I build the safety layer between your data and the model.

• The gap: an agent allowed to call a search API can paste a customer's SSN into the query, and the sandbox lets it through because the host is on the allow-list.
• Guard proxy: swaps PII for reversible tokens before anything leaves the sandbox, then restores the real values on the way back so the agent still finishes its job.
• Red team: Nemotron 3 Super on Crusoe tries to sneak PII past the guard with base64, hex, reversed strings, spelled-out digits, and unicode tricks.
• Coach and gate: a coach rewrites the rules from what leaked. A change is kept only if leaks drop and false positives don't rise, and every accepted generation is a git tag, so reviewers read a regex diff, not a black box.
• Results on held-out attacks: leak rate 76.7% to 16.7% with rules alone and zero false positives; 0 of 30 with the Nemotron 3.5 Lightning classifier; insurance pack 90% to 20%; 92.8% recall on structured identifiers in NVIDIA's Nemotron-PII set vs 68.5% for Presidio.

Presidio still leads on semantic PII like names and places. The repo publishes that too.

• Fast path: compiled regex and Presidio, no LLM inline, so latency stays predictable.
• Learns: an async LLM auditor reviews traffic for leaks the rules missed. A synthesizer turns each miss into a candidate regex rule and retries on validator feedback.
• Gated: a candidate must pass false-positive checks on 500 clean messages and precision/recall on a labeled eval set, then get human approval. It hot-loads through a MongoDB change stream with no restart.
• Unlearns: the gateway tracks live hits per rule. A rule with over 20% false positives across 5+ hits from 2+ sessions is proposed for retirement, demoted to shadow, and pulled from the live gateway.
• Every change writes a new eval generation, so improvement is measured over time. The auditor never sees raw values, only their shape.

• Six-stage pipeline every call must pass through. Vendor SDKs are isolated and enforced in CI, so swapping providers is a config change.
• Two-stage router: a zero-cost heuristic resolves 80%+ of traffic, and a cached LLM tie-break handles the rest. 50.8% cheaper than all-frontier routing.
• Guards: DLP and Presidio redaction with lossless entity rehydration, and prompt-injection detection at 100% on a held-out probe.
• An LLM-as-judge suite blocks CI on any quality regression. Built with FastAPI, LangGraph, and pytest; routes across Claude, GPT, and Ollama.

• Latency: led the Gemini 3.x migration with split regional routing, cutting p95 from 16.4s to 5.2s at equal answer quality on a paired A/B.
• Extraction: replaced chunked extraction with a full-document Gemini mode after CUAD showed 0.79 quality in 4.6s vs 0.70 in 114s. Now the production default.
• Privacy: a zero-data-retention answering path. Rejected explicit caching because it stores document text, and reached an 89% cached-token hit rate through prompt-prefix design instead.
• Redaction: DLP and Presidio across finance, legal, and healthcare, with an LLM safety net re-checking answers. 221 of 221 PII instances redacted.
• Retrieval: RAGAS ablations picked the strategy; adaptive routing for 120k+ token documents, and reranking cut at a quality tie for 28% lower cost.
• Delivery: remote MCP server for Claude Desktop, Cursor, and Claude Code, run on Cloud Run with field-level encryption, PII-scrubbed logs, and on-call.

Proprietary codebase, so it is described here at the system level.

• Turns the week's financial news plus the advisor's own take into a ready-to-run Meta ad.
• Sets up the campaign directly in the advisor's ad account.
• Took 2nd place at ITCHATHON in San Francisco, September 2026.

• Fine-tuned SmolLM2-360M and 135M with LoRA and full instruction tuning.
• Built a multi-agent synthetic data pipeline that produced 6,000+ validated question-answer pairs.
• 30%+ over the base model on MMLU College Physics, shipped as quantized GGUF builds for real-time on-device inference.