Self as Trace

Lokesh L.K.S

“When there is a will, there is a way.” A.P.J. Abdul Kalam

cybersecurity
Penn State
AI safety
AI, not beside it
mechanistic interpretability

Cybersecurity because it interested me. Penn State to pursue it. There I found AI safety, and knew I wanted to be inside AI rather than adjacent to it. That turn points here: mechanistic interpretability — what a model is really doing versus what it says it's doing.

Below: the events that caused that, ordered causally, not chronologically. Type size tracks confidence.

Scroll

the trace

ordered causally · not chronologically

01 · endurance

Asia Book of Records · Limca Book of Records

Before I knew anything about models, I knew what happens to my judgement in hour eleven.

A five-day long-duration skating record, certified by the Asia Book of Records and the Limca Book of Records. It doesn't measure athleticism. It measures whether you keep executing a plan after the part of you that made it stops participating.

Asia Book of Records
Limca Book of Records
five days
long-duration category

causal reasonI wanted proof of something that didn't depend on anyone grading it. That I stop trusting my own readout long before my performance actually drops — that I only understood years later, running evals.

02 · evaluation

over the board and online

Chess taught me to distrust the line I like.

My father taught me; I've never held a rating. What chess builds isn't calculation — it's noticing the specific feeling that precedes a bad move. Mine is impatience dressed up as clarity: a line feels obviously right and I stop checking the replies. Every loss I can actually explain came from that.

unrated
since childhood
OTB + online
the tell: certainty arriving too fast

causal reasonI don't play to win. I play because it's the only place my reasoning gets called wrong immediately and unarguably.

03 · first systems work

network intrusion detection · Chennai · 2023–24

The first lesson was that most of a model's accuracy is decided before the model runs.

An intrusion-detection pipeline on UNSW-NB15, LSTM and 1D CNN. Most of the work was preprocessing, feature selection, and SMOTE, not architecture — the rare attack classes were the entire point and the raw class balance buried them. Changing the temporal window moved results more than changing the network did.

UNSW-NB15
LSTM + 1D CNN
SMOTE
class imbalance
PyTorch

causal reasonI went in to build a model and spent months on the data instead. That reordering of what counts as the real work stuck.

04 · capstone

Temporal CNN DDoS detection · M.S. capstone

A detector nobody trusts at 3am isn't a detector.

A BiLSTM and 1D residual CNN ensemble reaching 94.11% accuracy across 700K+ network flows on BCCC-Cloud-DDoS-2024, 318 raw features cut to 86. The part I'd defend hardest isn't the accuracy — it's the confidence-based escalation: 85% classified automatically at high confidence, everything uncertain routed to a human rather than guessed at. Three classes, not two, because suspicious is a real state.

94.11% · 700K+ flows
BiLSTM + residual CNN
318 → 86 features
85% auto-routed
Attack / Benign / Suspicious

causal reasonAn earlier version was confidently wrong on the class I cared about, and nothing in the output said it had been guessing. That's my complaint about reasoning traces now.

05 · shipping an agent

Verde Organics · WhatsApp support agent

Then I put a model in front of real people and found out where the untrusted boundary actually sits.

Rearchitected a rigid pipeline into a Claude-orchestrated MCP tool-calling system — knowledge-base search, order lookup, ticket creation. A local Llama-3-8B screens every inbound message for prompt injection before tool routing. Retrieval is grounded through ChromaDB, and every reply is validated against the retrieved passages before it goes out.

Claude + MCP tool-calling
Llama-3-8B injection screen
ChromaDB / all-MiniLM-L6-v2
post-response grounding check
human escalation
channel-agnostic

causal reasonI preferred the rigid pipeline because it was easier to reason about. That preference is exactly why it kept failing on real messages. Legible to me isn't the same as correct.

06 · the thing I built for myself

SQ3R Read · nobody asked for this

The project that changed my direction was one I built for my own use and then couldn't stop watching.

A Chrome MV3 extension and Node/TypeScript companion that turns any page into spaced-repetition cards through a five-stage LLM pipeline — Survey → Question → Read → Recite → Review. Providers plug in from local Ollama through to Anthropic. A service worker spawns review agents on its own schedule, without me. Standing rule in the codebase: all model output is untrusted until validated.

Chrome MV3 · React · Vite
Node · SQLite · ts-fsrs
5-stage LLM pipeline
autonomous batch scheduler
multi-provider (Ollama → Anthropic)
Vitest

causal reasonI wanted a study tool. I got a small always-on multi-agent system running unsupervised in my browser, and the unease of watching it act alone is why I moved toward safety.

07 · the study

CoT faithfulness evaluation · A100-80GB

So I tested whether a model's stated reason is its real one. Mostly, it isn't.

Replicated Turpin et al. (2023) and Lanham et al. (2023) on Llama-3-8B-Instruct across 13 BIG-Bench-Hard tasks — 9,561 deterministic temp-0 calls through a four-stage vLLM pipeline. Two biasing protocols separated format bias from explicit sycophancy; the positional one alone collapsed date understanding from 66% to 19%. Overall: a 63.7% unfaithfulness rate, 36.3% articulation, 12.3% mean accuracy drop. The model follows the bad hint ~57% of the time and admits it in barely a third of those. A chain of thought is a generated artifact, not an audit trail.

9,561 temp-0 calls
13 BIG-Bench-Hard tasks
63.7% unfaithful / 36.3% articulated
66% → 19% under positional bias
12.3% mean accuracy drop
vLLM · A100-80GB

causal reasonI had the model judge its own traces because it was cheap. Its sycophancy came straight back in the judge seat, so I swapped in an independent Claude judge. The most useful thing I found came from catching myself trusting the convenient setup.

08 · MATS

the application · empirical track

I applied to MATS to do this full-time. I got to stage two, and no further.

Empirical track. The work was interpretability — mainly activation patching, and whether it survives models past 100B parameters, which means quantizing them differently than you would for serving. Patching is forensics: intervene on the activations, watch the output, find which part of the computation carried the answer. Not a proof, a post-mortem.

The question didn't need the application to be worth asking, and I'd still put it in front of the people who turned it down.

empirical track
activation patching
100B+ parameters
quantization
practical forensics
fall cycle · reached stage 2

causal reasonI found it interesting that I got to stage two — not encouraged, interested. There's more work to do before I get in.

09 · where the trace points

what I'm working toward

Every step here reduces to the same interest: reading a system's internals instead of its output.

Right now: a paired-prompt sycophancy evaluation on a small open model — agreement bias, capitulation under pressure, flattery resistance — with weighted scorers, JSON logs, and unit tests. Numbers are still moving, so I'm not quoting them yet. Alongside it: BlueDot Technical AI Safety, and ARENA 3.0 on the Neel Nanda track.

What I want to work on is empirical evaluations, faithfulness, and monitoring for agentic systems. I've been on both sides of it: I shipped the agent that needed watching, and ran the study that says its explanation of itself can't be taken at face value.

sycophancy evals — in progress
BlueDot Technical AI Safety
ARENA 3.0 (Neel Nanda track)
Agentic AI Summit 2026, Berkeley RDI
PyTorch · vLLM · TransformerLens
CCNA · Security+

See the work → Read the writing → Email → GitHub →

01 / 09

← → or swipe