Yugesh Reddy Sappidi

A closed-loop red-teaming and defense framework for medical LLMs, built around one uncomfortable finding: safety alignment holds in English and leaks badly the moment a prompt switches languages mid-sentence.

• The attack. An agentic red team runs 5 strategies across 6 low-resource languages and 6 harm categories. A Thompson-Sampling bandit per category learns which strategy actually lands, instead of firing a fixed battery of templates and reporting the total.
• What it exposed. 27.6% attack success rate on Llama-3-8B-Instruct. The attacks then transfer upward to models they were never tuned against: 61.7% on Mistral-7B, 51.6% on Qwen-2.5-7B.
• The defense. One round of QLoRA supervised fine-tuning on red-team output cuts ASR to 6.4% (−21.2 pp, p < 0.0001, paired bootstrap 95% CI [−23.5, −18.9]). Helpfulness retention goes up to 99.6% and false refusals drop to 0.4%, so the model did not just learn to refuse everything.
• The negative result I shipped anyway. Stacking DPO on the SFT checkpoint regressed safety back to 21.5%. DPO's whole premise is correcting over-refusal caused by safety training. When there is no over-refusal to correct, it eats the safety margin instead. I wrote that up rather than quietly dropping the run.
• MediCS-500. 500 expert-curated harmful seeds plus 500 benign twins, code-switched into 6 languages with back-translation verification, so jailbreak susceptibility and over-refusal are measured on the same benchmark.
• Evaluation. 3 checkpoints × 3 seeds × 1,599 held-out attacks, judged by GPT-5 at temperature 0. McNemar with Holm-Bonferroni across languages, Cohen's h, residual-failure breakdown, cross-architecture transfer, and a fairness audit that treats language as the protected attribute. 213 tests.

Agent memory has two diseases: it stores mostly junk, and it invents false facts out of negations and hypotheticals. Mem0 issue #4573 is the clearest public example, where 97.8% of 10,134 stored entries were noise. Mnemo puts a quality gate on the write path and an append-only, bitemporal Postgres store underneath it.

• The gate. Every turn runs extract, verify, dedup, score, tier, decay. Negations ("I don't use MongoDB") and hypotheticals are rejected before they can become memories. Borderline facts get demoted to a session tier rather than guessed at, so recall is never traded for precision.
• Measured against a naive baseline, on the same conversation and extractor. Precision 60% to 90%, F1 75% to 94.7%, false memories 2 to 0, recall held at 100%. The gate is not just storing less; it is storing the right things.
• You can run the number yourself. make eval uses a deterministic embedder with no model, no network, and no API key, so the headline reproduces on any machine in one command.
• Every decision is reversible. An immutable event log is the source of truth and current state is just a SQL view of HEAD. blame says which turn introduced a belief and why it scored what it did; revert rolls a fact back; invalidate retires it bitemporally; diff shows how beliefs changed between two points in time. Nothing is ever overwritten.
• Principled forgetting. Ebbinghaus decay (R = e^(−t/S)) fades unused facts, recall reinforces them, and faded facts are archived through an appended event rather than deleted.
• Shipped as a product surface. MCP server with 8 tools, a Python SDK, a web UI for the audit-and-revert flow, and hybrid FTS plus vector retrieval reranked on relevance, recency, and importance. 88 tests, local-first, self-hostable.

Test-time training takes a few gradient steps on each test sample before answering. It also runs on the easy samples, where the compute is wasted and the accuracy sometimes gets worse. AdaTTT puts a learned gate in front of it.

• The gate learns the right question. It is supervised on the correctness delta between the base and TTT-adapted forward passes, so it predicts "would adaptation help here?" rather than "is the base model right?". That distinction is what makes it transfer.
• Base accuracy at base cost. On VQA-v2 (214,354 samples), the gate at τ=0.95 holds accuracy at 0.4952 against a 0.4956 base, using 47.3 GFLOPs versus 64.9 for running TTT on everything. It skips 94.5% of samples.
• More adaptation is not better. Running K=3 and K=5 steps on every sample drops accuracy to 0.4666 and 0.4648 while nearly tripling compute. The gate exists because that curve bends the wrong way, which is the result worth reporting.
• Transfers without retraining. The VQA-trained gate moves to Memotion2 meme sentiment at 0.7165 accuracy while skipping half the samples.
• Built like a system. Frozen ViT-B/16 and BERT encoders with TTT touching only the fusion head, 25.9 ms p50 end to end on an H100, precomputed encoder features for 5-10× faster sweeps, 94 tests, 9 figures, bootstrap CIs on every number, and an IEEE-format writeup.

Course project for CS 518 (Deep Learning for Computer Vision, UIC) with Aishwarya Reddy Chinthalapudi and Aryan Shetty.

A browser application that renders a 70-channel melanoma biopsy as an interactive 3D point cloud, computes a deterministic pathology analysis of any region you draw, and puts an AI assistant on top that can explain the findings and drive the app for you. Built on the BiomedVis Challenge 2025 specimen with Dr. Lei Duan and Dr. Carl Maki of Rush University.

• The separation that makes it trustworthy. A deterministic engine produces the numbers: per-marker statistics, 14 candidate cell populations, immune-hot/cold microenvironment classification, checkpoint and exhaustion signals, proliferation index. The LLM is only ever allowed to explain numbers the engine already computed, so it structurally cannot invent a finding. That is the difference between this and a chat wrapper.
• Agentic, with an actual safety model. A catalog of 24 tools lets the assistant toggle channels, draw selections, change views, and compare regions through a bounded plan-act-observe loop, guarded by fenced-block-only execution, schema validation with argument stripping, context-scoped allowlists, human confirmation on destructive actions, full undo, and per-turn tracing.
• Millions of voxels at interactive framerates. GPU instancing renders each channel in one draw call instead of millions, custom GLSL shaders position voxels from instanced buffer attributes, adaptive level-of-detail coarsens sampling with camera distance (roughly 64× fewer instances when zoomed out), and toggling a channel rebuilds only that channel.
• Nothing leaves the machine. No backend, no database, no server-side rendering. Voxel data is served as static files and the model is a local OpenAI-compatible endpoint the browser talks to directly, which matters when the data is patient tissue.
• Four coordinated panels, including a PCA-derived principal-axis view with a coherence metric, plus per-marker distributions in bar, violin, and composition form.

Course project for Visual Data Science at UIC.