They change their names. They can't change their shape.

Phishing campaigns cycle domains faster than any blocklist keeps up — but the infrastructure topology behind them stays constant. EVELYN runs a continuous-time quantum walk over a phishing-infrastructure hypergraph and extracts a topology fingerprint that is invariant to domain names — detecting a campaign by its shape, not its strings. Zero-shot on topologies never seen in training.

What I built:

• Reframed detection as a graph-spectral problem instead of string/GNN classification — the reason it generalizes zero-shot
• Robust to rapid domain rotation by construction, not by retraining
• Building empirical case for provable advantage over GNNs on infrastructure-shape tasks

Python · Continuous-Time Quantum Walks · NetworkX · DBSCAN · Graph ML

Vanilla QMIX drops from 89% to 35% when a reactive jammer chases the swarm. This is why — and the fix.

Under Review · IEEE Transactions on Cybernetics "Two-Process Multi-Agent Reinforcement Learning for Jamming-Resilient Cooperative Coverage: Decoupling Exploration and Navigation via a KL-Anchored Navigator" Samratth Singh, Yeshita Motwani, Lakshit Saini, Faiza Bagban, and Bansidhar Joshi

Vanilla QMIX is comm-blind — a reactive jammer blocking 87% of communications causes only a 16-point detection drop because the learned coordination was never conditioned on communication content. Cross-modal attention inside the QMIX value function fails in two reproducible ways (attention collapse and Q-divergence), both traceable to the monotonicity constraint. The fix is architectural: freeze QMIX as a Bayesian exploration prior, then train a KL-anchored Navigator via PPO that learns the comm-aware policy QMIX structurally cannot.

┌────────────────────────────────────────────────────────────────┐
│  Method                  Clean    Dropout  Static   Chase      │
│  ─────────────────────── ──────── ──────── ──────── ────────   │
│  QMIX alone              40.5%    41.5%    42.0%    42.5%      │
│  IC3Net gated-comm       39.5%      —      49.0%    46.0%      │
│  OW-QMIX (α=0.5)         63.5%      —      60.0%    55.5%      │
│  Navigator + QMIX (ours) 50.0%    49.5%    54.5%    55.5%      │
│  Δ vs QMIX               +9.5     +8.0     +12.5    +13.0 ▲   │
│                                                                │
│  20 seeds per cell · paired t-tests · 46 passing tests        │
└────────────────────────────────────────────────────────────────┘

What I built:

• Diagnosed QMIX's comm-blindness as structural through ablation — not a tuning issue
• Proved cross-modal attention fails reproducibly inside monotonic value-decomposition (two failure modes characterized)
• Engineered frozen QMIX explorer + KL-anchored PPO Navigator — recovers comm-aware coordination under reactive jamming while preserving clean-condition performance
• Validated against IC3Net and OW-QMIX baselines · replicated across 3 independent training configurations · 46 passing tests, VRAM guards, checkpoint auto-resume

PyTorch · QMIX · PPO · KL Divergence · MARL · CUDA

The model that fooled every bot detector it met.

Under Review · IEEE Transactions on Information Forensics and Security

Hybrid LSTM + DDPM framework synthesizing human-indistinguishable mouse-motion trajectories — an adversarial stress test for behavioral-biometric defenses.

┌───────────────────────────────────────────────────────────────┐
│  Jensen–Shannon Divergence    0.1478    Near-human match      │
│  Bot-detector evasion         100%      Every detector beaten │
│  Custom behavioral dataset    212,568   Hand-collected corpus │
└───────────────────────────────────────────────────────────────┘

What I built:

• Combined LSTM temporal structure + DDPM stochastic realism — neither alone hits human-level JSD
• Built 212K-sample behavioral dataset from scratch
• Reframed as defense research: a generator this good is a benchmark forcing next-gen detectors to be robust

Python · PyTorch · DDPM · LSTM · Adversarial ML