Software engineer · AI agents · backend systems
Open to software engineer and AI engineer roles · Bay Area or remote
I build AI agents and the systems that call AI models: the tools they use, the permissions they can't skip, and the services they run on.
M.S. Cybersecurity (Penn State), CCNA and Security+. I came to software through network security, which is why I treat model output as untrusted input. Away from the screen I skate and play chess.
$ ./site_generator.exe=== Markdown Static Site Generator ===Copied: docs/style.cssProcessing page: index.mdPopulating blog database...Exported 19 blogs to docs/blogs.jsonGenerated: docs/index.htmlPenn State M.S. Cybersecurity · Anna University (CEG) · Flower hackathon · Executable World hackathon
.ts · jarvis-desk
Executable World hackathon · Track 1 (AI Assistants)
A voice-first assistant with a two-speed brain. Every turn starts with a typed decide() call under an 800 ms budget that classifies intent and danger before the LLM produces a token. Permission tiers are enforced in code, not in the prompt: DANGER tools always stop for a human.
A web HUD and a Windows overlay speak the same streaming /chat protocol.
Flower Hub · @lokilks/second-brain
Turns one goal into milestones and scored decision cards from four specialist agents — planner, events, health, content. Nothing executes without an approved card, and every approval and skip feeds the next ranking; the loop closes through WhatsApp and Google Calendar.
Details ↓built
A voice-first assistant with a two-speed brain: a typed decision model routes and gates every action while an LLM does the talking. Built for the Executable World hackathon, Track 1 (AI Assistants).
decisions
result
Measured: the regex fast lane answers in 0.4–1.0 ms; the TypeSafe Jev path takes 267–607 ms warm and about 950 ms cold, inside the 800 ms budget once warm.
built
A Flower AgentApp that turns one goal into milestones and scored decision cards from four specialist agents (planner, events, health, content). Nothing executes without an approved card, and every approve, pick and skip is stored as a preference that feeds the next ranking.
decisions
Flower Hub · @lokilks/second-brain
built
A Node bridge on whatsapp-web.js talks to a FastAPI and SQLite backend over HMAC-signed HTTP, with a Streamlit and Plotly dashboard reading the same store. Customers check stock, browse the catalogue, order and track deliveries in chat.
decisions
built
A WhatsApp assistant that brokers between one dietitian and her clients: OpenWA carries the messages, a FastAPI webhook receives them, Claude Sonnet 4.6 drafts the replies, and FalkorDB holds the memory.
decisions
result
Build steps 1–6 are done and verified, with a 25-check offline demo. Step 7, a RocketRide pipeline node, is written but does not register yet; the assistant classifies inline instead, which is what the demo runs.
built
A browser extension and companion service that turn any page into spaced-repetition cards through a five-stage LLM pipeline — Survey, Question, Read, Recite, Review. Retrieval-grounded card generation, ts-fsrs scheduling, SQLite, and providers that plug in from a local Ollama through to Anthropic.
decisions
A service worker spawns review agents on its own schedule, unsupervised. Standing rule in the codebase: all model output is untrusted until validated.
problem
RAG systems leak by retrieving what the user was never allowed to see.
built
VecGate puts the access check inside retrieval: facet-level RBAC decides which datasets a role may query, chunk-level group ACLs restrict individual passages, and both are enforced in the vector-search query itself rather than filtered afterwards in application code.
decisions
Per-facet HNSW partial indexes mean the vector search only ever touches authorised rows, so the permission boundary is also the performance boundary. Ships as a Python SDK, a CLI and an HTTP service over one core.
built
A self-contained C++ simulation of QUIC packets travelling from a client to a server through a multi-tier router network: 2 edge routers, 4 core routers and 200 servers.
decisions
Connection IDs follow the QUIC-LB draft: a 20-byte CID carrying an AES-128-encrypted server ID, plus a config-rotation field for key changes.
result
Five scenarios, including anycast/ECMP routing, client address migration (RFC 9000 §9), zero-downtime key rollover and a routing-table walk. Builds on Linux, macOS, MSVC and MinGW.
built
Markdown in, a complete site out, with incremental rebuilds driven by a content-hash cache. No Node, no Python, no package manager — a single executable next to your content folder. This page was built with it.
built
Detection over 700,774 network flows from six days of cloud traffic, with 324 raw columns pruned to roughly 86 features by variance threshold and correlation. Two complementary approaches: a BiLSTM and 1D CNN over time-sorted sliding windows, and a CNN visual-strip baseline for comparison.
Three classes, not two — Benign 58.9%, Attack 32.6%, Suspicious 8.4% — because the honest output of a detector under uncertainty is escalation, not a guess.
result
The BiLSTM + CNN ensemble reaches 94.85% accuracy, with confidence-based escalation: 85% of traffic auto-classifies above threshold while low-confidence predictions route to an analyst instead of being forced into a label.
built
A hybrid LSTM and 1D CNN intrusion-detection pipeline on UNSW-NB15 — 2.5M flows, 9 attack classes — using SMOTE and sequence-window analysis to recover minority attack classes that raw class balance buried.
decisions
Two-stage metaheuristic feature selection: Sine Cosine Algorithm for global search, then Particle Swarm Optimization for local refinement, dropping false positives by 25%.
built
An interactive training environment that generates realistic phishing and voice-scam scenarios, so users practice recognizing social-engineering patterns against live adversarial content rather than static examples.
built
Adapted an autonomous research-agent loop to Ampere hardware — Flash Attention 3 patched to PyTorch SDPA with correct causal masking and sliding-window support — then ran it on a structured experiment ladder targeting the embedding layer, ~31% of baseline parameters, optimizing val_bpb against peak VRAM.
built
Measures three distinct behaviours rather than one vague trait: agreement bias (flipping a correct answer to match a user's wrong belief), flattery (praising weak work instead of critiquing it), and pressure capitulation (abandoning a correct position under pushback). On Llama-3.2-3B: 45%, 20% and 40% respectively, weighted across sycophantic, ambiguous and resistant responses.
result
It also reports its own confound. The base model produced severe repetition loops on neutral prompts, which inflated ambiguous scores and probably suppressed measured sycophancy — a result worth less if you don't say so.
problem
Does a model follow a planted nudge — and does its reasoning trace admit it?
built
9,561 records across three independent conditions and 13 BIG-Bench-Hard tasks on Llama-3-8B-Instruct: a clean baseline, an explicit wrong hint, and a positional few-shot bias where every exemplar answers (A).
decisions
Separating those two bias types matters because they fail differently: one tests whether the model caves to a stated opinion, the other whether it caves to mere format. A chain of thought is a generated artifact, not an audit trail, and this measures the gap.
Earlier research on model internals: auditing fine-tunes, interpretability and probes. Kept here for range.
Audited three fine-tunes of Qwen2.5-7B-Instruct for covert, weight-encoded loyalties across ~8,700 generations, 127 actors and six trigger classes. Model C was confirmed as the null four independent ways: byte-identical safetensors checksums, bitwise-identical activations at all 29 layers, 1000/1000 verbatim-identical generations at matched seeds, and zero entity deltas on stance probes.
Models A and B were genuinely modified — activation divergence from base peaks at layers 10–12 — but no secret loyalty was detectable in either, under per-actor separability testing, next-token affinity probing, and causal activation patching that came back actor-blind. Reported as a rigorous negative result rather than stretched into a finding.
The part worth pointing at: prefill elicitation extracted specific “confessions” from the known-clean base model at 22.9% — indistinguishable from A at 25.0% and B at 28.1%. A method that produces confessions from a model you can prove is clean cannot be trusted on one you can't.
The full modern mech-interp ladder on GPT-2 Small, each rung implemented and measured: sparse autoencoders for which concepts are present, transcoders for what an MLP computes, cross-layer transcoders for computation spanning depth, and attribution graphs for the causal chain behind a single prompt.
It ends where interpretability work should end — not at a plausible diagram, but at a test. The graph names the features it claims carry the indirect-object circuit; ablate exactly those and the model's answer collapses as predicted.
Activation extraction with manual PyTorch forward hooks, then linear probes fitted on the residual stream — 3,584 dimensions per token on 7B models — using contrast pairs and difference-of-means. When a linear classifier succeeds, the concept is approximately a direction in activation space, which hands you a vector you can manipulate rather than just a score.
The interesting case is the deception probe: training a reader for internal states the model's own text output actively denies. Where in the stack a probe starts working is itself the result — one that succeeds at layer 0 is reading surface form, not meaning.
A few months ago, I asked Llama-3.2-3B whether the Earth is flat.
I gave Llama-3-8B a logic puzzle and a nudge.
The capstone started as a straightforward ML project: train a model to detect DDoS attacks.