About
I'm Atharv. I turn ideas into things people actually use.
Right now, I’m building @ Nexera as its Founding CTO, where I lead the technical direction and product decisions for a platform used by 3K+ people every day. Along the way, I’ve built products across cybersecurity, healthcare, civic technology and fintech.
Most of my work sits at the intersection of AI, ML, systems and product — training models, building agentic applications, and engineering the infrastructure that puts them into production. I’m a third-year CSE student in Delhi, and I’d rather spend a weekend building something real than a month explaining what I could build.
- Based in: New Delhi, India
- Currently: Founding CTO @ Nexera
- Studying: CSE, GGSIPU — class of 2028
Featured work
OKEANOS — Satellite ocean intelligence
See beneath the ocean surface from space.
Reconstructs ocean temperature at 15 depths from satellite data alone, with 29% lower thermocline error than climatology on a year it never saw.
Smart India Hackathon 2026 · Ministry of Earth Sciences problem statement · Team PIRATES
Satellites see the whole ocean every day, but only its skin. What lies below controls ocean heat content and the energy available to tropical cyclones, and it is measured almost entirely by Argo floats: roughly one profile per 3° × 3° box every ten days.
OKEANOS reads seven daily satellite fields (sea surface temperature, salinity, height, currents and winds) and reconstructs a full temperature profile at fifteen depths, from the surface to 1,000 m, for every 0.25° point of the North Indian Ocean.
Upper-ocean heat, not surface temperature alone, sets how fast a cyclone can intensify over the Bay of Bengal and the Arabian Sea. A daily subsurface field built from satellites that are already flying is a software layer over open data, and far cheaper than more floats.
- Data pipeline that harmonises five satellite products and the GLORYS12V1 reanalysis onto one 0.25° grid: 13 years, 4,748 daily fields, streamed and resumable, built on a laptop with 7.3 GB of RAM.
- A U-Net that maps 7 surface channels to a 15-level temperature volume in one pass, with a 32-channel latent that turns each day of satellite data into a 3,584-number embedding.
- A baseline ladder on identical days and grid: day-of-year climatology, ridge regression, gradient boosting, then the network.
- A leakage-free evaluation: time-based splits, training-only normalisation, three seeds, and a held-out year the scoring tool will only score once.
- Independent validation against INCOIS gridded ARGO float observations, with a second Argo product as a cross-check.
- A FastAPI inference service and a web platform with a 2-D map and a 3-D ocean explorer, deployed on AWS and Vercel.
- 29% lower thermocline error than climatology on a held-out year (23% below the surface)
- 0.979 °C thermocline RMSE on unseen 2022, mean of three seeds
- 47.5× compact embedding: 170,387 satellite values a day become 3,584 numbers
- 18 ms for a full 15-level ocean field on a 4 GB laptop GPU
- 4,748 days of data: 13 years from five satellite products
- 285 automated tests, run on every push
The data
- Region and grid: North Indian Ocean, 5–30°N, 45–105°E at 0.25°. 101 × 241 = 24,341 points
- Period: 2010–2022, daily. 4,748 days
- Inputs, 7 channels: SST (OSTIA), salinity (SMOS/SMAP), sea surface height (DUACS), currents U and V (OSCAR), winds U and V (CCMP)
- Target: GLORYS12V1 reanalysis temperature at 15 depths, 0–1,000 m. Never an input
- One conservative, area-weighted remapping rule for every satellite product: it uses all 36 OSTIA cells under a grid point where interpolation would read 4.
- Absolute dynamic topography instead of sea level anomaly: correlation with the ocean’s height field 0.972 instead of 0.571.
- Block-averaging the reanalysis instead of sampling its centre point removes target errors of up to 2.55 °C at ocean fronts.
- Server-side subsetting of the NASA products: one day of currents drops from 31.71 MB to 332 KB.
The model
- Input → output: 7 × 101 × 241 surface fields → 15 × 101 × 241 temperature volume
- Architecture: U-Net, 4 levels, 48 base channels, GroupNorm, skip connections
- Embedding: 32 channels on a 7 × 16 grid: 3,584 numbers per day
- Loss: Masked MSE over real ocean water at each depth, depth-weighted
- Training: AdamW, dropout 0.2, cosine schedule, 20 epochs, three seeds
- Size: 16.3 million parameters
Held-out year: 2022, scored once
| Model | Below-surface RMSE | Thermocline RMSE |
|---|
| Day-of-year climatology | 0.904 °C | 1.378 °C |
| Ridge regression | 0.877 °C | 1.257 °C |
| Gradient boosting (XGBoost) | 0.688 °C | 0.992 °C |
| OKEANOS U-Net, 3 seeds | 0.692 ± 0.007 °C | 0.979 ± 0.017 °C |
Trained on 2010–2019, chosen on 2020–2021. The network reads the seven satellite fields only; gradient boosting is also given latitude, longitude and day of year.
- From the validation years to the unseen year, error rose by only 1.4% below the surface and 0.6% in the thermocline: it generalises instead of memorising.
- On the validation years the largest gains over climatology are in the thermocline, where cyclone-relevant heat is stored: 35% at 75 m, 36% at 100 m and 36% at 125 m.
Experiments that shaped it
- 32-channel latent against a 768-channel bottleneck, three seeds each: 0.6830 vs 0.6850 °C. As accurate, and 24× narrower.
- Zeroing the skip connections at an identical parameter count raises error by 8.0%: the embedding holds the basin-scale state, the skips carry the fine detail.
- Predicting absolute temperature beats predicting the anomaly from climatology: 8.6% better below the surface, 11.8% in the thermocline.
- 20 training epochs match 60 (0.686 vs 0.688 °C): the same skill for a third of the compute.
Against real ocean observations
- Validated against INCOIS gridded ARGO, the float product the problem statement names: 24 matched months, scored only where floats determine the value.
- Highest correlation with the floats of the three models compared: 0.870 below the surface, against 0.859 for the GLORYS reanalysis and 0.842 for climatology.
Stack: PyTorch, U-Net, xarray + Dask, FastAPI, XGBoost, scikit-learn, Zarr, deck.gl, Docker, AWS
Live · Demo video
NETWM — Network attack forecasting
Predict the next move before the attacker makes it.
A world model for networks: it learns how a network’s state evolves and rolls it five minutes ahead. 0.677 PR-AUC on a held-out day, against 0.139 for the baseline.
Smart India Hackathon 2026 · NTRO problem statement · Team PIRATES
Intrusion detectors label each network flow on its own, benign or malicious. That throws away what makes an intrusion an intrusion: the order ports get probed in, the timing of reconnaissance before lateral movement. An attack is a process that unfolds over minutes to hours, not a single packet.
NetWM turns traffic, flow CSVs or raw PCAPs, into one state vector per 60-second window and learns the transition P(S_t+1 | S_t). It then imagines ten windows ahead and answers three questions for every window: how at risk the network is of compromise in the next five minutes, which MITRE ATT&CK stage it is heading into, and which features drive that score.
Rule-based and per-flow systems only react to traffic they have already seen, with no sense of where in the kill chain the network is. NetWM models how the network evolves, so every window comes with a forward-looking risk score, the ATT&CK stage it points to, and the features behind it.
- State builder: 60 s windows at a 30 s stride, 70 flow-level features (TCP flags, inter-arrival times, byte and packet statistics, port entropy, fan-out) plus 35 packet-level features on the PCAP route.
- The world model: a Transformer encoder with causal attention over the last 16 windows, feeding an RSSM-style stochastic latent with a learned prior. About 0.6 million parameters.
- K-step rollouts: ten imagined windows, five minutes, per forecast, with Monte-Carlo sampling for an uncertainty band.
- Multi-task heads on any real or imagined state: a next-state decoder, the MITRE ATT&CK stage, and three risk heads for attack, compromise and escalation.
- Explanations a defender can read: attention shows when, Integrated Gradients show which features.
- A dataset audit that corrected attack-onset times and kill-chain labels in CIC-IDS2017 before any training.
- A fully offline FastAPI backend and dashboard that take a CSV or PCAP upload, with 192 tests, one of which makes every outbound connection fail.
- 0.677 PR-AUC on a held-out day, against 0.139 for logistic regression
- 5× the baseline’s F1 at the same alarm threshold (0.59 vs 0.11)
- 0.96 ROC-AUC on brute-force attacks from a family never seen in training (baseline: 0.45)
- 85M+ network flows across CIC-IDS2017, CIC-IDS2018 and CTU-13
- ~0.6M parameters: trains in about 5 minutes a fold on a 4 GB laptop GPU
- 192 tests, and it runs fully offline
Network state
- Window: 60 s at a 30 s stride. One state vector S_t per window
- Flow features, 70: TCP flag ratios, protocol and service mix, bytes, packets, duration, inter-arrival statistics, bidirectional ratios, port entropy, fan-out
- Packet features, 35: TTL, fragments, retransmissions, zero windows, payload histogram, inter-packet timing, SYN-only and RST shares
- Scaling: log1p on heavy tails, then a scaler fitted on training days only
- Labels: 7 MITRE ATT&CK stages: Benign, Recon, Initial Access, Lateral Movement, C2, Exfiltration, Impact
The world model
- Dynamics: P(S_t+1 | S_t): Transformer encoder → causal attention over 16 windows → RSSM stochastic latent
- Rollout: K = 10 steps (5 minutes) in latent space, Monte-Carlo sampled
- Heads: Next-state decoder (its error is the surprise), MITRE stage, and attack, compromise and escalation risk
- Loss: Next-state NLL + KL divergence + multi-step rollout + stage cross-entropy + risk BCE
- Alarm: Causal alert budget: above the 90th percentile of earlier scores, with no tuning on the test day
- Size: 584,470 parameters
- Built to stream: scoring a feed in 60-window chunks equals one full pass to 2.3e-10.
Held-out day
| Model | PR-AUC | F1 | Precision | Recall |
|---|
| World model, flow route (served model) | 0.677 | 0.591 | 0.574 | 0.608 |
| World model, packet route (3-seed mean) | 0.514 | 0.583 | 0.581 | 0.584 |
| Logistic regression | 0.139 | 0.112 | 0.167 | 0.084 |
CIC-IDS2017, leave-one-day-out: neither model trained on the test day. Every model is scored at the same causal threshold.
What the dynamics earn
- Against the same encoder predicting risk directly, with no latent dynamics: PR-AUC 0.39 vs 0.22, and pre-attack windows ranked 0.70 vs 0.61.
- Imagined rollouts beat a “nothing changes” forecast, averaged over steps 2 to 10.
- Packet-level features raised held-out PR-AUC from 0.43 to 0.56 over flows alone.
- Attack families held out of training entirely are still recognised on CIC-IDS2018: brute force at 0.96 ROC-AUC (baseline 0.45), DoS at 0.87.
Data and audit
- CIC-IDS2017, corrected release: 2.10M flows over 5 days, 4,907 windows, and 53.7M packets from 52.4 GB of raw captures for the packet route.
- CIC-IDS2018 (63.2M flows, 10 days) and CTU-13 (20.0M flows, 13 botnet scenarios) to test on attack families the model never trained on.
- Audit before training: “Attempted” traffic would have labelled 727 of 968 Friday windows as command and control. Excluding it restored the published attack schedule.
- Splitting one portscan label by its source moved an attack onset from 17:00:00 to 17:18:30, matching the documented 17:19 infiltration.
- Leave-one-day-out only: windows are never shuffled across days, so near-duplicate flows cannot inflate the score.
Stack: PyTorch, Transformer, World model (RSSM), MITRE ATT&CK, Scapy, Captum, scikit-learn, FastAPI, pandas
Repository · Demo video
Onyx — AI-powered cybersecurity
Finds vulnerabilities. Then ships the fix.
Scans a live web application, uses AI to work out which findings are real, and opens a pull request with the fix.
Security scanners produce long lists with no priority and no context. Audits end as PDFs nobody acts on, a security engineer is out of reach for most small teams, and the same bugs come back with the next deploy. So the fix is always “later”.
Onyx is an autonomous security platform. It maps what a site exposes, attacks it the way a penetration tester would, reasons over what it found, and delivers the exact code change as a GitHub pull request.
The time between finding a vulnerability and fixing it is where the risk lives. Onyx takes a finding all the way to a reviewed pull request instead of stopping at a report.
- Scan pipeline that runs Subfinder, Nmap, ffuf and Nuclei in sequence as background jobs on Celery and Redis, with scan history, severity tracking and runs you can cancel.
- Active checks written from scratch, 1,600 lines of them: SQL injection including blind time-based, reflected XSS, SSTI, SSRF, path traversal, IDOR, CORS misconfiguration, mass assignment, HTTP method tampering, secrets leaked in JavaScript and missing security headers.
- Authenticated scanning: a Playwright browser signs in to the target and hands its session to the scanner, so the checks reach the pages behind the login.
- AI triage behind one LLM interface with automatic fallback across Llama 3.1, Claude and GPT-4o. It correlates findings, removes duplicates and false positives, and says what to fix first.
- Auto-fix through a GitHub App: inspects the repository, picks the files responsible, generates the patch, validates it, and opens the pull request on its own branch.
- ~70% reduction in mean time to repair
- 90%+ accuracy deduplicating scanner findings
- 4 scanners in one pipeline: Subfinder, Nmap, ffuf, Nuclei
- 11 vulnerability classes covered by its own active checks
Stack: Python, FastAPI, Nuclei, Claude, Celery + Redis, Next.js, PostgreSQL, Nmap, Playwright, GitHub App, Docker
Repository · Demo video
AI Health Companion — Multi-agent AI for health
Eight agents. One health context.
Eight specialised agents work around one shared picture of your health to explain symptoms and reports, without ever playing doctor.
Health data is everywhere and understanding is not. Symptoms, lab reports and vitals sit scattered across apps and PDFs, early warning patterns go unnoticed, and most health chatbots answer with no context and too much confidence.
AI Health Companion sits between raw health data and a doctor. It explains symptoms and reports in plain language, assesses risk from what you log, and escalates when it should. It never diagnoses, prescribes or suggests a dose.
Health is where a confident wrong answer does real damage. The system is built to explain and to escalate, never to diagnose.
- Eight specialised assistants over one user context: health chat, symptom analysis, risk interpretation, nutrition, mental wellness, report analysis, Ayurvedic remedies and medication help.
- Agents that call back into the app: six tool endpoints give them the user’s health summary, logs, risk assessment, profile, reports and reminders.
- RAG over a curated knowledge base of triage protocols: chest pain, cold and flu, medication safety, emergency red flags.
- A deterministic risk engine that scores logged symptoms, vitals and lifestyle and raises alerts on recurring patterns, with no LLM in the loop.
- A safety gate on every input and output, with its own test suite, plus crisis-keyword detection and one-tap SOS to emergency contacts.
- Report analysis: upload a PDF or an image and get a plain-language explanation, the values that need attention and questions to ask a doctor.
- 8 context-aware agents in one system
- 36 h built overnight at a live hackathon
- 26 API routes behind the app
- 127 commits over one weekend
Stack: Next.js 15, TypeScript, GPT-4.1 + RAG, AI Agents, PostgreSQL, Prisma, NextAuth, Tailwind CSS, Vercel
Repository · Live · Demo video
More work
Finstar — Gamified finance education for teens
Finance education Gen-Z teens actually finish.
A mobile game that teaches 15 to 18 year olds to budget, save and invest by playing through the decisions instead of reading about them.
Most teenagers meet money management only after their first salary, when mistakes cost real money, and there is nowhere to practise financial decisions without the risk.
Finstar turns it into play: short lessons, four games built on real-life money scenarios, and streaks, badges, friends and leaderboards to keep them coming back.
India has about 150 million teenagers, and financial literacy sits near 27%. Finstar gives them a place to make money mistakes before the mistakes are real.
- Four games in Flutter (Life Swipe, Budget Blitz, Market Explorer and Quiz Battle) with emotion-aware scoring wired into the learning path.
- Server-side game logic on Supabase Edge Functions: score validation and anti-cheat, XP, coins and levels, achievements, leaderboards, daily challenges and streak resets.
- Firebase backend: Firestore for data, Realtime Database for multiplayer quiz matchmaking, and sign-in with Google or email.
- AI-backed market simulation that reacts like a real (chaotic) market.
- 100+ positive reviews from real users
- 4 games on budgeting, saving and investing
- 13 edge functions running the game logic server-side
Stack: Flutter, Dart, Riverpod, Firebase, Supabase Edge Functions, Rive
Repository
Codeswipe — Swipe-based developer collaboration platform
Swipe right on your next collaborator.
A matching app for developers: swipe through profiles built from real work to find collaborators, mentors and co-founders.
Ideas sit in private repos and motivation fades without peers. Finding a collaborator or a mentor means digging through noisy Discords and formal LinkedIn feeds.
Codeswipe matches developers on skills, projects and interests. Swipe right to connect, then chat, share code and build together.
Good side projects die for want of a second person. Codeswipe makes finding that person as quick as a swipe.
- Swipe-based, mobile-first frontend for matching developers to projects and people.
- Gesture-driven card stack with its own swipe hook, match overlays and collaboration requests, on Framer Motion and Tailwind.
- Separate mobile and desktop apps over shared services: onboarding from GitHub, LinkedIn and a résumé, matches, real-time chat over WebSockets, profiles and notifications.
- The landing page and waitlist at codeswipe.app.
- 100+ pre-registrations before launch
- 13 universities named on the waitlist page, four IITs among them
- 5 things to match on: collaborators, mentors, mentees, co-founders, friends
Stack: React, Framer Motion, Tailwind CSS, Zustand, Firebase, WebSockets, GSAP
Live
HealthVault — Zero-knowledge encrypted health records
Your records. Your keys. Nobody else.
A portable health record: one encrypted locker a patient carries between hospitals and opens for a doctor with a QR code.
Medical records are scattered across hospitals, clinics and paper files that do not talk to each other. A patient who changes doctors starts from zero.
HealthVault is one digital health locker per patient. Files are encrypted in the browser before upload, a doctor asks for access by scanning the patient’s QR code, and the patient can grant or revoke it at any time. AI turns each report into a plain-language summary for the patient and a clinical one for the doctor.
A medical history should follow the patient, and stay theirs. Here the patient holds the record and decides who reads it.
- Client-side encryption with the Web Crypto API: every file gets its own 256-bit AES-GCM key and is encrypted in the browser before it is uploaded.
- QR-based access control: a doctor scans the patient’s code to request access, the patient approves, and can revoke it instantly.
- AI summaries with Gemini 2.5 Flash in two flavours: patient-friendly and clinical.
- 30+ APIs on Node.js, Express and MongoDB for secure medical data access, sharing and revocation.
- Patient and doctor dashboards in React, TypeScript and shadcn/ui.
- 40% easier comprehension of medical reports via AI summaries
- 256-bit AES-GCM key per file, generated in the browser
- 2 AI summaries per report: one for the patient, one for the doctor
Stack: React, TypeScript, Node.js, Express, MongoDB, AES-256-GCM, Gemini, QR access
Repository
Outreach — Personal cold email, with limits built in
Cold email that gets read, and knows when to stop.
Writes a personal cold email from your résumé and what you know about the person, sends it through your own Gmail, and stops the moment they reply.
Cold email works when it is personal and fails when it is a blast. Most tools are built for the blast.
Outreach is for personal outreach only: sign in with Google, upload a résumé, add the people you want to reach and why, review each draft, and send it through Gmail. Nothing sends until you press send. There are no mailing lists and no marketing mode. The limits are not a setting; they are the product.
The tool that helps one person write ten good emails can just as easily help them send ten thousand bad ones. This one is built so that it cannot.
- Draft generation that combines the sender’s profile, the target’s context and hook, a chosen template and the thread so far, and picks the most relevant project as proof.
- Sending that behaves: business-day scheduling, randomised times inside the sender’s window, warm-up and daily caps, and correct Gmail threading.
- Hard limits enforced on the server: at most three emails to one person, ever, at least three business days apart. A reply, bounce or opt-out ends the sequence for good.
- Reply tracking through Gmail push, watch renewal and reconcile sweeps. An out-of-office defers a sequence instead of killing it.
- CSV and Excel import with a verdict for every row before anything is saved: duplicates, suppressed contacts, invalid addresses, rows still missing a hook.
- Privacy by construction: Postgres row-level security behind every query, Google refresh tokens encrypted at rest, and recipient addresses kept as keyed HMACs.
- A Next.js PWA with a workflow dashboard, reply and bounce analytics, web push reminders and optional Google Calendar sync.
- 384 automated tests across the API and the scheduling core
- 304 commits in under three weeks
- 3 emails to one person, at most, ever
- 65 API endpoints
Stack: FastAPI, Next.js, PostgreSQL, Redis, Gmail API, Gemini, PWA, Docker
Repository · Live · Demo video
Civic Setu — Civic issue reporting for Jharkhand
Report the pothole. Watch it get fixed.
A citizen reports a civic issue with a photo and its GPS location, then follows it stage by stage until the municipality resolves it.
A complaint to a municipality usually disappears: no acknowledgement, no owner, no way of knowing whether anyone saw it.
Civic Setu connects citizens and municipal staff. A citizen reports a pothole, a dead street light or uncollected garbage from their phone, with a photo and its location. Staff triage, assign and resolve it from a dashboard, and every stage is visible to the person who reported it.
Accountability starts with being able to see what happened to your complaint. Civic Setu shows the whole path to the person who raised it.
- Mobile app in React Native (Expo): take a photo, tag the GPS location, pick one of ten categories, then track the report and upvote or comment on others.
- A report workflow with a visible status at every stage: submitted, acknowledged, assigned, in progress, resolved.
- Admin dashboard in React and Material UI: a map of complaints, filters, assignment to departments and staff, and analytics.
- REST API on Node.js, Express and MongoDB with JWT authentication, role-based access for citizens, staff and admins, and Cloudinary for media.
- 3 apps in one system: citizen mobile app, staff dashboard, API
- 5 stages every report moves through, each visible to the citizen
- 10 issue categories, from roads to street lights
Stack: React Native, Expo, React, Material UI, Node.js, Express, MongoDB, Leaflet, Cloudinary
Repository