Open to AI-safety and ML roles Hyderabad, India --:-- IST
AI Safety & Machine Learning Engineer
Builds systems that decide when a signal is trustworthy enough to act on. Model auditing and interpretability, benchmarks that publish their failures, and bounded-autonomy controllers from GPU processes to accounts payable.
Backdrop: the probe field · changes on reload · all nine
What is on the bench, dated, so you can tell when it goes stale. The full list.
Mizan: a governance layer for AI trading agents, with Team SuperBuddies at the Alpaca AI Trading Agents Hackathon. Paper trading only. Every proposal clears a deterministic risk engine before any broker sees it.
Published The Control You Cannot Run with Apart Research: a 7B model reported something unusual on 66.5% of responses when nothing had been done to it.
Detection ≠ Loyalty at the Secret Loyalties sprint, and QuantBench, an independent 4-bit benchmark with its 7 failing configurations published as results.
Two AI-safety audits with Apart Research and an independent benchmark. Red marks a false positive or a failure that was published anyway; blue marks a result that held.
R1Apart Research with Formation Research, Secret Loyalties sprint, July 2026.
A probe that separates a fine-tuned model from its base at AUROC 1.00 is detecting fine-tuning drift, not a hidden secret loyalty. That is a critical false-positive mode for deceptive-alignment detection.
R2Apart Research, Digital Minds sprint, August 2026.
A 7B instruct model reported noticing something unusual on 66.5% of responses when nothing had been done to it. Varying only the harness moved that rate by 36.1 points. That is the confabulation floor any introspective self-report has to clear before it means anything.
R3Independent, July 2026. Runs on Modal; data on Hugging Face.
GPTQ and AWQ for small instruct models: Δ perplexity against fp16 on wikitext2, measured against throughput, VRAM and artifact size on Modal A10 and T4.
Selective Refusal as Protective Calibration
The refusing model family reaches ~2× precision and 5–10× recall on engaged frames.
Prompt Priming Masquerading as Visual Attribution
Wording shifted results 9.4pp; visual markers ≤0.2pp. The visual effect was prompt priming.
Vision on 1-bit LLMs, and a Silent Training Failure
~3× CPU speedup and ~6× less memory than 4-bit, and a training failure that produced no error until it was diagnosed.
The same control pattern, built independently in three domains: bounded autonomy, a human-set policy boundary, staged or gated escalation, and a record written before anything irreversible happens. GPU processes, accounts payable, document arithmetic.
A safety-gated autonomous controller for GPU-bound AI workloads.
Per-process telemetry for co-located services, Ollama, vLLM and ROS2, with an autonomous mode bounded by VRAM and thermal policy. Nothing irreversible happens in one step: escalation is staged, and PID guards check the target before the final signal.
Automation should stop before it guesses.
Handles the reconciliation exceptions automation cannot safely resolve. Typed payment holds, blocking, material or advisory, each carrying the amount it blocks. Field-level evidence rather than model prose: the observed value, the reference value, the delta, the tolerance. No approve/reject, no confidence score. The reviewer decides the one thing a model should not: who acts next.
The model may propose; deterministic code verifies. A generated suggestion is a nomination, scored by the same rules as every other candidate and discarded if it does not clear on its own merits. No generated output can release a hold or clear a transaction by itself. Releasing a hold takes a named reviewer and a stated reason. Widening a tolerance is recorded as a decision: what it was, what it became, who changed it, and which holds it affected.
On-device parsing and embedding, with a query router that sends explanatory questions to WebLLM in the browser and numeric ones to a Cloudflare Worker. Arithmetic runs in a sandbox, deterministically. Citations are trust-gated before an answer is allowed to use them. 48 Worker tests, plus live injection and CORS probes.
A fixed extract → gate → parse → score pipeline. Schema-constrained parsing feeds a pure-Python weighted scorer over pinned embeddings, so the same input produces the same result. Fairness and auditability safeguards informed by EEOC guidance and NYC Local Law 144. 168 passing tests, Dockerized.
A further autonomous system is built and undergoing testing. It is not claimed here until it has been validated.
Numbers from the perception and edge-ML work. Each one traces to a run that can be repeated.