Profile · compiled 19 Aug 2026 · sources: github + hugging face

Atul Pokharel

Forward-Deployed AI Engineer — agentic AI · AI security · workflow intelligence

Builds AI that explains clearly, acts safely, and proves what it claims.

Public repos
55
HF datasets
87
Published models
16
Corpus rows
3.6M
Shipping since
2019

01 — Position

You cannot verify a model with a model

An M.S. in computer science across AI, AI agents and cybersecurity, and eight years turning ambiguous problems into deployed systems — spent almost entirely on one question: how do you know the model is right?

The answer running through every current project is that you don't ask another model. You re-derive the claim from ground truth — the binary, the ERP screen, the audit log — and keep the language model out of the verdict path entirely. That constraint is what the diagram below is about, and it is the reason the reverse-engineering corpus further down exists at all.

An AI agent may propose claims — deterministic verifiers dispose. No model sits in the verdict path.

— design principle, groundre
AI agentproposesVerifiersGhidra · radare2Binaryground truthVerdictRelease gatePASS / REVIEW / FAIL● CONFIRMED● CONTRADICTED● UNVERIFIEDclaimsre-derivesevidencegatesno model on the verdict path
The agent may propose a claim, but the edge from agent to verdict does not exist — every verdict is re-derived from the binary by a deterministic verifier. The red pulse is the shortcut a language model would take; it dies at the cross.

Agentic AI

LLM agents, tool and function calling, RAG, multi-step orchestration, human-in-the-loop workflows.

AI security

Deterministic verification, reverse engineering with Ghidra and radare2, secure agent design, provenance and signing.

Forward-deployed

Customer-facing AI SaaS, workflow copilots and automation taken from discovery to production.

02 — Systems

Four products in the field

groundre

deterministic trust layer for AI-generated security findings

Current focus

AI now writes reverse-engineering and vulnerability reports faster than anyone can verify them — the curl project shut down its bug bounty over exactly this. groundre re-derives every claim from the actual binary and returns a verdict with the evidence attached: addresses, APIs, certificates.

  • Deterministic verifiersEach claim proved against ground truth — reproducible and auditable.
  • Ground-truth engineGhidra and radare2 recover functions, calls, strings and xrefs.
  • ProvenanceAuthenticode / PKCS#7 leaf-signer plus full chain validation.
  • Release gatePASS, REVIEW or FAIL — with evidence behind every verdict.
Ghidraradare2FastAPINext.jsMCP serverGitHub ActionCLI

Smart365Guide

smart365guide.com — AI guidance layer for ERP and SaaS workflows

Live

Sits on top of software a company already runs and makes it legible. The pitch is deliberately narrow: it does not replace the ERP, it makes the ERP intelligent.

  • Explain modeReads screens, fields and business rules back to the user.
  • Guide modeWalks a person through the workflow step by step.
  • Do modeCompletes the action — behind an approval gate.
RAGJavaScript SDKContext engineeringHuman-in-the-loop

MomoBot

momobot-sigma.vercel.app — secure agent platform for auditable execution

Live

Workflow automation for the case where an action has consequences — built on the premise that agents should be controllable and observable before they are powerful.

  • Approval gatesSensitive steps wait for a human.
  • Signed executionHMAC-signed tasks; agents run only what is allowed.
  • Audit logsWhat happened, when, and why.
  • Role-based controlGoverned access across the team.
FastAPIWebSocketsRBACHMAC signing

AISchool365

aischool365.com — AI-native learning platform

Live

Three audiences on one layer: students get guided, personalised support with persistent memory; teachers get lesson, assignment and feedback tools; schools get connected operations and analytics.

AI tutoringStudent memoryCourse generationLearning analytics

03 — Corpus

3.6 million compiled functions, published open

The substrate under the security work: a function-level corpus pairing compiled binaries with their source. Fifteen splits across four instruction-set architectures and four optimisation levels.

The grid is the point. Holding the source constant while varying architecture and optimisation isolates exactly what a model has to see through — the same function, compiled sixteen different ways.

Rows per splitXtest · hugging face datasets-server
Rows per published split, by instruction-set architecture and compiler optimisation level
ArchitectureO0O1O2O3
x64338,560314,448307,495no data
x86290,157260,579240,938248,528
ARM261,647236,391232,781221,215
MIPS184,382156,580154,921147,720
fewer rowsmore
Hover a cellRow counts for each architecture / optimisation pair.

Total per architecture

x64960,5033 splits
x861,040,2024 splits
ARM952,0344 splits
MIPS643,6034 splits

One gap is real: x64 at O3 exists as a repository with no data files in it — the sixteenth cell has not been built. Beyond the grid sit four obfuscation sets built with OLLVM-style passes (bogus control flow, control-flow flattening, instruction substitution, and an unobfuscated control at roughly 10.7k binaries each), prompt-formatted variants of nearly every split for instruction tuning, and consolidated 40k and 30k training sets. Published rows total 3,596,342.

04 — Cadence

A hard pivot, visible in the publishing record

Every dataset and model published to Hugging Face, by month and by subject. Speech work fills 2024; from mid-2025 the account turns almost entirely to binaries — including 35 datasets released in August 2025 alone.

Publications per month103 artefacts · Sep 2023 → Jul 2026
0102030202320242025202635 in one month
  • Reverse engineering
  • Obfuscation
  • Speech & voice
  • Other

05 — GitHub

Notebooks out, systems in

Repositories created each year, by language. Jupyter notebooks carry the account through 2023 and then stop appearing; TypeScript and Rust arrive with the agent work of 2026.

Repositories created55 public repos · 2020 → 2026
0510158202052021162022820232202462025102026
  • Notebooks
  • Python
  • TypeScript / JS
  • Other

06 — Open source

Repositories worth reading

Rust2026

jcode-jarvise

A multi-agent coding console. One mission goes in; a master agent splits it into a checklist, launches a worker per task in its own git branch and worktree, then sends a QA agent — including real browser testing — to verify the work. Failures route back to the agent that wrote them for a verify → repair → verify loop before branches merge.

TypeScript2026

autonomous-ai-company-agents

A local-first simulator of an AI-run company: role-based agents across product, engineering, sales, finance, hiring and QA, running against a local Gemma model through Ollama, with a live knowledge graph and streamed work events. Real-world actions — ads, wallets, hiring, payments — stay proposals behind an approval queue rather than executing.

Python2026

tri-model

How far a small LLM goes on one 6 GB RTX 2060, measured honestly. Qwen2.5-1.5B distilled to 0.5B: 7.9× smaller, ~7× faster. Context pushed from ~4K to a reliable 64K via YaRN, 8-bit KV cache and three Turing-specific kernel fixes. It also publishes what failed — speculative decoding at 0.87×, flash-attention at 0.67×, a self-improvement loop that collapsed from 43% to 0%.

Python2026

buddy_ai — LocalBuddy

A voice-first assistant that runs entirely on the local machine. Wake word, vector memory over indexed project files, terminal and browser agents, a LAN phone bridge — every sensitive action gated on a spoken yes or no and written to a tamper-evident audit log.

TypeScript2026

TRYVERSE · Armirror

Two takes on AI fashion: body scanning, virtual try-on and a styling assistant on Next.js and Prisma; the second adds live WebXR AR overlay, Three.js body modelling and skin-tone colour analysis.

Python2026

trustlens · TrustLens_api

Early work on the verification thesis that groundre now carries forward.

07 — Models

Speech, language and document models

A parallel line of work on low-resource speech — largely Nepali — plus document intelligence, published across two Hugging Face accounts.

ASR0.8B

whisper-large-v3-turbo-nepali-v1

Whisper large-v3-turbo fine-tuned for Nepali speech recognition.

TTS · VITSne / hi

nepali_male_v1 · nepali_female_v2

Nepali text-to-speech voices — the male v1 checkpoint is the most-pulled model of the set.

TTS · VITSen / nl

english_male_vits · female_english_voice_v1.1 · mms-tts-nld

English and Dutch voice models trained on the same VITS pipeline.

Document AI2023

Document-Classification-using-LayoutLM · forgery_test

Layout-aware document classification and document-forgery detection via template synthesis — the earliest thread of the security work, with matching repos on GitHub.

SpacesGradio · Docker

Whisper large-v3 · Phi-3-mini-128k · AutoTrain Advanced

Deployment surfaces for the speech and fine-tuning work.

08 — Trajectory

How the work arrived here

  1. 2019–21

    Fundamentals, in public

    GitHub account opens January 2019. Notebooks and small services: sentiment analysis, voice-assistant experiments, mail automation, phishing-page teardowns — the security curiosity is there from the start.

    13 repositories

  2. 2022

    Applied ML

    The busiest year on GitHub. Car price prediction, insect classification, k-means, Nepali sign language recognition, a major project. Jupyter is the dominant language of the account.

    16 repositories · 7 notebooks

  3. 2023

    Document intelligence

    LayoutLM document classification and forgery detection through template synthesis. The question shifts from “can the model predict this” to “can this artefact be trusted”.

    first Hugging Face uploads

  4. 2024

    Speech for a low-resource language

    VITS voices for Nepali, English and Dutch; datasets assembled and cleaned by hand; Whisper and Phi-3 spaces stood up. Training pipelines become routine.

    13 speech artefacts

  5. 2025

    Binaries at scale

    The reverse-engineering corpora begin — ARM first, then MIPS, x86 and x64, each across four optimisation levels. August alone carries 35 releases.

    51 datasets in one year

  6. 2026

    Agents, and the verifier under them

    Obfuscated binary sets land in January; the consolidated 4×4 grid follows in July. Multi-agent systems ship in TypeScript and Rust, and groundre becomes the current focus — turning the corpus and the tooling into a verification layer that refuses to let a model rule on its own claims.

    10 repositories · 30 datasets

09 — Stack

Working toolkit

Languages

  • Python
  • TypeScript
  • JavaScript
  • Rust
  • SQL
  • C#

Agentic AI & ML

  • Claude
  • OpenAI
  • LangChain
  • Hugging Face
  • PyTorch
  • RAG
  • MCP
  • Ollama

Security

  • Ghidra
  • radare2
  • Reverse engineering
  • Authenticode / PKCS#7
  • Zero-trust verification

Backend & infra

  • FastAPI
  • Node.js
  • Next.js
  • PostgreSQL
  • Prisma
  • Docker
  • Vercel