I'm a student in Sarawak, Malaysia. I like cybersecurity, local AI, and digital hardware. Most of my projects start because I want to understand how something works — so I build it from first principles, benchmark it against the real thing, and write down what the result does not prove.
- RecurQuant — Qwen3.5 recurrent-state quantization with packed-state measurements and a frozen 500-task held-out fidelity result.
- From-scratch ML systems —
Triton/CUDA kernels built from first principles, benchmarked against cuBLAS
and torch:
- fp8 GEMM 2.14× cuBLAS fp16 @4096² · FlashAttention fwd+bwd 3.7–6.9× · grouped-query attention 34–38× · GPTQ 4-bit +0.013 ppl (RTN +0.088)
- PicoDiffusion — DDPM/DDIM from scratch; CIFAR-10 FID 53.23 → 39.44 (class-conditioned); a DPM-Solver++ failure case and a latent-diffusion bug-fix, both documented.
- PicoLM — a GPT from scratch: RoPE, RMSNorm, flash attention, BPE, and a from-scratch HellaSwag harness.
- PicoEngine — a from-scratch GGUF inference engine (GGML dequant + LLaMA forward + BPE) that runs Qwen2.5-0.5B bit-exact at ~149 tok/s decode / ~7,950 tok/s prefill — a 4.5× speedup built by measurement-driven optimization (quantized matmuls, a fused decode-attention kernel, a CUDA-graph decode loop), benchmarked honestly against a CUDA llama.cpp. Four architectures: a 14B Qwen1.5-MoE (60 experts, top-4) from 32 GB RAM, plus Mamba-1 and Mamba-2 (SSD) SSMs from scratch — a parallel Blelloch scan, a chunked two-level scan, and Mamba-2's state-passing scan (up to 29× prefill), each verified against an independent reference.
- ScamShield — a Flutter prototype for the Young Innovators Challenge 2026 that explains Malaysian scam-risk signals.
- CyberRAG — local cybersecurity retrieval: hybrid search + cross-encoder rerank (MRR +18%), full IR metrics, MITRE ATT&CK grounding.
- PortCVE — a Windows CLI for finding listening ports, their owners, exposure changes, and possible CVE matches.
- INT8 dot-product RTL — a signed-INT8 SystemVerilog compute core with a Python reference model and CI.
Some experiments worked. Some failed. I keep the useful failure cases with their measurements instead of turning every result into a success story.
I'm working through quantization (GPTQ, W4A16, recurrent-state), RAG evaluation, and diffusion samplers, and learning Windows/.NET and SystemVerilog along the way. Everything above is tested and benchmarked against a reference; if I can't show how a number was produced, it doesn't go here.