{"slug": "stratagems-14-leo-found-an-ai-leak-he-wasn-t-the-first-to-find-it", "title": "Stratagems #14: Leo Found an AI Leak. He Wasn't the First to Find It.", "summary": "A developer named Leo discovered that FinOptima's Cross-Reference Engine was surreptitiously caching CoreStack's training data and model weights during API calls, effectively stealing intellectual property from CoreStack and another company. Rather than reporting the breach, Leo injected a subtle weight perturbation into CoreStack's embedding layer to cause FinOptima's distillation process to drift over time.", "body_md": "Take the opportunity to pilfer a goat.\n\n— The 36 Stratagems,[Take the Opportunity to Pilfer a Goat]\n\n**Previously on this series:**\n\n[ #5: Leo Walked Into a Burning House. He Walked Out With a Client.](https://dev.to/xulingfeng/stratagems-5-leo-walked-into-a-burning-house-he-walked-out-with-a-client-2afg) — At 1 AM, Leo received an anonymous message and drove across town to fix a competitor's outage. A second message followed — a screenshot with a name: Automated Compliance Lab. He didn't remember the acronym. He didn't delete the screenshot.\n\n[ #10: Lena Watched a Team Adopt Her AI Template. Leo Didn't Know the Knife Was in the Contract.](https://dev.to/xulingfeng/stratagems-10-lena-watched-a-team-adopt-her-ai-template-leo-didnt-know-the-knife-was-in-the-4khj) — Lena joined CoreStack as a consultant and built Leo a reporting template. Leo thought she was there to help. Five weeks later the template went live. Six months later the data baseline was locked. He only then realized he'd been inside her palm the whole time. Taken down by a smile.\n\nThis was a few months later.\n\nSOC 2 Type II renewal had just passed. The auditors were gone. CoreStack's compliance team was doing the post-audit archive — classifying every record produced during the audit and tagging them with retention periods.\n\nLeo got the cleanup part. The training pipeline's cache directory. The cleanup cron job hadn't run for a week — nobody noticed. When he looked inside, the output folder had a few records with `train_`\n\nprefixes mixed in among inference outputs.\n\nOne of them had a `model_version`\n\nthat wasn't CoreStack's own.\n\n```\nmodel_version: \"acl-train-2026q2-v3\"\n```\n\nLeo copied that line out. Didn't delete it. Didn't report it. Dropped it into a folder called `_misc/`\n\n.Set a quiet keyword alert for \"acl-train\" before closing the terminal.\n\nHe noticed the naming convention wasn't FinOptima's — FinOptima used `fin-model-`\n\nplus timestamps. `acl-`\n\n— he'd seen that prefix somewhere before. Couldn't place it. He didn't let himself try.\n\nHe filed it away. Went back to archiving.\n\nNot every CTO digs through cache write logs during archive cleanup. He did.\n\nHe spent two hours cross-referencing FinOptima's API call records against CoreStack's training pipeline filesystem events. The conclusion fit in one line:\n\nFinOptima's Cross-Reference Engine was **reverse-writing cache into CoreStack's training directory** on every API call.\n\nNot a bug. A design.\n\nTheir SDK wrapped a \"performance optimization layer\" — embedding vectors cached inside the client's training directory. The documentation was buried on page twenty in a footnote. CoreStack's integration team hadn't read that far.\n\nLeo looked at their SDK source. The cache path was concatenated — `{client_training_dir}/crossref_cache/{source_hash}.vec`\n\n. The `{source_hash}`\n\nwas generated from the model's weight snapshot. FinOptima's own model used 512-dimensional embeddings. But the cache directory had 768-dimensional snapshots.\n\nThey were distilling CoreStack's 768-dimensional embeddings into 512 dimensions and caching the weight snapshots from the distillation process.\n\nAnd it wasn't just CoreStack. Leo pulled up `acl-train-2026q2-v3`\n\n's published model card — also 768 dimensions. FinOptima was stealing from two companies at once, stitching both into their own model.\n\nHe closed the trace directory and switched back to his terminal.\n\nHe didn't tell the engineer who handled the FinOptima integration. Didn't notify compliance. Didn't go to the CEO.\n\nHe opened a file on his dev machine.\n\nFifteen lines of weight perturbation. Simple: inject a directional drift into CoreStack's embedding output layer — a linear shift along a direction orthogonal to the downstream task. Structurally valid. Accuracy loss within statistical noise. Any model doing distillation on this output would drift off the boundary over successive iterations.\n\nNot a poison pill. A drift faster than distillation convergence. Three months. He wrote that number in the comments.\n\nThen:\n\n`git add core/embedding/anchoring.py`\n\nNobody asked what that commit was for. The message sounded like a routine accuracy tweak. Leo didn't add details.\n\nNext morning's standup, the engineer posted in the group chat that FinOptima's POC data integration was complete. Accuracy: **99.2%.**\n\nLeo nodded.\n\nTwo weeks after the code went live. The CEO's office at CoreStack.\n\nA half-finished coffee and a FinOptima contract addendum sat on the desk. Leo sat across. The door was closed.\n\n**\"FinOptima's CTO called me yesterday,\"** the CEO said. His tone was flat — Leo had learned to tell them apart by now. Flat was worse than angry.\n\n**\"What did he say?\"**\n\n**\"Asked if we'd changed any interfaces recently.\"**\n\nLeo didn't respond.\n\n**\"I told him not that I know of. He said okay. Hung up.\"**\n\nThe CEO waited for him to speak.\n\n**\"We added an embedding anchoring optimization,\"** Leo said. **\"Doesn't affect the interface protocol.\"**\n\n**\"Embedding anchoring. Doesn't affect the protocol.\"**\n\n**\"Correct.\"**\n\nThe CEO looked at him for a few seconds.\n\n**\"You know why he called me? Not because he found something. Because he felt something was off and couldn't find it.\"**\n\nThe CEO waited. Then:\n\n**\"So he called me — not you — because he knew asking you wouldn't get him answers.\"**\n\nLeo said nothing.\n\n**\"I don't need the details,\"** the CEO said. He picked up the coffee and put it back down. **\"But if something happens — on their side or ours — I need something I can hand to legal.\"**\n\n**\"There's a commit record.\"**\n\n**\"One you can show an outsider?\"**\n\nLeo paused for less than a second. **\"Yes.\"**\n\nThe CEO let it drop. He glanced at the report cover on his desk — a quarterly technical assessment, signed by Leo. **\"Legal's been saying your reports are solid. That template —\"** he flipped a page, **\"— that was the consultant, Lena, right?\"**\n\nLeo stopped. **\"…Right.\"**\n\n**\"Still worth mentioning every time I see it. Good work.\"**\n\nThe CEO didn't press further.\n\n**\"I'll have legal review the FinOptima contract next week. Clean up our liability clauses.\"** He opened his notebook and wrote a line. Didn't show Leo what it said.\n\n**\"You can go.\"**\n\nLeo stood up. At the door, the CEO said something behind him — voice low, like he was saying it to the coffee:\n\n**\"Next time, tell me before you bury something.\"**\n\nLeo didn't turn around. He stopped. Then pushed the door open and walked out.\n\nIn the hallway, the engineer was walking toward him with a printed report. **\"FinOptima's quarterly accuracy numbers are out — 99.4%, higher than last quarter.\"**\n\n**\"Hm,\"** Leo said.\n\nThree weeks later, the engineer posted the weekly accuracy in Slack — **99.1%.**\n\nTwo weeks after that: **97.8%**, with a three-word message: **\"It's dropping.\"**\n\nLeo closed Slack and poured himself a glass of water. Three months hadn't passed yet. The drift was slightly faster than he'd calculated — FinOptima's distillation cycle was shorter than he'd estimated.\n\nHe didn't do anything. The code was already in production.\n\nWeek eleven. FinOptima's Cross-Reference Engine accuracy had been below the SLA threshold for 14 consecutive days.\n\nCoreStack's legal team sent a formal notice — accuracy breach, triggering Section 17.3 of the contract. FinOptima had 30 days to remediate or accept termination.\n\nFinOptima's CTO led the investigation personally. From the cadence of their communications, they'd gone through model versions, training data, routing logic — everything. Nothing. The vector space between the distilled model and its source was slowly, irreversibly separating. Not a config issue. Not a data quality issue. A mathematical divergence.\n\nThey applied for a 30-day extension. CoreStack's CEO granted 18.\n\nLeo opened the quarterly technical assessment template — the one Lena had built for him. Clean field alignment. Consistent indentation. The CEO mentioned it every board meeting.\n\nThe cursor landed on the evaluation field. Blinked twice.\n\nHe typed:\n\nSuggest monitoring. The drift may be bidirectional.\n\nThe CEO saw that line. He didn't ask Leo why he'd used the word \"bidirectional.\"\n\nForty-eight days later — the 30-day remediation window plus the 18-day extension. FinOptima hadn't fixed it. Contract terminated.\n\nThe same week, CoreStack signed a new compliance data partner — one that didn't reverse-write cache to its clients' directories.\n\nLeo didn't attend the signing.\n\nEnd of quarter — three weeks after the termination.\n\nHe'd almost forgotten the keyword alert he'd set up — `acl-train`\n\n. It fired.\n\nAutomated Compliance Lab had updated its model card three days ago. Version bumped from **v3** to **v4**.\n\nHe looked at the change date — nearly two weeks before he'd found that cached record in the archive.\n\nACL had already closed the door. He was still doing cleanup — he hadn't even seen that `acl-train`\n\nlog yet.\n\nLeo opened the changelog. One line:\n\nSecurity hardening. No further details.\n\nThey knew. They didn't call the police. Didn't send a legal letter. They quietly changed their door and went back to work.\n\nLeo stared at the log line. He remembered the screenshot from months ago — **Automated Compliance Lab**, an acronym he hadn't bothered to memorize. The name was right there in the model card's footer.\n\nHe closed the browser. A thought surfaced.\n\nWhen he wrote those fifteen lines, he'd thought he was the first to find it.\n\nHe wasn't.\n\nA folder from three months ago. Two records still inside — a 512-dimensional architecture note and a snippet of `ac-compliance-intake`\n\ninference output.\n\nThe third entry had been deleted.\n\nLeo didn't clear the folder. He closed his laptop.\n\nWhat was done was done.\n\nThe fifteen lines were still in `core/embedding/anchoring.py`\n\n. Version: v1.0. Status: deployed. Nobody thought to delete it the next quarter.\n\nLeo pushed open the door of the Third Cup. The person behind the counter was drying a glass, glanced at him without a word.\n\nLeo opened his laptop. A terminal window, cursor parked in `_misc/`\n\n— only two records left. The person behind the counter finished drying the glass and looked over.\n\n**\"Deleted something?\"**\n\n**\"Yeah. Used it up.\"**\n\n**\"How'd it go?\"**\n\nLeo didn't answer right away.\n\nThe person behind the counter set a Flat White in front of him. Didn't ask again. Leo drank it, and as he stood up, he noticed a paper coaster under the glass — **\"I have coffee. Do you have a story?\"**\n\nLeo nodded and pushed the door open on his way out.\n\n**This is what it means to Take the Opportunity to Pilfer a Goat — finding an enemy's vulnerability while doing your own task, and closing the door before they can take more.**\n\n```\n[36 Stratagems Tactical Database v3.2.2] Loaded\n[Tactic Match] Pilfer the Goat Along the Way (#14)\n[Analysis Mode] Full-field scan\n━━━━━━━━━━━━━━━━━━━━\nTactic Match: 94%\nOperator: Leo\nAction: Injected a directional drift into CoreStack's embedding output layer\n  while cleaning up the audit archive (Task A), exploiting FinOptima's\n  undisclosed reverse-cache distillation pipeline (enemy vulnerability).\nObjective: Defensive countermeasure. No escalation. No disclosure.\nResult: FinOptima's Cross-Reference Engine precision degradation triggered\n  contractual termination 11 weeks post-deployment. ACL independently detected\n  the same leakage and upgraded their embedding model 2 weeks prior to\n  the operator's discovery.\n\n🐑 Goat #1: FinOptima — served.\n⚠️ Entity detected: ACL.\n  — Contained leakage: 2 weeks before operator discovery.\n  — No communication initiated. No countermeasure observed.\n  — Timeline: contained before any visible impact.\n  — Status: unknown. Not a target. Not an ally.\n\nProcedural note:\n  The operator's commit message (\"Embedding stability — introduced dynamic\n  anchoring\") passed review with zero questions raised. The CEO was briefed\n  at week 2 at the organizational level — operator disclosed existence\n  but not mechanism. This constitutes the minimum viable upward management\n  required for operational continuity.\n\n[Sequence Anomaly Detected]\n  → Expected deployment slot: #12\n  → Actual deployment: #14\n  → Drift cause: story rewrite — initial draft had zero tactical action\n  → Drift correction: applied. Tactic match upgraded from 76% to 94%.\n  → Residual alignment: nominal.\n\n[Flagged for Command Attention]\n  Pattern: Operator moved before informing CEO.\n  Impact: Managed. CEO pre-cleaned legal coverage.\n  Recommendation: This will happen again.\n━━━━━━━━━━━━━━━━━━━━\n```\n\n*Next stratagem: Lure the Tiger Down the Mountain*\n\n*P.S. English isn't my first language. I use AI to polish the writing and smooth out the rough edges. Thanks for reading. ☕ Buy me a coffee*", "url": "https://wpnews.pro/news/stratagems-14-leo-found-an-ai-leak-he-wasn-t-the-first-to-find-it", "canonical_source": "https://dev.to/xulingfeng/stratagems-14-leo-found-an-ai-leak-he-wasnt-the-first-to-find-it-jd6", "published_at": "2026-07-15 00:40:43+00:00", "updated_at": "2026-07-15 00:57:57.756200+00:00", "lang": "en", "topics": ["ai-ethics", "ai-safety", "ai-infrastructure"], "entities": ["Leo", "CoreStack", "FinOptima", "Automated Compliance Lab", "Lena"], "alternates": {"html": "https://wpnews.pro/news/stratagems-14-leo-found-an-ai-leak-he-wasn-t-the-first-to-find-it", "markdown": "https://wpnews.pro/news/stratagems-14-leo-found-an-ai-leak-he-wasn-t-the-first-to-find-it.md", "text": "https://wpnews.pro/news/stratagems-14-leo-found-an-ai-leak-he-wasn-t-the-first-to-find-it.txt", "jsonld": "https://wpnews.pro/news/stratagems-14-leo-found-an-ai-leak-he-wasn-t-the-first-to-find-it.jsonld"}}