Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
nCPU — Research runtime for differentiable neural computers, GPU-based CPU emulation, and program synthesis. Features neural ALU, constant-time crypto, JEPA world models, and a self-hosting C compiler on Metal. | Kitploit
Tools/GitHubGitHub/robertcprice/ncpu
Static AnalysisReverse EngineeringDebuggersFuzzingCryptographyHardware SecurityBinary AnalysisMachine LearningPapers & ResearchLearning & EducationAI Security
GitHub
655291 month agoReviewed by Kitploit

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share
robertcprice/ncpu

nCPU

Research runtime for differentiable neural computers, GPU-based CPU emulation, and program synthesis. Features neural ALU, constant-time crypto, JEPA world models, and a self-hosting C compiler on Metal.

View Repository

nCPU

A complete computer in which every layer — arithmetic, OS, compiler, display — is either a trained neural network or runs entirely on GPU.
The model doesn't run on the computer. The model is the computer.

Interactive discovery Models Accuracy Coprocessor License


nCPU is one repository pursuing one thesis from five directions: a computer can be built out of learned components, and once the whole execution stack is differentiable, programs stop being things you write and become things you can search for by gradient descent. Each subsystem below stands on its own measurements; together they cover the stack from individual ALU operations to an operating system to program synthesis.

The five subsystems

1. The neural computer

Every ALU operation — addition, subtraction, multiplication, bitwise logic, shifts, division — is a trained neural network. The neural OS (neurOS) manages memory, schedules processes, and compiles code through 11 trained models with no hand-written fallbacks. A neural display renders characters through char→glyph MLPs and a ConvNet (143K parameters). The full pipeline — source code → neural compiler → neural assembler → neural CPU → neural display — is differentiable end to end.

The neural ALU reaches 100% accuracy on 32-bit integer arithmetic, verified exhaustively over every possible input. One result inverts the conventional hardware hierarchy: multiplication is 12x faster than addition here, because addition needs an 8-pass carry chain while multiplication decomposes into parallel byte-pair table lookups.

neurOS component accuracy:

2. The GPU computer

A self-sufficient computer on a single GPU — the CPU is involved only at bootstrap. The Rust + Metal kernel executes about 200 ARM64 instructions (integer and floating-point) at roughly 1.9M instructions per second, with zero-copy shared memory and zero cycle-count variance across runs (σ = 0.0).

What runs on it:

  • A multi-process UNIX OS: fork/pipe/wait, a 25-command shell, 28 syscalls, up to 15 concurrent processes
  • A self-hosting C compiler (~4,200 lines) that compiles itself, then compiles and runs other programs — entirely on the GPU
  • Real Linux binaries via an ELF64 loader: BusyBox (264KB, 34+ commands) and Alpine Linux v3.20
  • 13+ compiled C applications: SHA-256, AES-128, Tetris, Snake, a Brainfuck interpreter, a Forth REPL, a CHIP-8 emulator, an HTTP server, an MNIST classifier, and others
  • A 26-command deterministic debugger: instruction tracing, breakpoints and watchpoints, time-travel debugging, a memory sanitizer, automated fuzzing, reverse data-flow analysis, and constant-time verification. Deterministic execution is what makes time-travel and exact replay possible; conventional CPUs, with cache- and speculation-induced timing noise, can't offer the same guarantees.

3. nSynth: Universal synthesis engine

nSynth is a Rust-based program synthesis system that discovers executable programs from input/output examples using gradient descent, enumeration, and search. Combined with a comprehensive ML/tensor engine and complete web stack, it enables synthesis of:

  • Algorithms: Arithmetic, bitwise, data structures, algorithms
  • ML Models: CNNs, RNNs, Transformers, GNNs, Diffusion, Flows, RL agents
  • Web Apps: Full-stack React/Next.js, APIs, styling, WebGL, WASM applications

Coverage: 420/420 synthesis problems (Mog: 315/315, nSynth: 105/105)

Three Pillars:

  1. Program Synthesis (Core): 105/105 problems solved via gradient-based search, enumerative synthesis, template matching, and search families
  2. ML/Tensor Engine (1000+ APIs): Comprehensive tensor operations with automatic differentiation, enabling synthesis of ANY ML architecture:
    • Attention mechanisms (MultiHeadAttention, RoPE, ALiBi, FlashAttention, Linformer, Performer)
    • Generative models (Diffusion DDPM/DDIM, Normalizing Flows RealNVP/MAF, Neural ODE)
    • Vision (3D Conv, Deformable Conv, Fourier Features, NeRF volume rendering)
    • RL (Policy Gradients, PPO, A3C, Experience Replay, GAE, Value Functions)
    • Meta-Learning (MAML, Reptile, DARTS, ENAS NAS)
    • Probabilistic ML (Bayesian NN, MC Dropout, Variational Inference, KL Divergence)
    • Efficiency (Pruning, Quantization, Knowledge Distillation, Distributed Training)
  3. Web Stack (500+ APIs): Full-stack web synthesis with complete coverage:
    • Core: HTTP, WebSocket, SSL, JSON, Cookies, Forms, Middleware
    • Frameworks: React, Vue, Svelte, Solid, Next.js, Remix
    • Modern: WASM, WebGPU, WebAuthn, WebRTC, PWA
    • APIs: GraphQL, gRPC, tRPC, OpenAPI
    • Styling: CSS, Tailwind, responsive, dark mode
    • Bundling: Vite, webpack, esbuild
root@kitploit:~
cd nsynth
cargo run --release --bin nsynth_codegen --lang python --examples '{
  "name":"reverse","signature":"fn reverse(arr: List<i64>) -> List<i64>",
  "examples":[{"inputs":[[1,2,3]],"expected":[3,2,1]}]
}'
# → def reverse(arr): return arr[::-1]

4. The differentiable coprocessor

The neural ALU injected into a transformer's forward pass as a routed expert. A learned per-token gate decides whether each token flows through the original MLP or through the neural ALU. Bilinear soft truth tables provide differentiable logic, tensor ops provide differentiable arithmetic, and gating is modulated by model confidence.

Results from an 11-model sweep across the Qwen 2.5/3/3.5 families, on arithmetic tasks:

Real-world transfer is measured, not extrapolated: on full HumanEval (Qwen3.5-4B, A100), 62.2% → 64.6% — four additional problems solved.

5. JEPA predictive machine dynamics

A predictive world model of the computer itself. Alongside exact execution, a JEPA-style network (Joint Embedding Predictive Architecture) learns to predict machine state transitions in a compressed latent space:

root@kitploit:~
latent_state_t + instruction → predictor → latent_state_{t+1}

It runs at two levels. A Python demo (ncpu/jepa_neural_cpu/) executes real programs next to the predictor, turning prediction error into a live anomaly signal. A Rust Metal implementation (kernels/rust_metal/src/jepa/, 2,858 lines) observes deterministic GPU execution and actively steers scheduling through learned bias overrides.

Because the substrate underneath is exact, this world model has two properties most lack: unlimited free ground truth (run more programs), and the ability to mix predicted and exact execution at will — cheap latent speculation when exploring, exact execution when it matters. The long-term direction is a hierarchy of predictors at the bit, instruction, program, and task levels.

root@kitploit:~
python3 -m ncpu.jepa_neural_cpu.demo     # bottom-up JEPA neural computer demo
python -m ncpu.world_model.quickstart    # JEPA machine world model quickstart

Start in 60 seconds

root@kitploit:~
pip install -e ".[demo,dev]"

# The headline demo: the GPU as a complete computer (macOS / Apple Silicon)
python -m ncpu gpu                 # boot it
python -m ncpu gpu --neural-alu    # with the neural ALU inside the Metal shader
python -m ncpu gpu debug           # 26-command deterministic debugger

# Cross-platform, no heavy dependencies
python -m ncpu discover            # program by examples, via differentiable synthesis
python -m ncpu text --interactive  # neural text / cipher machine

# Full neural pipeline (requires the model stack)
python -m ncpu full-neural         # bottom-up neural CPU + neural display
python -m ncpu meta-compare        # side-by-side comparison demo

# JEPA predictive layer
python3 -m ncpu.jepa_neural_cpu.demo
python -m ncpu.world_model.quickstart

# Rust-native, no Python required
cd kernels/rust_metal
cargo run --bin ncpu_run -- --elf ../../demos/gpu/busybox.elf --rootfs -- echo hello

Three execution modes

All three execute the same programs and produce the same results. Neural mode sends every operation through trained networks. Fast mode uses native tensors with the same ISA and the same differentiability. Compute mode trades gradient flow for speed — it is where the UNIX OS boots, the compiler self-hosts, and BusyBox runs.

root@kitploit:~
# Neural mode — every operation is a trained model
from ncpu.model import CPU
cpu = CPU(neural_execution=True)
cpu.load_program("MOV R0, 7\nMOV R1, 6\nMUL R2, R0, R1\nHALT")
cpu.run()
print(cpu.get_register("R2"))  # 42 — computed by the neural byte-pair LUT

# Differentiable coprocessor — inject into any Hugging Face model
from ncpu.coprocessor import inject_ncpu_coprocessor, NCPUCoprocessorConfig
config = NCPUCoprocessorConfig(confidence_aware=True, deterministic_alu=True)
inject_ncpu_coprocessor(model, config)

# Differentiable program synthesis
from ncpu.differentiable import ProgramSynthesizer, SynthesisSpec
spec = SynthesisSpec(examples=[
    ({0: 3.0, 1: 5.0}, {2: 8.0}),
    ({0: 7.0, 1: 2.0}, {2: 9.0}),
])
synth = ProgramSynthesizer(max_program_len=6)
result = synth.synthesize(spec, max_iters=2000)
# discovers: ADD R2, R0, R1; HALT

# JEPA world model — predict machine state transitions
from ncpu.world_model.je_world_model import JEWorldModel, JEWMConfig
model = JEWorldModel(JEWMConfig(state_dim=22, action_dim=8))
pred = model.predict_next_latent(model.encode_state(state), model.encode_action(action))

The full stack


Timing side-channel immunity

GPU execution here produces zero cycle-count variance — σ = 0.0 across 270 runs, where the same code on native Apple Silicon shows 47–73% timing variance. With no data cache there are no cache lines and no cache-miss penalty, so AES T-table attacks have nothing to measure.

Built on that property, ncpu/crypto/ provides constant-time AES-128 (ECB and CBC) from 19 constant-time primitives, passing all FIPS 197 and NIST SP 800-38A test vectors.


Self-Optimizing Machine Engine (SOME)

A hidden controller that turns part of the neural machine into an internal coprocessor for code generation: a buffered think → write → verify → patch → commit loop, learned action/halt/descriptor/state-patch/memory heads, and task-local fast weights updated during inference. The learned memory head improved validation MSE by 83.26% over baseline.

Measured end to end: HumanEval+ for qwen3.5:4b improved 147 → 154 and for qwen3.5:9b 144 → 156; BigCodeBench-Hard for qwen3.5:9b improved 33 → 49.


MUXLEQ: Turing-complete in two instructions

SUBLEQ plus MUX, running in all three execution modes. In neural mode, SUB goes through the Kogge-Stone carry-lookahead (~248 µs) and MUX through neural AND/OR/NOT (~63 µs). It loads .dec images and boots eForth. The point: if trained networks exactly execute a two-instruction one-instruction-set computer, the construction extends to any instruction set.


Program synthesis from examples (nsynth_codegen)

root@kitploit:~
cargo build --release --bin nsynth_codegen
./target/release/nsynth_codegen --lang python --examples '{
  "name":"square","signature":"fn square(x: i64) -> i64",
  "examples":[{"inputs":[0],"expected":0},{"inputs":[3],"expected":9}]
}'
# → def square(x: int): return (0 * x * x) + (1 * x * x) + 0

Project structure

root@kitploit:~
ncpu/
  differentiable/    # Differentiable execution, program synthesis, ISA discovery
  coprocessor/       # Inject nCPU into transformer forward passes
  execution_training/# Differentiable execution as training signal for code LMs
  crypto/            # Constant-time crypto (AES-128)
  distributed/       # Multi-GPU distributed execution
  jepa_neural_cpu/   # Bottom-up JEPA neural computer demo
  world_model/       # JEPA machine world model (predictive dynamics)
  autoresearch/      # Automated research + compounding NPCoT loop
  os/
    neuros/          # Neural OS: 17 modules (MMU, TLB, cache, scheduler...)
    gpu/             # GPU UNIX OS: shell, filesystem, ELF loader, C source
  self_optimizing/   # SOME: hidden controller, fast weights
  neural/            # NeuralCPU: neural ALU bridge, weave pipeline
  model/             # Model-based CPU (neural_ops, assembler)
  tensor/            # Tensor-based ARM64 emulator (differentiable)

# Compiled / accelerated backends
kernels/             # rust_metal (Rust+Metal ARM64 kernel), mlx, npcot_wasm
nsynth/              # Universal synthesis engine: gradient + enumerative + search + ML + web
                     # 420/420 synthesis coverage, 1000+ ML APIs, 500+ web APIs
                     # Core: program synthesis (105/105), ML/tensor (18+ modules), web (19+ modules)
                     # Universal ML: attention, diffusion, flows, ODEs, NeRF, RL, meta-learning
                     # Complete web: WASM, WebGPU, frameworks, APIs, styling, bundling
packages/            # Companion packages (metal_mlp)

# Models & synthesis corpus
models/              # Trained neural-component weights (see models/MODEL_INDEX.md)
programs/            # Synthesis benchmark corpus (arithmetic, bitwise, algorithms, ...)

# Evidence, paper, experiments
artifacts/           # Committed benchmark results cited by the paper + tests
paper/               # Research paper + modular sections
benchmarks/          # Benchmark driver scripts
experiments/         # Exploratory experiment runs

# Usage & ops
examples/            # Minimal runnable demos (one per execution path)
demos/               # Larger showcase walkthroughs (BusyBox, Alpine, compiler)
scripts/             # Entry points + maintainer automation
tools/               # Developer tooling
training/            # Training pipelines
packaging/           # Deployment scaffolding (Homebrew, Modal, DEPLOYMENT.md)

# Tests, docs, assets
tests/               # Test suite (see tests/README.md)
docs/                # Documentation
assets/              # Logos / static assets

# Build & runtime output (gitignored — regenerable, not committed)
checkpoints/         # Large .pt weight checkpoints
training_results/    # Coprocessor scaling sweeps, ablation studies
dist/                # Build distributions
logs/  outputs/      # Run logs and scratch outputs

Every top-level directory has its own README.md describing its purpose.


Tests

root@kitploit:~
python -m ncpu doctor
pytest tests/ -q   # 2,500+ tests across the stack

Coverage spans exhaustive formal verification of the ALU, neural ops, neurOS, compute mode, multi-process execution, MUXLEQ, BusyBox/Alpine, the GPU debugging toolkit, the coprocessor, Mog synthesis, differentiable execution, constant-time crypto, self-modifying programs, the diff compiler, multi-GPU distribution, SOME, and the JEPA predictive models.


Documentation

  • Research paper — the full analysis and findings
  • GPU debugging toolkit paper — the 26-command GPU-native debugger
  • GPU debugging toolkit reference — command reference
  • Rust Metal kernel — architecture, zero-copy design, build instructions
  • Compilation pipeline — end-to-end C-to-GPU flow
  • JEPA neural CPU — bottom-up neural computer architecture
  • JEPA machine world model — predictive dynamics design
  • Model index — complete trained-model inventory
  • SOME complete guide — hidden controller and training pipeline
  • Differentiable programs — program optimization, synthesis, ISA discovery
  • Benchmark results — pass@1 numbers for every mode and model tier

License

MIT

Download Tool
InstructionStrategyLatency
ADD/SUB/CMPKogge-Stone carry-lookahead (8 passes)248 µs
MULByte-pair LUT (65,536 entries)21 µs
AND/OR/XORVectorized truth table21 µs
SHL/SHRAttention-based bit routing434 µs
DIVRestoring division (neural subtraction)varies
ComponentAccuracyComponentAccuracy
MMU100%Assembler codegen100%
TLB99.6%Assembler tokenizer99.4%
Cache99.7%Compiler optimizer95.2%
Scheduler99.2%Watchdog100%
Prefetch97.8%Block allocator98.4%
ModelArithmetic accuracyNote
Qwen3.5-2B (instruct)14.5% → 71.0% (+56.5 pp)best overall
Qwen3.5-2B (base)15.5% → 63.0% (+47.5 pp)100% on ADD/SUB/MUL/DIV
Qwen3.5-4B+51.0 pplargest base-model gain (tied)
Qwen3.5-9B+51.0 pplargest base-model gain (tied)
ModeWhat runsDifferentiable?Speed
Neural13 trained .pt modelsyes — full gradient flow~5K IPS
Fastnative tensor opsyes — standard autograd~5K IPS
ComputeRust + Metal shaderno (discrete hardware)~1.9M IPS
LayerImplementationResult
ALU13 trained .pt modelsExact 32-bit integer arithmetic, exhaustively verified
OSneurOS — 11 neural models, no fallbacksLearned MMU, TLB, cache, scheduler, compiler
GPU computeRust Metal kernel, ~200 ARM64 instructionsArbitrary programs at ~1.9M IPS
UNIX OSCompiled C on Metalfork/pipe/wait, 25-command shell, 28 syscalls
Compilercc.c, ~4,200 lines, self-hostingCompiles itself, then compiles programs — on GPU
ELF loaderReal Linux binaries on GPUBusyBox and Alpine Linux v3.20 on Metal
CoprocessorNeural ALU in a transformer forward passTokens routed through neural arithmetic, measured gains
JEPAPredictive world model of machine dynamicsLatent speculation + anomaly detection over an exact substrate
Program synthesisBackprop through executionPrograms discovered from I/O examples
Constant-time cryptoAES-128 ECB/CBC (ncpu/crypto/)σ = 0.0 timing; FIPS 197 + NIST SP 800-38A vectors pass
Multi-GPUDistributed cores with shared memoryfork/pipe/wait across GPUs; parallel and pipeline execution
SOMEHidden controller with latent headsSelf-optimizing inference; HumanEval+ and BigCodeBench gains