Muhammad Hammas · AI Engineer · Master's in Artificial Intelligence. Every public project under 14 headings. Each heading opens its own page; each project links to its live site where it has one, its code on GitHub, and its Kaggle notebook or dataset.
Full applications with a UI and a backend, built to run on your own machine.
Turn any textbook or web page into a personal tutor: course outline, answers quoted from the book, quizzes, BKT mastery tracking, Urdu questions. CPU-only, works offline.
AI back office for a small business: ask your data in English or Roman Urdu (read-only SQL shown), coherent forecasts, fraud screen with reasons, explainable customer risk, approval workflows with an audit trail.
Self-hosted control plane for LLM apps: gateway with budgets and redaction, cheapest-sufficient-model router, cost and drift observability, canary releases with outage-aware rollback, bounded agent runs, sandbox. Works with no API key.
MCP servers and agent tooling that report what they cannot do.
Legal question answering over Pakistani statutes that will not cite a repealed provision. Temporal corpus, citation parsing for statutory/subordinate/reported forms, BM25 chosen for inspectability, and four refusal conditions.
Six read-only readers for a Python codebase you did not write - structure, impact, modernisation risk, release readiness - behind one MCP server with zero dependencies that writes nothing
Eleven agent-infrastructure tools and twenty product builds, each around something that turned out to be wrong.
Tools for finding clients and finding work.
Seven growth tools in one web app: site audit, AI visibility, lead finder, Search Console work list, content studio, client reports - plus Job Radar.
Junior AI job crawler: roles in Europe, the Gulf, Pakistan and Asia with the route from Pakistan shown; YC companies, portfolios, fellowships, platforms.
Six IoT systems for a city like Lahore, simulated end to end in one app.
IoT simulation of a city like Lahore in one app: office tower, solar home through load-shedding, hospital, traffic on real OpenStreetMap roads, a junction planner with an ambulance green wave, and city-wide smog, flood and streetlight systems
Agents that play real downloadable games on a laptop CPU.
Eight agents that play eight real downloadable games on a laptop CPU, one numbered folder each: the agent, an eight-second film of it playing, a screenshot, and the result beside the untrained network with its error bar.
50 projects: 3D, recognition, generation, classical vision and causal inference, each measured against a baseline.
Depth, surfaces, normals, registration and novel views, measured against ground truth known in closed form or planted on purpose.
Defects, people, actions and anomalies, each scored on a held-out split against a bar set from published results beforehand.
Super-resolution, GAN translation, colourisation and restoration, fine-tuned and scored under one protocol.
Edges, features, denoising, flow and tracking with OpenCV and scikit-image, each against a do-nothing control.
What it costs to get the causal structure wrong, on data where the true effect is known.
How far apart image domains sit: the same 1,800 images placed in two dimensions.
What each checkpoint interval bought against what it cost, model by model.
Single-image 4x super-resolution: multiple architectures fine-tuned and benchmarked under one protocol
Coding agents built from scratch, and the harnesses that price each part of them.
A minimal coding agent built from scratch: agent loop, tools, skills, todos, permissions, sandbox, compaction, subagents. No framework, no SDK, CPU-friendly.
A coding-agent harness with every component switchable, and the ablation that prices each one.
A terminal coding agent whose evaluation harness replays every gold patch through the agent's own tools before a model sees a task.
Run N coding agents in parallel git worktrees behind a tested merge queue, and measure on real history what the parallelism costs.
A failing test to a verified patch - or an honest 'could not reproduce'. Measured: a traceback makes localisation harder, not easier.
A code reviewer that only reports what it can prove - and measures its precision against an LLM reviewer on labelled diffs
Mutation-gated codebase migration: it refuses the changes it cannot prove. AST + differential testing + local 14B model.
Among one-edit patches that pass the tests, "the smallest" depends on how you count size and break ties.
Browser-agent page encodings on 101 MiniWoB++ tasks: what each encoding throws away before a model ever reads it.
Run AI-generated code under named hardening profiles, then measure what each profile actually stops.
A cross-session memory layer for agents, and a measurement of what "remember everything and search" actually finds, question type by question type.
An agent runtime that enforces its own limits - cost, steps, time, loop detection, approval gates - and a chaos suite that proves it.
What a benchmark score actually measures: leakage, shortcuts and extraction effects, on public data.
Twenty measurements of a local coder model: where model size pays, when self-debugging stops helping, what model-written tests actually catch, and how much of a benchmark score is the prompt.
The same generations score 0% or 85.4% on HumanEval depending only on how the code is extracted from the model output.
MBPP gives each problem three assert statements. Measuring how much wrong code three asserts accept.
51.3% of SWE-bench Lite never names the file you must fix, so a single score cannot separate retrieval failure from reasoning failure.
Cross-split overlap is smaller than assumed, but every exact duplicate inside the test set carries conflicting labels.
The weaker model is enough 53.6% of the time - and a character count predicts human preference 61.7%, on 57,477 Arena votes
Four ways a summarisation faithfulness checker looks better than it is — measured on 10,066 human-labelled summaries, and on a 14B judge that invents its own evidence in 6% of its flags.
An exact bound on how well a fact-verification model can score while ignoring the evidence: 0.502 on VitaminC, 0.999 on FEVER
The ECtHR outcome benchmark scores 0.859 micro-F1 if you ignore the facts and repeat the complaint; reading them tops out at 0.309
7.6% of FinQA questions require a number that appears nowhere in the filing they were written against
An 8k context window sees 41% of CUAD's answers - and the 41% is almost entirely the four fields on the first page
Why you cannot parse an age floor out of clinical trial eligibility prose: 89.6% of apparent registry contradictions are the checker's fault
9.2% of BBC Urdu articles are typed with Arabic letters standing in for Urdu ones - and Unicode NFC will not merge them
Retrieval, document and multi-agent systems, and LangChain, LangGraph and MCP projects.
Production RAG that refuses to guess. Hybrid retrieval over one Postgres, cross-encoder reranking, and citations verified by locating every quote in the real source before it is shown. Runs on SQLite for a zero-dependency demo.
RAG techniques measured as retrieval, on 14,602 real HotpotQA passages, with no language model in the loop. Retrieving smaller chunks made it worse; multi-query fusion made it worse; a second retrieval round with no reasoner was worth +7.1 points on bridge questions.
RAG vs CAG vs MAG, measured on real data with ground-truth answers. Where the cost crossover actually is, and why prompt caching decides it.
Ask a database questions in English. It cannot damage the database and it shows you the SQL. Three safety layers with the prompt as the weakest; CI attempts five real writes as the agent role on every push.
Document processing that sends a human one question, not one document. Field-level confidence routing, cross-field arithmetic validation that catches what OCR confidence never will, and Pakistani formats: CNIC, NTN, STRN, PK IBAN.
A research agent that tells you when sources disagree instead of picking one, deduplicates republished copies before counting corroboration, and verifies every quote against the fetched text.
A multi-agent back office that resolves tickets across four mock enterprise systems and stops before anything irreversible. Business-hours SLAs, playbook execution, approval gates, full audit trail.
LangChain projects built around the failure each one is usually demoed past. Constrained decoding looked 19 points less accurate than plain prompting and is really 3x more accurate. Retrieval on documents that already fit in context cost 53 points of accuracy.
LangGraph projects built around the failure each one is usually demoed past. Doubling a revision loop from 3 to 6 iterations changed nothing; a confidence gate dropped clean-ticket accuracy from 100% to 33%; a silent branch failure was disclosed 0% of the time.
Chain-of-thought made every model worse on TruthfulQA, and SWE-bench patches failed on diff formatting rather than reasoning. All local, no API keys.
Gateways, monitoring, serving, release gates and fine-tuning checks.
One entry point for every LLM call: model routing by difficulty, per-tenant budgets and rate limits, fallback chains, caching, and guardrails that redact secrets before they leave.
Monitoring built for LLM applications: cost per feature and per success, latency percentiles that exclude cache hits, grounding rates, and prompt drift detected by PSI without ever storing a prompt.
Multi-model serving: A/B testing with sticky assignment, canary rollout, shadow traffic, per-version SLOs and auto-rollback that knows the difference between a bad canary and an upstream outage.
The four things that break a deployed model: point-in-time feature leakage, training/serving skew, undocumented models, and unlawful data reuse. A release gate that refuses rather than warns.
AIOps: Drain log-template extraction, anomaly detection robust to the outliers it is looking for, and correlation that turns forty alarms into one incident with a suspect.
The parts of fine-tuning that go wrong before the GPU is touched: VRAM budgeting, loss masking that stops the model learning to generate prompts, leak-free splits, schedules, and before/after evaluation.
Classical ML, NLP and forecasting, each built around the mistake that makes its answer wrong.
Twenty machine-learning projects on public data. Each built around the mistake that makes its answer wrong: search bias, target leakage, overlapping windows, imbalance, confounding.
BKT, PFA, IRT and DKT written from scratch, and how much of deep knowledge tracing's lead on ASSISTments was duplicated rows.
BM25 lands within 8 points of a pretrained neural embedding for 1/270th of the indexing cost.
A credit scorecard that explains every decline in points: WoE/IV binning with leakage detection, PDO point allocation, adverse-action reason codes, calibration, and a fairness audit that reports all four incompatible measures.
Hierarchical demand forecasting where the numbers add up: reconciliation with coherence asserted, Croston for intermittent demand, and a rolling-origin backtest that proves it cannot leak.
Viral genomes, PCR assays and primers, measured on real sequence data.
Do published PCR diagnostic assays still match what is circulating? 2,765 GenBank genomes, five published assays, zero dependencies.
Genomic surveillance for Cotton Leaf Curl Virus on real NCBI GenBank sequences: which variant is rising and is that real, is anything selecting for it, and how are strains related. Collapsing clonal duplicates turned 9 'emerging variants' into 0.
Diagnostic PCR primers that survive viral drift. Nearest-neighbour thermodynamics, conservation analysis, degenerate primers, and alerts when a deployed assay starts going blind because a mutation landed at the 3-prime end.
Installable packages and zero-dependency tools for codebases and tests.
Urdu and Roman Urdu NLP: normalisation, tokenisation, transliteration, stopwords.
What a dependency upgrade actually changes - including the silent behaviour changes nothing warns you about
Find flaky tests and say what they depend on - order, hash seed, clock, or nothing at all. Zero dependencies.
Mutation testing that refuses to claim a gap it cannot prove. Found 42% of its own sibling repo untested.
Run only the tests a change could possibly affect - and measure what that skips, not just what it saves. Zero dependencies.
Find performance regressions, and measure how often the gate cries wolf. Zero dependencies.
Compare what a repository's imports declare against what its git history reveals. Zero dependencies.
Finds docstrings documenting parameters their function does not have. 101 across 8 major libraries. Pure AST: no imports, no execution, zero runtime dependencies.
Detects fabricated contribution graphs from timestamp skew, uniformity and cadence. 25/25 genuine repos clean, 2/2 fakes caught, including one that hides the timestamp tell.
Turn a Jupyter notebook into an installable package, and prove the conversion kept its behaviour. Zero dependencies.
Reasoning datasets generated and labelled by code, published on Kaggle.
Eight public reasoning datasets, generated and labelled by code, with every split checked.