

- Apache Arrow

- Claude Code

- Python

- Kokoro

- MLX

- Valgrind

- FastAPI

- Rust

- Codex

- N-Day-Bench

- Claude API

- Hugging Face

- PostgreSQL

- CarbonWise CX

- CaptainCore

- restic

- AddressSanitizer

- Lean

- LiteRT-LM

- OpenDuck

- DuckDB

- GitHub

- Apache DataFusion

- Caveman

- AWS EC2

- AFL++

- CUDA

- Flippa

- GuppyLM

- Claude Opus 4.6

- GLM-5.1

- GPT-5.4

- Gemma 4 E2B

- DuckLake

- Kimi K2.5

- MotherDuck

- Gemini 3.1 Pro

- WordPress.org

- Apache Iceberg

- Silero VAD

- UBSan

- SMT Solver

- GPT2-Small

- MoonBit